You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Madhan Neethiraj <ma...@apache.org> on 2022/05/16 21:12:23 UTC
Review Request 73989: RANGER-3765: tag-based policy masking to override resource-based masking
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73989/
-----------------------------------------------------------
Review request for ranger, Abhishek Kumar, Ankita Sinha, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
Bugs: RANGER-3765
https://issues.apache.org/jira/browse/RANGER-3765
Repository: ranger
Description
-------
updated policy evaluation to choose decision from tag-based masking
Diffs
-----
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java 41ad8936d
agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_mask.json f2518b0b2
Diff: https://reviews.apache.org/r/73989/diff/1/
Testing
-------
- updated unit tests to include a column for which both tag-based and resource-based policies are applicable
- verified that existing unit tests pass successfully
Thanks,
Madhan Neethiraj
Re: Review Request 73989: RANGER-3765: tag-based policy masking to override resource-based masking
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73989/#review224446
-----------------------------------------------------------
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java
Lines 771 (patched)
<https://reviews.apache.org/r/73989/#comment313242>
Deny/deny-all-else is not applicable for row-filter/masking policies.
- Madhan Neethiraj
On May 16, 2022, 9:12 p.m., Madhan Neethiraj wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73989/
> -----------------------------------------------------------
>
> (Updated May 16, 2022, 9:12 p.m.)
>
>
> Review request for ranger, Abhishek Kumar, Ankita Sinha, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-3765
> https://issues.apache.org/jira/browse/RANGER-3765
>
>
> Repository: ranger
>
>
> Description
> -------
>
> updated policy evaluation to choose decision from tag-based masking
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java 41ad8936d
> agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_mask.json f2518b0b2
>
>
> Diff: https://reviews.apache.org/r/73989/diff/1/
>
>
> Testing
> -------
>
> - updated unit tests to include a column for which both tag-based and resource-based policies are applicable
> - verified that existing unit tests pass successfully
>
>
> Thanks,
>
> Madhan Neethiraj
>
>
Re: Review Request 73989: RANGER-3765: tag-based policy masking to override resource-based masking
Posted by Ankita Sinha <an...@freestoneinfotech.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73989/#review224450
-----------------------------------------------------------
Ship it!
Ship It!
- Ankita Sinha
On May 16, 2022, 9:12 p.m., Madhan Neethiraj wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73989/
> -----------------------------------------------------------
>
> (Updated May 16, 2022, 9:12 p.m.)
>
>
> Review request for ranger, Abhishek Kumar, Ankita Sinha, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-3765
> https://issues.apache.org/jira/browse/RANGER-3765
>
>
> Repository: ranger
>
>
> Description
> -------
>
> updated policy evaluation to choose decision from tag-based masking
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java 41ad8936d
> agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_mask.json f2518b0b2
>
>
> Diff: https://reviews.apache.org/r/73989/diff/1/
>
>
> Testing
> -------
>
> - updated unit tests to include a column for which both tag-based and resource-based policies are applicable
> - verified that existing unit tests pass successfully
>
>
> Thanks,
>
> Madhan Neethiraj
>
>
Re: Review Request 73989: RANGER-3765: tag-based policy masking to override resource-based masking
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73989/#review224453
-----------------------------------------------------------
Ship it!
Ship It!
- Abhay Kulkarni
On May 16, 2022, 9:12 p.m., Madhan Neethiraj wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73989/
> -----------------------------------------------------------
>
> (Updated May 16, 2022, 9:12 p.m.)
>
>
> Review request for ranger, Abhishek Kumar, Ankita Sinha, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-3765
> https://issues.apache.org/jira/browse/RANGER-3765
>
>
> Repository: ranger
>
>
> Description
> -------
>
> updated policy evaluation to choose decision from tag-based masking
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java 41ad8936d
> agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_mask.json f2518b0b2
>
>
> Diff: https://reviews.apache.org/r/73989/diff/1/
>
>
> Testing
> -------
>
> - updated unit tests to include a column for which both tag-based and resource-based policies are applicable
> - verified that existing unit tests pass successfully
>
>
> Thanks,
>
> Madhan Neethiraj
>
>
Re: Review Request 73989: RANGER-3765: tag-based policy masking to override resource-based masking
Posted by Madhan Neethiraj <ma...@apache.org>.
> On May 16, 2022, 11:26 p.m., Abhay Kulkarni wrote:
> > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java
> > Lines 771 (patched)
> > <https://reviews.apache.org/r/73989/diff/1/?file=2268028#file2268028line771>
> >
> > Is there a deny (or deny-all-else) policy for row-filter/data-masking policy ? If so, then with this change, such deny policy with equal priority as the tag-based row-filter/data-masking policy will not be evaluated. Please clarify.
Deny/deny-all-else is not applicable for row-filter/masking policies.
- Madhan
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73989/#review224445
-----------------------------------------------------------
On May 16, 2022, 9:12 p.m., Madhan Neethiraj wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73989/
> -----------------------------------------------------------
>
> (Updated May 16, 2022, 9:12 p.m.)
>
>
> Review request for ranger, Abhishek Kumar, Ankita Sinha, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-3765
> https://issues.apache.org/jira/browse/RANGER-3765
>
>
> Repository: ranger
>
>
> Description
> -------
>
> updated policy evaluation to choose decision from tag-based masking
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java 41ad8936d
> agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_mask.json f2518b0b2
>
>
> Diff: https://reviews.apache.org/r/73989/diff/1/
>
>
> Testing
> -------
>
> - updated unit tests to include a column for which both tag-based and resource-based policies are applicable
> - verified that existing unit tests pass successfully
>
>
> Thanks,
>
> Madhan Neethiraj
>
>
Re: Review Request 73989: RANGER-3765: tag-based policy masking to override resource-based masking
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73989/#review224445
-----------------------------------------------------------
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java
Lines 771 (patched)
<https://reviews.apache.org/r/73989/#comment313241>
Is there a deny (or deny-all-else) policy for row-filter/data-masking policy ? If so, then with this change, such deny policy with equal priority as the tag-based row-filter/data-masking policy will not be evaluated. Please clarify.
- Abhay Kulkarni
On May 16, 2022, 9:12 p.m., Madhan Neethiraj wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73989/
> -----------------------------------------------------------
>
> (Updated May 16, 2022, 9:12 p.m.)
>
>
> Review request for ranger, Abhishek Kumar, Ankita Sinha, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-3765
> https://issues.apache.org/jira/browse/RANGER-3765
>
>
> Repository: ranger
>
>
> Description
> -------
>
> updated policy evaluation to choose decision from tag-based masking
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java 41ad8936d
> agents-common/src/test/resources/policyengine/test_policyengine_tag_hive_mask.json f2518b0b2
>
>
> Diff: https://reviews.apache.org/r/73989/diff/1/
>
>
> Testing
> -------
>
> - updated unit tests to include a column for which both tag-based and resource-based policies are applicable
> - verified that existing unit tests pass successfully
>
>
> Thanks,
>
> Madhan Neethiraj
>
>