Merge pull request #2575 from atlanhq/nikhilcontrolv2

Fix tag based evaluation for Create
atlanhq · Dec 4, 2023 · 5109f33 · 5109f33
2 parents 1a3fe51 + deccfbe
commit 5109f33
Showing 1 changed file with 13 additions and 8 deletions.
diff --git a/repository/src/main/java/org/apache/atlas/discovery/AtlasAuthorization.java b/repository/src/main/java/org/apache/atlas/discovery/AtlasAuthorization.java
@@ -322,18 +322,23 @@ private static boolean validateResourcesForCreateEntity(List<RangerPolicy> resou
 
                     //for tag based policy
                     if ("tag".equals(resource)) {
-                        if (entity.getClassifications() != null && !entity.getClassifications().isEmpty()) {
-                            List<String> assetTags = entity.getClassifications().stream().map(x -> x.getTypeName()).collect(Collectors.toList());
+                        if (entity.getClassifications() == null || entity.getClassifications().isEmpty()) {
+                            //since entity does not have tags at all, it should not pass this evaluation
+                            resourcesMatched = false;
+                            break;
+                        }
 
-                            for (String assetTag : assetTags) {
-                                Optional<String> match = values.stream().filter(x -> assetTag.matches(x.replace("*", ".*"))).findFirst();
+                        List<String> assetTags = entity.getClassifications().stream().map(x -> x.getTypeName()).collect(Collectors.toList());
 
-                                if (!match.isPresent()) {
-                                    resourcesMatched = false;
-                                    break;
-                                }
+                        for (String assetTag : assetTags) {
+                            Optional<String> match = values.stream().filter(x -> assetTag.matches(x.replace("*", ".*"))).findFirst();
+
+                            if (!match.isPresent()) {
+                                resourcesMatched = false;
+                                break;
                             }
                         }
+
                     }
                 }