From 246c7d1ae6972b6877b0ff3a239b4187ca830c0b Mon Sep 17 00:00:00 2001
From: Rakesh Gupta <rakesh.gupta.dev264@gmail.com>
Date: Thu, 10 Sep 2026 19:47:38 +0530
Subject: [PATCH] RANGER-5794: Atlas permissions reappear in tag policies when
 enableTagBasedPolicies is disabled

---
 .../plugin/store/AbstractServiceStore.java    | 10 ++--
 ...atingAtlasSvcDefAndTagPolicies_J10063.java | 48 +++++++++++++++++++
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/store/AbstractServiceStore.java b/agents-common/src/main/java/org/apache/ranger/plugin/store/AbstractServiceStore.java
index 30901f9a97..c8a1b900c6 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/store/AbstractServiceStore.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/store/AbstractServiceStore.java
@@ -66,9 +66,7 @@ public void updateTagServiceDefForAccessTypes() throws Exception {
 
         List<RangerServiceDef> allServiceDefs = getServiceDefs(new SearchFilter());
         for (RangerServiceDef serviceDef : allServiceDefs) {
-            if (ServiceDefUtil.getOption_enableTagBasedPolicies(serviceDef, config)) {
-                updateTagServiceDefForUpdatingAccessTypes(serviceDef);
-            }
+            updateTagServiceDefForUpdatingAccessTypes(serviceDef);
         }
 
         LOG.debug("<== ServiceDefDBStore.updateTagServiceDefForAccessTypes()");
@@ -280,6 +278,12 @@ private void updateTagServiceDefForUpdatingAccessTypes(RangerServiceDef serviceD
             return;
         }
 
+        if (!ServiceDefUtil.getOption_enableTagBasedPolicies(serviceDef, config)) {
+            LOG.debug("AbstractServiceStore.updateTagServiceDefForUpdatingAccessTypes({}): tag-based policies disabled", serviceDef.getName());
+
+            return;
+        }
+
         if (EmbeddedServiceDefsUtil.instance().getTagServiceDefId() == -1) {
             LOG.info("AbstractServiceStore.updateTagServiceDefForUpdatingAccessTypes({}): tag service-def does not exist", serviceDef.getName());
         }
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.java
index 774fd720a6..9e1b7a0294 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.java
@@ -97,6 +97,7 @@ public void execLoad() {
         try {
             if (updateAtlasServiceDef()) {
                 disableAtlasAccessForTagPolicies();
+                updateTagServiceDef();
             }
         } catch (Exception e) {
             logger.error("Error while updateTagServiceDef()data.", e);
@@ -263,4 +264,51 @@ private Map<String, String> jsonStringToMap(String jsonStr) {
         }
         return ret;
     }
+
+    private void updateTagServiceDef() throws Exception {
+        logger.info("==> PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.updateTagServiceDef()");
+        RangerServiceDef embeddedTagServiceDef;
+        RangerServiceDef dbTagServiceDef;
+        XXServiceDef     xXServiceDefObj;
+
+        embeddedTagServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME);
+
+        if (embeddedTagServiceDef != null) {
+            xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME);
+
+            if (xXServiceDefObj != null) {
+                dbTagServiceDef = svcStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME);
+
+                if (dbTagServiceDef != null && CollectionUtils.isNotEmpty(dbTagServiceDef.getAccessTypes())) {
+                    List<RangerServiceDef.RangerAccessTypeDef> accessTypesToRemove = new ArrayList<>();
+
+                    for (RangerServiceDef.RangerAccessTypeDef accessTypeDef : dbTagServiceDef.getAccessTypes()) {
+                        if (accessTypeDef != null) {
+                            final String accessTypeName = accessTypeDef.getName();
+
+                            String[] svcDefAccType  = accessTypeName.split(":");
+                            String   serviceDefName = svcDefAccType.length > 0 ? svcDefAccType[0] : null;
+
+                            if (serviceDefName != null && serviceDefName.equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_ATLAS_NAME)) {
+                                logger.info("==> PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.updateTagServiceDef() found atlas access type to remove: {}", accessTypeName);
+                                accessTypesToRemove.add(accessTypeDef);
+                            }
+                        }
+                    }
+
+                    if (!accessTypesToRemove.isEmpty()) {
+                        dbTagServiceDef.getAccessTypes().removeAll(accessTypesToRemove);
+
+                        svcStore.updateServiceDef(dbTagServiceDef);
+                    }
+                }
+            } else {
+                logger.error("Tag service-definition does not exist in the Ranger DAO.");
+            }
+        } else {
+            logger.error("The embedded Tag service-definition does not exist.");
+        }
+
+        logger.info("<== PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.updateTagServiceDef()");
+    }
 }