[jira] [Created] (RANGER-5858) Authz API: return constraints in the authorization result

["Vyom Mani Tiwari (Jira)" <ji...@apache.org>]

Vyom Mani Tiwari created RANGER-5858:
----------------------------------------

             Summary: Authz API: return constraints in the authorization result
                 Key: RANGER-5858
                 URL: https://issues.apache.org/jira/browse/RANGER-5858
             Project: Ranger
          Issue Type: New Feature
          Components: pdp
            Reporter: Vyom Mani Tiwari
            Assignee: Vyom Mani Tiwari


RANGER-5848 added constraints to {{RangerAccessResult}} ({{{}getConstraints(){}}}). Callers of the authz API (PDP {{/authz/v1/authorize}} and {{{}authz-embedded{}}}) receive {{{}RangerAuthzResult{}}}, which doesn’t carry them. As a result, a PDP caller such as the Agent Harness can’t see a returned {{{}requireApproval{}}}. This sub-task adds constraints to the authz API result.

_Changes_
 * *{{authz-api}} model:*
 ** New {{RangerAuthzResult.ConstraintResult}} with:
 *** {{{}name{}}};
 *** {{parameters}} ({{{}Map<String, Object>{}}});
 *** {{policy}} (the existing {{{}PolicyInfo{}}}: id, version);
 *** {{{}policyPriority{}}}.
 ** New {{constraints}} ({{{}List<ConstraintResult>{}}}) on {{ResultInfo}} and {{{}PermissionResult{}}}, next to {{dataMask}} and {{{}rowFilter{}}}, so each permission and sub-resource reports its own constraints.
 ** JSON: omitted when empty, the same as the other optional fields ({{{}NON_EMPTY{}}}).
 * *{{authz-embedded}} ({{{}RangerAuthzPlugin{}}}):* when the access result is allowed, map {{RangerAccessResult.getConstraints()}} into the permission’s {{{}constraints{}}}, in the order of {{{}RangerConstraintResult.CONSTRAINT_RESULT_COMPARATOR{}}}. On a deny, no constraints are returned.
 * {{authz-api}} does not depend on agents-common types such as {{{}MatchType{}}}, so the match type is not returned.

Example permission result:

"execute": {
  "access": \{ "decision": "ALLOW", "policy": { "id": 12, "version": 3 } },
  "constraints": [
    { "name": "requireApproval",
      "parameters": \{ "approver": "finance-approvers" },
      "policy": \{ "id": 21, "version": 1 },
      "policyPriority": 0 }
  ]
}

 

Until RANGER-5842 lands, the policy engine returns no constraints, so the response doesn’t change.

_Out of scope:_ the caller declaring supported constraints on the request ({{{}supportedConstraints{}}}) and deny-if-unsupported (sub-task D); audit (sub-task E).

_Testing:_
 * {{RangerAuthzResult}} JSON round-trip with constraints, and constraints left out when empty.
 * {{RangerAuthzPlugin}} mapping with a mocked {{{}RangerAccessResult{}}}:
 ** allowed with constraints: constraints are returned, in comparator order;
 ** allowed without constraints: none are returned;
 ** denied: none are returned;
 ** sub-resource results carry their own constraints.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)