diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/gds/GdsProjectEvaluator.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/gds/GdsProjectEvaluator.java index 52220563cb..2d2e671edf 100644 --- a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/gds/GdsProjectEvaluator.java +++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/gds/GdsProjectEvaluator.java @@ -40,6 +40,7 @@ import java.util.ArrayList; import java.util.Collections; import java.util.Comparator; +import java.util.Date; import java.util.List; import java.util.Set; @@ -97,7 +98,8 @@ public boolean isActive() { } public void evaluate(RangerAccessRequest request, GdsAccessResult result) { - LOG.debug("==> GdsDatasetEvaluator.evaluate({}, {})", request, result); + LOG.debug("==> GdsProjectEvaluator.evaluate({}, {})", request, result); + final Date accessTime = request.getAccessTime() != null ? request.getAccessTime() : new Date(); if (isActive()) { result.addProject(getName()); @@ -110,7 +112,11 @@ public void evaluate(RangerAccessRequest request, GdsAccessResult result) { RangerAccessRequestUtil.setAllRequestedAccessTypes(projectRequest.getContext(), null); RangerAccessRequestUtil.setAccessTypeACLResults(projectRequest.getContext(), null); - policyEvaluators.forEach(e -> e.evaluate(projectRequest, projectResult)); + policyEvaluators.forEach(e -> { + if (e.isApplicable(accessTime)) { + e.evaluate(projectRequest, projectResult); + } + }); } finally { RangerAccessRequestUtil.setAccessTypeResults(projectRequest.getContext(), null); RangerAccessRequestUtil.setAccessTypeACLResults(projectRequest.getContext(), null); @@ -134,7 +140,7 @@ public void evaluate(RangerAccessRequest request, GdsAccessResult result) { } } - LOG.debug("<== GdsDatasetEvaluator.evaluate({}, {})", request, result); + LOG.debug("<== GdsProjectEvaluator.evaluate({}, {})", request, result); } public void getResourceACLs(RangerAccessRequest request, RangerResourceACLs acls, boolean isConditional, Set allowedAccessTypes) {