RANGER-5403: fix intermittent HDFS authorization failures

Signed-off-by: Madhan Neethiraj <[email protected]>

Author: yangxuze

agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerPathResourceMatcher.java

@@ -596,15 +596,23 @@ static class RecursivePathResourceMatcher extends AbstractPathResourceMatcher {
         final IOCase                              ioCase;
         final BiFunction<String, String, Boolean> primaryFunction;
         final BiFunction<String, String, Boolean> fallbackFunction;
-        String valueWithoutSeparator;
-        String valueWithSeparator;
+        final String                              valueWithoutSeparator;
+        final String                              valueWithSeparator;
 
         RecursivePathResourceMatcher(String value, Map<String, String> options, char pathSeparatorChar, boolean optIgnoreCase, int priority) {
             super(value, options, pathSeparatorChar, true, priority);
 
             this.ioCase           = optIgnoreCase ? IOCase.INSENSITIVE : IOCase.SENSITIVE;
             this.primaryFunction  = optIgnoreCase ? StringUtils::equalsIgnoreCase : StringUtils::equals;
             this.fallbackFunction = optIgnoreCase ? StringUtils::startsWithIgnoreCase : StringUtils::startsWith;
+
+            if (this.value == null || getNeedsDynamicEval()) {
+                valueWithoutSeparator = null;
+                valueWithSeparator    = null;
+            } else {
+                valueWithoutSeparator = getStringToCompare(this.value);
+                valueWithSeparator    = valueWithoutSeparator + pathSeparatorChar;
+            }
         }
 
         String getStringToCompare(String policyValue) {
@@ -626,11 +634,6 @@ boolean isMatch(String resourceValue, Map<String, Object> evalContext) {
 
                 noSeparator = expandedPolicyValue != null ? getStringToCompare(expandedPolicyValue) : null;
             } else {
-                if (valueWithoutSeparator == null && value != null) {
-                    valueWithoutSeparator = getStringToCompare(value);
-                    valueWithSeparator    = valueWithoutSeparator + pathSeparatorChar;
-                }
-
                 noSeparator = valueWithoutSeparator;
             }
 
@@ -669,11 +672,6 @@ public boolean isChildMatch(String resourceValue, Map<String, Object> evalContex
 
                 noSeparator = expandedPolicyValue != null ? getStringToCompare(expandedPolicyValue) : null;
             } else {
-                if (valueWithoutSeparator == null && value != null) {
-                    valueWithoutSeparator = getStringToCompare(value);
-                    valueWithSeparator    = valueWithoutSeparator + pathSeparatorChar;
-                }
-
                 noSeparator = valueWithoutSeparator;
             }
 

agents-common/src/main/java/org/apache/ranger/plugin/resourcematcher/RangerURLResourceMatcher.java

@@ -268,13 +268,21 @@ int getPriority() {
     }
 
     abstract static class RecursiveMatcher extends AbstractStringResourceMatcher {
-        final char levelSeparatorChar;
-        String valueWithoutSeparator;
-        String valueWithSeparator;
+        final char   levelSeparatorChar;
+        final String valueWithoutSeparator;
+        final String valueWithSeparator;
 
         RecursiveMatcher(String value, Map<String, String> options, char levelSeparatorChar) {
             super(value, options);
             this.levelSeparatorChar = levelSeparatorChar;
+
+            if (this.value == null || getNeedsDynamicEval()) {
+                valueWithoutSeparator = null;
+                valueWithSeparator    = null;
+            } else {
+                valueWithoutSeparator = getStringToCompare(this.value);
+                valueWithSeparator    = valueWithoutSeparator + levelSeparatorChar;
+            }
         }
 
         String getStringToCompare(String policyValue) {
@@ -300,11 +308,6 @@ boolean isMatch(String resourceValue, Map<String, Object> evalContext) {
 
                 noSeparator = expandedPolicyValue != null ? getStringToCompare(expandedPolicyValue) : null;
             } else {
-                if (valueWithoutSeparator == null && value != null) {
-                    valueWithoutSeparator = getStringToCompare(value);
-                    valueWithSeparator    = valueWithoutSeparator + levelSeparatorChar;
-                }
-
                 noSeparator = valueWithoutSeparator;
             }
 
@@ -343,11 +346,6 @@ boolean isMatch(String resourceValue, Map<String, Object> evalContext) {
 
                 noSeparator = expandedPolicyValue != null ? getStringToCompare(expandedPolicyValue) : null;
             } else {
-                if (valueWithoutSeparator == null && value != null) {
-                    valueWithoutSeparator = getStringToCompare(value);
-                    valueWithSeparator    = valueWithoutSeparator + levelSeparatorChar;
-                }
-
                 noSeparator = valueWithoutSeparator;
             }