Skip to content

Conversation

@dhavalshah9131
Copy link
Contributor

Ported changes from master branch PR : #584

Problem Statement:

Currently, when Ranger Usersync is configured with case conversion and special character replacement using regex, it transforms the original user/group names from the source (e.g., AD/LDAP) before storing them in the Ranger Admin database.

Example:

Original name in LDAP/AD: John-jacobs
Usersync configuration:

ranger.usersync.ldap.username.caseconversion = lower
ranger.usersync.mapping.username.regex = s/[-]/_/g
Transformed and stored name in Ranger: john_jacobs
Issue:

If a Ranger plugin (e.g., Hive) uses the original name John-jacobs during authorization checks, it fails because Ranger Admin only recognizes the transformed name john_jacobs.

Error Example:

Permission denied: user [John-jacobs] does not have [SELECT] privilege on [vehicle/cars/*]
Solution:

To ensure consistency, the same transformation logic used by Usersync must also be applied on the plugin side before authorization. This transformation should be made available as a utility library packaged with the plugins.

Configurability:

This feature must be configurable at the plugin level via a property (e.g., ranger.plugin..supports.name.transformation), allowing users to enable or disable it based on their environment needs.

In ranger-admin-site.xml

ranger.plugins.ldap.username.caseconversion
ranger.plugins.ldap.groupname.caseconversion
ranger.plugins.mapping.username.handler
ranger.plugins.mapping.groupname.handler
ranger.plugins.mapping.regex.separator
ranger.plugins.mapping.username.regex
ranger.plugins.mapping.groupname.regex

How was this patch tested?
(Please explain how this patch was tested. Ex: unit tests, manual tests)
1.) Build successful with unit test.

@mneethiraj mneethiraj merged commit 83e6ddc into ranger-2.8 Nov 29, 2025
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants