From 403449bfc4b703c6816eca7fd4d4ba9323db85b1 Mon Sep 17 00:00:00 2001
From: abhiishek26 <abhisinghbest53@gmail.com>
Date: Tue, 25 Aug 2026 17:33:02 +0530
Subject: [PATCH] RANGER-5764:Enhancing RangerUserStore to include or exclude
 user group mappings

---
 .../org/apache/ranger/common/RangerUserStoreCache.java |  5 ++++-
 .../src/main/resources/conf.dist/ranger-admin-site.xml | 10 ++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/security-admin/src/main/java/org/apache/ranger/common/RangerUserStoreCache.java b/security-admin/src/main/java/org/apache/ranger/common/RangerUserStoreCache.java
index 1b1c1bfc956..0d68cea5329 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/RangerUserStoreCache.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/RangerUserStoreCache.java
@@ -27,6 +27,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.util.HashMap;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
@@ -42,6 +43,7 @@ public class RangerUserStoreCache {
 
     private final int             waitTimeInSeconds;
     private final boolean         dedupStrings;
+    private final boolean         includeUserGroupMappings;
     private final ReentrantLock   lock = new ReentrantLock();
     private       RangerUserStore rangerUserStore;
 
@@ -49,6 +51,7 @@ private RangerUserStoreCache() {
         RangerAdminConfig config = RangerAdminConfig.getInstance();
 
         this.waitTimeInSeconds = config.getInt("ranger.admin.userstore.download.cache.max.waittime.for.update", MAX_WAIT_TIME_FOR_UPDATE);
+        this.includeUserGroupMappings = config.getBoolean("ranger.admin.userstore.include.usergroups.mappings", false);
         this.dedupStrings      = config.getBoolean("ranger.admin.userstore.dedup.strings", Boolean.TRUE);
         this.rangerUserStore   = new RangerUserStore();
     }
@@ -93,7 +96,7 @@ public RangerUserStore getLatestRangerUserStoreOrCached(XUserMgr xUserMgr) {
                     final long                     startTimeMs      = System.currentTimeMillis();
                     final Set<UserInfo>            rangerUsersInDB  = xUserMgr.getUsers();
                     final Set<GroupInfo>           rangerGroupsInDB = xUserMgr.getGroups();
-                    final Map<String, Set<String>> userGroups       = xUserMgr.getUserGroups();
+                    final Map<String, Set<String>> userGroups       = includeUserGroupMappings ? xUserMgr.getUserGroups() : new HashMap<>();
                     final long                     dbLoadTime       = System.currentTimeMillis() - startTimeMs;
 
                     if (LOG.isDebugEnabled()) {
diff --git a/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml b/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
index d327f316712..5809e590aee 100644
--- a/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
+++ b/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
@@ -379,6 +379,16 @@
 		<name>ranger.downloadpolicy.session.log.enabled</name>
 		<value>false</value>
 	</property>
+	<!-- User-store download Properties starts-->
+	<property>
+		<name>ranger.admin.userstore.include.usergroups.mappings</name>
+		<value>false</value>
+		<description>
+			When set to true, the user-store download API includes the user-to-group mappings (userGroupMapping) in the response payload,
+		</description>
+	</property>
+	<!-- User-store download Properties ends-->
+
 	<!-- Service user for KMS -->
     <property>
     	<name>ranger.kms.service.user.hdfs</name>