You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2025/01/11 21:35:03 UTC
(ranger) branch RANGER-5061_master updated: RANGER-5061: checkstyle compliance updates - security-admin org.apache.ranger.rest (#505)
This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch RANGER-5061_master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/RANGER-5061_master by this push:
new 7b8d55ee1 RANGER-5061: checkstyle compliance updates - security-admin org.apache.ranger.rest (#505)
7b8d55ee1 is described below
commit 7b8d55ee1f744a3a2289dc951fbff4553d62664b
Author: PradeeP AgrawaL <pr...@apache.org>
AuthorDate: Sun Jan 12 03:04:58 2025 +0530
RANGER-5061: checkstyle compliance updates - security-admin org.apache.ranger.rest (#505)
---
.../java/org/apache/ranger/rest/AssetREST.java | 1335 ++-
.../main/java/org/apache/ranger/rest/GdsREST.java | 849 +-
.../java/org/apache/ranger/rest/MetricsREST.java | 68 +-
.../java/org/apache/ranger/rest/PublicAPIs.java | 641 +-
.../java/org/apache/ranger/rest/PublicAPIsv2.java | 1672 ++--
.../org/apache/ranger/rest/RangerHealthREST.java | 13 +-
.../main/java/org/apache/ranger/rest/RoleREST.java | 1362 +--
.../org/apache/ranger/rest/SecurityZoneREST.java | 679 +-
.../java/org/apache/ranger/rest/ServiceREST.java | 8948 ++++++++++----------
.../org/apache/ranger/rest/ServiceRESTUtil.java | 2142 +++--
.../apache/ranger/rest/ServiceTagsProcessor.java | 1163 ++-
.../main/java/org/apache/ranger/rest/TagREST.java | 905 +-
.../org/apache/ranger/rest/TagRESTConstants.java | 48 +-
.../main/java/org/apache/ranger/rest/UserREST.java | 605 +-
.../java/org/apache/ranger/rest/XAuditREST.java | 267 +-
.../main/java/org/apache/ranger/rest/XKeyREST.java | 382 +-
.../java/org/apache/ranger/rest/XUserREST.java | 2912 ++++---
.../org/apache/ranger/rest/TestServiceREST.java | 2 +-
18 files changed, 11756 insertions(+), 12237 deletions(-)
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java b/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
index 065b9d33e..46f16285c 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
@@ -17,28 +17,7 @@
* under the License.
*/
- package org.apache.ranger.rest;
-
-import java.text.SimpleDateFormat;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.Encoded;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
+package org.apache.ranger.rest;
import org.apache.commons.lang.StringUtils;
import org.apache.ranger.admin.client.datatype.RESTResponse;
@@ -59,15 +38,27 @@ import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil;
import org.apache.ranger.plugin.util.GrantRevokeRequest;
import org.apache.ranger.plugin.util.SearchFilter;
import org.apache.ranger.security.context.RangerAPIList;
+import org.apache.ranger.service.RangerTrxLogV2Service;
import org.apache.ranger.service.XAccessAuditService;
import org.apache.ranger.service.XAssetService;
import org.apache.ranger.service.XCredentialStoreService;
import org.apache.ranger.service.XPolicyExportAuditService;
import org.apache.ranger.service.XPolicyService;
import org.apache.ranger.service.XResourceService;
-import org.apache.ranger.service.RangerTrxLogV2Service;
import org.apache.ranger.util.RestUtil;
-import org.apache.ranger.view.*;
+import org.apache.ranger.view.VXAccessAuditList;
+import org.apache.ranger.view.VXAsset;
+import org.apache.ranger.view.VXAssetList;
+import org.apache.ranger.view.VXCredentialStore;
+import org.apache.ranger.view.VXCredentialStoreList;
+import org.apache.ranger.view.VXLong;
+import org.apache.ranger.view.VXPolicy;
+import org.apache.ranger.view.VXPolicyExportAuditList;
+import org.apache.ranger.view.VXResource;
+import org.apache.ranger.view.VXResourceList;
+import org.apache.ranger.view.VXResponse;
+import org.apache.ranger.view.VXTrxLogList;
+import org.apache.ranger.view.VXUgsyncAuditInfoList;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
@@ -77,6 +68,27 @@ import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.Encoded;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Context;
+
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
import static org.apache.ranger.util.RestUtil.convertToTimeZone;
@Path("assets")
@@ -85,704 +97,589 @@ import static org.apache.ranger.util.RestUtil.convertToTimeZone;
@RangerAnnotationJSMgrName("AssetMgr")
@Transactional(propagation = Propagation.REQUIRES_NEW)
public class AssetREST {
- private static final Logger logger = LoggerFactory.getLogger(AssetREST.class);
-
- @Autowired
- RangerSearchUtil searchUtil;
-
- @Autowired
- AssetMgr assetMgr;
-
- @Autowired
- XAssetService xAssetService;
-
- @Autowired
- XResourceService xResourceService;
-
- @Autowired
- XPolicyService xPolicyService;
-
- @Autowired
- XCredentialStoreService xCredentialStoreService;
-
- @Autowired
- RESTErrorUtil restErrorUtil;
-
- @Autowired
- XPolicyExportAuditService xPolicyExportAudits;
-
- @Autowired
- RangerTrxLogV2Service xTrxLogService;
-
- @Autowired
- RangerBizUtil msBizUtil;
-
- @Autowired
- XAccessAuditService xAccessAuditService;
-
- @Autowired
- ServiceUtil serviceUtil;
-
- @Autowired
- ServiceREST serviceREST;
-
- @Autowired
- RangerDaoManager daoManager;
-
- @GET
- @Path("/assets/{id}")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_X_ASSET + "\")")
- public VXAsset getXAsset(@PathParam("id") Long id) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.getXAsset(" + id + ")");
- }
-
- RangerService service = serviceREST.getService(id);
-
- VXAsset ret = serviceUtil.toVXAsset(service);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.getXAsset(" + id + "): " + ret);
- }
-
- return ret;
- }
-
- @POST
- @Path("/assets")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_X_ASSET + "\")")
- public VXAsset createXAsset(VXAsset vXAsset) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.createXAsset(" + vXAsset + ")");
- }
-
- RangerService service = serviceUtil.toRangerService(vXAsset);
-
- RangerService createdService = serviceREST.createService(service);
-
- VXAsset ret = serviceUtil.toVXAsset(createdService);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.createXAsset(" + vXAsset + "): " + ret);
- }
-
- return ret;
- }
-
- @PUT
- @Path("/assets/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_X_ASSET + "\")")
- public VXAsset updateXAsset(VXAsset vXAsset) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.updateXAsset(" + vXAsset + ")");
- }
-
- RangerService service = serviceUtil.toRangerService(vXAsset);
-
- RangerService updatedService = serviceREST.updateService(service, null);
-
- VXAsset ret = serviceUtil.toVXAsset(updatedService);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.updateXAsset(" + vXAsset + "): " + ret);
- }
-
- return ret;
- }
-
- @DELETE
- @Path("/assets/{id}")
- @RangerAnnotationClassName(class_name = VXAsset.class)
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DELETE_X_ASSET + "\")")
- public void deleteXAsset(@PathParam("id") Long id,
- @Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.deleteXAsset(" + id + ")");
- }
-
- serviceREST.deleteService(id);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.deleteXAsset(" + id + ")");
- }
- }
-
- @POST
- @Path("/assets/testConfig")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.TEST_CONFIG + "\")")
- public VXResponse configTest(VXAsset vXAsset) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.configTest(" + vXAsset + ")");
- }
-
- RangerService service = serviceUtil.toRangerService(vXAsset);
-
- VXResponse ret = serviceREST.validateConfig(service);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.testConfig(" + vXAsset + "): " + ret);
- }
-
- return ret;
- }
-
- @GET
- @Path("/assets")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_X_ASSETS + "\")")
- public VXAssetList searchXAssets(@Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.searchXAssets()");
- }
-
- VXAssetList ret = new VXAssetList();
-
- SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequestForRepositorySearch(request, xAssetService.sortFields);
-
- List<RangerService> services = serviceREST.getServices(filter);
-
- if(services != null) {
- List<VXAsset> assets = new ArrayList<VXAsset>();
- for(RangerService service : services) {
- VXAsset asset = serviceUtil.toVXAsset(service);
-
- if(asset != null) {
- assets.add(asset);
- }
- }
-
- ret.setVXAssets(assets);
- ret.setTotalCount(assets.size());
- ret.setResultSize(assets.size());
- }
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.searchXAssets(): count=" + ret.getListSize());
- }
-
- return ret;
- }
-
- @GET
- @Path("/assets/count")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.COUNT_X_ASSETS + "\")")
- public VXLong countXAssets(@Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.countXAssets()");
- }
-
- SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequest(request, xResourceService.sortFields);
-
- filter.setMaxRows(Integer.MAX_VALUE);
-
- List<RangerService> services = serviceREST.getServices(filter);
- int servicesCount = 0;
-
- if (services != null) {
- for (RangerService service : services) {
- VXAsset asset = serviceUtil.toVXAsset(service);
-
- if (asset != null) {
- servicesCount++;
- }
- }
- }
-
- VXLong ret = new VXLong();
-
- ret.setValue(servicesCount);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.countXAssets(): " + ret);
- }
-
- return ret;
- }
-
- @GET
- @Path("/resources/{id}")
- @Produces({ "application/json" })
- public VXResource getXResource(@PathParam("id") Long id) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.getXResource(" + id + ")");
- }
-
- RangerPolicy policy = null;
- RangerService service = null;
-
- policy = serviceREST.getPolicy(id);
-
- if(policy != null) {
- service = serviceREST.getServiceByName(policy.getService());
- }
-
- VXResource ret = serviceUtil.toVXResource(policy, service);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.getXResource(" + id + "): " + ret);
- }
-
- return ret;
- }
-
- @POST
- @Path("/resources")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXResource createXResource(VXResource vXResource) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.createXResource(" + vXResource + ")");
- }
-
- RangerService service = serviceREST.getService(vXResource.getAssetId());
- RangerPolicy policy = serviceUtil.toRangerPolicy(vXResource, service);
-
- RangerPolicy createdPolicy = serviceREST.createPolicy(policy, null);
-
- VXResource ret = serviceUtil.toVXResource(createdPolicy, service);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.createXResource(" + vXResource + "): " + ret);
- }
-
- return ret;
- }
-
- @PUT
- @Path("/resources/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXResource updateXResource(VXResource vXResource , @PathParam("id") Long id) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.updateXResource(" + vXResource + ")");
- }
-
- // if vXResource.id is specified, it should be same as the param 'id'
- if (vXResource.getId() == null) {
- vXResource.setId(id);
- } else if(!vXResource.getId().equals(id)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "resource Id mismatch", true);
- }
-
- RangerService service = serviceREST.getService(vXResource.getAssetId());
- RangerPolicy policy = serviceUtil.toRangerPolicy(vXResource, service);
+ private static final Logger logger = LoggerFactory.getLogger(AssetREST.class);
+
+ @Autowired
+ RangerSearchUtil searchUtil;
+
+ @Autowired
+ AssetMgr assetMgr;
+
+ @Autowired
+ XAssetService xAssetService;
+
+ @Autowired
+ XResourceService xResourceService;
+
+ @Autowired
+ XPolicyService xPolicyService;
+
+ @Autowired
+ XCredentialStoreService xCredentialStoreService;
+
+ @Autowired
+ RESTErrorUtil restErrorUtil;
+
+ @Autowired
+ XPolicyExportAuditService xPolicyExportAudits;
+
+ @Autowired
+ RangerTrxLogV2Service xTrxLogService;
+
+ @Autowired
+ RangerBizUtil msBizUtil;
+
+ @Autowired
+ XAccessAuditService xAccessAuditService;
+
+ @Autowired
+ ServiceUtil serviceUtil;
+
+ @Autowired
+ ServiceREST serviceREST;
+
+ @Autowired
+ RangerDaoManager daoManager;
+
+ @GET
+ @Path("/assets/{id}")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_X_ASSET + "\")")
+ public VXAsset getXAsset(@PathParam("id") Long id) {
+ logger.debug("==> AssetREST.getXAsset({})", id);
+
+ RangerService service = serviceREST.getService(id);
+ VXAsset ret = serviceUtil.toVXAsset(service);
+
+ logger.debug("<== AssetREST.getXAsset({}): {}", id, ret);
+
+ return ret;
+ }
+
+ @POST
+ @Path("/assets")
+ @Consumes("application/json")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_X_ASSET + "\")")
+ public VXAsset createXAsset(VXAsset vXAsset) {
+ logger.debug("==> AssetREST.createXAsset({})", vXAsset);
+
+ RangerService service = serviceUtil.toRangerService(vXAsset);
+ RangerService createdService = serviceREST.createService(service);
+ VXAsset ret = serviceUtil.toVXAsset(createdService);
+
+ logger.debug("<== AssetREST.createXAsset({}):{}", vXAsset, ret);
+
+ return ret;
+ }
+
+ @PUT
+ @Path("/assets/{id}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_X_ASSET + "\")")
+ public VXAsset updateXAsset(VXAsset vXAsset) {
+ logger.debug("==> AssetREST.updateXAsset({})", vXAsset);
+
+ RangerService service = serviceUtil.toRangerService(vXAsset);
+ RangerService updatedService = serviceREST.updateService(service, null);
+ VXAsset ret = serviceUtil.toVXAsset(updatedService);
+
+ logger.debug("<== AssetREST.updateXAsset({}):{}", vXAsset, ret);
+
+ return ret;
+ }
+
+ @DELETE
+ @Path("/assets/{id}")
+ @RangerAnnotationClassName(class_name = VXAsset.class)
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DELETE_X_ASSET + "\")")
+ public void deleteXAsset(@PathParam("id") Long id, @Context HttpServletRequest request) {
+ logger.debug("==> AssetREST.deleteXAsset({})", id);
+
+ serviceREST.deleteService(id);
+
+ logger.debug("<== AssetREST.deleteXAsset({})", id);
+ }
+
+ @POST
+ @Path("/assets/testConfig")
+ @Consumes("application/json")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.TEST_CONFIG + "\")")
+ public VXResponse configTest(VXAsset vXAsset) {
+ logger.debug("==> AssetREST.configTest({})", vXAsset);
+
+ RangerService service = serviceUtil.toRangerService(vXAsset);
+ VXResponse ret = serviceREST.validateConfig(service);
+
+ logger.debug("<== AssetREST.testConfig({}):{}", vXAsset, ret);
+
+ return ret;
+ }
+
+ @GET
+ @Path("/assets")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_X_ASSETS + "\")")
+ public VXAssetList searchXAssets(@Context HttpServletRequest request) {
+ logger.debug("==> AssetREST.searchXAssets()");
+
+ VXAssetList ret = new VXAssetList();
+ SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequestForRepositorySearch(request, xAssetService.sortFields);
+ List<RangerService> services = serviceREST.getServices(filter);
+
+ if (services != null) {
+ List<VXAsset> assets = new ArrayList<>();
+
+ for (RangerService service : services) {
+ VXAsset asset = serviceUtil.toVXAsset(service);
+
+ if (asset != null) {
+ assets.add(asset);
+ }
+ }
+
+ ret.setVXAssets(assets);
+ ret.setTotalCount(assets.size());
+ ret.setResultSize(assets.size());
+ }
+
+ logger.debug("<== AssetREST.searchXAssets(): count={}", ret.getListSize());
+
+ return ret;
+ }
+
+ @GET
+ @Path("/assets/count")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.COUNT_X_ASSETS + "\")")
+ public VXLong countXAssets(@Context HttpServletRequest request) {
+ logger.debug("==> AssetREST.countXAssets()");
+
+ SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequest(request, xResourceService.sortFields);
+
+ filter.setMaxRows(Integer.MAX_VALUE);
+
+ List<RangerService> services = serviceREST.getServices(filter);
+ int servicesCount = 0;
+
+ if (services != null) {
+ for (RangerService service : services) {
+ VXAsset asset = serviceUtil.toVXAsset(service);
+
+ if (asset != null) {
+ servicesCount++;
+ }
+ }
+ }
+
+ VXLong ret = new VXLong();
+
+ ret.setValue(servicesCount);
+
+ logger.debug("<== AssetREST.countXAssets(): {}", ret);
+
+ return ret;
+ }
+
+ @GET
+ @Path("/resources/{id}")
+ @Produces("application/json")
+ public VXResource getXResource(@PathParam("id") Long id) {
+ logger.debug("==> AssetREST.getXResource({})", id);
+
+ RangerService service = null;
+ RangerPolicy policy = serviceREST.getPolicy(id);
+
+ if (policy != null) {
+ service = serviceREST.getServiceByName(policy.getService());
+ }
+
+ VXResource ret = serviceUtil.toVXResource(policy, service);
+
+ logger.debug("<== AssetREST.getXResource({}): {}", id, ret);
+
+ return ret;
+ }
+
+ @POST
+ @Path("/resources")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXResource createXResource(VXResource vXResource) {
+ logger.debug("==> AssetREST.createXResource({})", vXResource);
+
+ RangerService service = serviceREST.getService(vXResource.getAssetId());
+ RangerPolicy policy = serviceUtil.toRangerPolicy(vXResource, service);
+ RangerPolicy createdPolicy = serviceREST.createPolicy(policy, null);
+ VXResource ret = serviceUtil.toVXResource(createdPolicy, service);
+
+ logger.debug("<== AssetREST.createXResource({}): {}", vXResource, ret);
+
+ return ret;
+ }
+
+ @PUT
+ @Path("/resources/{id}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXResource updateXResource(VXResource vXResource, @PathParam("id") Long id) {
+ logger.debug("==> AssetREST.updateXResource({})", vXResource);
+
+ // if vXResource.id is specified, it should be same as the param 'id'
+ if (vXResource.getId() == null) {
+ vXResource.setId(id);
+ } else if (!vXResource.getId().equals(id)) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "resource Id mismatch", true);
+ }
+
+ RangerService service = serviceREST.getService(vXResource.getAssetId());
+ RangerPolicy policy = serviceUtil.toRangerPolicy(vXResource, service);
+ RangerPolicy updatedPolicy = serviceREST.updatePolicy(policy, policy.getId());
+ VXResource ret = serviceUtil.toVXResource(updatedPolicy, service);
+
+ logger.debug("<== AssetREST.updateXResource({}): {}", vXResource, ret);
+
+ return ret;
+ }
+
+ @DELETE
+ @Path("/resources/{id}")
+ @RangerAnnotationClassName(class_name = VXResource.class)
+ public void deleteXResource(@PathParam("id") Long id, @Context HttpServletRequest request) {
+ logger.debug("==> AssetREST.deleteXResource({})", id);
+
+ serviceREST.deletePolicy(id);
+
+ logger.debug("<== AssetREST.deleteXResource({})", id);
+ }
+
+ @GET
+ @Path("/resources")
+ @Produces("application/json")
+ public VXResourceList searchXResources(@Context HttpServletRequest request) {
+ logger.debug("==> AssetREST.searchXResources()");
+
+ VXResourceList ret = new VXResourceList();
+ SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequest(request, xResourceService.sortFields);
+ List<RangerPolicy> policies = serviceREST.getPolicies(filter);
+
+ if (policies != null) {
+ List<VXResource> resources = new ArrayList<>();
- RangerPolicy updatedPolicy = serviceREST.updatePolicy(policy, policy.getId());
-
- VXResource ret = serviceUtil.toVXResource(updatedPolicy, service);
+ for (RangerPolicy policy : policies) {
+ RangerService service = serviceREST.getServiceByName(policy.getService());
+ VXResource resource = serviceUtil.toVXResource(policy, service);
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.updateXResource(" + vXResource + "): " + ret);
- }
+ if (resource != null) {
+ resources.add(resource);
+ }
+ }
- return ret;
- }
+ ret.setVXResources(resources);
+ ret.setTotalCount(resources.size());
+ ret.setResultSize(resources.size());
+ }
- @DELETE
- @Path("/resources/{id}")
- @RangerAnnotationClassName(class_name = VXResource.class)
- public void deleteXResource(@PathParam("id") Long id,
- @Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.deleteXResource(" + id + ")");
- }
+ logger.debug("<== AssetREST.searchXResources(): count={}", ret.getResultSize());
+
+ return ret;
+ }
- serviceREST.deletePolicy(id);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.deleteXResource(" + id + ")");
- }
- }
-
- @GET
- @Path("/resources")
- @Produces({ "application/json" })
- public VXResourceList searchXResources(@Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.searchXResources()");
- }
-
- VXResourceList ret = new VXResourceList();
-
- SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequest(request, xResourceService.sortFields);
-
- List<RangerPolicy> policies = serviceREST.getPolicies(filter);
-
- if(policies != null) {
- List<VXResource> resources = new ArrayList<VXResource>();
- for(RangerPolicy policy : policies) {
- RangerService service = serviceREST.getServiceByName(policy.getService());
-
- VXResource resource = serviceUtil.toVXResource(policy, service);
-
- if(resource != null) {
- resources.add(resource);
- }
- }
-
- ret.setVXResources(resources);
- ret.setTotalCount(resources.size());
- ret.setResultSize(resources.size());
- }
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.searchXResources(): count=" + ret.getResultSize());
- }
-
- return ret;
- }
-
- @GET
- @Path("/resources/count")
- @Produces({ "application/json" })
- public VXLong countXResources(@Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.countXResources()");
- }
-
- SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequest(request, xResourceService.sortFields);
-
- filter.setMaxRows(Integer.MAX_VALUE);
-
- List<RangerPolicy> policies = serviceREST.getPolicies(filter);
- int policiesCount = 0;
-
- if (policies != null) {
- Map<String, RangerService> services = new HashMap<>();
-
- for (RangerPolicy policy : policies) {
- RangerService service = services.get(policy.getService());
-
- if (service == null) {
- service = serviceREST.getServiceByName(policy.getService());
-
- services.put(policy.getService(), service);
- }
-
- VXResource resource = serviceUtil.toVXResource(policy, service);
-
- if (resource != null) {
- policiesCount++;
- }
- }
- }
-
- VXLong ret = new VXLong();
-
- ret.setValue(policiesCount);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.countXResources(): " + ret);
- }
-
- return ret;
- }
-
- @GET
- @Path("/credstores/{id}")
- @Produces({ "application/json" })
- public VXCredentialStore getXCredentialStore(@PathParam("id") Long id) {
- return assetMgr.getXCredentialStore(id);
- }
-
- @POST
- @Path("/credstores")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXCredentialStore createXCredentialStore(
- VXCredentialStore vXCredentialStore) {
- return assetMgr.createXCredentialStore(vXCredentialStore);
- }
-
- @PUT
- @Path("/credstores")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXCredentialStore updateXCredentialStore(
- VXCredentialStore vXCredentialStore) {
- return assetMgr.updateXCredentialStore(vXCredentialStore);
- }
-
- @DELETE
- @Path("/credstores/{id}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- @RangerAnnotationClassName(class_name = VXCredentialStore.class)
- public void deleteXCredentialStore(@PathParam("id") Long id,
- @Context HttpServletRequest request) {
- boolean force = false;
- assetMgr.deleteXCredentialStore(id, force);
- }
-
- @GET
- @Path("/credstores")
- @Produces({ "application/json" })
- public VXCredentialStoreList searchXCredentialStores(
- @Context HttpServletRequest request) {
- SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(
- request, xCredentialStoreService.sortFields);
- return assetMgr.searchXCredentialStores(searchCriteria);
- }
-
- @GET
- @Path("/credstores/count")
- @Produces({ "application/json" })
- public VXLong countXCredentialStores(@Context HttpServletRequest request) {
- SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(
- request, xCredentialStoreService.sortFields);
- return assetMgr.getXCredentialStoreSearchCount(searchCriteria);
- }
-
- @GET
- @Path("/exportAudit")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_X_POLICY_EXPORT_AUDITS + "\")")
- public VXPolicyExportAuditList searchXPolicyExportAudits(
- @Context HttpServletRequest request) {
-
- SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(
- request, xPolicyExportAudits.sortFields);
- searchUtil.extractString(request, searchCriteria, "agentId",
- "The XA agent id pulling the policies.",
- StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "clientIP",
- "The XA agent ip pulling the policies.",
- StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "repositoryName",
- "Repository name for which export was done.",
- StringUtil.VALIDATION_TEXT);
- searchUtil.extractInt(request, searchCriteria, "httpRetCode",
- "HTTP response code for exported policy.");
- searchUtil.extractDate(request, searchCriteria, "startDate",
- "Start Date", null);
- searchUtil.extractDate(request, searchCriteria, "endDate",
- "End Date", null);
- searchUtil.extractString(request, searchCriteria, "cluster",
- "Cluster Name", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "zoneName",
- "Zone Name", StringUtil.VALIDATION_TEXT);
- return assetMgr.searchXPolicyExportAudits(searchCriteria);
- }
-
- @GET
- @Path("/report")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_REPORT_LOGS + "\")")
- public VXTrxLogList getReportLogs(@Context HttpServletRequest request){
-
- SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(
- request, xTrxLogService.getSortFields());
- searchUtil.extractInt(request, searchCriteria, "objectClassType", "audit type.");
- searchUtil.extractInt(request, searchCriteria, "objectId", "Object ID");
- searchUtil.extractString(request, searchCriteria, "attributeName",
- "Attribute Name", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "action",
- "CRUD Action Type", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "sessionId",
- "Session Id", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "owner",
- "Owner", StringUtil.VALIDATION_TEXT);
- searchUtil.extractDate(request, searchCriteria, "startDate", "Trasaction date since", "MM/dd/yyyy");
- searchUtil.extractDate(request, searchCriteria, "endDate", "Trasaction date till", "MM/dd/yyyy");
- return assetMgr.getReportLogs(searchCriteria);
- }
-
- @GET
- @Path("/report/{transactionId}")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_TRANSACTION_REPORT + "\")")
- public VXTrxLogList getTransactionReport(@Context HttpServletRequest request,
- @PathParam("transactionId") String transactionId){
- return assetMgr.getTransactionReport(transactionId);
- }
-
- @GET
- @Path("/accessAudit")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_ACCESS_LOGS + "\")")
- public VXAccessAuditList getAccessLogs(@Context HttpServletRequest request, @QueryParam("timeZone") String timeZone){
- SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(
- request, xAccessAuditService.sortFields);
- searchUtil.extractString(request, searchCriteria, "accessType",
- "Access Type", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "aclEnforcer",
- "Access Enforcer", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "agentId",
- "Application", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "repoName",
- "Service Name", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "sessionId",
- "Session ID", StringUtil.VALIDATION_TEXT);
- searchUtil.extractStringList(request, searchCriteria, "requestUser",
- "Users", "requestUser", null, StringUtil.VALIDATION_TEXT);
- searchUtil.extractStringList(request, searchCriteria, "excludeUser",
- "Exclude Users", "-requestUser", null, StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "requestData",
- "Request Data", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "resourcePath",
- "Resource Name", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "clientIP",
- "Client IP", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "resourceType",
- "Resource Type", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request,searchCriteria,"excludeServiceUser",
- "Exclude Service User",StringUtil.VALIDATION_TEXT);
-
- searchUtil.extractInt(request, searchCriteria, "auditType", "Audit Type");
- searchUtil.extractInt(request, searchCriteria, "accessResult", "Result");
- searchUtil.extractInt(request, searchCriteria, "assetId", "Asset ID");
- searchUtil.extractLong(request, searchCriteria, "policyId", "Policy ID");
- searchUtil.extractInt(request, searchCriteria, "repoType", "Service Type");
-
- searchUtil.extractDate(request, searchCriteria, "startDate","Start Date", "MM/dd/yyyy");
- searchUtil.extractDate(request, searchCriteria, "endDate", "End Date", "MM/dd/yyyy");
-
- searchUtil.extractString(request, searchCriteria, "tags", "tags", null);
- searchUtil.extractString(request, searchCriteria, "cluster", "Cluster Name", StringUtil.VALIDATION_TEXT);
- searchUtil.extractStringList(request, searchCriteria, "zoneName", "Zone Name List", "zoneName", null, null);
-
- searchUtil.extractString(request, searchCriteria, "agentHost", "Agent Host Name", StringUtil.VALIDATION_TEXT);
-
- searchUtil.extractString(request, searchCriteria, "eventId", "Event Id", null);
-
- boolean isKeyAdmin = msBizUtil.isKeyAdmin();
- boolean isAuditKeyAdmin = msBizUtil.isAuditKeyAdmin();
- XXServiceDef xxServiceDef = daoManager.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME);
- if(isKeyAdmin && xxServiceDef != null || isAuditKeyAdmin && xxServiceDef != null){
- searchCriteria.getParamList().put("repoType", xxServiceDef.getId());
- }
- else if (xxServiceDef != null) {
- searchCriteria.getParamList().put("-repoType", xxServiceDef.getId());
- }
- VXAccessAuditList vxAccessAuditList = assetMgr.getAccessLogs(searchCriteria);
-
- if (timeZone != null && !StringUtils.isBlank(timeZone)) {
- vxAccessAuditList.getVXAccessAudits().forEach(vxAccessAudit -> {
- String zonedEventTime = convertToTimeZone(vxAccessAudit.getEventTime(), timeZone);
- if (zonedEventTime == null || zonedEventTime.isEmpty()) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "Passed timeZone value is invalid", true);
- }
- vxAccessAudit.setZonedEventTime(zonedEventTime);
- });
- } else {
- vxAccessAuditList.getVXAccessAudits().forEach(vxAccessAudit -> {
- vxAccessAudit.setZonedEventTime(new SimpleDateFormat(RestUtil.ZONED_EVENT_TIME_FORMAT).format(vxAccessAudit.getEventTime()));
- });
- }
- return vxAccessAuditList;
- }
-
- @POST
- @Path("/resources/grant")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXPolicy grantPermission(@Context HttpServletRequest request,VXPolicy vXPolicy) {
-
- RESTResponse ret = null;
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.grantPermission(" + vXPolicy + ")");
- }
-
- if ( vXPolicy != null) {
- String serviceName = vXPolicy.getRepositoryName();
- GrantRevokeRequest grantRevokeRequest = serviceUtil.toGrantRevokeRequest(vXPolicy);
- try {
- ret = serviceREST.grantAccess(serviceName, grantRevokeRequest, request);
- } catch(WebApplicationException excp) {
- throw excp;
- } catch (Throwable e) {
- logger.error( HttpServletResponse.SC_BAD_REQUEST + "Grant Access Failed for the request " + vXPolicy, e);
- throw restErrorUtil.createRESTException("Grant Access Failed for the request: " + vXPolicy + ". " + e.getMessage());
- }
- } else {
- logger.error( HttpServletResponse.SC_BAD_REQUEST + "Bad Request parameter");
- throw restErrorUtil.createRESTException("Bad Request parameter");
- }
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.grantPermission(" + ret + ")");
- }
-
- // TO DO Current Grant REST doesn't return a policy so returning a null value. Has to be replace with VXpolicy.
- return vXPolicy;
- }
-
- @POST
- @Path("/resources/revoke")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXPolicy revokePermission(@Context HttpServletRequest request,VXPolicy vXPolicy) {
-
- RESTResponse ret = null;
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> AssetREST.revokePermission(" + vXPolicy + ")");
- }
-
- if ( vXPolicy != null) {
- String serviceName = vXPolicy.getRepositoryName();
- GrantRevokeRequest grantRevokeRequest = serviceUtil.toGrantRevokeRequest(vXPolicy);
- try {
- ret = serviceREST.revokeAccess(serviceName, grantRevokeRequest, request);
- } catch(WebApplicationException excp) {
- throw excp;
- } catch (Throwable e) {
- logger.error( HttpServletResponse.SC_BAD_REQUEST + "Revoke Access Failed for the request " + vXPolicy, e);
- throw restErrorUtil.createRESTException("Revoke Access Failed for the request: " + vXPolicy + ". " + e.getMessage());
- }
- } else {
- logger.error( HttpServletResponse.SC_BAD_REQUEST + "Bad Request parameter");
- throw restErrorUtil.createRESTException("Bad Request parameter");
- }
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== AssetREST.revokePermission(" + ret + ")");
- }
- return vXPolicy;
- }
-
- @GET
- @Path("/ugsyncAudits")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_UGSYNC_AUDITS + "\")")
- public VXUgsyncAuditInfoList getUgsyncAudits(@Context HttpServletRequest request){
-
- SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(
- request, xAccessAuditService.sortFields);
- searchUtil.extractString(request, searchCriteria, "userName",
- "User Name", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "sessionId",
- "Session Id", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "syncSource",
- "Sync Source", StringUtil.VALIDATION_TEXT);
- searchUtil.extractString(request, searchCriteria, "syncSourceInfo",
- "Sync Source Info", StringUtil.VALIDATION_TEXT);
- searchUtil.extractLong(request, searchCriteria, "noOfUsers", "No of Users");
- searchUtil.extractLong(request, searchCriteria, "noOfGroups", "No of Groups");
-
- searchUtil.extractDate(request, searchCriteria, "startDate",
- "Start Date", "MM/dd/yyyy");
- searchUtil.extractDate(request, searchCriteria, "endDate", "End Date",
- "MM/dd/yyyy");
- return assetMgr.getUgsyncAudits(searchCriteria);
- }
-
- @GET
- @Path("/ugsyncAudits/{syncSource}")
- @Encoded
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_UGSYNC_AUDITS_BY_SYNCSOURCE + "\")")
- public VXUgsyncAuditInfoList getUgsyncAuditsBySyncSource(@PathParam("syncSource") String syncSource){
- VXUgsyncAuditInfoList vxUgsyncAuditInfoList = new VXUgsyncAuditInfoList();
- vxUgsyncAuditInfoList = assetMgr.getUgsyncAuditsBySyncSource(syncSource);
- return vxUgsyncAuditInfoList;
- }
+ @GET
+ @Path("/resources/count")
+ @Produces("application/json")
+ public VXLong countXResources(@Context HttpServletRequest request) {
+ logger.debug("==> AssetREST.countXResources()");
+
+ SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequest(request, xResourceService.sortFields);
+
+ filter.setMaxRows(Integer.MAX_VALUE);
+
+ List<RangerPolicy> policies = serviceREST.getPolicies(filter);
+ int policiesCount = 0;
+
+ if (policies != null) {
+ Map<String, RangerService> services = new HashMap<>();
+
+ for (RangerPolicy policy : policies) {
+ RangerService service = services.get(policy.getService());
+
+ if (service == null) {
+ service = serviceREST.getServiceByName(policy.getService());
+
+ services.put(policy.getService(), service);
+ }
+
+ VXResource resource = serviceUtil.toVXResource(policy, service);
+
+ if (resource != null) {
+ policiesCount++;
+ }
+ }
+ }
+
+ VXLong ret = new VXLong();
+
+ ret.setValue(policiesCount);
+
+ logger.debug("<== AssetREST.countXResources(): {}", ret);
+
+ return ret;
+ }
+
+ @GET
+ @Path("/credstores/{id}")
+ @Produces("application/json")
+ public VXCredentialStore getXCredentialStore(@PathParam("id") Long id) {
+ return assetMgr.getXCredentialStore(id);
+ }
+
+ @POST
+ @Path("/credstores")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXCredentialStore createXCredentialStore(VXCredentialStore vXCredentialStore) {
+ return assetMgr.createXCredentialStore(vXCredentialStore);
+ }
+
+ @PUT
+ @Path("/credstores")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXCredentialStore updateXCredentialStore(VXCredentialStore vXCredentialStore) {
+ return assetMgr.updateXCredentialStore(vXCredentialStore);
+ }
+
+ @DELETE
+ @Path("/credstores/{id}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ @RangerAnnotationClassName(class_name = VXCredentialStore.class)
+ public void deleteXCredentialStore(@PathParam("id") Long id, @Context HttpServletRequest request) {
+ boolean force = false;
+
+ assetMgr.deleteXCredentialStore(id, force);
+ }
+
+ @GET
+ @Path("/credstores")
+ @Produces("application/json")
+ public VXCredentialStoreList searchXCredentialStores(@Context HttpServletRequest request) {
+ SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(request, xCredentialStoreService.sortFields);
+
+ return assetMgr.searchXCredentialStores(searchCriteria);
+ }
+
+ @GET
+ @Path("/credstores/count")
+ @Produces("application/json")
+ public VXLong countXCredentialStores(@Context HttpServletRequest request) {
+ SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(request, xCredentialStoreService.sortFields);
+
+ return assetMgr.getXCredentialStoreSearchCount(searchCriteria);
+ }
+
+ @GET
+ @Path("/exportAudit")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_X_POLICY_EXPORT_AUDITS + "\")")
+ public VXPolicyExportAuditList searchXPolicyExportAudits(@Context HttpServletRequest request) {
+ SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(request, xPolicyExportAudits.sortFields);
+
+ searchUtil.extractString(request, searchCriteria, "agentId", "The XA agent id pulling the policies.", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "clientIP", "The XA agent ip pulling the policies.", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "repositoryName", "Repository name for which export was done.", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractInt(request, searchCriteria, "httpRetCode", "HTTP response code for exported policy.");
+ searchUtil.extractDate(request, searchCriteria, "startDate", "Start Date", null);
+ searchUtil.extractDate(request, searchCriteria, "endDate", "End Date", null);
+ searchUtil.extractString(request, searchCriteria, "cluster", "Cluster Name", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "zoneName", "Zone Name", StringUtil.VALIDATION_TEXT);
+
+ return assetMgr.searchXPolicyExportAudits(searchCriteria);
+ }
+
+ @GET
+ @Path("/report")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_REPORT_LOGS + "\")")
+ public VXTrxLogList getReportLogs(@Context HttpServletRequest request) {
+ SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(request, xTrxLogService.getSortFields());
+
+ searchUtil.extractInt(request, searchCriteria, "objectClassType", "audit type.");
+ searchUtil.extractInt(request, searchCriteria, "objectId", "Object ID");
+ searchUtil.extractString(request, searchCriteria, "attributeName", "Attribute Name", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "action", "CRUD Action Type", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "sessionId", "Session Id", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "owner", "Owner", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractDate(request, searchCriteria, "startDate", "Trasaction date since", "MM/dd/yyyy");
+ searchUtil.extractDate(request, searchCriteria, "endDate", "Trasaction date till", "MM/dd/yyyy");
+
+ return assetMgr.getReportLogs(searchCriteria);
+ }
+
+ @GET
+ @Path("/report/{transactionId}")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_TRANSACTION_REPORT + "\")")
+ public VXTrxLogList getTransactionReport(@Context HttpServletRequest request, @PathParam("transactionId") String transactionId) {
+ return assetMgr.getTransactionReport(transactionId);
+ }
+
+ @GET
+ @Path("/accessAudit")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_ACCESS_LOGS + "\")")
+ public VXAccessAuditList getAccessLogs(@Context HttpServletRequest request, @QueryParam("timeZone") String timeZone) {
+ SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(request, xAccessAuditService.sortFields);
+
+ searchUtil.extractString(request, searchCriteria, "accessType", "Access Type", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "aclEnforcer", "Access Enforcer", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "agentId", "Application", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "repoName", "Service Name", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "sessionId", "Session ID", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractStringList(request, searchCriteria, "requestUser", "Users", "requestUser", null, StringUtil.VALIDATION_TEXT);
+ searchUtil.extractStringList(request, searchCriteria, "excludeUser", "Exclude Users", "-requestUser", null, StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "requestData", "Request Data", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "resourcePath", "Resource Name", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "clientIP", "Client IP", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "resourceType", "Resource Type", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "excludeServiceUser", "Exclude Service User", StringUtil.VALIDATION_TEXT);
+
+ searchUtil.extractInt(request, searchCriteria, "auditType", "Audit Type");
+ searchUtil.extractInt(request, searchCriteria, "accessResult", "Result");
+ searchUtil.extractInt(request, searchCriteria, "assetId", "Asset ID");
+ searchUtil.extractLong(request, searchCriteria, "policyId", "Policy ID");
+ searchUtil.extractInt(request, searchCriteria, "repoType", "Service Type");
+ searchUtil.extractDate(request, searchCriteria, "startDate", "Start Date", "MM/dd/yyyy");
+ searchUtil.extractDate(request, searchCriteria, "endDate", "End Date", "MM/dd/yyyy");
+ searchUtil.extractString(request, searchCriteria, "tags", "tags", null);
+ searchUtil.extractString(request, searchCriteria, "cluster", "Cluster Name", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractStringList(request, searchCriteria, "zoneName", "Zone Name List", "zoneName", null, null);
+ searchUtil.extractString(request, searchCriteria, "agentHost", "Agent Host Name", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "eventId", "Event Id", null);
+
+ boolean isKeyAdmin = msBizUtil.isKeyAdmin();
+ boolean isAuditKeyAdmin = msBizUtil.isAuditKeyAdmin();
+ XXServiceDef xxServiceDef = daoManager.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME);
+
+ if (isKeyAdmin && xxServiceDef != null || isAuditKeyAdmin && xxServiceDef != null) {
+ searchCriteria.getParamList().put("repoType", xxServiceDef.getId());
+ } else if (xxServiceDef != null) {
+ searchCriteria.getParamList().put("-repoType", xxServiceDef.getId());
+ }
+
+ VXAccessAuditList vxAccessAuditList = assetMgr.getAccessLogs(searchCriteria);
+
+ if (timeZone != null && !StringUtils.isBlank(timeZone)) {
+ vxAccessAuditList.getVXAccessAudits().forEach(vxAccessAudit -> {
+ String zonedEventTime = convertToTimeZone(vxAccessAudit.getEventTime(), timeZone);
+
+ if (zonedEventTime == null || zonedEventTime.isEmpty()) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Passed timeZone value is invalid", true);
+ }
+
+ vxAccessAudit.setZonedEventTime(zonedEventTime);
+ });
+ } else {
+ vxAccessAuditList.getVXAccessAudits().forEach(vxAccessAudit -> vxAccessAudit.setZonedEventTime(new SimpleDateFormat(RestUtil.ZONED_EVENT_TIME_FORMAT).format(vxAccessAudit.getEventTime())));
+ }
+
+ return vxAccessAuditList;
+ }
+
+ @POST
+ @Path("/resources/grant")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXPolicy grantPermission(@Context HttpServletRequest request, VXPolicy vXPolicy) {
+ RESTResponse ret;
+
+ logger.debug("==> AssetREST.grantPermission({})", vXPolicy);
+
+ if (vXPolicy != null) {
+ String serviceName = vXPolicy.getRepositoryName();
+ GrantRevokeRequest grantRevokeRequest = serviceUtil.toGrantRevokeRequest(vXPolicy);
+
+ try {
+ ret = serviceREST.grantAccess(serviceName, grantRevokeRequest, request);
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable e) {
+ logger.error("{} Grant Access Failed for the request {}", HttpServletResponse.SC_BAD_REQUEST, vXPolicy, e);
+
+ throw restErrorUtil.createRESTException("Grant Access Failed for the request: " + vXPolicy + ". " + e.getMessage());
+ }
+ } else {
+ logger.error("{} Bad Request parameter", HttpServletResponse.SC_BAD_REQUEST);
+
+ throw restErrorUtil.createRESTException("Bad Request parameter");
+ }
+
+ logger.debug("<== AssetREST.grantPermission({})", ret);
+
+ // TO DO Current Grant REST doesn't return a policy so returning a null value. Has to be replace with VXpolicy.
+ return vXPolicy;
+ }
+
+ @POST
+ @Path("/resources/revoke")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXPolicy revokePermission(@Context HttpServletRequest request, VXPolicy vXPolicy) {
+ RESTResponse ret;
+
+ logger.debug("==> AssetREST.revokePermission({})", vXPolicy);
+
+ if (vXPolicy != null) {
+ String serviceName = vXPolicy.getRepositoryName();
+ GrantRevokeRequest grantRevokeRequest = serviceUtil.toGrantRevokeRequest(vXPolicy);
+
+ try {
+ ret = serviceREST.revokeAccess(serviceName, grantRevokeRequest, request);
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable e) {
+ logger.error("{} Revoke Access Failed for the request {}", HttpServletResponse.SC_BAD_REQUEST, vXPolicy, e);
+
+ throw restErrorUtil.createRESTException("Revoke Access Failed for the request: " + vXPolicy + ". " + e.getMessage());
+ }
+ } else {
+ logger.error("{} Bad Request parameter", HttpServletResponse.SC_BAD_REQUEST);
+
+ throw restErrorUtil.createRESTException("Bad Request parameter");
+ }
+
+ logger.debug("<== AssetREST.revokePermission({})", ret);
+
+ return vXPolicy;
+ }
+
+ @GET
+ @Path("/ugsyncAudits")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_UGSYNC_AUDITS + "\")")
+ public VXUgsyncAuditInfoList getUgsyncAudits(@Context HttpServletRequest request) {
+ SearchCriteria searchCriteria = searchUtil.extractCommonCriterias(request, xAccessAuditService.sortFields);
+
+ searchUtil.extractString(request, searchCriteria, "userName", "User Name", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "sessionId", "Session Id", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "syncSource", "Sync Source", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractString(request, searchCriteria, "syncSourceInfo", "Sync Source Info", StringUtil.VALIDATION_TEXT);
+ searchUtil.extractLong(request, searchCriteria, "noOfUsers", "No of Users");
+ searchUtil.extractLong(request, searchCriteria, "noOfGroups", "No of Groups");
+ searchUtil.extractDate(request, searchCriteria, "startDate", "Start Date", "MM/dd/yyyy");
+ searchUtil.extractDate(request, searchCriteria, "endDate", "End Date", "MM/dd/yyyy");
+
+ return assetMgr.getUgsyncAudits(searchCriteria);
+ }
+
+ @GET
+ @Path("/ugsyncAudits/{syncSource}")
+ @Encoded
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_UGSYNC_AUDITS_BY_SYNCSOURCE + "\")")
+ public VXUgsyncAuditInfoList getUgsyncAuditsBySyncSource(@PathParam("syncSource") String syncSource) {
+ return assetMgr.getUgsyncAuditsBySyncSource(syncSource);
+ }
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/GdsREST.java b/security-admin/src/main/java/org/apache/ranger/rest/GdsREST.java
index 87eb6ea4d..0d3ef3d76 100755
--- a/security-admin/src/main/java/org/apache/ranger/rest/GdsREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/GdsREST.java
@@ -20,7 +20,6 @@
package org.apache.ranger.rest;
import org.apache.commons.collections4.CollectionUtils;
-import java.util.function.Predicate;
import org.apache.commons.lang.ArrayUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.hadoop.thirdparty.com.google.common.annotations.VisibleForTesting;
@@ -34,17 +33,16 @@ import org.apache.ranger.common.RESTErrorUtil;
import org.apache.ranger.common.RangerSearchUtil;
import org.apache.ranger.common.ServiceUtil;
import org.apache.ranger.plugin.model.RangerGds;
-import org.apache.ranger.plugin.model.RangerGds.DatasetSummary;
-import org.apache.ranger.plugin.model.RangerGds.DataShareSummary;
import org.apache.ranger.plugin.model.RangerGds.DataShareInDatasetSummary;
+import org.apache.ranger.plugin.model.RangerGds.DataShareSummary;
+import org.apache.ranger.plugin.model.RangerGds.DatasetSummary;
+import org.apache.ranger.plugin.model.RangerGds.RangerDataShare;
+import org.apache.ranger.plugin.model.RangerGds.RangerDataShareInDataset;
import org.apache.ranger.plugin.model.RangerGds.RangerDataset;
import org.apache.ranger.plugin.model.RangerGds.RangerDatasetInProject;
-import org.apache.ranger.plugin.model.RangerGds.RangerDataShareInDataset;
-import org.apache.ranger.plugin.model.RangerGds.RangerDataShare;
import org.apache.ranger.plugin.model.RangerGds.RangerProject;
import org.apache.ranger.plugin.model.RangerGds.RangerSharedResource;
import org.apache.ranger.plugin.model.RangerGrant;
-
import org.apache.ranger.plugin.model.RangerPluginInfo;
import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem;
@@ -61,13 +59,12 @@ import org.apache.ranger.plugin.util.RangerServiceNotFoundException;
import org.apache.ranger.plugin.util.SearchFilter;
import org.apache.ranger.plugin.util.ServiceGdsInfo;
import org.apache.ranger.security.context.RangerAPIList;
-import org.apache.ranger.service.RangerGdsDatasetInProjectService;
import org.apache.ranger.service.RangerGdsDataShareInDatasetService;
import org.apache.ranger.service.RangerGdsDataShareService;
+import org.apache.ranger.service.RangerGdsDatasetInProjectService;
import org.apache.ranger.service.RangerGdsDatasetService;
import org.apache.ranger.service.RangerGdsProjectService;
import org.apache.ranger.service.RangerGdsSharedResourceService;
-
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
@@ -79,8 +76,19 @@ import org.springframework.transaction.annotation.Transactional;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.*;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.DefaultValue;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.Context;
+
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
@@ -89,6 +97,7 @@ import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
+import java.util.function.Predicate;
import java.util.stream.Collectors;
@Path("gds")
@@ -99,20 +108,15 @@ public class GdsREST {
private static final Logger LOG = LoggerFactory.getLogger(GdsREST.class);
private static final Logger PERF_LOG = RangerPerfTracer.getPerfLogger("rest.GdsREST");
- private final RangerAdminConfig config = RangerAdminConfig.getInstance();
-
- private final int SHARED_RESOURCES_MAX_BATCH_SIZE = config.getInt("ranger.admin.rest.gds.shared.resources.max.batch.size", 100);
-
- private static final String PRINCIPAL_TYPE_USER = RangerPrincipal.PrincipalType.USER.name().toLowerCase();
-
- private static final String PRINCIPAL_TYPE_GROUP = RangerPrincipal.PrincipalType.GROUP.name().toLowerCase();
-
- private static final String PRINCIPAL_TYPE_ROLE = RangerPrincipal.PrincipalType.ROLE.name().toLowerCase();
-
- private static final String DEFAULT_PRINCIPAL_TYPE = PRINCIPAL_TYPE_USER;
-
public static final String GDS_POLICY_EXPR_CONDITION = "expression";
+ private static final String PRINCIPAL_TYPE_USER = RangerPrincipal.PrincipalType.USER.name().toLowerCase();
+ private static final String PRINCIPAL_TYPE_GROUP = RangerPrincipal.PrincipalType.GROUP.name().toLowerCase();
+ private static final String PRINCIPAL_TYPE_ROLE = RangerPrincipal.PrincipalType.ROLE.name().toLowerCase();
+ private static final String DEFAULT_PRINCIPAL_TYPE = PRINCIPAL_TYPE_USER;
+ private static final RangerAdminConfig config = RangerAdminConfig.getInstance();
+ private static final int SHARED_RESOURCES_MAX_BATCH_SIZE = config.getInt("ranger.admin.rest.gds.shared.resources.max.batch.size", 100);
+
@Autowired
GdsDBStore gdsStore;
@@ -152,11 +156,10 @@ public class GdsREST {
@Autowired
AssetMgr assetMgr;
-
@POST
@Path("/dataset")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_DATASET + "\")")
public RangerDataset createDataset(RangerDataset dataset) {
LOG.debug("==> GdsREST.createDataset({})", dataset);
@@ -165,14 +168,14 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.createDataset(datasetName=" + dataset.getName() + ")");
}
ret = gdsStore.createDataset(dataset);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("createDataset({}) failed", dataset, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -187,32 +190,37 @@ public class GdsREST {
@POST
@Path("/dataset/{id}/resources/{serviceName}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.ADD_SHARED_RESOURCES + "\")")
- public List<RangerSharedResource> addDatasetResources(@PathParam("id") Long datasetId,
- @PathParam("serviceName") String serviceName,
- @QueryParam("zoneName") @DefaultValue("") String zoneName,
- List<RangerSharedResource> resources) {
+ public List<RangerSharedResource> addDatasetResources(@PathParam("id") Long datasetId, @PathParam("serviceName") String serviceName, @QueryParam("zoneName") @DefaultValue("") String zoneName, List<RangerSharedResource> resources) {
LOG.debug("==> GdsREST.addDatasetResources(datasetId={} serviceName={} zoneNam={} resources={})", datasetId, serviceName, zoneName, resources);
List<RangerSharedResource> ret = new ArrayList<>();
RangerPerfTracer perf = null;
try {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.addDatasetResources(datasetId=" + datasetId + ")");
+ }
+
Long serviceId = validateAndGetServiceId(serviceName);
Long zoneId = validateAndGetZoneId(zoneName);
Long dataShareId = getOrCreateDataShare(datasetId, serviceId, zoneId, serviceName);
+
// Add resources to DataShare
for (RangerSharedResource resource : resources) {
resource.setDataShareId(dataShareId);
+
RangerSharedResource rangerSharedResource = addSharedResource(resource);
+
ret.add(rangerSharedResource);
}
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("GdsREST.addDatasetResources(datasetId={} serviceName={} zoneName={} resources={}) failed!", datasetId, serviceName, zoneName, resources, excp);
+
throw restErrorUtil.createRESTException(excp.getMessage());
} finally {
RangerPerfTracer.log(perf);
@@ -225,8 +233,8 @@ public class GdsREST {
@POST
@Path("/dataset/{id}/datashare")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.ADD_DATASHARE_IN_DATASET + "\")")
public List<RangerDataShareInDataset> addDataSharesInDataset(@PathParam("id") Long datasetId, List<RangerDataShareInDataset> dataSharesInDataset) {
LOG.debug("==> GdsREST.addDataSharesInDataset({}, {})", datasetId, dataSharesInDataset);
@@ -236,7 +244,7 @@ public class GdsREST {
try {
if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.addDataSharesInDataset(" + datasetId + ")");
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.addDataSharesInDataset(" + datasetId + ")");
}
if (CollectionUtils.isNotEmpty(dataSharesInDataset)) {
@@ -252,9 +260,9 @@ public class GdsREST {
}
ret = gdsStore.addDataSharesInDataset(dataSharesInDataset);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("addDataShareInDataset({}) failed", datasetId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -269,8 +277,8 @@ public class GdsREST {
@PUT
@Path("/dataset/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_DATASET + "\")")
public RangerDataset updateDataset(@PathParam("id") Long datasetId, RangerDataset dataset) {
LOG.debug("==> GdsREST.updateDataset({}, {})", datasetId, dataset);
@@ -279,16 +287,16 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateDataset(datasetId=" + datasetId + ", datasetName=" + dataset.getName() + ")");
}
dataset.setId(datasetId);
ret = gdsStore.updateDataset(dataset);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("updateDataset({}, {}) failed", datasetId, dataset, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -303,7 +311,7 @@ public class GdsREST {
@DELETE
@Path("/dataset/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DELETE_DATASET + "\")")
public void deleteDataset(@PathParam("id") Long datasetId, @Context HttpServletRequest request) {
LOG.debug("==> deleteDataset({})", datasetId);
@@ -311,16 +319,16 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.deleteDataset(datasetId=" + datasetId + ")");
}
boolean forceDelete = Boolean.parseBoolean(request.getParameter("forceDelete"));
gdsStore.deleteDataset(datasetId, forceDelete);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("deleteDataset({}) failed", datasetId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -333,7 +341,7 @@ public class GdsREST {
@GET
@Path("/dataset/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_DATASET + "\")")
public RangerDataset getDataset(@PathParam("id") Long datasetId) {
LOG.debug("==> GdsREST.getDataset({})", datasetId);
@@ -342,7 +350,7 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getDataset(datasetId=" + datasetId + ")");
}
@@ -351,9 +359,9 @@ public class GdsREST {
if (ret == null) {
throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "no dataset with id=" + datasetId, false);
}
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("getDataset({}) failed", datasetId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -368,7 +376,7 @@ public class GdsREST {
@GET
@Path("/dataset")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_DATASETS + "\")")
public PList<RangerDataset> searchDatasets(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.searchDatasets()");
@@ -378,7 +386,7 @@ public class GdsREST {
SearchFilter filter = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.searchDatasets()");
}
@@ -388,9 +396,9 @@ public class GdsREST {
searchUtil.extractStringList(request, filter, SearchFilter.DATASET_KEYWORD, "Dataset Keyword List", "datasetKeywords", null, null);
ret = gdsStore.searchDatasets(filter);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("searchDatasets({}) failed", filter, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -405,7 +413,7 @@ public class GdsREST {
@GET
@Path("/dataset/names")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.LIST_DATASET_NAMES + "\")")
public PList<String> listDatasetNames(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.listDatasetNames()");
@@ -418,9 +426,9 @@ public class GdsREST {
filter = searchUtil.getSearchFilter(request, datasetService.sortFields);
ret = gdsStore.getDatasetNames(filter);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("listDatasetNames({}) failed", filter, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -435,7 +443,7 @@ public class GdsREST {
@GET
@Path("/dataset/summary")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_DATASET_SUMMARY + "\")")
public PList<DatasetSummary> getDatasetSummary(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.getDatasetSummary()");
@@ -465,8 +473,8 @@ public class GdsREST {
@POST
@Path(("/dataset/{id}/policy"))
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DATASET_POLICY + "\")")
public RangerPolicy addDatasetPolicy(@PathParam("id") Long datasetId, RangerPolicy policy) {
LOG.debug("==> GdsREST.addDatasetPolicy({}, {})", datasetId, policy);
@@ -493,8 +501,8 @@ public class GdsREST {
@PUT
@Path(("/dataset/{id}/policy/{policyId}"))
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DATASET_POLICY + "\")")
public RangerPolicy updateDatasetPolicy(@PathParam("id") Long datasetId, @PathParam("policyId") Long policyId, RangerPolicy policy) {
LOG.debug("==> GdsREST.updateDatasetPolicy({}, {})", datasetId, policy);
@@ -504,6 +512,7 @@ public class GdsREST {
try {
policy.setId(policyId);
+
ret = gdsStore.updateDatasetPolicy(datasetId, policy);
} catch (WebApplicationException excp) {
throw excp;
@@ -545,7 +554,7 @@ public class GdsREST {
@GET
@Path(("/dataset/{id}/policy/{policyId}"))
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DATASET_POLICY + "\")")
public RangerPolicy getDatasetPolicy(@PathParam("id") Long datasetId, @PathParam("policyId") Long policyId) {
LOG.debug("==> GdsREST.getDatasetPolicy({}, {})", datasetId, policyId);
@@ -572,7 +581,7 @@ public class GdsREST {
@GET
@Path(("/dataset/{id}/policy"))
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DATASET_POLICY + "\")")
public List<RangerPolicy> getDatasetPolicies(@PathParam("id") Long datasetId, @Context HttpServletRequest request) {
LOG.debug("==> GdsREST.getDatasetPolicies({})", datasetId);
@@ -599,8 +608,8 @@ public class GdsREST {
@POST
@Path("/project")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_PROJECT + "\")")
public RangerProject createProject(RangerProject project) {
LOG.debug("==> GdsREST.createProject({})", project);
@@ -609,14 +618,14 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.createProject(projectName=" + project.getName() + ")");
}
ret = gdsStore.createProject(project);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("createProject({}) failed", project, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -631,8 +640,8 @@ public class GdsREST {
@PUT
@Path("/project/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_PROJECT + "\")")
public RangerProject updateProject(@PathParam("id") Long projectId, RangerProject project) {
LOG.debug("==> GdsREST.updateProject({}, {})", projectId, project);
@@ -641,16 +650,16 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateProject(projectId=" + projectId + ", projectName=" + project.getName() + ")");
}
project.setId(projectId);
ret = gdsStore.updateProject(project);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("updateProject({}, {}) failed", projectId, project, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -665,7 +674,7 @@ public class GdsREST {
@DELETE
@Path("/project/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DELETE_PROJECT + "\")")
public void deleteProject(@PathParam("id") Long projectId, @Context HttpServletRequest request) {
LOG.debug("==> deleteProject({})", projectId);
@@ -673,16 +682,16 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.deleteProject(projectId=" + projectId + ")");
}
boolean forceDelete = Boolean.parseBoolean(request.getParameter("forceDelete"));
gdsStore.deleteProject(projectId, forceDelete);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("deleteProject({}) failed", projectId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -695,7 +704,7 @@ public class GdsREST {
@GET
@Path("/project/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_PROJECT + "\")")
public RangerProject getProject(@PathParam("id") Long projectId) {
LOG.debug("==> GdsREST.getProject({})", projectId);
@@ -704,7 +713,7 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getProject(projectId=" + projectId + ")");
}
@@ -713,9 +722,9 @@ public class GdsREST {
if (ret == null) {
throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "no project with id=" + projectId, false);
}
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("getProject({}) failed", projectId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -730,7 +739,7 @@ public class GdsREST {
@GET
@Path("/project")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_PROJECTS + "\")")
public PList<RangerProject> searchProjects(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.searchProjects()");
@@ -743,9 +752,9 @@ public class GdsREST {
filter = searchUtil.getSearchFilter(request, projectService.sortFields);
ret = gdsStore.searchProjects(filter);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("searchProjects({}) failed", filter, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -760,7 +769,7 @@ public class GdsREST {
@GET
@Path("/project/names")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.LIST_PROJECT_NAMES + "\")")
public PList<String> listProjectNames(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.listProjectNames()");
@@ -773,9 +782,9 @@ public class GdsREST {
filter = searchUtil.getSearchFilter(request, projectService.sortFields);
ret = gdsStore.getProjectNames(filter);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("listProjectNames({}) failed", filter, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -790,8 +799,8 @@ public class GdsREST {
@POST
@Path(("/project/{id}/policy"))
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.PROJECT_POLICY + "\")")
public RangerPolicy addProjectPolicy(@PathParam("id") Long projectId, RangerPolicy policy) {
LOG.debug("==> GdsREST.addProjectPolicy({}, {})", projectId, policy);
@@ -818,8 +827,8 @@ public class GdsREST {
@PUT
@Path(("/project/{id}/policy/{policyId}"))
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.PROJECT_POLICY + "\")")
public RangerPolicy updateProjectPolicy(@PathParam("id") Long projectId, @PathParam("policyId") Long policyId, RangerPolicy policy) {
LOG.debug("==> GdsREST.updateProjectPolicy({}, {})", projectId, policy);
@@ -829,6 +838,7 @@ public class GdsREST {
try {
policy.setId(policyId);
+
ret = gdsStore.updateProjectPolicy(projectId, policy);
} catch (WebApplicationException excp) {
throw excp;
@@ -870,7 +880,7 @@ public class GdsREST {
@GET
@Path(("/project/{id}/policy/{policyId}"))
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.PROJECT_POLICY + "\")")
public RangerPolicy getProjectPolicy(@PathParam("id") Long projectId, @PathParam("policyId") Long policyId) {
LOG.debug("==> GdsREST.getProjectPolicy({}, {})", projectId, policyId);
@@ -897,7 +907,7 @@ public class GdsREST {
@GET
@Path(("/project/{id}/policy"))
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.PROJECT_POLICY + "\")")
public List<RangerPolicy> getProjectPolicies(@PathParam("id") Long projectId, @Context HttpServletRequest request) {
LOG.debug("==> GdsREST.getProjectPolicies({})", projectId);
@@ -924,8 +934,8 @@ public class GdsREST {
@POST
@Path("/datashare")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_DATA_SHARE + "\")")
public RangerDataShare createDataShare(RangerDataShare dataShare) {
LOG.debug("==> GdsREST.createDataShare({})", dataShare);
@@ -934,14 +944,14 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.createDataShare(" + dataShare + ")");
}
ret = gdsStore.createDataShare(dataShare);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("createDataShare({}) failed", dataShare, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -956,8 +966,8 @@ public class GdsREST {
@PUT
@Path("/datashare/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_DATA_SHARE + "\")")
public RangerDataShare updateDataShare(@PathParam("id") Long dataShareId, RangerDataShare dataShare) {
LOG.debug("==> GdsREST.updateDataShare({}, {})", dataShareId, dataShare);
@@ -966,16 +976,16 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateDataShare(" + dataShare + ")");
}
dataShare.setId(dataShareId);
ret = gdsStore.updateDataShare(dataShare);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("updateDataShare({}, {}) failed", dataShareId, dataShare, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -990,7 +1000,7 @@ public class GdsREST {
@DELETE
@Path("/datashare/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DELETE_DATA_SHARE + "\")")
public void deleteDataShare(@PathParam("id") Long dataShareId, @Context HttpServletRequest request) {
LOG.debug("==> GdsREST.deleteDataShare({})", dataShareId);
@@ -998,17 +1008,17 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.deleteDataShare(" + dataShareId + ")");
}
- String forceDeleteStr = request.getParameter("forceDelete");
- boolean forceDelete = !StringUtils.isEmpty(forceDeleteStr) && "true".equalsIgnoreCase(forceDeleteStr);
+ String forceDeleteStr = request.getParameter("forceDelete");
+ boolean forceDelete = !StringUtils.isEmpty(forceDeleteStr) && "true".equalsIgnoreCase(forceDeleteStr);
gdsStore.deleteDataShare(dataShareId, forceDelete);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("deleteDataShare({}) failed", dataShareId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1021,7 +1031,7 @@ public class GdsREST {
@GET
@Path("/datashare/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_DATA_SHARE + "\")")
public RangerDataShare getDataShare(@PathParam("id") Long dataShareId) {
LOG.debug("==> GdsREST.getDataShare({})", dataShareId);
@@ -1030,7 +1040,7 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getDataShare(" + dataShareId + ")");
}
@@ -1039,9 +1049,9 @@ public class GdsREST {
if (ret == null) {
throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "no dataShare with id=" + dataShareId, false);
}
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("getDataShare({}) failed", dataShareId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1056,7 +1066,7 @@ public class GdsREST {
@GET
@Path("/datashare")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_DATA_SHARES + "\")")
public PList<RangerDataShare> searchDataShares(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.searchDataShares()");
@@ -1069,9 +1079,9 @@ public class GdsREST {
filter = searchUtil.getSearchFilter(request, dataShareService.sortFields);
ret = gdsStore.searchDataShares(filter);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("searchDataShares({}) failed", filter, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1086,7 +1096,7 @@ public class GdsREST {
@GET
@Path("/datashare/summary")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_DATA_SHARE_SUMMARY + "\")")
public PList<DataShareSummary> getDataShareSummary(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.getDataShareSummary()");
@@ -1115,8 +1125,8 @@ public class GdsREST {
@POST
@Path("/resource")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.ADD_SHARED_RESOURCE + "\")")
public RangerSharedResource addSharedResource(RangerSharedResource resource) {
LOG.debug("==> GdsREST.addSharedResource({})", resource);
@@ -1125,16 +1135,16 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.addSharedResource(" + resource + ")");
}
- List<RangerSharedResource> sharedResources = gdsStore.addSharedResources(Arrays.asList(resource));
+ List<RangerSharedResource> sharedResources = gdsStore.addSharedResources(Collections.singletonList(resource));
ret = CollectionUtils.isNotEmpty(sharedResources) ? sharedResources.get(0) : null;
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("addSharedResource({}) failed", resource, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1149,8 +1159,8 @@ public class GdsREST {
@POST
@Path("/resources")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.ADD_SHARED_RESOURCES + "\")")
public List<RangerSharedResource> addSharedResources(List<RangerSharedResource> resources) {
LOG.debug("==> GdsREST.addSharedResources({})", resources);
@@ -1168,9 +1178,9 @@ public class GdsREST {
}
ret = gdsStore.addSharedResources(resources);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("addSharedResources({}) failed", resources, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1185,26 +1195,26 @@ public class GdsREST {
@PUT
@Path("/resource/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_SHARED_RESOURCE + "\")")
public RangerSharedResource updateSharedResource(@PathParam("id") Long resourceId, RangerSharedResource resource) {
LOG.debug("==> GdsREST.updateSharedResource({}, {})", resourceId, resource);
- RangerSharedResource ret;
- RangerPerfTracer perf = null;
+ RangerSharedResource ret;
+ RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateSharedResource(" + resource + ")");
}
resource.setId(resourceId);
ret = gdsStore.updateSharedResource(resource);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("updateSharedResource({}, {}) failed", resourceId, resource, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1219,7 +1229,7 @@ public class GdsREST {
@DELETE
@Path("/resource/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.REMOVE_SHARED_RESOURCE + "\")")
public void removeSharedResource(@PathParam("id") Long resourceId) {
LOG.debug("==> GdsREST.removeSharedResource({})", resourceId);
@@ -1227,14 +1237,14 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.removeSharedResource(" + resourceId + ")");
}
- gdsStore.removeSharedResources(Arrays.asList(resourceId));
- } catch(WebApplicationException excp) {
+ gdsStore.removeSharedResources(Collections.singletonList(resourceId));
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("removeSharedResource({}) failed", resourceId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1263,9 +1273,9 @@ public class GdsREST {
}
gdsStore.removeSharedResources(resourceIds);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("removeSharedResources({}) failed", resourceIds, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1278,16 +1288,16 @@ public class GdsREST {
@GET
@Path("/resource/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_SHARED_RESOURCE + "\")")
public RangerSharedResource getSharedResource(@PathParam("id") Long resourceId) {
LOG.debug("==> GdsREST.getSharedResource({})", resourceId);
- RangerSharedResource ret;
- RangerPerfTracer perf = null;
+ RangerSharedResource ret;
+ RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getSharedResource(" + resourceId + ")");
}
@@ -1296,9 +1306,9 @@ public class GdsREST {
if (ret == null) {
throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "no shared-resource with id=" + resourceId, false);
}
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("getSharedResource({}) failed", resourceId, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1313,7 +1323,7 @@ public class GdsREST {
@GET
@Path("/resource")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_SHARED_RESOURCES + "\")")
public PList<RangerSharedResource> searchSharedResources(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.searchSharedResources()");
@@ -1326,9 +1336,9 @@ public class GdsREST {
filter = searchUtil.getSearchFilter(request, sharedResourceService.sortFields);
ret = gdsStore.searchSharedResources(filter);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("searchSharedResources({}) failed", filter, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1343,8 +1353,8 @@ public class GdsREST {
@POST
@Path("/datashare/dataset")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.ADD_DATASHARE_IN_DATASET + "\")")
public RangerDataShareInDataset addDataShareInDataset(RangerDataShareInDataset datasetData) {
LOG.debug("==> GdsREST.addDataShareInDataset({})", datasetData);
@@ -1353,14 +1363,14 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.addDataShareInDataset(" + datasetData + ")");
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.addDataShareInDataset(" + datasetData + ")");
}
ret = gdsStore.addDataShareInDataset(datasetData);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("addDataShareInDataset({}) failed", datasetData, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1375,8 +1385,8 @@ public class GdsREST {
@PUT
@Path("/datashare/dataset/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_DATASHARE_IN_DATASET + "\")")
public RangerDataShareInDataset updateDataShareInDataset(@PathParam("id") Long id, RangerDataShareInDataset dataShareInDataset) {
LOG.debug("==> GdsREST.updateDataShareInDataset({}, {})", id, dataShareInDataset);
@@ -1385,16 +1395,16 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateDataShareInDataset(" + dataShareInDataset + ")");
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateDataShareInDataset(" + dataShareInDataset + ")");
}
dataShareInDataset.setId(id);
ret = gdsStore.updateDataShareInDataset(dataShareInDataset);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("updateDataShareInDataset({}) failed", dataShareInDataset, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1416,14 +1426,14 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.removeDatasetData(" + id + ")");
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.removeDatasetData(" + id + ")");
}
gdsStore.removeDataShareInDataset(id);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("removeDatasetData({}) failed", id, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1436,7 +1446,7 @@ public class GdsREST {
@GET
@Path("/datashare/dataset/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_DATASHARE_IN_DATASET + "\")")
public RangerDataShareInDataset getDataShareInDataset(@PathParam("id") Long id) {
LOG.debug("==> GdsREST.updateDataShareInDataset({})", id);
@@ -1445,14 +1455,14 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getDataShareInDataset(" + id + ")");
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getDataShareInDataset(" + id + ")");
}
ret = gdsStore.getDataShareInDataset(id);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("getDataShareInDataset({}) failed", id, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1467,22 +1477,22 @@ public class GdsREST {
@GET
@Path("/datashare/dataset")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_DATASHARE_IN_DATASET + "\")")
public PList<RangerDataShareInDataset> searchDataShareInDatasets(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.searchDataShareInDatasets()");
PList<RangerDataShareInDataset> ret;
- RangerPerfTracer perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.searchDataShareInDatasets()");
- SearchFilter filter = null;
+ RangerPerfTracer perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.searchDataShareInDatasets()");
+ SearchFilter filter = null;
try {
filter = searchUtil.getSearchFilter(request, dshidService.sortFields);
ret = gdsStore.searchDataShareInDatasets(filter);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("searchDataShareInDatasets({}) failed", filter, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1495,56 +1505,56 @@ public class GdsREST {
return ret;
}
- @GET
- @Path("/datashare/dataset/summary")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_DATASHARE_IN_DATASET_SUMMARY + "\")")
- public PList<DataShareInDatasetSummary> getDshInDsSummary(@Context HttpServletRequest request) {
- LOG.debug("==> GdsREST.searchDshInDsSummary()");
+ @GET
+ @Path("/datashare/dataset/summary")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_DATASHARE_IN_DATASET_SUMMARY + "\")")
+ public PList<DataShareInDatasetSummary> getDshInDsSummary(@Context HttpServletRequest request) {
+ LOG.debug("==> GdsREST.searchDshInDsSummary()");
- PList<DataShareInDatasetSummary> ret;
- SearchFilter filter = null;
- RangerPerfTracer perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getDshInDsSummary()");
+ PList<DataShareInDatasetSummary> ret;
+ SearchFilter filter = null;
+ RangerPerfTracer perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getDshInDsSummary()");
- try {
- filter = searchUtil.getSearchFilter(request, dshidService.sortFields);
+ try {
+ filter = searchUtil.getSearchFilter(request, dshidService.sortFields);
- ret = gdsStore.getDshInDsSummary(filter);
- } catch (WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("getDshInDsSummary({}) failed", filter, excp);
+ ret = gdsStore.getDshInDsSummary(filter);
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("getDshInDsSummary({}) failed", filter, excp);
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
+ throw restErrorUtil.createRESTException(excp.getMessage());
+ } finally {
+ RangerPerfTracer.log(perf);
+ }
- LOG.debug("<== GdsREST.getDshInDsSummary({}): {}", filter, ret);
+ LOG.debug("<== GdsREST.getDshInDsSummary({}): {}", filter, ret);
- return ret;
- }
+ return ret;
+ }
@POST
@Path("/dataset/project")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.ADD_DATASET_IN_PROJECT + "\")")
public RangerDatasetInProject addDatasetInProject(RangerDatasetInProject projectData) {
LOG.debug("==> GdsREST.addDatasetInProject({})", projectData);
RangerDatasetInProject ret;
- RangerPerfTracer perf = null;
+ RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.addDatasetInProject(" + projectData + ")");
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.addDatasetInProject(" + projectData + ")");
}
ret = gdsStore.addDatasetInProject(projectData);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("addDatasetInProject({}) failed", projectData, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1559,26 +1569,26 @@ public class GdsREST {
@PUT
@Path("/dataset/project/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_DATASET_IN_PROJECT + "\")")
public RangerDatasetInProject updateDatasetInProject(@PathParam("id") Long id, RangerDatasetInProject dataShareInProject) {
LOG.debug("==> GdsREST.updateDatasetInProject({}, {})", id, dataShareInProject);
RangerDatasetInProject ret;
- RangerPerfTracer perf = null;
+ RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateDatasetInProject(" + dataShareInProject + ")");
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateDatasetInProject(" + dataShareInProject + ")");
}
dataShareInProject.setId(id);
ret = gdsStore.updateDatasetInProject(dataShareInProject);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("updateDatasetInProject({}) failed", dataShareInProject, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1600,14 +1610,14 @@ public class GdsREST {
RangerPerfTracer perf = null;
try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.removeProjectData(" + id + ")");
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.removeProjectData(" + id + ")");
}
gdsStore.removeDatasetInProject(id);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("removeProjectData({}) failed", id, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1620,7 +1630,7 @@ public class GdsREST {
@GET
@Path("/dataset/project/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_DATASET_IN_PROJECT + "\")")
public RangerDatasetInProject getDatasetInProject(@PathParam("id") Long id) {
LOG.debug("==> GdsREST.getDatasetInProject({})", id);
@@ -1630,7 +1640,7 @@ public class GdsREST {
try {
if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getDatasetInProject(" + id + ")");
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.getDatasetInProject(" + id + ")");
}
ret = gdsStore.getDatasetInProject(id);
@@ -1651,7 +1661,7 @@ public class GdsREST {
@GET
@Path("/dataset/project")
- @Produces({ "application/json" })
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.SEARCH_DATASET_IN_PROJECT + "\")")
public PList<RangerDatasetInProject> searchDatasetInProjects(@Context HttpServletRequest request) {
LOG.debug("==> GdsREST.searchDatasetInProjects()");
@@ -1664,9 +1674,9 @@ public class GdsREST {
filter = searchUtil.getSearchFilter(request, dipService.sortFields);
ret = gdsStore.searchDatasetInProjects(filter);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("searchDatasetInProjects({}) failed", filter, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
@@ -1679,17 +1689,10 @@ public class GdsREST {
return ret;
}
-
@GET
@Path("/download/{serviceName}")
- @Produces({ "application/json" })
- public ServiceGdsInfo getServiceGdsInfoIfUpdated(@PathParam("serviceName") String serviceName,
- @QueryParam("lastKnownGdsVersion") @DefaultValue("-1") Long lastKnownVersion,
- @QueryParam("lastActivationTime") @DefaultValue("0") Long lastActivationTime,
- @QueryParam("pluginId") String pluginId,
- @QueryParam("clusterName") @DefaultValue("") String clusterName,
- @QueryParam("pluginCapabilities") @DefaultValue("") String pluginCapabilities,
- @Context HttpServletRequest request) {
+ @Produces("application/json")
+ public ServiceGdsInfo getServiceGdsInfoIfUpdated(@PathParam("serviceName") String serviceName, @QueryParam("lastKnownGdsVersion") @DefaultValue("-1") Long lastKnownVersion, @QueryParam("lastActivationTime") @DefaultValue("0") Long lastActivationTime, @QueryParam("pluginId") String pluginId, @QueryParam("clusterName") @DefaultValue("") String clusterName, @QueryParam("pluginCapabilities") @DefaultValue("") String pluginCapabilities, @Context HttpServletRequest request) {
LOG.debug("==> GdsREST.getServiceGdsInfoIfUpdated(serviceName={}, lastKnownVersion={}, lastActivationTime={}, pluginId={}, clusterName={}, pluginCapabilities{})", serviceName, lastKnownVersion, lastActivationTime, pluginId, clusterName, pluginCapabilities);
ServiceGdsInfo ret = null;
@@ -1738,14 +1741,8 @@ public class GdsREST {
@GET
@Path("/secure/download/{serviceName}")
- @Produces({ "application/json" })
- public ServiceGdsInfo getSecureServiceGdsInfoIfUpdated(@PathParam("serviceName") String serviceName,
- @QueryParam("lastKnownGdsVersion") @DefaultValue("-1") Long lastKnownVersion,
- @QueryParam("lastActivationTime") @DefaultValue("0") Long lastActivationTime,
- @QueryParam("pluginId") String pluginId,
- @QueryParam("clusterName") @DefaultValue("") String clusterName,
- @QueryParam("pluginCapabilities") @DefaultValue("") String pluginCapabilities,
- @Context HttpServletRequest request) {
+ @Produces("application/json")
+ public ServiceGdsInfo getSecureServiceGdsInfoIfUpdated(@PathParam("serviceName") String serviceName, @QueryParam("lastKnownGdsVersion") @DefaultValue("-1") Long lastKnownVersion, @QueryParam("lastActivationTime") @DefaultValue("0") Long lastActivationTime, @QueryParam("pluginId") String pluginId, @QueryParam("clusterName") @DefaultValue("") String clusterName, @QueryParam("pluginCapabilities") @DefaultValue("") String pluginCapabilities, @Context HttpServletRequest request) {
LOG.debug("==> GdsREST.getSecureServiceGdsInfoIfUpdated(serviceName={}, lastKnownVersion={}, lastActivationTime={}, pluginId={}, clusterName={}, pluginCapabilities{})", serviceName, lastKnownVersion, lastActivationTime, pluginId, clusterName, pluginCapabilities);
ServiceGdsInfo ret = null;
@@ -1792,114 +1789,9 @@ public class GdsREST {
return ret;
}
- private Long getOrCreateDataShare(Long datasetId, Long serviceId, Long zoneId, String serviceName) throws Exception {
- LOG.debug("==> GdsREST.getOrCreateDataShare(dataSetId={} serviceId={} zoneId={} seviceName={})", datasetId);
-
- Long ret;
- RangerDataShare rangerDataShare;
- RangerDataset rangerDataset = gdsStore.getDataset(datasetId);
- String dataShareName = "__dataset_" + datasetId + "__service_" + serviceId + "__zone_" + zoneId;
-
- SearchFilter filter = new SearchFilter();
- filter.setParam(SearchFilter.DATA_SHARE_NAME, dataShareName);
- PList<RangerDataShare> dataSharePList = gdsStore.searchDataShares(filter);
- List<RangerDataShare> dataShareList = dataSharePList.getList();
-
- if (CollectionUtils.isNotEmpty(dataShareList)) {
- List<RangerDataShare> rangerDataShares = dataSharePList.getList();
- rangerDataShare = rangerDataShares.get(0);
- ret = rangerDataShare.getId();
- } else {
- //Create a DataShare
- RangerDataShare dataShare = new RangerDataShare();
- dataShare.setName(dataShareName);
- dataShare.setDescription(dataShareName);
- dataShare.setTermsOfUse(rangerDataset.getTermsOfUse());
- dataShare.setService(serviceName);
- Set<String> accessTypes = new HashSet<>(CollectionUtils.EMPTY_COLLECTION);
- dataShare.setDefaultAccessTypes(accessTypes);
- rangerDataShare = gdsStore.createDataShare(dataShare);
-
- //Add DataShare to DataSet
- List<RangerDataShareInDataset> rangerDataShareInDatasets = new ArrayList<>();
- RangerDataShareInDataset rangerDataShareInDataset = new RangerDataShareInDataset();
- rangerDataShareInDataset.setDataShareId(rangerDataShare.getId());
- rangerDataShareInDataset.setDatasetId(rangerDataset.getId());
- rangerDataShareInDataset.setStatus(RangerGds.GdsShareStatus.REQUESTED);
- rangerDataShareInDatasets.add(rangerDataShareInDataset);
- addDataSharesInDataset(rangerDataset.getId(), rangerDataShareInDatasets);
- ret = rangerDataShare.getId();
- }
-
- LOG.debug("<== GdsREST.getOrCreateDataShare(RangerDataShare={})", ret);
-
- return ret;
- }
-
- private Long validateAndGetServiceId(String serviceName){
- Long ret;
- if (serviceName == null || serviceName.isEmpty()) {
- LOG.error("ServiceName not provided");
- throw restErrorUtil.createRESTException("ServiceName not provided.",
- MessageEnums.INVALID_INPUT_DATA);
- }
-
- RangerService service;
-
- try {
- service = serviceDBStore.getServiceByName(serviceName);
- ret = service.getId();
- } catch (Exception e) {
- LOG.error("Requested Service not found. serviceName=" + serviceName);
- throw restErrorUtil.createRESTException("Service:" + serviceName + " not found",
- MessageEnums.DATA_NOT_FOUND);
- }
-
- if(service == null){
- LOG.error("Requested Service not found. serviceName=" + serviceName);
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, RangerServiceNotFoundException.buildExceptionMsg(serviceName),
- false);
- }
-
- if(!service.getIsEnabled()){
- LOG.error("Requested Service is disabled. serviceName=" + serviceName);
- throw restErrorUtil.createRESTException("Unauthorized access.",
- MessageEnums.OPER_NOT_ALLOWED_FOR_STATE);
- }
-
- return ret;
- }
-
- private Long validateAndGetZoneId(String zoneName){
- Long ret = RangerSecurityZone.RANGER_UNZONED_SECURITY_ZONE_ID;
-
- if (zoneName == null || zoneName.isEmpty()) {
- return ret;
- }
-
- RangerSecurityZone rangerSecurityZone = null;
-
- try {
- rangerSecurityZone = serviceDBStore.getSecurityZone(zoneName);
- ret = rangerSecurityZone.getId();
- } catch (Exception e) {
- LOG.error("Requested Zone not found. ZoneName=" + zoneName);
- throw restErrorUtil.createRESTException("Zone:" + zoneName + " not found",
- MessageEnums.DATA_NOT_FOUND);
- }
-
- if(rangerSecurityZone == null){
- LOG.error("Requested Zone not found. ZoneName=" + zoneName);
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, RangerServiceNotFoundException.buildExceptionMsg(zoneName),
- false);
- }
-
- return ret;
- }
-
@GET
@Path("/dataset/{id}/grants")
- @Produces({"application/json"})
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_DATASET_GRANTS + "\")")
public List<RangerGrant> getDataSetGrants(@PathParam("id") Long id, @Context HttpServletRequest request) {
LOG.debug("==> GdsREST.getDataSetGrants(dataSetId: {})", id);
@@ -1919,13 +1811,12 @@ public class GdsREST {
if (CollectionUtils.isNotEmpty(filteredPolicyItems)) {
ret = transformPolicyItemsToGrants(filteredPolicyItems);
- } else {
+ } else {
LOG.debug("getDataSetGrants(): no grants available in dataset(id={}), policy(id={}) for query {}", id, policies.get(0).getId(), request.getQueryString());
}
} else {
LOG.debug("getDataSetGrants(): no policy found for dataset(id={})", id);
}
-
} catch (WebApplicationException excp) {
throw excp;
} catch (Throwable excp) {
@@ -1942,8 +1833,8 @@ public class GdsREST {
@PUT
@Path("/dataset/{id}/grant")
- @Consumes({"application/json"})
- @Produces({"application/json"})
+ @Consumes("application/json")
+ @Produces("application/json")
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_DATASET_GRANTS + "\")")
public RangerPolicyHeader updateDataSetGrants(@PathParam("id") Long id, List<RangerGrant> rangerGrants) {
LOG.debug("==> GdsREST.updateDataSetGrants(dataSetId: {}, rangerGrants: {})", id, rangerGrants);
@@ -1953,15 +1844,16 @@ public class GdsREST {
try {
if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateDataSetGrants( DataSetId: " + id + "rangerGrants: " + rangerGrants + ")");
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "GdsREST.updateDataSetGrants( DataSetId: " + id + "rangerGrants: " + rangerGrants + ")");
}
- List<RangerPolicy> policies = gdsStore.getDatasetPolicies(id);
- RangerPolicy policy = CollectionUtils.isNotEmpty(policies) ? policies.get(0) : gdsStore.addDatasetPolicy(id, new RangerPolicy());
- RangerPolicy policyWithModifiedGrants = updatePolicyWithModifiedGrants(policy, rangerGrants);
+ List<RangerPolicy> policies = gdsStore.getDatasetPolicies(id);
+ RangerPolicy policy = CollectionUtils.isNotEmpty(policies) ? policies.get(0) : gdsStore.addDatasetPolicy(id, new RangerPolicy());
+ RangerPolicy policyWithModifiedGrants = updatePolicyWithModifiedGrants(policy, rangerGrants);
if (policyWithModifiedGrants != null) {
RangerPolicy updatedPolicy = gdsStore.updateDatasetPolicy(id, policyWithModifiedGrants);
+
ret = rangerPolicyHeaderOf(updatedPolicy);
} else {
throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_MODIFIED, "No action performed: The grant may already exist or may not be found for deletion.", false);
@@ -1988,30 +1880,27 @@ public class GdsREST {
return Collections.emptyList();
}
- List<RangerPolicyItem> policyItems = rangerPolicy.getPolicyItems();
- String[] filteringPrincipals = searchUtil.getParamMultiValues(request, "principal");
- String[] filteringAccessTypes = searchUtil.getParamMultiValues(request, "accessType");
+ List<RangerPolicyItem> policyItems = rangerPolicy.getPolicyItems();
+ String[] filteringPrincipals = searchUtil.getParamMultiValues(request, "principal");
+ String[] filteringAccessTypes = searchUtil.getParamMultiValues(request, "accessType");
- Predicate<RangerPolicyItem> byPrincipalPredicate = filterByPrincipalsPredicate(filteringPrincipals);
+ Predicate<RangerPolicyItem> byPrincipalPredicate = filterByPrincipalsPredicate(filteringPrincipals);
Predicate<RangerPolicyItem> byAccessTypePredicate = filterByAccessTypesPredicate(filteringAccessTypes);
-
- List<RangerPolicyItem> filteredPolicyItems = policyItems.stream()
- .filter(byPrincipalPredicate.and(byAccessTypePredicate))
- .collect(Collectors.toList());
+ List<RangerPolicyItem> filteredPolicyItems = policyItems.stream().filter(byPrincipalPredicate.and(byAccessTypePredicate)).collect(Collectors.toList());
LOG.debug("<== GdsREST.filterPolicyItemsByRequest(rangerPolicy: {}): filteredPolicyItems= {}", rangerPolicy, filteredPolicyItems);
return filteredPolicyItems;
}
- @VisibleForTesting
- List<RangerGrant> transformPolicyItemsToGrants(List<RangerPolicyItem> policyItems) {
+ @VisibleForTesting
+ List<RangerGrant> transformPolicyItemsToGrants(List<RangerPolicyItem> policyItems) {
LOG.debug("==> GdsREST.transformPolicyItemsToGrants(policyItems: {})", policyItems);
if (CollectionUtils.isEmpty(policyItems)) {
return null;
}
- List<RangerGrant> ret = new ArrayList<>();
+ List<RangerGrant> ret = new ArrayList<>();
for (RangerPolicyItem policyItem : policyItems) {
List<String> policyItemUsers = policyItem.getUsers();
@@ -2021,19 +1910,19 @@ public class GdsREST {
List<RangerPolicyItemAccess> policyItemAccesses = policyItem.getAccesses();
List<RangerPolicyItemCondition> policyItemConditions = policyItem.getConditions();
- List<String> policyItemAccessTypes = policyItemAccesses.stream().map(x -> x.getType()).collect(Collectors.toList());
+ List<String> policyItemAccessTypes = policyItemAccesses.stream().map(RangerPolicyItemAccess::getType).collect(Collectors.toList());
List<String> policyItemConditionValues = policyItemConditions.stream().flatMap(x -> x.getValues().stream()).collect(Collectors.toList());
if (CollectionUtils.isNotEmpty(policyItemUsers)) {
- policyItemUsers.stream().forEach(x -> ret.add(new RangerGrant(new RangerPrincipal(RangerPrincipal.PrincipalType.USER, x), policyItemAccessTypes, policyItemConditionValues)));
+ policyItemUsers.forEach(x -> ret.add(new RangerGrant(new RangerPrincipal(RangerPrincipal.PrincipalType.USER, x), policyItemAccessTypes, policyItemConditionValues)));
}
if (CollectionUtils.isNotEmpty(policyItemGroups)) {
- policyItemGroups.stream().forEach(x -> ret.add(new RangerGrant(new RangerPrincipal(RangerPrincipal.PrincipalType.GROUP, x), policyItemAccessTypes, policyItemConditionValues)));
+ policyItemGroups.forEach(x -> ret.add(new RangerGrant(new RangerPrincipal(RangerPrincipal.PrincipalType.GROUP, x), policyItemAccessTypes, policyItemConditionValues)));
}
if (CollectionUtils.isNotEmpty(policyItemRoles)) {
- policyItemRoles.stream().forEach(x -> ret.add(new RangerGrant(new RangerPrincipal(RangerPrincipal.PrincipalType.ROLE, x), policyItemAccessTypes, policyItemConditionValues)));
+ policyItemRoles.forEach(x -> ret.add(new RangerGrant(new RangerPrincipal(RangerPrincipal.PrincipalType.ROLE, x), policyItemAccessTypes, policyItemConditionValues)));
}
}
@@ -2042,38 +1931,25 @@ public class GdsREST {
return ret;
}
- private RangerPolicyHeader rangerPolicyHeaderOf(RangerPolicy rangerPolicy) {
- LOG.debug("==> GdsREST.rangerPolicyHeaderOf(rangerPolicy: {})", rangerPolicy);
-
- RangerPolicyHeader ret = null;
- if (rangerPolicy != null) {
- ret = new RangerPolicyHeader(rangerPolicy);
- }
-
- LOG.debug("<== GdsREST.rangerPolicyHeaderOf(rangerPolicy: {}): ret= {}", rangerPolicy, ret);
- return ret;
- }
-
- @VisibleForTesting
- RangerPolicy updatePolicyWithModifiedGrants(RangerPolicy policy, List<RangerGrant> rangerGrants) {
+ @VisibleForTesting
+ RangerPolicy updatePolicyWithModifiedGrants(RangerPolicy policy, List<RangerGrant> rangerGrants) {
LOG.debug("==> GdsREST.updatePolicyWithModifiedGrants(policy: {}, rangerGrants: {})", policy, rangerGrants);
try {
- List<RangerPolicyItem> policyItems = policy.getPolicyItems();
+ List<RangerPolicyItem> policyItems = policy.getPolicyItems();
List<RangerPolicyItem> policyItemsToUpdate = policyItems.stream().map(this::copyOf).collect(Collectors.toList());
-
- Set<RangerPrincipal> principalsToUpdate = rangerGrants.stream().map(RangerGrant::getPrincipal).collect(Collectors.toSet());
+ Set<RangerPrincipal> principalsToUpdate = rangerGrants.stream().map(RangerGrant::getPrincipal).collect(Collectors.toSet());
for (RangerPrincipal principal : principalsToUpdate) {
List<RangerPolicyItem> policyItemsToRemove = new ArrayList<>();
- policyItemsToUpdate.stream()
- .filter(matchesPrincipalPredicate(principal))
- .forEach(policyItem -> {
- removeMatchingPrincipalFromPolicyItem(policyItem, principal);
- if (isPolicyItemEmpty(policyItem)) {
- policyItemsToRemove.add(policyItem);
- }
-
- });
+
+ policyItemsToUpdate.stream().filter(matchesPrincipalPredicate(principal)).forEach(policyItem -> {
+ removeMatchingPrincipalFromPolicyItem(policyItem, principal);
+
+ if (isPolicyItemEmpty(policyItem)) {
+ policyItemsToRemove.add(policyItem);
+ }
+ });
+
policyItemsToUpdate.removeAll(policyItemsToRemove);
}
@@ -2092,18 +1968,145 @@ public class GdsREST {
} catch (Exception e) {
throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, e.getMessage(), true);
}
+
LOG.debug("<== GdsREST.updatePolicyWithModifiedGrants(updatedPolicy: {})", policy);
+
return policy;
}
+ private Long getOrCreateDataShare(Long datasetId, Long serviceId, Long zoneId, String serviceName) throws Exception {
+ LOG.debug("==> GdsREST.getOrCreateDataShare(dataSetId={} serviceId={} zoneId={} serviceName={})", datasetId, serviceId, zoneId, serviceName);
+
+ Long ret;
+ RangerDataShare rangerDataShare;
+ RangerDataset rangerDataset = gdsStore.getDataset(datasetId);
+ String dataShareName = "__dataset_" + datasetId + "__service_" + serviceId + "__zone_" + zoneId;
+
+ SearchFilter filter = new SearchFilter();
+
+ filter.setParam(SearchFilter.DATA_SHARE_NAME, dataShareName);
+
+ PList<RangerDataShare> dataSharePList = gdsStore.searchDataShares(filter);
+ List<RangerDataShare> dataShareList = dataSharePList.getList();
+
+ if (CollectionUtils.isNotEmpty(dataShareList)) {
+ List<RangerDataShare> rangerDataShares = dataSharePList.getList();
+
+ rangerDataShare = rangerDataShares.get(0);
+ ret = rangerDataShare.getId();
+ } else {
+ //Create a DataShare
+ RangerDataShare dataShare = new RangerDataShare();
+
+ dataShare.setName(dataShareName);
+ dataShare.setDescription(dataShareName);
+ dataShare.setTermsOfUse(rangerDataset.getTermsOfUse());
+ dataShare.setService(serviceName);
+ dataShare.setDefaultAccessTypes(new HashSet<>());
+
+ rangerDataShare = gdsStore.createDataShare(dataShare);
+
+ //Add DataShare to DataSet
+ List<RangerDataShareInDataset> rangerDataShareInDatasets = new ArrayList<>();
+ RangerDataShareInDataset rangerDataShareInDataset = new RangerDataShareInDataset();
+
+ rangerDataShareInDataset.setDataShareId(rangerDataShare.getId());
+ rangerDataShareInDataset.setDatasetId(rangerDataset.getId());
+ rangerDataShareInDataset.setStatus(RangerGds.GdsShareStatus.REQUESTED);
+ rangerDataShareInDatasets.add(rangerDataShareInDataset);
+
+ addDataSharesInDataset(rangerDataset.getId(), rangerDataShareInDatasets);
+
+ ret = rangerDataShare.getId();
+ }
+
+ LOG.debug("<== GdsREST.getOrCreateDataShare(RangerDataShare={})", ret);
+
+ return ret;
+ }
+
+ private Long validateAndGetServiceId(String serviceName) {
+ Long ret;
+
+ if (serviceName == null || serviceName.isEmpty()) {
+ LOG.error("ServiceName not provided");
+
+ throw restErrorUtil.createRESTException("ServiceName not provided.", MessageEnums.INVALID_INPUT_DATA);
+ }
+
+ RangerService service;
+
+ try {
+ service = serviceDBStore.getServiceByName(serviceName);
+ ret = service.getId();
+ } catch (Exception e) {
+ LOG.error("Requested Service not found. serviceName={}", serviceName);
+
+ throw restErrorUtil.createRESTException("Service:" + serviceName + " not found", MessageEnums.DATA_NOT_FOUND);
+ }
+
+ if (service == null) {
+ LOG.error("Requested Service not found. serviceName={}", serviceName);
+
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, RangerServiceNotFoundException.buildExceptionMsg(serviceName), false);
+ }
+
+ if (!service.getIsEnabled()) {
+ LOG.error("Requested Service is disabled. serviceName={}", serviceName);
+
+ throw restErrorUtil.createRESTException("Unauthorized access.", MessageEnums.OPER_NOT_ALLOWED_FOR_STATE);
+ }
+
+ return ret;
+ }
+
+ private Long validateAndGetZoneId(String zoneName) {
+ Long ret = RangerSecurityZone.RANGER_UNZONED_SECURITY_ZONE_ID;
+
+ if (zoneName == null || zoneName.isEmpty()) {
+ return ret;
+ }
+
+ RangerSecurityZone rangerSecurityZone;
+
+ try {
+ rangerSecurityZone = serviceDBStore.getSecurityZone(zoneName);
+ ret = rangerSecurityZone.getId();
+ } catch (Exception e) {
+ LOG.error("Requested Zone not found. ZoneName={}", zoneName);
+
+ throw restErrorUtil.createRESTException("Zone:" + zoneName + " not found", MessageEnums.DATA_NOT_FOUND);
+ }
+
+ if (rangerSecurityZone == null) {
+ LOG.error("Requested Zone not found. ZoneName={}", zoneName);
+
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, RangerServiceNotFoundException.buildExceptionMsg(zoneName), false);
+ }
+
+ return ret;
+ }
+
+ private RangerPolicyHeader rangerPolicyHeaderOf(RangerPolicy rangerPolicy) {
+ LOG.debug("==> GdsREST.rangerPolicyHeaderOf(rangerPolicy: {})", rangerPolicy);
+
+ RangerPolicyHeader ret = null;
+
+ if (rangerPolicy != null) {
+ ret = new RangerPolicyHeader(rangerPolicy);
+ }
+
+ LOG.debug("<== GdsREST.rangerPolicyHeaderOf(rangerPolicy: {}): ret= {}", rangerPolicy, ret);
+
+ return ret;
+ }
+
private boolean isPolicyItemEmpty(RangerPolicyItem policyItem) {
- return CollectionUtils.isEmpty(policyItem.getUsers()) &&
- CollectionUtils.isEmpty(policyItem.getGroups()) &&
- CollectionUtils.isEmpty(policyItem.getRoles());
+ return CollectionUtils.isEmpty(policyItem.getUsers()) && CollectionUtils.isEmpty(policyItem.getGroups()) && CollectionUtils.isEmpty(policyItem.getRoles());
}
private void removeMatchingPrincipalFromPolicyItem(RangerPolicyItem policyItem, RangerPrincipal principal) {
- String principalName = principal.getName();
+ String principalName = principal.getName();
PrincipalType principalType = principal.getType();
if (principalType == PrincipalType.USER && policyItem.getUsers() != null) {
@@ -2122,20 +2125,16 @@ public class GdsREST {
return null;
}
- RangerPolicyItem policyItem = new RangerPolicyItem();
+ RangerPolicyItem policyItem = new RangerPolicyItem();
+ List<String> permissions = grant.getAccessTypes();
+ List<String> conditions = grant.getConditions();
- List<String> permissions = grant.getAccessTypes();
if (CollectionUtils.isNotEmpty(permissions)) {
- policyItem.setAccesses(permissions.stream()
- .map(accessType -> new RangerPolicyItemAccess(accessType, true))
- .collect(Collectors.toList()));
+ policyItem.setAccesses(permissions.stream().map(accessType -> new RangerPolicyItemAccess(accessType, true)).collect(Collectors.toList()));
}
- List<String> conditions = grant.getConditions();
if (CollectionUtils.isNotEmpty(conditions)) {
- policyItem.setConditions(conditions.stream()
- .map(condition -> new RangerPolicyItemCondition(GDS_POLICY_EXPR_CONDITION, Collections.singletonList(condition)))
- .collect(Collectors.toList()));
+ policyItem.setConditions(conditions.stream().map(condition -> new RangerPolicyItemCondition(GDS_POLICY_EXPR_CONDITION, Collections.singletonList(condition))).collect(Collectors.toList()));
}
switch (grant.getPrincipal().getType()) {
@@ -2156,7 +2155,7 @@ public class GdsREST {
}
private Predicate<RangerPolicyItem> matchesPrincipalPredicate(RangerPrincipal principal) {
- String principalName = principal.getName();
+ String principalName = principal.getName();
PrincipalType principalType = principal.getType();
return policyItem -> {
@@ -2182,24 +2181,21 @@ public class GdsREST {
}
Map<String, Set<String>> principalCriteriaMap = new HashMap<>();
+
for (String principal : filteringPrincipals) {
- String[] parts = principal.split(":");
- String principalType = parts.length > 1 ? parts[0] : DEFAULT_PRINCIPAL_TYPE;
- String principalName = parts.length > 1 ? parts[1] : parts[0];
+ String[] parts = principal.split(":");
+ String principalType = parts.length > 1 ? parts[0] : DEFAULT_PRINCIPAL_TYPE;
+ String principalName = parts.length > 1 ? parts[1] : parts[0];
- principalCriteriaMap
- .computeIfAbsent(principalType.toLowerCase(), k -> new HashSet<>())
- .add(principalName);
+ principalCriteriaMap.computeIfAbsent(principalType.toLowerCase(), k -> new HashSet<>()).add(principalName);
}
return policyItem -> {
- Set<String> users = principalCriteriaMap.getOrDefault(PRINCIPAL_TYPE_USER, Collections.emptySet());
+ Set<String> users = principalCriteriaMap.getOrDefault(PRINCIPAL_TYPE_USER, Collections.emptySet());
Set<String> groups = principalCriteriaMap.getOrDefault(PRINCIPAL_TYPE_GROUP, Collections.emptySet());
- Set<String> roles = principalCriteriaMap.getOrDefault(PRINCIPAL_TYPE_ROLE, Collections.emptySet());
+ Set<String> roles = principalCriteriaMap.getOrDefault(PRINCIPAL_TYPE_ROLE, Collections.emptySet());
- return (policyItem.getUsers() != null && policyItem.getUsers().stream().anyMatch(users::contains)) ||
- (policyItem.getGroups() != null && policyItem.getGroups().stream().anyMatch(groups::contains)) ||
- (policyItem.getRoles() != null && policyItem.getRoles().stream().anyMatch(roles::contains));
+ return (policyItem.getUsers() != null && policyItem.getUsers().stream().anyMatch(users::contains)) || (policyItem.getGroups() != null && policyItem.getGroups().stream().anyMatch(groups::contains)) || (policyItem.getRoles() != null && policyItem.getRoles().stream().anyMatch(roles::contains));
};
}
@@ -2209,18 +2205,19 @@ public class GdsREST {
}
Set<String> accessTypeSet = new HashSet<>(Arrays.asList(filteringAccessTypes));
- return policyItem -> policyItem.getAccesses().stream()
- .anyMatch(access -> accessTypeSet.contains(access.getType()));
+
+ return policyItem -> policyItem.getAccesses().stream().anyMatch(access -> accessTypeSet.contains(access.getType()));
}
private RangerPolicyItem copyOf(RangerPolicyItem policyItem) {
RangerPolicyItem copy = new RangerPolicyItem();
+
copy.setAccesses(new ArrayList<>(policyItem.getAccesses()));
copy.setUsers(new ArrayList<>(policyItem.getUsers()));
copy.setGroups(new ArrayList<>(policyItem.getGroups()));
copy.setRoles(new ArrayList<>(policyItem.getRoles()));
copy.setConditions(new ArrayList<>(policyItem.getConditions()));
- copy.setDelegateAdmin(new Boolean(policyItem.getDelegateAdmin()));
+ copy.setDelegateAdmin(policyItem.getDelegateAdmin());
return copy;
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/MetricsREST.java b/security-admin/src/main/java/org/apache/ranger/rest/MetricsREST.java
index b34a795b4..c4ab05dd5 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/MetricsREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/MetricsREST.java
@@ -19,16 +19,6 @@
package org.apache.ranger.rest;
-import java.lang.management.ManagementFactory;
-import java.lang.management.RuntimeMXBean;
-import java.util.LinkedHashMap;
-import java.util.Map;
-
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-
import org.apache.ranger.metrics.RangerAdminMetricsWrapper;
import org.apache.ranger.plugin.model.RangerMetrics;
import org.apache.ranger.util.RangerMetricsUtil;
@@ -40,17 +30,28 @@ import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+
+import java.lang.management.ManagementFactory;
+import java.lang.management.RuntimeMXBean;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
@Path("metrics")
@Component
@Scope("request")
@Transactional(propagation = Propagation.REQUIRES_NEW)
public class MetricsREST {
private static final Logger LOG = LoggerFactory.getLogger(MetricsREST.class);
- private static final RuntimeMXBean RUNTIME = ManagementFactory.getRuntimeMXBean();
- private static final String JVM_MACHINE_ACTUAL_NAME = RUNTIME.getVmName();
- private static final String VERSION = RUNTIME.getVmVersion();
- private static final String JVM_MACHINE_REPRESENTATION_NAME = RUNTIME.getName();
- private static final String JVM_VENDOR_NAME = RUNTIME.getVmVendor();
+
+ private static final RuntimeMXBean RUNTIME = ManagementFactory.getRuntimeMXBean();
+ private static final String JVM_MACHINE_ACTUAL_NAME = RUNTIME.getVmName();
+ private static final String VERSION = RUNTIME.getVmVersion();
+ private static final String JVM_MACHINE_REPRESENTATION_NAME = RUNTIME.getName();
+ private static final String JVM_VENDOR_NAME = RUNTIME.getVmVendor();
@Autowired
RangerMetricsUtil jvmMetricUtil;
@@ -60,25 +61,23 @@ public class MetricsREST {
@GET
@Path("/status")
- @Produces({ "application/json" })
+ @Produces("application/json")
public RangerMetrics getStatus() {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> MetricsREST.getStatus()");
- }
+ LOG.debug("==> MetricsREST.getStatus()");
- Map<String, Object> jvm = new LinkedHashMap<>();
+ Map<String, Object> jvm = new LinkedHashMap<>();
Map<String, Object> vmDetails = new LinkedHashMap<>();
+
vmDetails.put("JVM Machine Actual Name", JVM_MACHINE_ACTUAL_NAME);
vmDetails.put("version", VERSION);
vmDetails.put("JVM Machine Representation Name", JVM_MACHINE_REPRESENTATION_NAME);
vmDetails.put("Up time of JVM", RUNTIME.getUptime());
vmDetails.put("JVM Vendor Name", JVM_VENDOR_NAME);
vmDetails.putAll(jvmMetricUtil.getValues());
- jvm.put("jvm",vmDetails);
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== MetricsREST.getStatus(): jvm=" + jvm);
- }
+ jvm.put("jvm", vmDetails);
+
+ LOG.debug("<== MetricsREST.getStatus(): jvm={}", jvm);
return new RangerMetrics(jvm);
}
@@ -87,19 +86,18 @@ public class MetricsREST {
@Path("/prometheus")
@Produces(MediaType.TEXT_PLAIN)
public String getMetricsPrometheus() {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> MetricsREST.getMetricsPrometheus()");
- }
+ LOG.debug("==> MetricsREST.getMetricsPrometheus()");
+
String ret = "";
+
try {
ret = rangerAdminMetricsWrapper.getRangerMetricsInPrometheusFormat();
} catch (Exception e) {
LOG.error("MetricsREST.getMetricsPrometheus(): Exception occurred while getting metric.", e);
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== MetricsREST.getMetricsPrometheus(): ret=" + ret);
- }
+ LOG.debug("<== MetricsREST.getMetricsPrometheus(): ret={}", ret);
+
return ret;
}
@@ -107,20 +105,18 @@ public class MetricsREST {
@Path("/json")
@Produces(MediaType.APPLICATION_JSON)
public Map<String, Map<String, Object>> getMetricsJson() {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> MetricsREST.getMetricsJson()");
- }
+ LOG.debug("==> MetricsREST.getMetricsJson()");
Map<String, Map<String, Object>> ret = null;
+
try {
ret = rangerAdminMetricsWrapper.getRangerMetrics();
} catch (Exception e) {
LOG.error("MetricsREST.getMetricsJson(): Exception occurred while getting metric.", e);
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== MetricsREST.getMetricsJson(): ret=" + ret);
- }
+ LOG.debug("<== MetricsREST.getMetricsJson(): ret={}", ret);
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/PublicAPIs.java b/security-admin/src/main/java/org/apache/ranger/rest/PublicAPIs.java
index b7735e715..5d11e97a4 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/PublicAPIs.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/PublicAPIs.java
@@ -19,7 +19,11 @@
package org.apache.ranger.rest;
-import org.apache.ranger.common.*;
+import org.apache.ranger.common.MessageEnums;
+import org.apache.ranger.common.RESTErrorUtil;
+import org.apache.ranger.common.RangerSearchUtil;
+import org.apache.ranger.common.ServiceUtil;
+import org.apache.ranger.common.StringUtil;
import org.apache.ranger.common.annotation.RangerAnnotationClassName;
import org.apache.ranger.common.annotation.RangerAnnotationJSMgrName;
import org.apache.ranger.db.RangerDaoManager;
@@ -30,7 +34,13 @@ import org.apache.ranger.plugin.model.RangerService;
import org.apache.ranger.plugin.util.SearchFilter;
import org.apache.ranger.service.RangerPolicyService;
import org.apache.ranger.service.XAssetService;
-import org.apache.ranger.view.*;
+import org.apache.ranger.view.VXAsset;
+import org.apache.ranger.view.VXLong;
+import org.apache.ranger.view.VXPolicy;
+import org.apache.ranger.view.VXPolicyList;
+import org.apache.ranger.view.VXRepository;
+import org.apache.ranger.view.VXRepositoryList;
+import org.apache.ranger.view.VXResource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
@@ -42,7 +52,14 @@ import org.springframework.transaction.annotation.Transactional;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.*;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
import javax.ws.rs.core.Context;
import java.util.List;
@@ -53,352 +70,276 @@ import java.util.List;
@RangerAnnotationJSMgrName("PublicMgr")
@Transactional(propagation = Propagation.REQUIRES_NEW)
public class PublicAPIs {
- private static final Logger logger = LoggerFactory.getLogger(PublicAPIs.class);
-
- @Autowired
- RangerSearchUtil searchUtil;
-
- @Autowired
- XAssetService xAssetService;
-
- @Autowired
- RangerPolicyService policyService;
-
- @Autowired
- StringUtil stringUtil;
-
- @Autowired
- ServiceUtil serviceUtil;
-
- @Autowired
- ServiceREST serviceREST;
-
- @Autowired
- RangerDaoManager daoMgr;
-
- @Autowired
- RESTErrorUtil restErrorUtil;
-
- @Autowired
- AssetREST assetREST;
-
- @GET
- @Path("/api/repository/{id}")
- @Produces({ "application/json" })
- public VXRepository getRepository(@PathParam("id") Long id) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.getRepository(" + id + ")");
- }
-
- RangerService service = serviceREST.getService(id);
-
- VXRepository ret = serviceUtil.toVXRepository(service);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<= PublicAPIs.getRepository(" + id + ")");
- }
- return ret;
- }
-
-
- @POST
- @Path("/api/repository/")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXRepository createRepository(VXRepository vXRepository) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.createRepository(" + vXRepository + ")");
- }
-
- VXAsset vXAsset = serviceUtil.publicObjecttoVXAsset(vXRepository);
-
- RangerService service = serviceUtil.toRangerService(vXAsset);
-
- RangerService createdService = serviceREST.createService(service);
-
- VXAsset retvXAsset = serviceUtil.toVXAsset(createdService);
-
- VXRepository ret = serviceUtil.vXAssetToPublicObject(retvXAsset);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.createRepository(" + ret + ")");
- }
-
- return ret;
- }
-
-
- @PUT
- @Path("/api/repository/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXRepository updateRepository(VXRepository vXRepository,
- @PathParam("id") Long id) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.updateRepository(" + id + ")");
- }
-
- XXService existing = daoMgr.getXXService().getById(id);
- if(existing == null) {
- throw restErrorUtil.createRESTException("Repository not found for Id: " + id, MessageEnums.DATA_NOT_FOUND);
- }
-
- vXRepository.setId(id);
-
- VXAsset vXAsset = serviceUtil.publicObjecttoVXAsset(vXRepository);
-
- RangerService service = serviceUtil.toRangerService(vXAsset);
- service.setVersion(existing.getVersion());
-
- RangerService updatedService = serviceREST.updateService(service, null);
-
- VXAsset retvXAsset = serviceUtil.toVXAsset(updatedService);
-
- VXRepository ret = serviceUtil.vXAssetToPublicObject(retvXAsset);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.updateRepository(" + ret + ")");
- }
-
- return ret;
- }
-
-
- @DELETE
- @Path("/api/repository/{id}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- @RangerAnnotationClassName(class_name = VXAsset.class)
- public void deleteRepository(@PathParam("id") Long id,
- @Context HttpServletRequest request) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.deleteRepository(" + id + ")");
- }
-
- serviceREST.deleteService(id);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.deleteRepository(" + id + ")");
- }
- }
-
- @GET
- @Path("/api/repository/")
- @Produces({ "application/json" })
- public VXRepositoryList searchRepositories(
- @Context HttpServletRequest request) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.searchRepositories()");
- }
-
- SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequestForRepositorySearch(request, xAssetService.sortFields);
-
- List<RangerService> serviceList = serviceREST.getServices(filter);
-
- VXRepositoryList ret = null;
-
- if (serviceList != null) {
- ret = serviceUtil.rangerServiceListToPublicObjectList(serviceList);
- }
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.searchRepositories(): count=" + (ret == null ? 0 : ret.getListSize()));
- }
-
- return ret;
- }
-
-
- @GET
- @Path("/api/repository/count")
- @Produces({ "application/json" })
- public VXLong countRepositories(@Context HttpServletRequest request) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.countRepositories()");
- }
-
- VXLong ret = assetREST.countXAssets(request);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.countRepositories(): count=" + ret);
- }
-
- return ret;
- }
-
-
-
- @GET
- @Path("/api/policy/{id}")
- @Produces({ "application/json" })
- public VXPolicy getPolicy(@PathParam("id") Long id) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.getPolicy() " + id);
- }
-
- RangerPolicy policy = null;
- RangerService service = null;
-
- policy = serviceREST.getPolicy(id);
-
- if(policy != null) {
- service = serviceREST.getServiceByName(policy.getService());
- }
-
- VXPolicy ret = serviceUtil.toVXPolicy(policy, service);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.getPolicy()" + ret);
- }
-
- return ret;
- }
-
-
- @POST
- @Path("/api/policy")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXPolicy createPolicy(VXPolicy vXPolicy) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.createPolicy()");
- }
-
- if(vXPolicy == null) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Policy object is null in create policy api", false);
- }
- RangerService service = serviceREST.getServiceByName(vXPolicy.getRepositoryName());
- RangerPolicy policy = serviceUtil.toRangerPolicy(vXPolicy,service);
-
- VXPolicy ret = null;
- if(policy != null) {
- if(logger.isDebugEnabled()) {
- logger.debug("RANGERPOLICY: " + policy.toString());
- }
-
- RangerPolicy createdPolicy = serviceREST.createPolicy(policy,null);
-
- ret = serviceUtil.toVXPolicy(createdPolicy, service);
- }
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.createPolicy(" + policy + "): " + ret);
- }
-
- return ret;
- }
-
- @PUT
- @Path("/api/policy/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public VXPolicy updatePolicy(VXPolicy vXPolicy, @PathParam("id") Long id) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.updatePolicy(): " + vXPolicy );
- }
-
- if(vXPolicy == null) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Policy object is null in update policy api", false);
- }
-
- XXPolicy existing = daoMgr.getXXPolicy().getById(id);
- if(existing == null) {
- throw restErrorUtil.createRESTException("Policy not found for Id: " + id, MessageEnums.DATA_NOT_FOUND);
- }
-
- vXPolicy.setId(id);
-
- RangerService service = serviceREST.getServiceByName(vXPolicy.getRepositoryName());
- RangerPolicy policy = serviceUtil.toRangerPolicy(vXPolicy,service);
-
- VXPolicy ret = null;
- if(policy != null) {
- policy.setVersion(existing.getVersion());
-
- RangerPolicy updatedPolicy = serviceREST.updatePolicy(policy, policy.getId());
-
- ret = serviceUtil.toVXPolicy(updatedPolicy, service);
- }
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.updatePolicy(" + policy + "): " + ret);
- }
-
- return ret;
- }
-
- @DELETE
- @Path("/api/policy/{id}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- @RangerAnnotationClassName(class_name = VXResource.class)
- public void deletePolicy(@PathParam("id") Long id,
- @Context HttpServletRequest request) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.deletePolicy(): " + id );
- }
-
- serviceREST.deletePolicy(id);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.deletePolicy(): " + id );
- }
- }
-
- @GET
- @Path("/api/policy")
- @Produces({ "application/json" })
- public VXPolicyList searchPolicies(@Context HttpServletRequest request) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.searchPolicies(): ");
- }
-
- SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequest(request, policyService.sortFields);
- // get all policies from the store; pick the page to return after applying filter
- int savedStartIndex = filter.getStartIndex();
- int savedMaxRows = filter.getMaxRows();
-
- filter.setStartIndex(0);
- filter.setMaxRows(Integer.MAX_VALUE);
-
- List<RangerPolicy> rangerPolicyList = serviceREST.getPolicies(filter);
-
- filter.setStartIndex(savedStartIndex);
- filter.setMaxRows(savedMaxRows);
-
- VXPolicyList vXPolicyList = null;
- if (rangerPolicyList != null) {
- vXPolicyList = serviceUtil.rangerPolicyListToPublic(rangerPolicyList,filter);
- }
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.searchPolicies(): " + vXPolicyList );
- }
- return vXPolicyList;
- }
-
- @GET
- @Path("/api/policy/count")
- @Produces({ "application/json" })
- public VXLong countPolicies(@Context HttpServletRequest request) {
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIs.countPolicies(): ");
- }
-
- VXLong ret = assetREST.countXResources(request);
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIs.countPolicies(): " + ret);
- }
-
- return ret;
- }
+ private static final Logger logger = LoggerFactory.getLogger(PublicAPIs.class);
+ @Autowired
+ RangerSearchUtil searchUtil;
+
+ @Autowired
+ XAssetService xAssetService;
+
+ @Autowired
+ RangerPolicyService policyService;
+
+ @Autowired
+ StringUtil stringUtil;
+
+ @Autowired
+ ServiceUtil serviceUtil;
+
+ @Autowired
+ ServiceREST serviceREST;
+
+ @Autowired
+ RangerDaoManager daoMgr;
+
+ @Autowired
+ RESTErrorUtil restErrorUtil;
+
+ @Autowired
+ AssetREST assetREST;
+
+ @GET
+ @Path("/api/repository/{id}")
+ @Produces("application/json")
+ public VXRepository getRepository(@PathParam("id") Long id) {
+ logger.debug("==> PublicAPIs.getRepository({})", id);
+
+ RangerService service = serviceREST.getService(id);
+ VXRepository ret = serviceUtil.toVXRepository(service);
+
+ logger.debug("<= PublicAPIs.getRepository({})", id);
+
+ return ret;
+ }
+
+ @POST
+ @Path("/api/repository/")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXRepository createRepository(VXRepository vXRepository) {
+ logger.debug("==> PublicAPIs.createRepository({})", vXRepository);
+
+ VXAsset vXAsset = serviceUtil.publicObjecttoVXAsset(vXRepository);
+ RangerService service = serviceUtil.toRangerService(vXAsset);
+ RangerService createdService = serviceREST.createService(service);
+ VXAsset retvXAsset = serviceUtil.toVXAsset(createdService);
+ VXRepository ret = serviceUtil.vXAssetToPublicObject(retvXAsset);
+
+ logger.debug("<== PublicAPIs.createRepository({})", ret);
+
+ return ret;
+ }
+
+ @PUT
+ @Path("/api/repository/{id}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXRepository updateRepository(VXRepository vXRepository, @PathParam("id") Long id) {
+ logger.debug("==> PublicAPIs.updateRepository({})", id);
+
+ XXService existing = daoMgr.getXXService().getById(id);
+
+ if (existing == null) {
+ throw restErrorUtil.createRESTException("Repository not found for Id: " + id, MessageEnums.DATA_NOT_FOUND);
+ }
+
+ vXRepository.setId(id);
+
+ VXAsset vXAsset = serviceUtil.publicObjecttoVXAsset(vXRepository);
+ RangerService service = serviceUtil.toRangerService(vXAsset);
+
+ service.setVersion(existing.getVersion());
+
+ RangerService updatedService = serviceREST.updateService(service, null);
+ VXAsset retvXAsset = serviceUtil.toVXAsset(updatedService);
+ VXRepository ret = serviceUtil.vXAssetToPublicObject(retvXAsset);
+
+ logger.debug("<== PublicAPIs.updateRepository({})", ret);
+
+ return ret;
+ }
+
+ @DELETE
+ @Path("/api/repository/{id}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ @RangerAnnotationClassName(class_name = VXAsset.class)
+ public void deleteRepository(@PathParam("id") Long id, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIs.deleteRepository({})", id);
+
+ serviceREST.deleteService(id);
+
+ logger.debug("<== PublicAPIs.deleteRepository({})", id);
+ }
+
+ @GET
+ @Path("/api/repository/")
+ @Produces("application/json")
+ public VXRepositoryList searchRepositories(@Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIs.searchRepositories()");
+
+ SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequestForRepositorySearch(request, xAssetService.sortFields);
+ List<RangerService> serviceList = serviceREST.getServices(filter);
+ VXRepositoryList ret = null;
+
+ if (serviceList != null) {
+ ret = serviceUtil.rangerServiceListToPublicObjectList(serviceList);
+ }
+
+ logger.debug("<== PublicAPIs.searchRepositories(): count={}", (ret == null ? 0 : ret.getListSize()));
+
+ return ret;
+ }
+
+ @GET
+ @Path("/api/repository/count")
+ @Produces("application/json")
+ public VXLong countRepositories(@Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIs.countRepositories()");
+
+ VXLong ret = assetREST.countXAssets(request);
+
+ logger.debug("<== PublicAPIs.countRepositories(): count={}", ret);
+
+ return ret;
+ }
+
+ @GET
+ @Path("/api/policy/{id}")
+ @Produces("application/json")
+ public VXPolicy getPolicy(@PathParam("id") Long id) {
+ logger.debug("==> PublicAPIs.getPolicy() {}", id);
+
+ RangerService service = null;
+ RangerPolicy policy = serviceREST.getPolicy(id);
+
+ if (policy != null) {
+ service = serviceREST.getServiceByName(policy.getService());
+ }
+
+ VXPolicy ret = serviceUtil.toVXPolicy(policy, service);
+
+ logger.debug("<== PublicAPIs.getPolicy(){}", ret);
+
+ return ret;
+ }
+
+ @POST
+ @Path("/api/policy")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXPolicy createPolicy(VXPolicy vXPolicy) {
+ logger.debug("==> PublicAPIs.createPolicy()");
+
+ if (vXPolicy == null) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Policy object is null in create policy api", false);
+ }
+
+ RangerService service = serviceREST.getServiceByName(vXPolicy.getRepositoryName());
+ RangerPolicy policy = serviceUtil.toRangerPolicy(vXPolicy, service);
+
+ VXPolicy ret = null;
+ if (policy != null) {
+ logger.debug("RangerPolicy: {}", policy);
+
+ RangerPolicy createdPolicy = serviceREST.createPolicy(policy, null);
+
+ ret = serviceUtil.toVXPolicy(createdPolicy, service);
+ }
+
+ logger.debug("<== PublicAPIs.createPolicy({}): {}", policy, ret);
+
+ return ret;
+ }
+
+ @PUT
+ @Path("/api/policy/{id}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public VXPolicy updatePolicy(VXPolicy vXPolicy, @PathParam("id") Long id) {
+ logger.debug("==> PublicAPIs.updatePolicy(): {}", vXPolicy);
+
+ if (vXPolicy == null) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Policy object is null in update policy api", false);
+ }
+
+ XXPolicy existing = daoMgr.getXXPolicy().getById(id);
+
+ if (existing == null) {
+ throw restErrorUtil.createRESTException("Policy not found for Id: " + id, MessageEnums.DATA_NOT_FOUND);
+ }
+
+ vXPolicy.setId(id);
+
+ RangerService service = serviceREST.getServiceByName(vXPolicy.getRepositoryName());
+ RangerPolicy policy = serviceUtil.toRangerPolicy(vXPolicy, service);
+
+ VXPolicy ret = null;
+ if (policy != null) {
+ policy.setVersion(existing.getVersion());
+
+ RangerPolicy updatedPolicy = serviceREST.updatePolicy(policy, policy.getId());
+
+ ret = serviceUtil.toVXPolicy(updatedPolicy, service);
+ }
+
+ logger.debug("<== PublicAPIs.updatePolicy({}):{}", policy, ret);
+
+ return ret;
+ }
+
+ @DELETE
+ @Path("/api/policy/{id}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ @RangerAnnotationClassName(class_name = VXResource.class)
+ public void deletePolicy(@PathParam("id") Long id, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIs.deletePolicy(): {}", id);
+
+ serviceREST.deletePolicy(id);
+
+ logger.debug("<== PublicAPIs.deletePolicy(): {}", id);
+ }
+
+ @GET
+ @Path("/api/policy")
+ @Produces("application/json")
+ public VXPolicyList searchPolicies(@Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIs.searchPolicies(): ");
+
+ SearchFilter filter = searchUtil.getSearchFilterFromLegacyRequest(request, policyService.sortFields);
+
+ // get all policies from the store; pick the page to return after applying filter
+ int savedStartIndex = filter.getStartIndex();
+ int savedMaxRows = filter.getMaxRows();
+
+ filter.setStartIndex(0);
+ filter.setMaxRows(Integer.MAX_VALUE);
+
+ List<RangerPolicy> rangerPolicyList = serviceREST.getPolicies(filter);
+
+ filter.setStartIndex(savedStartIndex);
+ filter.setMaxRows(savedMaxRows);
+
+ VXPolicyList vXPolicyList = null;
+
+ if (rangerPolicyList != null) {
+ vXPolicyList = serviceUtil.rangerPolicyListToPublic(rangerPolicyList, filter);
+ }
+
+ logger.debug("<== PublicAPIs.searchPolicies(): {}", vXPolicyList);
+ return vXPolicyList;
+ }
+
+ @GET
+ @Path("/api/policy/count")
+ @Produces("application/json")
+ public VXLong countPolicies(@Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIs.countPolicies(): ");
+
+ VXLong ret = assetREST.countXResources(request);
+
+ logger.debug("<== PublicAPIs.countPolicies(): {}", ret);
+
+ return ret;
+ }
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/PublicAPIsv2.java b/security-admin/src/main/java/org/apache/ranger/rest/PublicAPIsv2.java
index d9a214099..7b1eb7fe7 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/PublicAPIsv2.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/PublicAPIsv2.java
@@ -29,14 +29,14 @@ import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerRole;
import org.apache.ranger.plugin.model.RangerSecurityZone;
import org.apache.ranger.plugin.model.RangerSecurityZoneHeaderInfo;
+import org.apache.ranger.plugin.model.RangerSecurityZoneV2;
+import org.apache.ranger.plugin.model.RangerSecurityZoneV2.RangerSecurityZoneChangeRequest;
+import org.apache.ranger.plugin.model.RangerSecurityZoneV2.RangerSecurityZoneResource;
import org.apache.ranger.plugin.model.RangerService;
import org.apache.ranger.plugin.model.RangerServiceDef;
import org.apache.ranger.plugin.model.RangerServiceHeaderInfo;
import org.apache.ranger.plugin.model.RangerServiceResource;
import org.apache.ranger.plugin.model.RangerServiceTags;
-import org.apache.ranger.plugin.model.RangerSecurityZoneV2;
-import org.apache.ranger.plugin.model.RangerSecurityZoneV2.RangerSecurityZoneChangeRequest;
-import org.apache.ranger.plugin.model.RangerSecurityZoneV2.RangerSecurityZoneResource;
import org.apache.ranger.plugin.store.PList;
import org.apache.ranger.plugin.util.GrantRevokeRoleRequest;
import org.apache.ranger.plugin.util.RangerPurgeResult;
@@ -66,7 +66,6 @@ import javax.ws.rs.QueryParam;
import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.Context;
-import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
@@ -76,933 +75,868 @@ import java.util.List;
@RangerAnnotationJSMgrName("PublicMgr")
@Transactional(propagation = Propagation.REQUIRES_NEW)
public class PublicAPIsv2 {
- private static final Logger logger = LoggerFactory.getLogger(PublicAPIsv2.class);
+ private static final Logger logger = LoggerFactory.getLogger(PublicAPIsv2.class);
- @Autowired
- ServiceREST serviceREST;
+ @Autowired
+ ServiceREST serviceREST;
- @Autowired
- TagREST tagREST;
+ @Autowired
+ TagREST tagREST;
- @Autowired
- SecurityZoneREST securityZoneRest;
+ @Autowired
+ SecurityZoneREST securityZoneRest;
- @Autowired
- RoleREST roleREST;
+ @Autowired
+ RoleREST roleREST;
- @Autowired
- RESTErrorUtil restErrorUtil;
+ @Autowired
+ RESTErrorUtil restErrorUtil;
@Autowired
SecurityZoneDBStore securityZoneStore;
- /*
- * SecurityZone Creation API
- */
- @POST
- @Path("/api/zones")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerSecurityZone createSecurityZone(RangerSecurityZone securityZone) {
- return securityZoneRest.createSecurityZone(securityZone);
- }
-
- /*
- * SecurityZone Manipulation API
- */
- @PUT
- @Path("/api/zones/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerSecurityZone updateSecurityZone(@PathParam("id") Long zoneId, RangerSecurityZone securityZone) {
- return securityZoneRest.updateSecurityZone(zoneId, securityZone);
- }
-
- @DELETE
- @Path("/api/zones/name/{name}")
- public void deleteSecurityZone(@PathParam("name") String zoneName) {
- securityZoneRest.deleteSecurityZone(zoneName);
- }
-
- @DELETE
- @Path("/api/zones/{id}")
- public void deleteSecurityZone(@PathParam("id") Long zoneId) {
- securityZoneRest.deleteSecurityZone(zoneId);
- }
-
- /*
- * API's to Access SecurityZones
- */
- @GET
- @Path("/api/zones/name/{name}")
- @Produces({ "application/json" })
- public RangerSecurityZone getSecurityZone(@PathParam("name") String zoneName) {
- return securityZoneRest.getSecurityZone(zoneName);
- }
-
- @GET
- @Path("/api/zones/{id}")
- @Produces({ "application/json"})
- public RangerSecurityZone getSecurityZone(@PathParam("id") Long id) {
- return securityZoneRest.getSecurityZone(id);
- }
-
- @GET
+ /*
+ * SecurityZone Creation API
+ */
+ @POST
+ @Path("/api/zones")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerSecurityZone createSecurityZone(RangerSecurityZone securityZone) {
+ return securityZoneRest.createSecurityZone(securityZone);
+ }
+
+ /*
+ * SecurityZone Manipulation API
+ */
+ @PUT
+ @Path("/api/zones/{id}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerSecurityZone updateSecurityZone(@PathParam("id") Long zoneId, RangerSecurityZone securityZone) {
+ return securityZoneRest.updateSecurityZone(zoneId, securityZone);
+ }
+
+ @DELETE
+ @Path("/api/zones/name/{name}")
+ public void deleteSecurityZone(@PathParam("name") String zoneName) {
+ securityZoneRest.deleteSecurityZone(zoneName);
+ }
+
+ @DELETE
+ @Path("/api/zones/{id}")
+ public void deleteSecurityZone(@PathParam("id") Long zoneId) {
+ securityZoneRest.deleteSecurityZone(zoneId);
+ }
+
+ /*
+ * API's to Access SecurityZones
+ */
+ @GET
+ @Path("/api/zones/name/{name}")
+ @Produces("application/json")
+ public RangerSecurityZone getSecurityZone(@PathParam("name") String zoneName) {
+ return securityZoneRest.getSecurityZone(zoneName);
+ }
+
+ @GET
+ @Path("/api/zones/{id}")
+ @Produces("application/json")
+ public RangerSecurityZone getSecurityZone(@PathParam("id") Long id) {
+ return securityZoneRest.getSecurityZone(id);
+ }
+
+ @GET
@Path("/api/zones")
- @Produces({ "application/json"})
- public List<RangerSecurityZone> getAllZones(@Context HttpServletRequest request){
- return securityZoneRest.getAllZones(request).getSecurityZones();
- }
+ @Produces("application/json")
+ public List<RangerSecurityZone> getAllZones(@Context HttpServletRequest request) {
+ return securityZoneRest.getAllZones(request).getSecurityZones();
+ }
/**
* Get {@link List} of security zone header info.
* This API is authorized to every authenticated user.
+ *
* @return {@link List} of {@link RangerSecurityZoneHeaderInfo} if present.
*/
@GET
@Path("/api/zone-headers")
- @Produces({ "application/json" })
+ @Produces("application/json")
public List<RangerSecurityZoneHeaderInfo> getSecurityZoneHeaderInfoList(@Context HttpServletRequest request) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.getSecurityZoneHeaderInfoList()");
- }
+ logger.debug("==> PublicAPIsv2.getSecurityZoneHeaderInfoList()");
List<RangerSecurityZoneHeaderInfo> ret;
+
try {
ret = securityZoneStore.getSecurityZoneHeaderInfoList(request);
} catch (WebApplicationException excp) {
throw excp;
} catch (Throwable excp) {
logger.error("PublicAPIsv2.getSecurityZoneHeaderInfoList() failed", excp);
+
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.getSecurityZoneHeaderInfoList():" + ret);
- }
+ logger.debug("<== PublicAPIsv2.getSecurityZoneHeaderInfoList():{}", ret);
+
return ret;
}
- /**
- * Get {@link List} of security zone header info.
- * This API is authorized to every authenticated user.
- * @param serviceId
- * @param isTagService
- * @return {@link List} of {@link RangerSecurityZoneHeaderInfo} if present.
- */
- @GET
- @Path("/api/zones/zone-headers/for-service/{serviceId}")
- @Produces({ "application/json" })
- public List<RangerSecurityZoneHeaderInfo> getSecurityZoneHeaderInfoListByServiceId(@PathParam("serviceId") Long serviceId,
- @DefaultValue("false") @QueryParam("isTagService") Boolean isTagService,
- @Context HttpServletRequest request) {
- return securityZoneRest.getSecurityZoneHeaderInfoListByServiceId(serviceId,isTagService, request);
- }
+ /**
+ * Get {@link List} of security zone header info.
+ * This API is authorized to every authenticated user.
+ *
+ * @param serviceId
+ * @param isTagService
+ * @return {@link List} of {@link RangerSecurityZoneHeaderInfo} if present.
+ */
+ @GET
+ @Path("/api/zones/zone-headers/for-service/{serviceId}")
+ @Produces("application/json")
+ public List<RangerSecurityZoneHeaderInfo> getSecurityZoneHeaderInfoListByServiceId(@PathParam("serviceId") Long serviceId, @DefaultValue("false") @QueryParam("isTagService") Boolean isTagService, @Context HttpServletRequest request) {
+ return securityZoneRest.getSecurityZoneHeaderInfoListByServiceId(serviceId, isTagService, request);
+ }
/**
* Get service header info {@link List} for given zone.
* This API is authorized to every authenticated user.
+ *
* @param zoneId
* @return {@link List} of {@link RangerServiceHeaderInfo} for given zone if present.
*/
@GET
@Path("/api/zones/{zoneId}/service-headers")
- @Produces({ "application/json" })
+ @Produces("application/json")
public List<RangerServiceHeaderInfo> getServiceHeaderInfoListByZoneId(@PathParam("zoneId") Long zoneId, @Context HttpServletRequest request) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.getServiceHeaderInfoListByZoneId({})" + zoneId);
- }
+ logger.debug("==> PublicAPIsv2.getServiceHeaderInfoListByZoneId({})", zoneId);
List<RangerServiceHeaderInfo> ret;
+
try {
ret = securityZoneStore.getServiceHeaderInfoListByZoneId(zoneId, request);
} catch (WebApplicationException excp) {
throw excp;
} catch (Throwable excp) {
logger.error("PublicAPIsv2.getServiceHeaderInfoListByZoneId() failed", excp);
+
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.getServiceHeaderInfoListByZoneId():" + ret);
+ logger.debug("<== PublicAPIsv2.getServiceHeaderInfoListByZoneId():{}", ret);
+ return ret;
+ }
+
+ @GET
+ @Path("/api/zone-names/{serviceName}/resource")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ public Collection<String> getSecurityZoneNamesForResource(@PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
+ return securityZoneRest.getZoneNamesForResource(serviceName, request);
+ }
+
+ @POST
+ @Path("/api/zones-v2")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerSecurityZoneV2 createSecurityZone(RangerSecurityZoneV2 securityZone) {
+ return securityZoneRest.createSecurityZone(securityZone);
+ }
+
+ @PUT
+ @Path("/api/zones-v2/{id}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerSecurityZoneV2 updateSecurityZone(@PathParam("id") Long zoneId, RangerSecurityZoneV2 securityZone) {
+ return securityZoneRest.updateSecurityZone(zoneId, securityZone);
+ }
+
+ @PUT
+ @Path("/api/zones-v2/{id}/partial")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public Boolean updateSecurityZone(@PathParam("id") Long zoneId, RangerSecurityZoneChangeRequest changeRequest) {
+ return securityZoneRest.updateSecurityZone(zoneId, changeRequest);
+ }
+
+ @GET
+ @Path("/api/zones-v2/name/{name}")
+ @Produces("application/json")
+ public RangerSecurityZoneV2 getSecurityZoneV2(@PathParam("name") String zoneName) {
+ return securityZoneRest.getSecurityZoneV2(zoneName);
+ }
+
+ @GET
+ @Path("/api/zones-v2/{id}")
+ @Produces("application/json")
+ public RangerSecurityZoneV2 getSecurityZoneV2(@PathParam("id") Long zoneId) {
+ return securityZoneRest.getSecurityZoneV2(zoneId);
+ }
+
+ @GET
+ @Path("/api/zones-v2/{id}/resources/{serviceName}")
+ @Produces("application/json")
+ public PList<RangerSecurityZoneResource> getResources(@PathParam("id") Long zoneId, @PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
+ return securityZoneRest.getResources(zoneId, serviceName, request);
+ }
+
+ @GET
+ @Path("/api/zones-v2/name/{name}/resources/{serviceName}")
+ @Produces("application/json")
+ public PList<RangerSecurityZoneResource> getResources(@PathParam("name") String zoneName, @PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
+ return securityZoneRest.getResources(zoneName, serviceName, request);
+ }
+
+ @GET
+ @Path("/api/zones-v2")
+ @Produces("application/json")
+ public PList<RangerSecurityZoneV2> getAllZonesV2(@Context HttpServletRequest request) {
+ return securityZoneRest.getAllZonesV2(request);
+ }
+
+ /*
+ * ServiceDef Manipulation APIs
+ */
+
+ @GET
+ @Path("/api/servicedef/{id}")
+ @Produces("application/json")
+ public RangerServiceDef getServiceDef(@PathParam("id") Long id) {
+ return serviceREST.getServiceDef(id);
+ }
+
+ @GET
+ @Path("/api/servicedef/name/{name}")
+ @Produces("application/json")
+ public RangerServiceDef getServiceDefByName(@PathParam("name") String name) {
+ return serviceREST.getServiceDefByName(name);
+ }
+
+ @GET
+ @Path("/api/servicedef/")
+ @Produces("application/json")
+ public List<RangerServiceDef> searchServiceDefs(@Context HttpServletRequest request) {
+ return serviceREST.getServiceDefs(request).getServiceDefs();
+ }
+
+ @POST
+ @Path("/api/servicedef/")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerServiceDef createServiceDef(RangerServiceDef serviceDef) {
+ return serviceREST.createServiceDef(serviceDef);
+ }
+
+ @PUT
+ @Path("/api/servicedef/{id}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerServiceDef updateServiceDef(RangerServiceDef serviceDef, @PathParam("id") Long id) {
+ // if serviceDef.id is specified, it should be same as param 'id'
+ if (serviceDef.getId() == null) {
+ serviceDef.setId(id);
+ } else if (!serviceDef.getId().equals(id)) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "serviceDef id mismatch", true);
+ }
+
+ return serviceREST.updateServiceDef(serviceDef, serviceDef.getId());
+ }
+
+ @PUT
+ @Path("/api/servicedef/name/{name}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerServiceDef updateServiceDefByName(RangerServiceDef serviceDef, @PathParam("name") String name) {
+ // serviceDef.name is immutable
+ // if serviceDef.name is specified, it should be same as the param 'name'
+ if (serviceDef.getName() == null) {
+ serviceDef.setName(name);
+ } else if (!serviceDef.getName().equals(name)) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "serviceDef name mismatch", true);
+ }
+
+ // ignore serviceDef.id - if specified. Retrieve using the given name and use id from the retrieved object
+ RangerServiceDef existingServiceDef = getServiceDefByName(name);
+
+ serviceDef.setId(existingServiceDef.getId());
+
+ if (StringUtils.isEmpty(serviceDef.getGuid())) {
+ serviceDef.setGuid(existingServiceDef.getGuid());
+ }
+
+ return serviceREST.updateServiceDef(serviceDef, serviceDef.getId());
+ }
+
+ /*
+ * Should add this back when guid is used for search and delete operations as well
+ @PUT
+ @Path("/api/servicedef/guid/{guid}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ @Produces({ "application/json" })
+ public RangerServiceDef updateServiceDefByGuid(RangerServiceDef serviceDef, @PathParam("guid") String guid) {
+ // ignore serviceDef.id - if specified. Retrieve using the given guid and use id from the retrieved object
+ RangerServiceDef existingServiceDef = getServiceDefByGuid(guid);
+ serviceDef.setId(existingServiceDef.getId());
+ if(StringUtils.isEmpty(serviceDef.getGuid())) {
+ serviceDef.setGuid(existingServiceDef.getGuid());
+ }
+
+ return serviceREST.updateServiceDef(serviceDef);
+ }
+ */
+
+ @DELETE
+ @Path("/api/servicedef/{id}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ public void deleteServiceDef(@PathParam("id") Long id, @Context HttpServletRequest request) {
+ serviceREST.deleteServiceDef(id, request);
+ }
+
+ @DELETE
+ @Path("/api/servicedef/name/{name}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ public void deleteServiceDefByName(@PathParam("name") String name, @Context HttpServletRequest request) {
+ RangerServiceDef serviceDef = serviceREST.getServiceDefByName(name);
+
+ serviceREST.deleteServiceDef(serviceDef.getId(), request);
+ }
+
+ /*
+ * Service Manipulation APIs
+ */
+
+ @GET
+ @Path("/api/service/{id}")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ public RangerService getService(@PathParam("id") Long id) {
+ return serviceREST.getService(id);
+ }
+
+ @GET
+ @Path("/api/service/name/{name}")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ public RangerService getServiceByName(@PathParam("name") String name) {
+ return serviceREST.getServiceByName(name);
+ }
+
+ @GET
+ @Path("/api/service/")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ public List<RangerService> searchServices(@Context HttpServletRequest request) {
+ return serviceREST.getServices(request).getServices();
+ }
+
+ @GET
+ @Path("/api/service-headers")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_SERVICE_HEADERS + "\")")
+ public List<RangerServiceHeaderInfo> getServiceHeaders(@Context HttpServletRequest request) {
+ return serviceREST.getServiceHeaders(request);
+ }
+
+ @POST
+ @Path("/api/service/")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerService createService(RangerService service) {
+ return serviceREST.createService(service);
+ }
+
+ @PUT
+ @Path("/api/service/{id}")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerService updateService(RangerService service, @PathParam("id") Long id, @Context HttpServletRequest request) {
+ // if service.id is specified, it should be same as the param 'id'
+ if (service.getId() == null) {
+ service.setId(id);
+ } else if (!service.getId().equals(id)) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "service id mismatch", true);
+ }
+
+ return serviceREST.updateService(service, request);
+ }
+
+ @PUT
+ @Path("/api/service/name/{name}")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerService updateServiceByName(RangerService service, @PathParam("name") String name, @Context HttpServletRequest request) {
+ // ignore service.id - if specified. Retrieve using the given name and use id from the retrieved object
+ RangerService existingService = getServiceByName(name);
+
+ service.setId(existingService.getId());
+
+ if (StringUtils.isEmpty(service.getGuid())) {
+ service.setGuid(existingService.getGuid());
+ }
+
+ if (StringUtils.isEmpty(service.getName())) {
+ service.setName(existingService.getName());
+ }
+
+ return serviceREST.updateService(service, request);
+ }
+
+ /*
+ * Should add this back when guid is used for search and delete operations as well
+ @PUT
+ @Path("/api/service/guid/{guid}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ @Produces({ "application/json" })
+ public RangerService updateServiceByGuid(RangerService service, @PathParam("guid") String guid) {
+ // ignore service.id - if specified. Retrieve using the given guid and use id from the retrieved object
+ RangerService existingService = getServiceByGuid(guid);
+ service.setId(existingService.getId());
+ if(StringUtils.isEmpty(service.getGuid())) {
+ service.setGuid(existingService.getGuid());
}
+
+ return serviceREST.updateService(service);
+ }
+ */
+
+ @DELETE
+ @Path("/api/service/{id}")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ public void deleteService(@PathParam("id") Long id) {
+ serviceREST.deleteService(id);
+ }
+
+ @DELETE
+ @Path("/api/service/name/{name}")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
+ public void deleteServiceByName(@PathParam("name") String name) {
+ RangerService service = serviceREST.getServiceByName(name);
+
+ serviceREST.deleteService(service.getId());
+ }
+
+ /*
+ * Policy Manipulation APIs
+ */
+
+ @GET
+ @Path("/api/policy/{id}")
+ @Produces("application/json")
+ public RangerPolicy getPolicy(@PathParam("id") Long id) {
+ return serviceREST.getPolicy(id);
+ }
+
+ @GET
+ @Path("/api/policy/")
+ @Produces("application/json")
+ public List<RangerPolicy> getPolicies(@Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.getPolicies()");
+
+ List<RangerPolicy> ret = serviceREST.getPolicies(request).getPolicies();
+ boolean includeMetaAttributes = Boolean.parseBoolean(request.getParameter("includeMetaAttributes"));
+
+ if (includeMetaAttributes) {
+ ret = serviceREST.getPoliciesWithMetaAttributes(ret);
+ }
+
+ logger.debug("<== PublicAPIsv2.getPolicies(Request: {} Result Size: {}", request.getQueryString(), ret.size());
+
return ret;
}
- @GET
- @Path("/api/zone-names/{serviceName}/resource")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- public Collection<String> getSecurityZoneNamesForResource(@PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
- return securityZoneRest.getZoneNamesForResource(serviceName, request);
- }
-
- @POST
- @Path("/api/zones-v2")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerSecurityZoneV2 createSecurityZone(RangerSecurityZoneV2 securityZone) {
- return securityZoneRest.createSecurityZone(securityZone);
- }
-
- @PUT
- @Path("/api/zones-v2/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerSecurityZoneV2 updateSecurityZone(@PathParam("id") Long zoneId, RangerSecurityZoneV2 securityZone) {
- return securityZoneRest.updateSecurityZone(zoneId, securityZone);
- }
-
- @PUT
- @Path("/api/zones-v2/{id}/partial")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public Boolean updateSecurityZone(@PathParam("id") Long zoneId, RangerSecurityZoneChangeRequest changeRequest) {
- return securityZoneRest.updateSecurityZone(zoneId, changeRequest);
- }
-
- @GET
- @Path("/api/zones-v2/name/{name}")
- @Produces({ "application/json" })
- public RangerSecurityZoneV2 getSecurityZoneV2(@PathParam("name") String zoneName) {
- return securityZoneRest.getSecurityZoneV2(zoneName);
- }
-
- @GET
- @Path("/api/zones-v2/{id}")
- @Produces({ "application/json" })
- public RangerSecurityZoneV2 getSecurityZoneV2(@PathParam("id") Long zoneId) {
- return securityZoneRest.getSecurityZoneV2(zoneId);
- }
-
- @GET
- @Path("/api/zones-v2/{id}/resources/{serviceName}")
- @Produces({ "application/json" })
- public PList<RangerSecurityZoneResource> getResources(@PathParam("id") Long zoneId, @PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
- return securityZoneRest.getResources(zoneId, serviceName, request);
- }
-
- @GET
- @Path("/api/zones-v2/name/{name}/resources/{serviceName}")
- @Produces({ "application/json" })
- public PList<RangerSecurityZoneResource> getResources(@PathParam("name") String zoneName, @PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
- return securityZoneRest.getResources(zoneName, serviceName, request);
- }
-
- @GET
- @Path("/api/zones-v2")
- @Produces({ "application/json"})
- public PList<RangerSecurityZoneV2> getAllZonesV2(@Context HttpServletRequest request){
- return securityZoneRest.getAllZonesV2(request);
- }
-
- /*
- * ServiceDef Manipulation APIs
- */
-
- @GET
- @Path("/api/servicedef/{id}")
- @Produces({ "application/json" })
- public RangerServiceDef getServiceDef(@PathParam("id") Long id) {
- return serviceREST.getServiceDef(id);
- }
-
- @GET
- @Path("/api/servicedef/name/{name}")
- @Produces({ "application/json" })
- public RangerServiceDef getServiceDefByName(@PathParam("name") String name) {
- return serviceREST.getServiceDefByName(name);
- }
-
- @GET
- @Path("/api/servicedef/")
- @Produces({ "application/json" })
- public List<RangerServiceDef> searchServiceDefs(@Context HttpServletRequest request) {
- return serviceREST.getServiceDefs(request).getServiceDefs();
- }
-
- @POST
- @Path("/api/servicedef/")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerServiceDef createServiceDef(RangerServiceDef serviceDef) {
- return serviceREST.createServiceDef(serviceDef);
- }
-
- @PUT
- @Path("/api/servicedef/{id}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerServiceDef updateServiceDef(RangerServiceDef serviceDef, @PathParam("id") Long id) {
- // if serviceDef.id is specified, it should be same as param 'id'
- if(serviceDef.getId() == null) {
- serviceDef.setId(id);
- } else if(!serviceDef.getId().equals(id)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "serviceDef id mismatch", true);
- }
-
- return serviceREST.updateServiceDef(serviceDef, serviceDef.getId());
- }
-
-
- @PUT
- @Path("/api/servicedef/name/{name}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerServiceDef updateServiceDefByName(RangerServiceDef serviceDef,
- @PathParam("name") String name) {
- // serviceDef.name is immutable
- // if serviceDef.name is specified, it should be same as the param 'name'
- if(serviceDef.getName() == null) {
- serviceDef.setName(name);
- } else if(!serviceDef.getName().equals(name)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "serviceDef name mismatch", true);
- }
-
- // ignore serviceDef.id - if specified. Retrieve using the given name and use id from the retrieved object
- RangerServiceDef existingServiceDef = getServiceDefByName(name);
- serviceDef.setId(existingServiceDef.getId());
- if(StringUtils.isEmpty(serviceDef.getGuid())) {
- serviceDef.setGuid(existingServiceDef.getGuid());
- }
-
- return serviceREST.updateServiceDef(serviceDef, serviceDef.getId());
- }
-
- /*
- * Should add this back when guid is used for search and delete operations as well
- @PUT
- @Path("/api/servicedef/guid/{guid}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- @Produces({ "application/json" })
- public RangerServiceDef updateServiceDefByGuid(RangerServiceDef serviceDef,
- @PathParam("guid") String guid) {
- // ignore serviceDef.id - if specified. Retrieve using the given guid and use id from the retrieved object
- RangerServiceDef existingServiceDef = getServiceDefByGuid(guid);
- serviceDef.setId(existingServiceDef.getId());
- if(StringUtils.isEmpty(serviceDef.getGuid())) {
- serviceDef.setGuid(existingServiceDef.getGuid());
- }
-
- return serviceREST.updateServiceDef(serviceDef);
- }
- */
-
-
- @DELETE
- @Path("/api/servicedef/{id}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- public void deleteServiceDef(@PathParam("id") Long id, @Context HttpServletRequest request) {
- serviceREST.deleteServiceDef(id, request);
- }
-
- @DELETE
- @Path("/api/servicedef/name/{name}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- public void deleteServiceDefByName(@PathParam("name") String name, @Context HttpServletRequest request) {
- RangerServiceDef serviceDef = serviceREST.getServiceDefByName(name);
- serviceREST.deleteServiceDef(serviceDef.getId(), request);
- }
-
- /*
- * Service Manipulation APIs
- */
-
- @GET
- @Path("/api/service/{id}")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- public RangerService getService(@PathParam("id") Long id) {
- return serviceREST.getService(id);
- }
-
- @GET
- @Path("/api/service/name/{name}")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- public RangerService getServiceByName(@PathParam("name") String name) {
- return serviceREST.getServiceByName(name);
- }
-
- @GET
- @Path("/api/service/")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- public List<RangerService> searchServices(@Context HttpServletRequest request) {
- return serviceREST.getServices(request).getServices();
- }
-
- @GET
- @Path("/api/service-headers")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_SERVICE_HEADERS + "\")")
- public List<RangerServiceHeaderInfo> getServiceHeaders(@Context HttpServletRequest request) {
- return serviceREST.getServiceHeaders(request);
- }
-
- @POST
- @Path("/api/service/")
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerService createService(RangerService service) {
- return serviceREST.createService(service);
- }
-
- @PUT
- @Path("/api/service/{id}")
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerService updateService(RangerService service, @PathParam("id") Long id,
- @Context HttpServletRequest request) {
- // if service.id is specified, it should be same as the param 'id'
- if(service.getId() == null) {
- service.setId(id);
- } else if(!service.getId().equals(id)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "service id mismatch", true);
- }
-
- return serviceREST.updateService(service, request);
- }
-
- @PUT
- @Path("/api/service/name/{name}")
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerService updateServiceByName(RangerService service,
- @PathParam("name") String name,
- @Context HttpServletRequest request) {
- // ignore service.id - if specified. Retrieve using the given name and use id from the retrieved object
- RangerService existingService = getServiceByName(name);
- service.setId(existingService.getId());
- if(StringUtils.isEmpty(service.getGuid())) {
- service.setGuid(existingService.getGuid());
- }
- if (StringUtils.isEmpty(service.getName())) {
- service.setName(existingService.getName());
- }
-
- return serviceREST.updateService(service, request);
- }
-
- /*
- * Should add this back when guid is used for search and delete operations as well
- @PUT
- @Path("/api/service/guid/{guid}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- @Produces({ "application/json" })
- public RangerService updateServiceByGuid(RangerService service,
- @PathParam("guid") String guid) {
- // ignore service.id - if specified. Retrieve using the given guid and use id from the retrieved object
- RangerService existingService = getServiceByGuid(guid);
- service.setId(existingService.getId());
- if(StringUtils.isEmpty(service.getGuid())) {
- service.setGuid(existingService.getGuid());
- }
-
- return serviceREST.updateService(service);
- }
- */
-
- @DELETE
- @Path("/api/service/{id}")
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- public void deleteService(@PathParam("id") Long id) {
- serviceREST.deleteService(id);
- }
-
- @DELETE
- @Path("/api/service/name/{name}")
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPISpnegoAccessible()")
- public void deleteServiceByName(@PathParam("name") String name) {
- RangerService service = serviceREST.getServiceByName(name);
- serviceREST.deleteService(service.getId());
- }
-
-
- /*
- * Policy Manipulation APIs
- */
-
- @GET
- @Path("/api/policy/{id}")
- @Produces({ "application/json" })
- public RangerPolicy getPolicy(@PathParam("id") Long id) {
- return serviceREST.getPolicy(id);
- }
-
- @GET
- @Path("/api/policy/")
- @Produces({ "application/json" })
- public List<RangerPolicy> getPolicies(@Context HttpServletRequest request) {
-
- List<RangerPolicy> ret = new ArrayList<RangerPolicy>();
-
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.getPolicies()");
- }
-
- ret = serviceREST.getPolicies(request).getPolicies();
-
- boolean includeMetaAttributes = Boolean.parseBoolean(request.getParameter("includeMetaAttributes"));
- if (includeMetaAttributes) {
- ret = serviceREST.getPoliciesWithMetaAttributes(ret);
- }
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.getPolicies(Request: " + request.getQueryString() + " Result Size: " + ret.size() );
- }
- return ret;
- }
-
- @GET
- @Path("/api/service/{servicename}/policy/{policyname}")
- @Produces({ "application/json" })
- public RangerPolicy getPolicyByName(@PathParam("servicename") String serviceName,
- @PathParam("policyname") String policyName,
- @QueryParam("zoneName") String zoneName,
- @Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.getPolicyByName(" + serviceName + "," + policyName + "," + zoneName + ")");
- }
-
- RangerPolicy policy = serviceREST.getPolicyByName(serviceName, policyName, zoneName);
-
- if (policy == null) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "Not found", true);
- }
-
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.getPolicyByName(" + serviceName + "," + policyName + "," + zoneName + ")" + policy);
- }
- return policy;
- }
-
- @GET
- @Path("/api/service/{servicename}/policy/")
- @Produces({ "application/json" })
- public List<RangerPolicy> searchPolicies(@PathParam("servicename") String serviceName,
- @Context HttpServletRequest request) {
- return serviceREST.getServicePoliciesByName(serviceName, request).getPolicies();
- }
-
- @GET
- @Path("/api/policies/{serviceDefName}/for-resource/")
- @Produces({ "application/json" })
- public List<RangerPolicy> getPoliciesForResource(@PathParam("serviceDefName") String serviceDefName,
- @DefaultValue("") @QueryParam("serviceName") String serviceName,
- @Context HttpServletRequest request) {
- return serviceREST.getPoliciesForResource(serviceDefName, serviceName, request);
- }
-
- @GET
- @Path("/api/policy/guid/{guid}")
- @Produces({ "application/json" })
- public RangerPolicy getPolicyByGUIDAndServiceNameAndZoneName(@PathParam("guid") String guid,
- @DefaultValue("") @QueryParam("serviceName") String serviceName,
- @DefaultValue("") @QueryParam("ZoneName") String zoneName) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.getPolicyByGUIDAndServiceNameAndZoneName(" + guid + "," + serviceName + "," + zoneName + ")");
- }
- RangerPolicy rangerPolicy = serviceREST.getPolicyByGUIDAndServiceNameAndZoneName(guid, serviceName, zoneName);
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.getPolicyByGUIDAndServiceNameAndZoneName(" + guid + "," + serviceName + "," + zoneName + ")");
- }
- return rangerPolicy;
- }
-
- @POST
- @Path("/api/policy/")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerPolicy createPolicy(RangerPolicy policy , @Context HttpServletRequest request) {
- return serviceREST.createPolicy(policy, request);
- }
-
- @POST
- @Path("/api/policy/apply/")
- @Consumes({ "application/json"})
- @Produces({ "application/json"})
- public RangerPolicy applyPolicy(RangerPolicy policy, @Context HttpServletRequest request) { // new API
- return serviceREST.applyPolicy(policy, request);
- }
-
- @PUT
- @Path("/api/policy/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerPolicy updatePolicy(RangerPolicy policy, @PathParam("id") Long id) {
- // if policy.id is specified, it should be same as the param 'id'
- if(policy.getId() == null) {
- policy.setId(id);
- } else if(!policy.getId().equals(id)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "policyID mismatch", true);
- }
-
- return serviceREST.updatePolicy(policy, id);
- }
-
- @PUT
- @Path("/api/service/{servicename}/policy/{policyname}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerPolicy updatePolicyByName(RangerPolicy policy,
- @PathParam("servicename") String serviceName,
- @PathParam("policyname") String policyName,
- @QueryParam("zoneName") String zoneName,
- @Context HttpServletRequest request) {
- if (policy.getService() == null || !policy.getService().equals(serviceName)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "service name mismatch", true);
- }
- RangerPolicy oldPolicy = getPolicyByName(serviceName, policyName, zoneName, request);
-
- // ignore policy.id - if specified. Retrieve using the given serviceName+policyName and use id from the retrieved object
- policy.setId(oldPolicy.getId());
- if(StringUtils.isEmpty(policy.getGuid())) {
- policy.setGuid(oldPolicy.getGuid());
- }
- if(StringUtils.isEmpty(policy.getName())) {
- policy.setName(StringUtils.trim(oldPolicy.getName()));
- }
-
- return serviceREST.updatePolicy(policy, policy.getId());
- }
-
-
- /* Should add this back when guid is used for search and delete operations as well
- @PUT
- @Path("/api/policy/guid/{guid}")
- @Produces({ "application/json" })
- public RangerPolicy updatePolicyByGuid(RangerPolicy policy,
- @PathParam("guid") String guid) {
- // ignore policy.guid - if specified. Retrieve using the given guid and use id from the retrieved object
- RangerPolicy existingPolicy = getPolicyByGuid(name);
- policy.setId(existingPolicy.getId());
- if(StringUtils.isEmpty(policy.getGuid())) {
- policy.setGuid(existingPolicy.getGuid());
- }
-
- return serviceREST.updatePolicy(policy);
- }
- */
-
-
- @DELETE
- @Path("/api/policy/{id}")
- public void deletePolicy(@PathParam("id") Long id) {
- serviceREST.deletePolicy(id);
- }
-
- @DELETE
- @Path("/api/policy")
- public void deletePolicyByName(@QueryParam("servicename") String serviceName,
- @QueryParam("policyname") String policyName,
- @QueryParam("zoneName") String zoneName,
- @Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.deletePolicyByName(" + serviceName + "," + policyName + ")");
- }
-
- if (serviceName == null || policyName == null) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "Invalid service name or policy name", true);
- }
- RangerPolicy policy = getPolicyByName(serviceName, policyName, zoneName, request);
- serviceREST.deletePolicy(policy.getId());
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.deletePolicyByName(" + serviceName + "," + policyName + ")");
- }
- }
-
- @DELETE
- @Path("/api/policy/guid/{guid}")
- public void deletePolicyByGUIDAndServiceNameAndZoneName(@PathParam("guid") String guid,
- @DefaultValue("") @QueryParam("serviceName") String serviceName,
- @DefaultValue("") @QueryParam("zoneName") String zoneName) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.deletePolicyByGUIDAndServiceNameAndZoneName(" + guid + "," + serviceName + "," + zoneName + ")");
- }
- serviceREST.deletePolicyByGUIDAndServiceNameAndZoneName(guid, serviceName, zoneName);
- if(logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.deletePolicyByGUIDAndServiceNameAndZoneName(" + guid + "," + serviceName + "," + zoneName + ")");
- }
- }
-
- @PUT
- @Path("/api/service/{serviceName}/tags")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- public void importServiceTags(@PathParam("serviceName") String serviceName, RangerServiceTags svcTags) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.importServiceTags()");
- }
-
- // overwrite serviceName with the one given in url
- if (svcTags.getServiceResources() != null) {
- for (RangerServiceResource svcResource : svcTags.getServiceResources()) {
- svcResource.setServiceName(serviceName);
- }
- }
-
- ServiceTags serviceTags = RangerServiceTags.toServiceTags(svcTags);
-
- // overwrite serviceName with the one given in url
- serviceTags.setServiceName(serviceName);
-
- tagREST.importServiceTags(serviceTags);
-
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.importServiceTags()");
- }
- }
-
- @GET
- @Path("/api/service/{serviceName}/tags")
- @Produces({ "application/json" })
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- public RangerServiceTags getServiceTags(@PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.getServiceTags()");
- }
-
- Long lastKnownVersion = -1L;
- Long lastActivationTime = 0L;
- String pluginId = null;
- Boolean supportsTagDeltas = false;
- String pluginCapabilities = "";
- ServiceTags tags = tagREST.getServiceTagsIfUpdated(serviceName, lastKnownVersion, lastActivationTime, pluginId, supportsTagDeltas, pluginCapabilities, request);
- RangerServiceTags ret = RangerServiceTags.toRangerServiceTags(tags);
-
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.getServiceTags()");
- }
-
- return ret;
- }
-
-
- @GET
- @Path("/api/plugins/info")
- @Produces({ "application/json" })
- public List<RangerPluginInfo> getPluginsInfo(@Context HttpServletRequest request) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.getPluginsInfo()");
- }
-
- List<RangerPluginInfo> ret = serviceREST.getPluginsInfo(request).getPluginInfoList();
-
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.getPluginsInfo()");
- }
- return ret;
- }
-
- @DELETE
- @Path("/api/server/policydeltas")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- public void deletePolicyDeltas(@DefaultValue("7") @QueryParam("days") Integer olderThan, @Context HttpServletRequest request) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.deletePolicyDeltas(" + olderThan + ")");
- }
-
- serviceREST.deletePolicyDeltas(olderThan, request);
-
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.deletePolicyDeltas(" + olderThan + ")");
- }
- }
-
- @DELETE
- @Path("/api/server/tagdeltas")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- public void deleteTagDeltas(@DefaultValue("7") @QueryParam("days") Integer olderThan, @Context HttpServletRequest request) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.deleteTagDeltas(" + olderThan + ")");
- }
-
- tagREST.deleteTagDeltas(olderThan, request);
-
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.deleteTagDeltas(" + olderThan + ")");
- }
- }
-
- @DELETE
- @Path("/api/server/purgepolicies/{serviceName}")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- public void purgeEmptyPolicies(@PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.purgeEmptyPolicies(" + serviceName + ")");
- }
-
- if (serviceName == null) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "Invalid service name", true);
- }
-
- serviceREST.purgeEmptyPolicies(serviceName, request);
-
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.purgeEmptyPolicies(" + serviceName + ")");
- }
- }
-
- /*
- * Role Creation API
- */
-
- @POST
- @Path("/api/roles")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerRole createRole(@QueryParam("serviceName") String serviceName, RangerRole role
- , @DefaultValue("false") @QueryParam("createNonExistUserGroup") Boolean createNonExistUserGroup
- , @Context HttpServletRequest request) {
- logger.info("==> PublicAPIsv2.createRole");
- RangerRole ret;
- ret = roleREST.createRole(serviceName, role, createNonExistUserGroup);
- logger.info("<== PublicAPIsv2.createRole" + ret.getName());
- return ret;
- }
-
- /*
- * Role Manipulation API
- */
- @PUT
- @Path("/api/roles/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerRole updateRole(@PathParam("id") Long roleId, RangerRole role
- , @DefaultValue("false") @QueryParam("createNonExistUserGroup") Boolean createNonExistUserGroup
- , @Context HttpServletRequest request) {
- return roleREST.updateRole(roleId, role, createNonExistUserGroup);
- }
-
- @DELETE
- @Path("/api/roles/name/{name}")
- public void deleteRole(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String userName, @PathParam("name") String roleName, @Context HttpServletRequest request) {
- roleREST.deleteRole(serviceName, userName, roleName);
- }
-
- @DELETE
- @Path("/api/roles/{id}")
- public void deleteRole(@PathParam("id") Long roleId, @Context HttpServletRequest request) {
- roleREST.deleteRole(roleId);
- }
-
- /*
- * APIs to Access Roles
- */
- @GET
- @Path("/api/roles/name/{name}")
- @Produces({ "application/json" })
- public RangerRole getRole(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String userName, @PathParam("name") String roleName, @Context HttpServletRequest request) {
- return roleREST.getRole(serviceName, userName, roleName);
- }
-
- @GET
- @Path("/api/roles/{id}")
- @Produces({ "application/json" })
- public RangerRole getRole(@PathParam("id") Long id, @Context HttpServletRequest request) {
- return roleREST.getRole(id);
- }
-
- @GET
- @Path("/api/roles")
- @Produces({ "application/json" })
- public List<RangerRole> getAllRoles(@Context HttpServletRequest request) {
- return roleREST.getAllRoles(request).getSecurityRoles();
- }
-
- @GET
- @Path("/api/roles/names")
- @Produces({ "application/json" })
- public List<String> getAllRoleNames(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String userName, @Context HttpServletRequest request){
- return roleREST.getAllRoleNames(serviceName, userName, request);
- }
-
- @GET
- @Path("/api/roles/user/{user}")
- @Produces({ "application/json" })
- public List<String> getUserRoles(@PathParam("user") String userName, @Context HttpServletRequest request){
- return roleREST.getUserRoles(userName, request);
- }
-
- /*
- This API is used to add users and groups with/without GRANT privileges to this Role. It follows add-or-update semantics
- */
- @PUT
- @Path("/api/roles/{id}/addUsersAndGroups")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerRole addUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups, Boolean isAdmin, @Context HttpServletRequest request) {
- return roleREST.addUsersAndGroups(roleId, users, groups, isAdmin);
- }
-
- /*
+ @GET
+ @Path("/api/service/{servicename}/policy/{policyname}")
+ @Produces("application/json")
+ public RangerPolicy getPolicyByName(@PathParam("servicename") String serviceName, @PathParam("policyname") String policyName, @QueryParam("zoneName") String zoneName, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.getPolicyByName({}, {}, {})", serviceName, policyName, zoneName);
+
+ RangerPolicy policy = serviceREST.getPolicyByName(serviceName, policyName, zoneName);
+
+ if (policy == null) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "Not found", true);
+ }
+
+ logger.debug("<== PublicAPIsv2.getPolicyByName({}, {}, {}): {}", serviceName, policyName, zoneName, policy);
+ return policy;
+ }
+
+ @GET
+ @Path("/api/service/{servicename}/policy/")
+ @Produces("application/json")
+ public List<RangerPolicy> searchPolicies(@PathParam("servicename") String serviceName, @Context HttpServletRequest request) {
+ return serviceREST.getServicePoliciesByName(serviceName, request).getPolicies();
+ }
+
+ @GET
+ @Path("/api/policies/{serviceDefName}/for-resource/")
+ @Produces("application/json")
+ public List<RangerPolicy> getPoliciesForResource(@PathParam("serviceDefName") String serviceDefName, @DefaultValue("") @QueryParam("serviceName") String serviceName, @Context HttpServletRequest request) {
+ return serviceREST.getPoliciesForResource(serviceDefName, serviceName, request);
+ }
+
+ @GET
+ @Path("/api/policy/guid/{guid}")
+ @Produces("application/json")
+ public RangerPolicy getPolicyByGUIDAndServiceNameAndZoneName(@PathParam("guid") String guid, @DefaultValue("") @QueryParam("serviceName") String serviceName, @DefaultValue("") @QueryParam("ZoneName") String zoneName) {
+ logger.debug("==> PublicAPIsv2.getPolicyByGUIDAndServiceNameAndZoneName({}, {}, {})", guid, serviceName, zoneName);
+
+ RangerPolicy rangerPolicy = serviceREST.getPolicyByGUIDAndServiceNameAndZoneName(guid, serviceName, zoneName);
+
+ logger.debug("<== PublicAPIsv2.getPolicyByGUIDAndServiceNameAndZoneName({}, {}, {})", guid, serviceName, zoneName);
+
+ return rangerPolicy;
+ }
+
+ @POST
+ @Path("/api/policy/")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerPolicy createPolicy(RangerPolicy policy, @Context HttpServletRequest request) {
+ return serviceREST.createPolicy(policy, request);
+ }
+
+ @POST
+ @Path("/api/policy/apply/")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerPolicy applyPolicy(RangerPolicy policy, @Context HttpServletRequest request) { // new API
+ return serviceREST.applyPolicy(policy, request);
+ }
+
+ @PUT
+ @Path("/api/policy/{id}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerPolicy updatePolicy(RangerPolicy policy, @PathParam("id") Long id) {
+ // if policy.id is specified, it should be same as the param 'id'
+ if (policy.getId() == null) {
+ policy.setId(id);
+ } else if (!policy.getId().equals(id)) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "policyID mismatch", true);
+ }
+
+ return serviceREST.updatePolicy(policy, id);
+ }
+
+ @PUT
+ @Path("/api/service/{servicename}/policy/{policyname}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerPolicy updatePolicyByName(RangerPolicy policy, @PathParam("servicename") String serviceName, @PathParam("policyname") String policyName, @QueryParam("zoneName") String zoneName, @Context HttpServletRequest request) {
+ if (policy.getService() == null || !policy.getService().equals(serviceName)) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "service name mismatch", true);
+ }
+
+ RangerPolicy oldPolicy = getPolicyByName(serviceName, policyName, zoneName, request);
+
+ // ignore policy.id - if specified. Retrieve using the given serviceName+policyName and use id from the retrieved object
+ policy.setId(oldPolicy.getId());
+
+ if (StringUtils.isEmpty(policy.getGuid())) {
+ policy.setGuid(oldPolicy.getGuid());
+ }
+
+ if (StringUtils.isEmpty(policy.getName())) {
+ policy.setName(StringUtils.trim(oldPolicy.getName()));
+ }
+
+ return serviceREST.updatePolicy(policy, policy.getId());
+ }
+
+ /* Should add this back when guid is used for search and delete operations as well
+ @PUT
+ @Path("/api/policy/guid/{guid}")
+ @Produces({ "application/json" })
+ public RangerPolicy updatePolicyByGuid(RangerPolicy policy, @PathParam("guid") String guid) {
+ // ignore policy.guid - if specified. Retrieve using the given guid and use id from the retrieved object
+ RangerPolicy existingPolicy = getPolicyByGuid(name);
+ policy.setId(existingPolicy.getId());
+ if(StringUtils.isEmpty(policy.getGuid())) {
+ policy.setGuid(existingPolicy.getGuid());
+ }
+
+ return serviceREST.updatePolicy(policy);
+ }
+ */
+
+ @DELETE
+ @Path("/api/policy/{id}")
+ public void deletePolicy(@PathParam("id") Long id) {
+ serviceREST.deletePolicy(id);
+ }
+
+ @DELETE
+ @Path("/api/policy")
+ public void deletePolicyByName(@QueryParam("servicename") String serviceName, @QueryParam("policyname") String policyName, @QueryParam("zoneName") String zoneName, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.deletePolicyByName({}, {})", serviceName, policyName);
+
+ if (serviceName == null || policyName == null) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Invalid service name or policy name", true);
+ }
+
+ RangerPolicy policy = getPolicyByName(serviceName, policyName, zoneName, request);
+
+ serviceREST.deletePolicy(policy.getId());
+
+ logger.debug("<== PublicAPIsv2.deletePolicyByName({}, {})", serviceName, policyName);
+ }
+
+ @DELETE
+ @Path("/api/policy/guid/{guid}")
+ public void deletePolicyByGUIDAndServiceNameAndZoneName(@PathParam("guid") String guid, @DefaultValue("") @QueryParam("serviceName") String serviceName, @DefaultValue("") @QueryParam("zoneName") String zoneName) {
+ logger.debug("==> PublicAPIsv2.deletePolicyByGUIDAndServiceNameAndZoneName({}, {}, {})", guid, serviceName, zoneName);
+
+ serviceREST.deletePolicyByGUIDAndServiceNameAndZoneName(guid, serviceName, zoneName);
+
+ logger.debug("<== PublicAPIsv2.deletePolicyByGUIDAndServiceNameAndZoneName({}, {}, {})", guid, serviceName, zoneName);
+ }
+
+ @PUT
+ @Path("/api/service/{serviceName}/tags")
+ @Consumes("application/json")
+ @Produces("application/json")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ public void importServiceTags(@PathParam("serviceName") String serviceName, RangerServiceTags svcTags) {
+ logger.debug("==> PublicAPIsv2.importServiceTags()");
+
+ // overwrite serviceName with the one given in url
+ if (svcTags.getServiceResources() != null) {
+ for (RangerServiceResource svcResource : svcTags.getServiceResources()) {
+ svcResource.setServiceName(serviceName);
+ }
+ }
+
+ ServiceTags serviceTags = RangerServiceTags.toServiceTags(svcTags);
+
+ // overwrite serviceName with the one given in url
+ serviceTags.setServiceName(serviceName);
+
+ tagREST.importServiceTags(serviceTags);
+
+ logger.debug("<== PublicAPIsv2.importServiceTags()");
+ }
+
+ @GET
+ @Path("/api/service/{serviceName}/tags")
+ @Produces("application/json")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ public RangerServiceTags getServiceTags(@PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.getServiceTags()");
+
+ Long lastKnownVersion = -1L;
+ Long lastActivationTime = 0L;
+ String pluginId = null;
+ Boolean supportsTagDeltas = false;
+ String pluginCapabilities = "";
+ ServiceTags tags = tagREST.getServiceTagsIfUpdated(serviceName, lastKnownVersion, lastActivationTime, pluginId, supportsTagDeltas, pluginCapabilities, request);
+ RangerServiceTags ret = RangerServiceTags.toRangerServiceTags(tags);
+
+ logger.debug("<== PublicAPIsv2.getServiceTags()");
+
+ return ret;
+ }
+
+ @GET
+ @Path("/api/plugins/info")
+ @Produces("application/json")
+ public List<RangerPluginInfo> getPluginsInfo(@Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.getPluginsInfo()");
+
+ List<RangerPluginInfo> ret = serviceREST.getPluginsInfo(request).getPluginInfoList();
+
+ logger.debug("<== PublicAPIsv2.getPluginsInfo()");
+
+ return ret;
+ }
+
+ @DELETE
+ @Path("/api/server/policydeltas")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ public void deletePolicyDeltas(@DefaultValue("7") @QueryParam("days") Integer olderThan, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.deletePolicyDeltas({})", olderThan);
+
+ serviceREST.deletePolicyDeltas(olderThan, request);
+
+ logger.debug("<== PublicAPIsv2.deletePolicyDeltas({})", olderThan);
+ }
+
+ @DELETE
+ @Path("/api/server/tagdeltas")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ public void deleteTagDeltas(@DefaultValue("7") @QueryParam("days") Integer olderThan, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.deleteTagDeltas({})", olderThan);
+
+ tagREST.deleteTagDeltas(olderThan, request);
+
+ logger.debug("<== PublicAPIsv2.deleteTagDeltas({})", olderThan);
+ }
+
+ @DELETE
+ @Path("/api/server/purgepolicies/{serviceName}")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ public void purgeEmptyPolicies(@PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.purgeEmptyPolicies({})", serviceName);
+
+ if (serviceName == null) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Invalid service name", true);
+ }
+
+ serviceREST.purgeEmptyPolicies(serviceName, request);
+
+ logger.debug("<== PublicAPIsv2.purgeEmptyPolicies({})", serviceName);
+ }
+
+ /*
+ * Role Creation API
+ */
+
+ @POST
+ @Path("/api/roles")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerRole createRole(@QueryParam("serviceName") String serviceName, RangerRole role, @DefaultValue("false") @QueryParam("createNonExistUserGroup") Boolean createNonExistUserGroup, @Context HttpServletRequest request) {
+ logger.info("==> PublicAPIsv2.createRole");
+
+ RangerRole ret = roleREST.createRole(serviceName, role, createNonExistUserGroup);
+
+ logger.info("<== PublicAPIsv2.createRole({})", ret.getName());
+
+ return ret;
+ }
+
+ /*
+ * Role Manipulation API
+ */
+ @PUT
+ @Path("/api/roles/{id}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerRole updateRole(@PathParam("id") Long roleId, RangerRole role, @DefaultValue("false") @QueryParam("createNonExistUserGroup") Boolean createNonExistUserGroup, @Context HttpServletRequest request) {
+ return roleREST.updateRole(roleId, role, createNonExistUserGroup);
+ }
+
+ @DELETE
+ @Path("/api/roles/name/{name}")
+ public void deleteRole(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String userName, @PathParam("name") String roleName, @Context HttpServletRequest request) {
+ roleREST.deleteRole(serviceName, userName, roleName);
+ }
+
+ @DELETE
+ @Path("/api/roles/{id}")
+ public void deleteRole(@PathParam("id") Long roleId, @Context HttpServletRequest request) {
+ roleREST.deleteRole(roleId);
+ }
+
+ /*
+ * APIs to Access Roles
+ */
+ @GET
+ @Path("/api/roles/name/{name}")
+ @Produces("application/json")
+ public RangerRole getRole(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String userName, @PathParam("name") String roleName, @Context HttpServletRequest request) {
+ return roleREST.getRole(serviceName, userName, roleName);
+ }
+
+ @GET
+ @Path("/api/roles/{id}")
+ @Produces("application/json")
+ public RangerRole getRole(@PathParam("id") Long id, @Context HttpServletRequest request) {
+ return roleREST.getRole(id);
+ }
+
+ @GET
+ @Path("/api/roles")
+ @Produces("application/json")
+ public List<RangerRole> getAllRoles(@Context HttpServletRequest request) {
+ return roleREST.getAllRoles(request).getSecurityRoles();
+ }
+
+ @GET
+ @Path("/api/roles/names")
+ @Produces("application/json")
+ public List<String> getAllRoleNames(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String userName, @Context HttpServletRequest request) {
+ return roleREST.getAllRoleNames(serviceName, userName, request);
+ }
+
+ @GET
+ @Path("/api/roles/user/{user}")
+ @Produces("application/json")
+ public List<String> getUserRoles(@PathParam("user") String userName, @Context HttpServletRequest request) {
+ return roleREST.getUserRoles(userName, request);
+ }
+
+ /*
+ This API is used to add users and groups with/without GRANT privileges to this Role. It follows add-or-update semantics
+ */
+ @PUT
+ @Path("/api/roles/{id}/addUsersAndGroups")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerRole addUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups, Boolean isAdmin, @Context HttpServletRequest request) {
+ return roleREST.addUsersAndGroups(roleId, users, groups, isAdmin);
+ }
+
+ /*
This API is used to remove users and groups, without regard to their GRANT privilege, from this Role.
*/
- @PUT
- @Path("/api/roles/{id}/removeUsersAndGroups")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerRole removeUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups, @Context HttpServletRequest request) {
- return roleREST.removeUsersAndGroups(roleId, users, groups);
- }
-
- /*
+ @PUT
+ @Path("/api/roles/{id}/removeUsersAndGroups")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerRole removeUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups, @Context HttpServletRequest request) {
+ return roleREST.removeUsersAndGroups(roleId, users, groups);
+ }
+
+ /*
This API is used to remove GRANT privilege from listed users and groups.
*/
- @PUT
- @Path("/api/roles/{id}/removeAdminFromUsersAndGroups")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerRole removeAdminFromUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups, @Context HttpServletRequest request) {
- return roleREST.removeAdminFromUsersAndGroups(roleId, users, groups);
- }
-
- /*
- This API is used to add users and roles with/without GRANT privileges to this Role. It follows add-or-update semantics
- */
- @PUT
- @Path("/api/roles/grant/{serviceName}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RESTResponse grantRole(@PathParam("serviceName") String serviceName, GrantRevokeRoleRequest grantRoleRequest, @Context HttpServletRequest request) {
- if(logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.grantRoleUsersAndRoles(" + grantRoleRequest.toString() + ")");
- }
- return roleREST.grantRole(serviceName, grantRoleRequest, request);
- }
-
- /*
+ @PUT
+ @Path("/api/roles/{id}/removeAdminFromUsersAndGroups")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerRole removeAdminFromUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups, @Context HttpServletRequest request) {
+ return roleREST.removeAdminFromUsersAndGroups(roleId, users, groups);
+ }
+
+ /*
+ This API is used to add users and roles with/without GRANT privileges to this Role. It follows add-or-update semantics
+ */
+ @PUT
+ @Path("/api/roles/grant/{serviceName}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RESTResponse grantRole(@PathParam("serviceName") String serviceName, GrantRevokeRoleRequest grantRoleRequest, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.grantRoleUsersAndRoles({})", grantRoleRequest);
+
+ return roleREST.grantRole(serviceName, grantRoleRequest, request);
+ }
+
+ /*
This API is used to remove users and groups, without regard to their GRANT privilege, from this Role.
*/
- @PUT
- @Path("/api/roles/revoke/{serviceName}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RESTResponse revokeRoleUsersAndRoles(@PathParam("serviceName") String serviceName, GrantRevokeRoleRequest revokeRoleRequest, @Context HttpServletRequest request) {
- return roleREST.revokeRole(serviceName, revokeRoleRequest, request);
- }
-
- @DELETE
- @Path("/api/server/purge/records")
- @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
- public List<RangerPurgeResult> purgeRecords(@QueryParam("type") String recordType, @DefaultValue("180") @QueryParam("retentionDays") Integer olderThan, @Context HttpServletRequest request) {
- if (logger.isDebugEnabled()) {
- logger.debug("==> PublicAPIsv2.purgeRecords(" + recordType + ", " + olderThan + ")");
- }
-
- List<RangerPurgeResult> ret = serviceREST.purgeRecords(recordType, olderThan, request);
-
- if (logger.isDebugEnabled()) {
- logger.debug("<== PublicAPIsv2.purgeRecords(" + recordType + ", " + olderThan + "): ret=" + ret);
- }
-
- return ret;
- }
+ @PUT
+ @Path("/api/roles/revoke/{serviceName}")
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RESTResponse revokeRoleUsersAndRoles(@PathParam("serviceName") String serviceName, GrantRevokeRoleRequest revokeRoleRequest, @Context HttpServletRequest request) {
+ return roleREST.revokeRole(serviceName, revokeRoleRequest, request);
+ }
+
+ @DELETE
+ @Path("/api/server/purge/records")
+ @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")
+ public List<RangerPurgeResult> purgeRecords(@QueryParam("type") String recordType, @DefaultValue("180") @QueryParam("retentionDays") Integer olderThan, @Context HttpServletRequest request) {
+ logger.debug("==> PublicAPIsv2.purgeRecords({}, {})", recordType, olderThan);
+
+ List<RangerPurgeResult> ret = serviceREST.purgeRecords(recordType, olderThan, request);
+
+ logger.debug("<== PublicAPIsv2.purgeRecords({}, {}): ret={}", recordType, olderThan, ret);
+
+ return ret;
+ }
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/RangerHealthREST.java b/security-admin/src/main/java/org/apache/ranger/rest/RangerHealthREST.java
index c982a9e8d..2798866e9 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/RangerHealthREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/RangerHealthREST.java
@@ -19,9 +19,6 @@
package org.apache.ranger.rest;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
import org.apache.ranger.biz.RangerBizUtil;
import org.apache.ranger.plugin.model.RangerServerHealth;
import org.apache.ranger.util.RangerServerHealthUtil;
@@ -31,6 +28,10 @@ import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+
@Path("actuator")
@Component
@Scope("request")
@@ -46,11 +47,11 @@ public class RangerHealthREST {
*/
@GET
@Path("/health")
- @Produces({"application/json"})
+ @Produces("application/json")
@Transactional(propagation = Propagation.NOT_SUPPORTED)
public RangerServerHealth getRangerServerHealth() {
- String dbVersion = xaBizUtil.getDBVersion();
+ String dbVersion = xaBizUtil.getDBVersion();
return rangerServerHealthUtil.getRangerServerHealth(dbVersion);
}
-}
\ No newline at end of file
+}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
index d8e30b516..3a80595da 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
@@ -19,24 +19,11 @@
package org.apache.ranger.rest;
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Set;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.*;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-
-import org.apache.commons.lang.StringUtils;
+import com.sun.jersey.core.header.FormDataContentDisposition;
+import com.sun.jersey.multipart.FormDataParam;
import org.apache.commons.collections.CollectionUtils;
import org.apache.commons.io.IOUtils;
+import org.apache.commons.lang.StringUtils;
import org.apache.ranger.admin.client.datatype.RESTResponse;
import org.apache.ranger.authorization.utils.StringUtil;
import org.apache.ranger.biz.AssetMgr;
@@ -45,15 +32,15 @@ import org.apache.ranger.biz.RoleDBStore;
import org.apache.ranger.biz.ServiceDBStore;
import org.apache.ranger.biz.ServiceDBStore.JSON_FILE_NAME_TYPE;
import org.apache.ranger.biz.XUserMgr;
+import org.apache.ranger.common.AppConstants;
+import org.apache.ranger.common.ContextUtil;
+import org.apache.ranger.common.MessageEnums;
+import org.apache.ranger.common.PropertiesUtil;
import org.apache.ranger.common.RESTErrorUtil;
import org.apache.ranger.common.RangerSearchUtil;
import org.apache.ranger.common.RangerValidatorFactory;
import org.apache.ranger.common.ServiceUtil;
import org.apache.ranger.common.UserSessionBase;
-import org.apache.ranger.common.PropertiesUtil;
-import org.apache.ranger.common.AppConstants;
-import org.apache.ranger.common.ContextUtil;
-import org.apache.ranger.common.MessageEnums;
import org.apache.ranger.db.RangerDaoManager;
import org.apache.ranger.entity.XXService;
import org.apache.ranger.entity.XXServiceDef;
@@ -85,8 +72,30 @@ import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;
-import com.sun.jersey.multipart.FormDataParam;
-import com.sun.jersey.core.header.FormDataContentDisposition;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.DefaultValue;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MediaType;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Set;
@Path("roles")
@Component
@@ -95,12 +104,12 @@ import com.sun.jersey.core.header.FormDataContentDisposition;
public class RoleREST {
private static final Logger LOG = LoggerFactory.getLogger(RoleREST.class);
- private static List<String> INVALID_USERS = new ArrayList<>();
-
- public static final String POLICY_DOWNLOAD_USERS = "policy.download.auth.users";
- public static final String PARAM_ROLE_NAME = "roleName";
+ public static final String POLICY_DOWNLOAD_USERS = "policy.download.auth.users";
+ public static final String PARAM_ROLE_NAME = "roleName";
public static final String PARAM_IMPORT_IN_PROGRESS = "importInProgress";
+ private static final List<String> INVALID_USERS = new ArrayList<>();
+
@Autowired
RESTErrorUtil restErrorUtil;
@@ -137,224 +146,242 @@ public class RoleREST {
@Autowired
XUserMgr userMgr;
- static {
- INVALID_USERS.add(RangerPolicyEngine.USER_CURRENT);
- INVALID_USERS.add(RangerPolicyEngine.RESOURCE_OWNER);
- }
-
- /* This operation is allowed only when effective User has ranger admin privilege
- * if execUser is not same as logged-in user then effective user is execUser
- * else effective user is logged-in user.
- * This logic is implemented as part of ensureAdminAccess(String serviceName, String userName);
- */
-
@POST
@Path("/roles")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerRole createRole(@QueryParam("serviceName") String serviceName, RangerRole role
- , @DefaultValue("false") @QueryParam("createNonExistUserGroup") Boolean createNonExistUserGroup
- ) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> createRole("+ role + ")");
- }
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerRole createRole(@QueryParam("serviceName") String serviceName, RangerRole role, @DefaultValue("false") @QueryParam("createNonExistUserGroup") Boolean createNonExistUserGroup) {
+ LOG.debug("==> createRole({})", role);
RangerRole ret;
+
try {
RangerRoleValidator validator = validatorFactory.getRangerRoleValidator(roleStore);
+
validator.validate(role, RangerValidator.Action.CREATE);
String userName = role.getCreatedByUser();
+
ensureAdminAccess(serviceName, userName);
+
if (containsInvalidMember(role.getUsers())) {
throw new Exception("Invalid role user(s)");
}
+
ret = roleStore.createRole(role, createNonExistUserGroup);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("createRole(" + role + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("createRole({}) failed", role, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== createRole("+ role + "):" + ret);
- }
+
+ LOG.debug("<== createRole({}): {}", role, ret);
+
return ret;
}
- /* This operation is allowed only when -
- * Logged in user has ranger admin role
+ /* This operation is allowed only when effective User has ranger admin privilege
+ * if execUser is not same as logged-in user then effective user is execUser
+ * else effective user is logged-in user.
+ * This logic is implemented as part of ensureAdminAccess(String serviceName, String userName);
*/
@PUT
@Path("/roles/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerRole updateRole(@PathParam("id") Long roleId
- , RangerRole role
- , @DefaultValue("false") @QueryParam("createNonExistUserGroup") Boolean createNonExistUserGroup
- ) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> updateRole(id=" + roleId +", " + role + ")");
- }
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerRole updateRole(@PathParam("id") Long roleId, RangerRole role, @DefaultValue("false") @QueryParam("createNonExistUserGroup") Boolean createNonExistUserGroup) {
+ LOG.debug("==> updateRole(id={}, role={})", roleId, role);
if (role.getId() != null && !roleId.equals(role.getId())) {
throw restErrorUtil.createRESTException("roleId mismatch!!");
} else {
role.setId(roleId);
}
+
RangerRole ret;
+
try {
UserSessionBase usb = ContextUtil.getCurrentUserSession();
String loggedInUser = usb != null ? usb.getLoginId() : null;
RangerRole existingRole = getRole(roleId);
if (!bizUtil.isUserRangerAdmin(loggedInUser) && !ensureRoleAccess(loggedInUser, userMgr.getGroupsForUser(loggedInUser), existingRole)) {
- LOG.error("User " + loggedInUser + " does not have permission for this operation");
+ LOG.error("User {} does not have permission for this operation", loggedInUser);
throw new Exception("User does not have permission for this operation");
}
RangerRoleValidator validator = validatorFactory.getRangerRoleValidator(roleStore);
+
validator.validate(role, RangerValidator.Action.UPDATE);
if (containsInvalidMember(role.getUsers())) {
throw new Exception("Invalid role user(s)");
}
+
ret = roleStore.updateRole(role, createNonExistUserGroup);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("updateRole(" + role + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("updateRole({}) failed", role, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== updateRole(id=" + roleId +", " + role + "):" + ret);
- }
+
+ LOG.debug("<== updateRole(id={}, role={}) => ret:{}", roleId, role, ret);
+
return ret;
}
- /* This operation is allowed only when effective User has ranger admin privilege
- * if execUser is not same as logged-in user then effective user is execUser
- * else effective user is logged-in user.
- * This logic is implemented as part of ensureAdminAccess(String serviceName, String userName);
+ /* This operation is allowed only when -
+ * Logged in user has ranger admin role
*/
@DELETE
@Path("/roles/name/{name}")
public void deleteRole(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String execUser, @PathParam("name") String roleName) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> deleteRole(user=" + execUser + " name=" + roleName + ")");
- }
+ LOG.debug("==> deleteRole(user={}, name={})", execUser, roleName);
+
try {
RangerRoleValidator validator = validatorFactory.getRangerRoleValidator(roleStore);
+
validator.validate(roleName, RangerRoleValidator.Action.DELETE);
ensureAdminAccess(serviceName, execUser);
+
roleStore.deleteRole(roleName);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("deleteRole(" + roleName + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("deleteRole({}) failed", roleName, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== deleteRole(name=" + roleName + ")");
- }
+
+ LOG.debug("<== deleteRole(name={})", roleName);
}
- /* This operation is allowed only when -
- * Logged in user has ranger admin role
+ /* This operation is allowed only when effective User has ranger admin privilege
+ * if execUser is not same as logged-in user then effective user is execUser
+ * else effective user is logged-in user.
+ * This logic is implemented as part of ensureAdminAccess(String serviceName, String userName);
*/
@DELETE
@Path("/roles/{id}")
public void deleteRole(@PathParam("id") Long roleId) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> deleteRole(id=" + roleId + ")");
- }
+ LOG.debug("==> deleteRole(id={})", roleId);
+
try {
RangerRoleValidator validator = validatorFactory.getRangerRoleValidator(roleStore);
+
validator.validate(roleId, RangerRoleValidator.Action.DELETE);
ensureAdminAccess(null, null);
+
roleStore.deleteRole(roleId);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("deleteRole(" + roleId + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("deleteRole({}) failed", roleId, excp);
if (excp.getMessage().contains(String.valueOf(ValidationErrorCode.ROLE_VALIDATION_ERR_INVALID_ROLE_ID.getErrorCode()))) {
- throw restErrorUtil.createRESTException(
- "Data Not Found for given Id",
- MessageEnums.DATA_NOT_FOUND, roleId, null,
- "readResource : No Object found with given id.");
+ throw restErrorUtil.createRESTException("Data Not Found for given Id", MessageEnums.DATA_NOT_FOUND, roleId, null, "readResource : No Object found with given id.");
} else {
throw restErrorUtil.createRESTException(excp.getMessage());
}
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== deleteRole(id=" + roleId + ")");
- }
+
+ LOG.debug("<== deleteRole(id={})", roleId);
}
- /*
- * Minimum required privilege is the effective user has admin option for this role.
- * This is used to list all the roles, groups, and users who belong to this role.
+ /* This operation is allowed only when -
+ * Logged in user has ranger admin role
*/
@GET
@Path("/roles/name/{name}")
- @Produces({ "application/json" })
+ @Produces("application/json")
public RangerRole getRole(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String execUser, @PathParam("name") String roleName) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getRole(name=" + roleName + ", execUser=" + execUser + ")");
- }
+ LOG.debug("==> getRole(name={}, execUser={})", roleName, execUser);
+
RangerRole ret;
try {
Set<String> userGroups = StringUtils.isNotEmpty(execUser) ? userMgr.getGroupsForUser(execUser) : new HashSet<>();
ret = getRoleIfAccessible(roleName, serviceName, execUser, userGroups);
+
if (ret == null) {
throw restErrorUtil.createRESTException("User doesn't have permissions to get details for " + roleName);
}
-
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("getRole(name=" + roleName + ", execUser=" + execUser + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("getRole(name={}, execUser={}) failed", roleName, execUser, excp);
+
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getRole(name=" + roleName + ", execUser=" + execUser + "):" + ret);
- }
+
+ LOG.debug("<== getRole(name={}, execUser={}):{}", roleName, execUser, ret);
+
return ret;
}
+ /*
+ * Minimum required privilege is the effective user has admin option for this role.
+ * This is used to list all the roles, groups, and users who belong to this role.
+ */
+
@GET
@Path("/roles/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
public RangerRole getRole(@PathParam("id") Long id) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getRole(id=" + id + ")");
- }
+ LOG.debug("==> getRole(id={})", id);
+
RangerRole ret;
+
try {
ret = roleStore.getRole(id);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("getRole(" + id + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("getRole({}) failed", id, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getRole(id=" + id + "):" + ret);
+
+ LOG.debug("<== getRole(id={}):{}", id, ret);
+
+ return ret;
+ }
+
+ @GET
+ @Path("/roles")
+ @Produces("application/json")
+ public RangerRoleList getAllRoles(@Context HttpServletRequest request) {
+ LOG.debug("==> getAllRoles()");
+
+ RangerRoleList ret = new RangerRoleList();
+ SearchFilter filter = searchUtil.getSearchFilter(request, roleService.sortFields);
+
+ try {
+ ensureAdminAccess(null, null);
+
+ roleStore.getRoles(filter, ret);
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("getRoles() failed", excp);
+
+ throw restErrorUtil.createRESTException(excp.getMessage());
}
+
+ LOG.debug("<== getAllRoles():{}", ret);
+
return ret;
}
@@ -365,271 +392,242 @@ public class RoleREST {
*/
@GET
- @Path("/roles")
- @Produces({ "application/json" })
- public RangerRoleList getAllRoles(@Context HttpServletRequest request) {
- RangerRoleList ret = new RangerRoleList();
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getAllRoles()");
- }
- SearchFilter filter = searchUtil.getSearchFilter(request, roleService.sortFields);
+ @Path("/roles/exportJson")
+ @Produces("application/json")
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAdminRole()")
+ public void getRolesInJson(@Context HttpServletRequest request, @Context HttpServletResponse response) {
+ LOG.debug("==> getRolesInJson()");
+
try {
- ensureAdminAccess(null, null);
- roleStore.getRoles(filter,ret);
- } catch(WebApplicationException excp) {
+ List<RangerRole> roleLists = getAllFilteredRoleList(request);
+
+ if (CollectionUtils.isNotEmpty(roleLists)) {
+ svcStore.getObjectInJson(roleLists, response, JSON_FILE_NAME_TYPE.ROLE);
+ } else {
+ response.setStatus(HttpServletResponse.SC_NO_CONTENT);
+
+ LOG.error("There is no Role to Export!!");
+ }
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("getRoles() failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("Error while exporting policy file!!", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getAllRoles():" + ret);
+
+ LOG.debug("<== getRolesInJson()");
+ }
+
+ @POST
+ @Path("/roles/importRolesFromFile")
+ @Consumes({MediaType.MULTIPART_FORM_DATA, MediaType.APPLICATION_JSON})
+ @Produces({"application/json", "application/xml"})
+ @PreAuthorize("@rangerPreAuthSecurityHandler.isAdminRole()")
+ public RESTResponse importRolesFromFile(@Context HttpServletRequest request, @FormDataParam("file") InputStream uploadedInputStream, @FormDataParam("file") FormDataContentDisposition fileDetail, @QueryParam("updateIfExists") Boolean updateIfExists, @DefaultValue("false") @QueryParam("createNonExistUserGroupRole") Boolean createNonExistUserGroupRole) {
+ LOG.debug("==> RoleREST.importRolesFromFile()");
+
+ RESTResponse ret = new RESTResponse();
+ String metaDataInfo = null;
+
+ RangerContextHolder.getOrCreateOpContext().setBulkModeContext(true);
+
+ request.setAttribute(PARAM_IMPORT_IN_PROGRESS, true);
+
+ try {
+ roleService.createTransactionLog(new XXTrxLogV2(AppConstants.CLASS_TYPE_RANGER_ROLE, null, null, "IMPORT START"), "Import", "IMPORT START", null);
+
+ if (updateIfExists == null) {
+ updateIfExists = false;
+ }
+
+ List<String> roleNameList = getRoleNameList(request, new ArrayList<>());
+ String fileName = fileDetail.getFileName();
+ int totalRoleCreate = 0;
+ int totalRoleUpdate = 0;
+ int totalRoleUnchange = 0;
+ String msg;
+
+ if (fileName.endsWith("json")) {
+ try {
+ RangerExportRoleList rangerExportRoleList = processRoleInputJsonForMetaData(uploadedInputStream, null);
+
+ if (rangerExportRoleList != null && !CollectionUtils.sizeIsEmpty(rangerExportRoleList.getMetaDataInfo())) {
+ metaDataInfo = JsonUtilsV2.mapToJson(rangerExportRoleList.getMetaDataInfo());
+ } else {
+ LOG.info("metadata info is not provided!!");
+ }
+
+ List<RangerRole> roles = getRolesFromProvidedJson(rangerExportRoleList);
+
+ if (roles != null && !CollectionUtils.sizeIsEmpty(roles)) {
+ for (RangerRole roleInJson : roles) {
+ if (roleInJson != null && StringUtils.isNotEmpty(roleInJson.getName().trim())) {
+ String roleNameInJson = roleInJson.getName().trim();
+
+ if (CollectionUtils.isNotEmpty(roleNameList) && roleNameList.contains(roleNameInJson)) {
+ // check updateIfExists
+ if (updateIfExists) {
+ try {
+ RangerRole exitingRole = roleStore.getRole(roleNameInJson);
+
+ if (!exitingRole.getId().equals(roleInJson.getId())) {
+ roleInJson.setId(exitingRole.getId());
+ }
+
+ if (exitingRole.equals(roleInJson)) {
+ totalRoleUnchange++;
+
+ LOG.debug("Ignoring Roles from provided role in Json file... {}", roleNameInJson);
+ } else {
+ roleStore.updateRole(roleInJson, createNonExistUserGroupRole);
+
+ totalRoleUpdate++;
+ }
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("updateRole({}) failed", roleInJson, excp);
+
+ throw restErrorUtil.createRESTException(excp.getMessage());
+ }
+ } else {
+ totalRoleUnchange++;
+
+ LOG.debug("Ignoring Roles from provided role in Json file... {}", roleNameInJson);
+ }
+
+ ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
+ } else if (!roleNameList.contains(roleNameInJson) && (!roleNameInJson.isEmpty())) {
+ try {
+ roleStore.createRole(roleInJson, createNonExistUserGroupRole);
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("createRole({}) failed", roleInJson, excp);
+
+ throw restErrorUtil.createRESTException(excp.getMessage());
+ }
+
+ totalRoleCreate++;
+
+ ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
+ }
+ }
+ }
+ } else {
+ LOG.error("Json File does not contain any role.");
+
+ throw restErrorUtil.createRESTException("Json File does not contain any role.");
+ }
+
+ if (updateIfExists) {
+ msg = "Total Role Created = " + totalRoleCreate + " , Total Role Updated = " + totalRoleUpdate + " , Total Role Unchanged = " + totalRoleUnchange;
+
+ ret.setMsgDesc(msg);
+ } else {
+ msg = "Total Role Created = " + totalRoleCreate + " , Total Role Unchanged = " + totalRoleUnchange;
+
+ ret.setMsgDesc(msg);
+ }
+ } catch (IOException e) {
+ LOG.error(e.getMessage());
+
+ throw restErrorUtil.createRESTException(e.getMessage());
+ }
+ } else {
+ LOG.error("Provided file format is not supported!!");
+
+ throw restErrorUtil.createRESTException("Provided file format is not supported!!");
+ }
+ } catch (WebApplicationException excp) {
+ LOG.error("Error while importing role from file!!", excp);
+
+ roleService.createTransactionLog(new XXTrxLogV2(AppConstants.CLASS_TYPE_RANGER_ROLE, null, null, "IMPORT ERROR"), "Import failed", StringUtils.isNotEmpty(metaDataInfo) ? metaDataInfo : null, null);
+
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("Error while importing role from file!!", excp);
+
+ roleService.createTransactionLog(new XXTrxLogV2(AppConstants.CLASS_TYPE_RANGER_ROLE, null, null, "IMPORT ERROR"), "Import failed", StringUtils.isNotEmpty(metaDataInfo) ? metaDataInfo : null, null);
+
+ throw restErrorUtil.createRESTException(excp.getMessage());
+ } finally {
+ roleService.createTransactionLog(new XXTrxLogV2(AppConstants.CLASS_TYPE_RANGER_ROLE, null, null, "IMPORT END"), "IMPORT END", StringUtils.isNotEmpty(metaDataInfo) ? metaDataInfo : null, null);
+
+ LOG.debug("<== RoleREST.importRolesFromFile()");
}
+
return ret;
}
- @GET
- @Path("/roles/exportJson")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAdminRole()")
- public void getRolesInJson(@Context HttpServletRequest request, @Context HttpServletResponse response) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getRolesInJson()");
- }
- try {
- List<RangerRole> roleLists = getAllFilteredRoleList(request);
-
- if (CollectionUtils.isNotEmpty(roleLists)) {
- svcStore.getObjectInJson(roleLists, response, JSON_FILE_NAME_TYPE.ROLE);
- } else {
- response.setStatus(HttpServletResponse.SC_NO_CONTENT);
- LOG.error("There is no Role to Export!!");
- }
-
- } catch (WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("Error while exporting policy file!!", excp);
- throw restErrorUtil.createRESTException(excp.getMessage());
- }
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getRolesInJson()");
- }
- }
-
- @POST
- @Path("/roles/importRolesFromFile")
- @Consumes({ MediaType.MULTIPART_FORM_DATA, MediaType.APPLICATION_JSON })
- @Produces({ "application/json", "application/xml" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAdminRole()")
- public RESTResponse importRolesFromFile(@Context HttpServletRequest request,
- @FormDataParam("file") InputStream uploadedInputStream,
- @FormDataParam("file") FormDataContentDisposition fileDetail,
- @QueryParam("updateIfExists") Boolean updateIfExists,
- @DefaultValue("false") @QueryParam("createNonExistUserGroupRole") Boolean createNonExistUserGroupRole) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> RoleREST.importRolesFromFile()");
- }
- RESTResponse ret = new RESTResponse();
-
- RangerContextHolder.getOrCreateOpContext().setBulkModeContext(true);
-
- String metaDataInfo = null;
- request.setAttribute(PARAM_IMPORT_IN_PROGRESS, true);
-
- try {
- roleService.createTransactionLog(new XXTrxLogV2(AppConstants.CLASS_TYPE_RANGER_ROLE, null, null, "IMPORT START"), "Import", "IMPORT START", null);
-
- if (updateIfExists == null) {
- updateIfExists = false;
- }
- List<String> roleNameList = new ArrayList<String>();
-
- roleNameList = getRoleNameList(request, roleNameList);
-
- String fileName = fileDetail.getFileName();
- int totalRoleCreate = 0;
- int totalRoleUpdate = 0;
- int totalRoleUnchange = 0;
- String msg;
-
- if (fileName.endsWith("json")) {
- try {
- RangerExportRoleList rangerExportRoleList = null;
- List<RangerRole> roles = null;
- rangerExportRoleList = processRoleInputJsonForMetaData(uploadedInputStream, rangerExportRoleList);
-
- if (rangerExportRoleList != null
- && !CollectionUtils.sizeIsEmpty(rangerExportRoleList.getMetaDataInfo())) {
- metaDataInfo = JsonUtilsV2.mapToJson(rangerExportRoleList.getMetaDataInfo());
- } else {
- LOG.info("metadata info is not provided!!");
- }
- roles = getRolesFromProvidedJson(rangerExportRoleList);
-
- if (roles != null && !CollectionUtils.sizeIsEmpty(roles)) {
- for (RangerRole roleInJson : roles) {
-
- if (roleInJson != null && StringUtils.isNotEmpty(roleInJson.getName().trim())) {
- String roleNameInJson = roleInJson.getName().trim();
- if (CollectionUtils.isNotEmpty(roleNameList) && roleNameList.contains(roleNameInJson)) {
-
- // check updateIfExists
- if (updateIfExists) {
- try {
- RangerRole exitingRole = roleStore.getRole(roleNameInJson);
- if (!exitingRole.getId().equals(roleInJson.getId())) {
- roleInJson.setId(exitingRole.getId());
- }
- if(exitingRole.equals(roleInJson)){
- totalRoleUnchange++;
- if (LOG.isDebugEnabled()) {
- LOG.debug("Ignoring Roles from provided role in Json file... "+ roleNameInJson);
- }
- }
- else {
- roleStore.updateRole(roleInJson, createNonExistUserGroupRole);
- totalRoleUpdate++;
- }
- } catch (WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("updateRole(" + roleInJson + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- }
- } else {
- totalRoleUnchange++;
- if (LOG.isDebugEnabled()) {
- LOG.debug("Ignoring Roles from provided role in Json file... " + roleNameInJson);
- }
- }
- ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
- } else if (!roleNameList.contains(roleNameInJson) && (!roleNameInJson.isEmpty())) {
- try {
- roleStore.createRole(roleInJson, createNonExistUserGroupRole);
- } catch (WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("createRole(" + roleInJson + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- }
- totalRoleCreate++;
- ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
- }
- }
- }
- } else {
- LOG.error("Json File does not contain any role.");
- throw restErrorUtil.createRESTException("Json File does not contain any role.");
- }
- if (updateIfExists) {
- msg = "Total Role Created = " + totalRoleCreate + " , Total Role Updated = " + totalRoleUpdate + " , Total Role Unchanged = " + totalRoleUnchange;
- ret.setMsgDesc(msg);
- } else {
- msg = "Total Role Created = " + totalRoleCreate + " , Total Role Unchanged = " + totalRoleUnchange;
- ret.setMsgDesc(msg);
- }
-
- } catch (IOException e) {
- LOG.error(e.getMessage());
- throw restErrorUtil.createRESTException(e.getMessage());
- }
- } else {
- LOG.error("Provided file format is not supported!!");
- throw restErrorUtil.createRESTException("Provided file format is not supported!!");
- }
- } catch (WebApplicationException excp) {
- LOG.error("Error while importing role from file!!", excp);
-
- roleService.createTransactionLog(new XXTrxLogV2(AppConstants.CLASS_TYPE_RANGER_ROLE, null, null, "IMPORT ERROR"), "Import failed", StringUtils.isNotEmpty(metaDataInfo) ? metaDataInfo : null, null);
-
- throw excp;
- } catch (Throwable excp) {
- LOG.error("Error while importing role from file!!", excp);
-
- roleService.createTransactionLog(new XXTrxLogV2(AppConstants.CLASS_TYPE_RANGER_ROLE, null, null, "IMPORT ERROR"), "Import failed", StringUtils.isNotEmpty(metaDataInfo) ? metaDataInfo : null, null);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- roleService.createTransactionLog(new XXTrxLogV2(AppConstants.CLASS_TYPE_RANGER_ROLE, null, null, "IMPORT END"), "IMPORT END", StringUtils.isNotEmpty(metaDataInfo) ? metaDataInfo : null, null);
-
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== RoleREST.importRolesFromFile()");
- }
- }
-
- return ret;
- }
-
@GET
@Path("/lookup/roles")
- @Produces({ "application/json" })
+ @Produces("application/json")
public RangerRoleList getAllRolesForUser(@Context HttpServletRequest request) {
- RangerRoleList ret = new RangerRoleList();
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getAllRolesForUser()");
- }
- SearchFilter filter = searchUtil.getSearchFilter(request, roleService.sortFields);
+ LOG.debug("==> getAllRolesForUser()");
+
+ RangerRoleList ret = new RangerRoleList();
+ SearchFilter filter = searchUtil.getSearchFilter(request, roleService.sortFields);
+
try {
- roleStore.getRolesForUser(filter,ret);
- } catch(WebApplicationException excp) {
+ roleStore.getRolesForUser(filter, ret);
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("getRoles() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getAllRoles():" + ret);
- }
+
+ LOG.debug("<== getAllRoles():{}", ret);
+
return ret;
}
- /* This operation is allowed only when effective User has ranger admin privilege
- * if execUser is not same as logged-in user then effective user is execUser
- * else effective user is logged-in user.
- * This logic is implemented as part of ensureAdminAccess(String serviceName, String userName);
- */
-
@GET
@Path("/roles/names")
- @Produces({ "application/json" })
+ @Produces("application/json")
public List<String> getAllRoleNames(@QueryParam("serviceName") String serviceName, @QueryParam("execUser") String userName, @Context HttpServletRequest request) {
final List<String> ret;
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getAllRoleNames()");
- }
+
+ LOG.debug("==> getAllRoleNames()");
+
SearchFilter filter = searchUtil.getSearchFilter(request, roleService.sortFields);
+
try {
ensureAdminAccess(serviceName, userName);
- ret = roleStore.getRoleNames(filter);
- } catch(WebApplicationException excp) {
+ ret = roleStore.getRoleNames(filter);
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("getAllRoleNames() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getAllRoleNames():" + ret);
- }
+
+ LOG.debug("<== getAllRoleNames():{}", ret);
+
return ret;
}
+ /* This operation is allowed only when effective User has ranger admin privilege
+ * if execUser is not same as logged-in user then effective user is execUser
+ * else effective user is logged-in user.
+ * This logic is implemented as part of ensureAdminAccess(String serviceName, String userName);
+ */
+
/*
This API is used to add users and groups with/without GRANT privileges to this Role. It follows add-or-update semantics
*/
@PUT
@Path("/roles/{id}/addUsersAndGroups")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
public RangerRole addUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups, Boolean isAdmin) {
if (LOG.isDebugEnabled()) {
- LOG.debug("==> addUsersAndGroups(id=" + roleId + ", users=" + Arrays.toString(users.toArray()) + ", groups=" + Arrays.toString(groups.toArray()) + ", isAdmin=" + isAdmin + ")");
+ LOG.debug("==> addUsersAndGroups(id={}, users={}, groups={}, isAdmin={})", roleId, Arrays.toString(users.toArray()), Arrays.toString(groups.toArray()), isAdmin);
}
RangerRole role;
@@ -637,22 +635,26 @@ public class RoleREST {
try {
// Real processing
ensureAdminAccess(null, null);
+
if (containsInvalidUser(users)) {
throw new Exception("Invalid role user(s)");
}
role = getRole(roleId);
- Set<RangerRole.RoleMember> roleUsers = new HashSet<>();
+ Set<RangerRole.RoleMember> roleUsers = new HashSet<>();
Set<RangerRole.RoleMember> roleGroups = new HashSet<>();
for (RangerRole.RoleMember user : role.getUsers()) {
if (users.contains(user.getName()) && isAdmin == Boolean.TRUE) {
- user.setIsAdmin(isAdmin);
+ user.setIsAdmin(true);
+
roleUsers.add(user);
}
}
+
Set<String> existingUsernames = getUserNames(role);
+
for (String user : users) {
if (!existingUsernames.contains(user)) {
roleUsers.add(new RangerRole.RoleMember(user, isAdmin));
@@ -664,24 +666,25 @@ public class RoleREST {
roleGroups.add(group);
}
}
+
for (String group : groups) {
roleGroups.add(new RangerRole.RoleMember(group, isAdmin));
}
+
role.setUsers(new ArrayList<>(roleUsers));
role.setGroups(new ArrayList<>(roleGroups));
- role = roleStore.updateRole(role,false);
-
- } catch(WebApplicationException excp) {
+ role = roleStore.updateRole(role, false);
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("addUsersAndGroups() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
if (LOG.isDebugEnabled()) {
- LOG.debug("==> addUsersAndGroups(id=" + roleId + ", users=" + Arrays.toString(users.toArray()) + ", groups=" + Arrays.toString(groups.toArray()) + ", isAdmin=" + isAdmin + ")");
+ LOG.debug("==> addUsersAndGroups(id={}, users={}, groups={}, isAdmin={})", roleId, Arrays.toString(users.toArray()), Arrays.toString(groups.toArray()), isAdmin);
}
return role;
@@ -692,33 +695,40 @@ public class RoleREST {
*/
@PUT
@Path("/roles/{id}/removeUsersAndGroups")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
public RangerRole removeUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups) {
if (LOG.isDebugEnabled()) {
- LOG.debug("==> removeUsersAndGroups(id=" + roleId + ", users=" + Arrays.toString(users.toArray()) + ", groups=" + Arrays.toString(groups.toArray()) + ")");
+ LOG.debug("==> removeUsersAndGroups(id={}, users={}, groups={})", roleId, Arrays.toString(users.toArray()), Arrays.toString(groups.toArray()));
}
+
RangerRole role;
try {
// Real processing
ensureAdminAccess(null, null);
+
role = getRole(roleId);
for (String user : users) {
Iterator<RangerRole.RoleMember> iter = role.getUsers().iterator();
+
while (iter.hasNext()) {
RangerRole.RoleMember member = iter.next();
+
if (StringUtils.equals(member.getName(), user)) {
iter.remove();
break;
}
}
}
+
for (String group : groups) {
Iterator<RangerRole.RoleMember> iter = role.getGroups().iterator();
+
while (iter.hasNext()) {
RangerRole.RoleMember member = iter.next();
+
if (StringUtils.equals(member.getName(), group)) {
iter.remove();
break;
@@ -727,16 +737,16 @@ public class RoleREST {
}
role = roleStore.updateRole(role, false);
-
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("removeUsersAndGroups() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
+
if (LOG.isDebugEnabled()) {
- LOG.debug("<== removeUsersAndGroups(id=" + roleId + ", users=" + Arrays.toString(users.toArray()) + ", groups=" + Arrays.toString(groups.toArray()) + ")");
+ LOG.debug("<== removeUsersAndGroups(id={}, users={}, groups={})", roleId, Arrays.toString(users.toArray()), Arrays.toString(groups.toArray()));
}
return role;
@@ -747,16 +757,17 @@ public class RoleREST {
*/
@PUT
@Path("/roles/{id}/removeAdminFromUsersAndGroups")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
public RangerRole removeAdminFromUsersAndGroups(@PathParam("id") Long roleId, List<String> users, List<String> groups) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> removeAdminFromUsersAndGroups(id=" + roleId + ", users=" + Arrays.toString(users.toArray()) + ", groups=" + Arrays.toString(groups.toArray()) + ")");
- }
+ LOG.debug("==> removeAdminFromUsersAndGroups(id={}, users={}, groups={})", roleId, Arrays.toString(users.toArray()), Arrays.toString(groups.toArray()));
+
RangerRole role;
+
try {
// Real processing
ensureAdminAccess(null, null);
+
role = getRole(roleId);
for (String user : users) {
@@ -766,6 +777,7 @@ public class RoleREST {
}
}
}
+
for (String group : groups) {
for (RangerRole.RoleMember member : role.getGroups()) {
if (StringUtils.equals(member.getName(), group) && member.getIsAdmin()) {
@@ -775,111 +787,109 @@ public class RoleREST {
}
role = roleStore.updateRole(role, false);
-
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("removeAdminFromUsersAndGroups() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> removeAdminFromUsersAndGroups(id=" + roleId + ", users=" + Arrays.toString(users.toArray()) + ", groups=" + Arrays.toString(groups.toArray()) + ")");
- }
+ LOG.debug("==> removeAdminFromUsersAndGroups(id={}, users={}, groups={})", roleId, Arrays.toString(users.toArray()), Arrays.toString(groups.toArray()));
return role;
}
- /*
- * This API is used to GRANT role to users and roles with/without ADMIN option. It follows add-or-update semantics
- * Minimum required privilege is the effective user has admin option for the target roles
- */
-
@PUT
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
@Path("/roles/grant/{serviceName}")
public RESTResponse grantRole(@PathParam("serviceName") String serviceName, GrantRevokeRoleRequest grantRoleRequest, @Context HttpServletRequest request) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> RoleREST.grantRole(" + serviceName + ", " + grantRoleRequest + ")");
- }
- RESTResponse ret = new RESTResponse();
+ LOG.debug("==> RoleREST.grantRole({}, {})", serviceName, grantRoleRequest);
+
+ RESTResponse ret = new RESTResponse();
try {
validateUsersGroupsAndRoles(grantRoleRequest);
+
String userName = grantRoleRequest.getGrantor();
+
for (String roleName : grantRoleRequest.getTargetRoles()) {
/* For each target Role, check following to allow access
* If userName (execUser) is not same as logged in user then check
- * If logged-in user is not ranger admin/service admin/service user, then deny the operation
- * effective User is execUser
+ * If logged-in user is not ranger admin/service admin/service user, then deny the operation
+ * effective User is execUser
* else
- * effective user is logged-in user
+ * effective user is logged-in user
* If effective user is ranger admin/has role admin privilege, then allow the operation
* else deny the operation
* This logic is implemented as part of getRoleIfAccessible(roleName, serviceName, userName, userGroups)
- */
- Set<String> userGroups = CollectionUtils.isNotEmpty(grantRoleRequest.getGrantorGroups()) ? grantRoleRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
- RangerRole existingRole = getRoleIfAccessible(roleName, serviceName, userName, userGroups);
+ */
+ Set<String> userGroups = CollectionUtils.isNotEmpty(grantRoleRequest.getGrantorGroups()) ? grantRoleRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
+ RangerRole existingRole = getRoleIfAccessible(roleName, serviceName, userName, userGroups);
+
if (existingRole == null) {
throw restErrorUtil.createRESTException("User doesn't have permissions to grant role " + roleName);
}
existingRole.setUpdatedBy(userName);
+
addUsersGroupsAndRoles(existingRole, grantRoleRequest.getUsers(), grantRoleRequest.getGroups(), grantRoleRequest.getRoles(), grantRoleRequest.getGrantOption());
}
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("grantRole() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
if (LOG.isDebugEnabled()) {
- LOG.debug("==> grantRole(serviceName=" + serviceName + ", users=" + Arrays.toString(grantRoleRequest.getUsers().toArray()) + ", groups=" + Arrays.toString(grantRoleRequest.getRoles().toArray()) + ", isAdmin=" + grantRoleRequest.getGrantOption() + ")");
+ LOG.debug("==> grantRole(serviceName={}, users={}, groups={}, isAdmin={})", serviceName, Arrays.toString(grantRoleRequest.getUsers().toArray()), Arrays.toString(grantRoleRequest.getRoles().toArray()), grantRoleRequest.getGrantOption());
}
+
ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
return ret;
}
/*
- * This API is used to remove users and roles, with regard to their REVOKE role from users and roles.
- * Minimum required privilege is the execUser (or doAsUser) has admin option for the target roles
+ * This API is used to GRANT role to users and roles with/without ADMIN option. It follows add-or-update semantics
+ * Minimum required privilege is the effective user has admin option for the target roles
*/
@PUT
@Path("/roles/revoke/{serviceName}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
public RESTResponse revokeRole(@PathParam("serviceName") String serviceName, GrantRevokeRoleRequest revokeRoleRequest, @Context HttpServletRequest request) {
+ LOG.debug("==> RoleREST.revokeRole({}, {})", serviceName, revokeRoleRequest);
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> RoleREST.revokeRole(" + serviceName + ", " + revokeRoleRequest + ")");
- }
- RESTResponse ret = new RESTResponse();
+ RESTResponse ret = new RESTResponse();
try {
validateUsersGroupsAndRoles(revokeRoleRequest);
+
String userName = revokeRoleRequest.getGrantor();
+
for (String roleName : revokeRoleRequest.getTargetRoles()) {
/* For each target Role, check following to allow access
* If userName (execUser) is not same as logged in user then check
- * If logged-in user is not ranger admin/service admin/service user, then deny the operation
- * effective User is execUser
+ * If logged-in user is not ranger admin/service admin/service user, then deny the operation
+ * effective User is execUser
* else
- * effective user is logged-in user
+ * effective user is logged-in user
* If effective user is ranger admin/has role admin privilege, then allow the operation
* else deny the operation
* This logic is implemented as part of getRoleIfAccessible(roleName, serviceName, userName, userGroups)
*/
- Set<String> userGroups = CollectionUtils.isNotEmpty(revokeRoleRequest.getGrantorGroups()) ? revokeRoleRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
- RangerRole existingRole = getRoleIfAccessible(roleName, serviceName, userName, userGroups);
+ Set<String> userGroups = CollectionUtils.isNotEmpty(revokeRoleRequest.getGrantorGroups()) ? revokeRoleRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
+ RangerRole existingRole = getRoleIfAccessible(roleName, serviceName, userName, userGroups);
+
if (existingRole == null) {
throw restErrorUtil.createRESTException("User doesn't have permissions to revoke role " + roleName);
}
+
existingRole.setUpdatedBy(userName);
if (revokeRoleRequest.getGrantOption()) {
@@ -888,108 +898,111 @@ public class RoleREST {
removeUsersGroupsAndRoles(existingRole, revokeRoleRequest.getUsers(), revokeRoleRequest.getGroups(), revokeRoleRequest.getRoles());
}
}
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("revokeRole() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
if (LOG.isDebugEnabled()) {
- LOG.debug("==> revokeRole(serviceName=" + serviceName + ", users=" + Arrays.toString(revokeRoleRequest.getUsers().toArray()) + ", roles=" + Arrays.toString(revokeRoleRequest.getRoles().toArray()) + ", isAdmin=" + revokeRoleRequest.getGrantOption() + ")");
+ LOG.debug("==> revokeRole(serviceName={}, users={}, groups={}, isAdmin={})", serviceName, Arrays.toString(revokeRoleRequest.getUsers().toArray()), Arrays.toString(revokeRoleRequest.getRoles().toArray()), revokeRoleRequest.getGrantOption());
}
+
ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
return ret;
}
- /* Get all the roles that this user or user's groups belong to
+ /*
+ * This API is used to remove users and roles, with regard to their REVOKE role from users and roles.
+ * Minimum required privilege is the execUser (or doAsUser) has admin option for the target roles
*/
@GET
@Path("/roles/user/{user}")
- @Produces({ "application/json" })
+ @Produces("application/json")
public List<String> getUserRoles(@PathParam("user") String userName, @Context HttpServletRequest request) {
Set<String> ret = new HashSet<>();
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getUserRoles()");
- }
+ LOG.debug("==> getUserRoles()");
+
try {
if (xUserService.getXUserByUserName(userName) == null) {
throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "User:" + userName + " not found", false);
}
+
Set<RangerRole> roleList = roleStore.getRoleNames(userName, userMgr.getGroupsForUser(userName));
+
for (RangerRole role : roleList) {
ret.add(role.getName());
+
Set<String> roleMembers = new HashSet<>();
+
getRoleMemberNames(roleMembers, role);
+
ret.addAll(roleMembers);
}
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("getUserRoles() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getUserRoles():" + ret);
- }
+
+ LOG.debug("<== getUserRoles():{}", ret);
+
return new ArrayList<>(ret);
}
+ /* Get all the roles that this user or user's groups belong to
+ */
+
@GET
@Path("/download/{serviceName}")
- @Produces({ "application/json" })
- public RangerRoles getRangerRolesIfUpdated(
- @PathParam("serviceName") String serviceName,
- @DefaultValue("-1") @QueryParam("lastKnownRoleVersion") Long lastKnownRoleVersion,
- @DefaultValue("0") @QueryParam("lastActivationTime") Long lastActivationTime,
- @QueryParam("pluginId") String pluginId,
- @DefaultValue("") @QueryParam("clusterName") String clusterName,
- @DefaultValue("") @QueryParam(RangerRESTUtils.REST_PARAM_CAPABILITIES) String pluginCapabilities,
- @Context HttpServletRequest request) throws Exception {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> RoleREST.getRangerRolesIfUpdated("
- + serviceName + ", " + lastKnownRoleVersion + ", " + lastActivationTime + ")");
- }
- RangerRoles ret = null;
+ @Produces("application/json")
+ public RangerRoles getRangerRolesIfUpdated(@PathParam("serviceName") String serviceName, @DefaultValue("-1") @QueryParam("lastKnownRoleVersion") Long lastKnownRoleVersion, @DefaultValue("0") @QueryParam("lastActivationTime") Long lastActivationTime, @QueryParam("pluginId") String pluginId, @DefaultValue("") @QueryParam("clusterName") String clusterName, @DefaultValue("") @QueryParam(RangerRESTUtils.REST_PARAM_CAPABILITIES) String pluginCapabilities, @Context HttpServletRequest request) {
+ LOG.debug("==> RoleREST.getRangerRolesIfUpdated({}, {}, {})", serviceName, lastKnownRoleVersion, lastActivationTime);
- boolean isValid = false;
- int httpCode = HttpServletResponse.SC_OK;
- Long downloadedVersion = null;
- String logMsg = null;
+ RangerRoles ret = null;
+ boolean isValid = false;
+ int httpCode = HttpServletResponse.SC_OK;
+ Long downloadedVersion = null;
+ String logMsg = null;
try {
bizUtil.failUnauthenticatedDownloadIfNotAllowed();
+
isValid = serviceUtil.isValidService(serviceName, request);
} catch (WebApplicationException webException) {
httpCode = webException.getResponse().getStatus();
- logMsg = webException.getResponse().getEntity().toString();
+ logMsg = webException.getResponse().getEntity().toString();
} catch (Exception e) {
httpCode = HttpServletResponse.SC_BAD_REQUEST;
- logMsg = e.getMessage();
+ logMsg = e.getMessage();
}
+
if (isValid) {
try {
RangerRoles roles = roleStore.getRoles(serviceName, lastKnownRoleVersion);
+
if (roles == null) {
downloadedVersion = lastKnownRoleVersion;
- httpCode = HttpServletResponse.SC_NOT_MODIFIED;
- logMsg = "No change since last update";
+ httpCode = HttpServletResponse.SC_NOT_MODIFIED;
+ logMsg = "No change since last update";
} else {
- downloadedVersion = roles.getRoleVersion();
roles.setServiceName(serviceName);
- ret = roles;
- httpCode = HttpServletResponse.SC_OK;
- logMsg = "Returning RangerRoles =>" + (ret.toString());
- }
+ downloadedVersion = roles.getRoleVersion();
+ ret = roles;
+ logMsg = "Returning RangerRoles =>" + (ret);
+ }
} catch (Throwable excp) {
- LOG.error("getRangerRolesIfUpdated(" + serviceName + ", " + lastKnownRoleVersion + ", " + lastActivationTime + ") failed", excp);
+ LOG.error("getRangerRolesIfUpdated({}, {}, {}) failed", serviceName, lastKnownRoleVersion, lastActivationTime, excp);
+
httpCode = HttpServletResponse.SC_BAD_REQUEST;
- logMsg = excp.getMessage();
+ logMsg = excp.getMessage();
}
}
@@ -997,71 +1010,64 @@ public class RoleREST {
if (httpCode != HttpServletResponse.SC_OK) {
boolean logError = httpCode != HttpServletResponse.SC_NOT_MODIFIED;
+
throw restErrorUtil.createRESTException(httpCode, logMsg, logError);
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== RoleREST.getRangerRolesIfUpdated(" + serviceName + ", " + lastKnownRoleVersion + ", " + lastActivationTime + ")" + ret);
- }
+ LOG.debug("<== RoleREST.getRangerRolesIfUpdated({}, {}, {}) ret:{}", serviceName, lastKnownRoleVersion, lastActivationTime, ret);
+
return ret;
}
@GET
@Path("/secure/download/{serviceName}")
- @Produces({ "application/json" })
- public RangerRoles getSecureRangerRolesIfUpdated(
- @PathParam("serviceName") String serviceName,
- @DefaultValue("-1") @QueryParam("lastKnownRoleVersion") Long lastKnownRoleVersion,
- @DefaultValue("0") @QueryParam("lastActivationTime") Long lastActivationTime,
- @QueryParam("pluginId") String pluginId,
- @DefaultValue("") @QueryParam("clusterName") String clusterName,
- @DefaultValue("") @QueryParam(RangerRESTUtils.REST_PARAM_CAPABILITIES) String pluginCapabilities,
- @Context HttpServletRequest request) throws Exception {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> RoleREST.getSecureRangerRolesIfUpdated("
- + serviceName + ", " + lastKnownRoleVersion + ", " + lastKnownRoleVersion + ")");
- }
- RangerRoles ret = null;
- int httpCode = HttpServletResponse.SC_OK;
- String logMsg = null;
- boolean isAllowed = false;
- boolean isAdmin = bizUtil.isAdmin();
- boolean isKeyAdmin = bizUtil.isKeyAdmin();
- Long downloadedVersion = null;
+ @Produces("application/json")
+ public RangerRoles getSecureRangerRolesIfUpdated(@PathParam("serviceName") String serviceName, @DefaultValue("-1") @QueryParam("lastKnownRoleVersion") Long lastKnownRoleVersion, @DefaultValue("0") @QueryParam("lastActivationTime") Long lastActivationTime, @QueryParam("pluginId") String pluginId, @DefaultValue("") @QueryParam("clusterName") String clusterName, @DefaultValue("") @QueryParam(RangerRESTUtils.REST_PARAM_CAPABILITIES) String pluginCapabilities, @Context HttpServletRequest [...]
+ LOG.debug("==> RoleREST.getSecureRangerRolesIfUpdated({}, {}, {})", serviceName, lastKnownRoleVersion, lastActivationTime);
+ RangerRoles ret = null;
+ int httpCode = HttpServletResponse.SC_OK;
+ String logMsg = null;
+ boolean isAdmin = bizUtil.isAdmin();
+ boolean isKeyAdmin = bizUtil.isKeyAdmin();
+ Long downloadedVersion = null;
+ boolean isValid = false;
+ boolean isAllowed;
request.setAttribute("downloadPolicy", "secure");
- boolean isValid = false;
try {
isValid = serviceUtil.isValidService(serviceName, request);
} catch (WebApplicationException webException) {
httpCode = webException.getResponse().getStatus();
- logMsg = webException.getResponse().getEntity().toString();
+ logMsg = webException.getResponse().getEntity().toString();
} catch (Exception e) {
httpCode = HttpServletResponse.SC_BAD_REQUEST;
- logMsg = e.getMessage();
+ logMsg = e.getMessage();
}
+
if (isValid) {
try {
XXService xService = daoManager.getXXService().findByName(serviceName);
+
if (xService == null) {
- LOG.error("Requested Service not found. serviceName=" + serviceName);
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "Service:" + serviceName + " not found",
- false);
+ LOG.error("Requested Service not found. serviceName={}", serviceName);
+
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "Service:" + serviceName + " not found", false);
}
- XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
+
+ XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
RangerService rangerService = svcStore.getServiceByName(serviceName);
if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
if (isKeyAdmin) {
isAllowed = true;
- }else {
+ } else {
isAllowed = bizUtil.isUserAllowed(rangerService, POLICY_DOWNLOAD_USERS);
}
- }else{
+ } else {
if (isAdmin) {
isAllowed = true;
- }else{
+ } else {
isAllowed = bizUtil.isUserAllowed(rangerService, POLICY_DOWNLOAD_USERS);
}
}
@@ -1070,25 +1076,26 @@ public class RoleREST {
RangerRoles roles = roleStore.getRoles(serviceName, lastKnownRoleVersion);
if (roles == null) {
downloadedVersion = lastKnownRoleVersion;
- httpCode = HttpServletResponse.SC_NOT_MODIFIED;
- logMsg = "No change since last update";
+ httpCode = HttpServletResponse.SC_NOT_MODIFIED;
+ logMsg = "No change since last update";
} else {
- downloadedVersion = roles.getRoleVersion();
roles.setServiceName(serviceName);
- ret = roles;
- httpCode = HttpServletResponse.SC_OK;
- logMsg = "Returning RangerRoles =>" + (ret.toString());
+
+ downloadedVersion = roles.getRoleVersion();
+ ret = roles;
+ logMsg = "Returning RangerRoles =>" + (ret);
}
} else {
- LOG.error("getSecureRangerRolesIfUpdated(" + serviceName + ", " + lastKnownRoleVersion + ") failed as User doesn't have permission to UserGroupRoles");
+ LOG.error("getSecureRangerRolesIfUpdated({}, {}) failed as User doesn't have permission to UserGroupRoles", serviceName, lastKnownRoleVersion);
+
httpCode = HttpServletResponse.SC_FORBIDDEN; // assert user is authenticated.
- logMsg = "User doesn't have permission to download UserGroupRoles";
+ logMsg = "User doesn't have permission to download UserGroupRoles";
}
-
} catch (Throwable excp) {
- LOG.error("getSecureRangerRolesIfUpdated(" + serviceName + ", " + lastKnownRoleVersion + ", " + lastActivationTime + ") failed", excp);
+ LOG.error("getSecureRangerRolesIfUpdated({}, {}, {}) failed", serviceName, lastKnownRoleVersion, lastActivationTime, excp);
+
httpCode = HttpServletResponse.SC_BAD_REQUEST;
- logMsg = excp.getMessage();
+ logMsg = excp.getMessage();
}
}
@@ -1096,32 +1103,84 @@ public class RoleREST {
if (httpCode != HttpServletResponse.SC_OK) {
boolean logError = httpCode != HttpServletResponse.SC_NOT_MODIFIED;
+
throw restErrorUtil.createRESTException(httpCode, logMsg, logError);
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== RoleREST.getSecureRangerRolesIfUpdated(" + serviceName + ", " + lastKnownRoleVersion + ", " + lastActivationTime + ")" + ret);
- }
+ LOG.debug("<== RoleREST.getSecureRangerRolesIfUpdated({}, {}, {}) ret:{}", serviceName, lastKnownRoleVersion, lastActivationTime, ret);
+
return ret;
}
- private void ensureAdminAccess(String serviceName, String userName) throws Exception {
+ protected List<RangerRole> getAllFilteredRoleList(HttpServletRequest request) throws Exception {
+ LOG.debug("==> getAllFilteredRoleList()");
+
+ String roleNames = null;
+ List<String> roleNameList = null;
+ List<RangerRole> roleLists = new ArrayList<>();
+
+ if (request.getParameter(PARAM_ROLE_NAME) != null) {
+ roleNames = request.getParameter(PARAM_ROLE_NAME);
+ }
+
+ if (StringUtils.isNotEmpty(roleNames)) {
+ roleNameList = new ArrayList<>(Arrays.asList(roleNames.split(",")));
+ }
+
+ SearchFilter filter = new SearchFilter();
+ List<RangerRole> rangerRoleList = roleStore.getRoles(filter);
+
+ if (!CollectionUtils.isEmpty(rangerRoleList)) {
+ for (RangerRole role : rangerRoleList) {
+ if (role != null) {
+ if (CollectionUtils.isNotEmpty(roleNameList)) {
+ if (roleNameList.contains(role.getName())) {
+ // set createTime & updateTime Time as null since exported Roles don't need this
+ role.setCreateTime(null);
+ role.setUpdateTime(null);
+
+ roleLists.add(role);
+
+ roleNameList.remove(role.getName());
+
+ if (roleNameList.isEmpty()) {
+ break;
+ }
+ }
+ } else {
+ // set createTime & updateTime Time as null since exported Roles don't need this
+ role.setCreateTime(null);
+ role.setUpdateTime(null);
+
+ roleLists.add(role);
+ }
+ }
+ }
+ }
+ LOG.debug("<== getAllFilteredRoleList(){}", roleLists.size());
+
+ return roleLists;
+ }
+
+ private void ensureAdminAccess(String serviceName, String userName) throws Exception {
/* If userName (execUser) is not same as logged in user then check
- * If logged-in user is not ranger admin/service admin/service user, then deny the operation
- * effective User is execUser
+ * If logged-in user is not ranger admin/service admin/service user, then deny the operation
+ * effective User is execUser
* else
- * effective user is logged-in user
+ * effective user is logged-in user
* If effective user is ranger admin, then allow the operation
* else deny the operation
*/
- String effectiveUser;
- UserSessionBase usb = ContextUtil.getCurrentUserSession();
- String loggedInUser = usb != null ? usb.getLoginId() : null;
+ String effectiveUser;
+ UserSessionBase usb = ContextUtil.getCurrentUserSession();
+ String loggedInUser = usb != null ? usb.getLoginId() : null;
+
if (!StringUtil.equals(userName, loggedInUser)) {
if (!bizUtil.isUserRangerAdmin(loggedInUser) && !userIsSrvAdmOrSrvUser(serviceName, loggedInUser)) {
throw new Exception("User does not have permission for this operation");
}
+
effectiveUser = userName != null ? userName : loggedInUser;
} else {
effectiveUser = loggedInUser;
@@ -1134,36 +1193,41 @@ public class RoleREST {
private RangerRole getRoleIfAccessible(String roleName, String serviceName, String userName, Set<String> userGroups) {
/* If userName (execUser) is not same as logged in user then check
- * If logged-in user is not ranger admin/service admin/service user, then deny the operation
- * effective User is execUser
+ * If logged-in user is not ranger admin/service admin/service user, then deny the operation
+ * effective User is execUser
* else
- * effective user is logged-in user
+ * effective user is logged-in user
* If effective user is ranger admin/has role admin privilege, then allow the operation
* else deny the operation
*/
- RangerRole existingRole;
- String effectiveUser;
- UserSessionBase usb = ContextUtil.getCurrentUserSession();
- String loggedInUser = usb != null ? usb.getLoginId() : null;
+ RangerRole existingRole;
+ String effectiveUser;
+ UserSessionBase usb = ContextUtil.getCurrentUserSession();
+ String loggedInUser = usb != null ? usb.getLoginId() : null;
+
if (!StringUtil.equals(userName, loggedInUser)) {
if (!bizUtil.isUserRangerAdmin(loggedInUser) && !userIsSrvAdmOrSrvUser(serviceName, loggedInUser)) {
LOG.error("User does not have permission for this operation");
+
return null;
}
+
effectiveUser = userName != null ? userName : loggedInUser;
} else {
effectiveUser = loggedInUser;
}
+
try {
if (!bizUtil.isUserRangerAdmin(effectiveUser) && !svcStore.isServiceAdminUser(serviceName, effectiveUser)) {
existingRole = roleStore.getRole(roleName);
- ensureRoleAccess(effectiveUser, userGroups, existingRole);
+ ensureRoleAccess(effectiveUser, userGroups, existingRole);
} else {
existingRole = roleStore.getRole(roleName);
}
} catch (Exception ex) {
LOG.error(ex.getMessage());
+
return null;
}
@@ -1176,8 +1240,10 @@ public class RoleREST {
if (!StringUtil.isEmpty(serviceName)) {
try {
isServiceAdmin = svcStore.isServiceAdminUser(serviceName, username);
+
if (!isServiceAdmin) {
RangerService rangerService = svcStore.getServiceByName(serviceName);
+
if (rangerService != null) {
String serviceUser = PropertiesUtil.getProperty("ranger.plugins." + rangerService.getType() + ".serviceuser");
@@ -1188,22 +1254,27 @@ public class RoleREST {
LOG.error(ex.getMessage());
}
}
+
return isServiceAdmin;
}
private boolean containsInvalidMember(List<RangerRole.RoleMember> users) {
boolean ret = false;
+
for (RangerRole.RoleMember user : users) {
for (String invalidUser : INVALID_USERS) {
if (StringUtils.equals(user.getName(), invalidUser)) {
ret = true;
+
break;
}
}
+
if (ret) {
break;
}
}
+
return ret;
}
@@ -1212,70 +1283,76 @@ public class RoleREST {
}
private boolean ensureRoleAccess(String username, Set<String> userGroups, RangerRole role) throws Exception {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ensureRoleAccess("+ username + ", " + role + ")");
- }
- boolean isAccessible = false;
- List<RangerRole.RoleMember> userList = role.getUsers();
- RangerRole.RoleMember userMember = new RangerRole.RoleMember(username, true);
+ LOG.debug("==> ensureRoleAccess({}, {})", username, role);
+
+ boolean isAccessible = false;
+ List<RangerRole.RoleMember> userList = role.getUsers();
+ RangerRole.RoleMember userMember = new RangerRole.RoleMember(username, true);
- if (!CollectionUtils.isEmpty(userList) && userList.contains(userMember)) {
+ if (!CollectionUtils.isEmpty(userList) && userList.contains(userMember)) {
isAccessible = true;
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ensureRoleAccess(): user "+ username + " has permission for role " + role.getName());
- }
+
+ LOG.debug("==> ensureRoleAccess(): user {} has permission for role {}", username, role.getName());
+
return isAccessible;
}
if (!CollectionUtils.isEmpty(userGroups)) {
List<RangerRole.RoleMember> groupList = role.getGroups();
+
for (RangerRole.RoleMember groupMember : groupList) {
if (!groupMember.getIsAdmin()) {
continue;
}
+
if (userGroups.contains(groupMember.getName())) {
isAccessible = true;
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ensureRoleAccess(): group " + groupMember.getName() + " has permission for role " + role.getName());
- }
+
+ LOG.debug("==> ensureRoleAccess(): group {} has permission for role {}", groupMember.getName(), role.getName());
+
return isAccessible;
}
}
}
Set<RangerRole.RoleMember> roleMemberList = new HashSet<>();
+
getRoleMembers(roleMemberList, role);
+
for (RangerRole.RoleMember roleMember : roleMemberList) {
if (!roleMember.getIsAdmin()) {
continue;
}
RangerRole roleMemberObj = roleStore.getRole(roleMember.getName());
+
if (getUserNames(roleMemberObj).contains(username)) {
isAccessible = true;
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ensureRoleAccess(): role "+ roleMember.getName() + " has permission for role " + role.getName());
- }
+
+ LOG.debug("==> ensureRoleAccess(): role {} has permission for role {}", roleMember.getName(), role.getName());
+
return isAccessible;
}
if (!CollectionUtils.isEmpty(userGroups) && !CollectionUtils.intersection(userGroups, getGroupNames(roleMemberObj)).isEmpty()) {
isAccessible = true;
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ensureRoleAccess(): role " + roleMember.getName() + " has permission for role " + role.getName());
- }
+
+ LOG.debug("==> ensureRoleAccess(): role {} has permission for role {}", roleMember.getName(), role.getName());
+
return isAccessible;
}
}
+
if (!isAccessible) {
throw restErrorUtil.createRESTException("User " + username + " does not have privilege to role " + role.getName());
}
+
return isAccessible;
}
private RangerRole addUsersGroupsAndRoles(RangerRole role, Set<String> users, Set<String> groups, Set<String> roles, Boolean isAdmin) {
if (LOG.isDebugEnabled()) {
- LOG.debug("==> addUsersGroupsAndRoles(name=" + role.getName() + ", users=" + Arrays.toString(users.toArray()) + ", roles=" + Arrays.toString(roles.toArray()) + ", isAdmin=" + isAdmin + ")");
+ LOG.debug("==> addUsersGroupsAndRoles(name={}, users={}, roles={}, isAdmin={})", role.getName(), Arrays.toString(users.toArray()), Arrays.toString(roles.toArray()), isAdmin);
}
try {
@@ -1283,80 +1360,89 @@ public class RoleREST {
for (String newRole : roles) {
//get members recursively and check if the grantor role is already a member
Set<String> roleMembers = new HashSet<>();
+
getRoleMemberNames(roleMembers, roleStore.getRole(newRole));
- if (LOG.isDebugEnabled()) {
- LOG.debug("Role members for " + newRole + " = " + roleMembers);
- }
+
+ LOG.debug("Role members for {} = {}", newRole, roleMembers);
+
if (roleMembers.contains(role.getName())) {
throw new Exception("Invalid role grant");
}
-
}
- Set<RangerRole.RoleMember> roleUsers = new HashSet<>();
+ Set<RangerRole.RoleMember> roleUsers = new HashSet<>();
Set<RangerRole.RoleMember> roleGroups = new HashSet<>();
- Set<RangerRole.RoleMember> roleRoles = new HashSet<>();
+ Set<RangerRole.RoleMember> roleRoles = new HashSet<>();
+
+ for (RangerRole.RoleMember user : role.getUsers()) {
+ String userName = user.getName();
- for (RangerRole.RoleMember user : role.getUsers()) {
- String userName = user.getName();
- if (users.contains(userName)) {
- user.setIsAdmin(isAdmin);
- }
- roleUsers.add(user);
- }
+ if (users.contains(userName)) {
+ user.setIsAdmin(isAdmin);
+ }
+
+ roleUsers.add(user);
+ }
Set<String> existingUsernames = getUserNames(role);
+
for (String user : users) {
if (!existingUsernames.contains(user)) {
roleUsers.add(new RangerRole.RoleMember(user, isAdmin));
}
}
- for (RangerRole.RoleMember group : role.getGroups()) {
- String groupName = group.getName();
- if (groups.contains(groupName)) {
- group.setIsAdmin(isAdmin);
- }
- roleGroups.add(group);
- }
+ for (RangerRole.RoleMember group : role.getGroups()) {
+ String groupName = group.getName();
+
+ if (groups.contains(groupName)) {
+ group.setIsAdmin(isAdmin);
+ }
+
+ roleGroups.add(group);
+ }
Set<String> existingGroupnames = getGroupNames(role);
+
for (String group : groups) {
if (!existingGroupnames.contains(group)) {
roleGroups.add(new RangerRole.RoleMember(group, isAdmin));
}
}
- for (RangerRole.RoleMember roleMember : role.getRoles()) {
- String roleName = roleMember.getName();
- if (roles.contains(roleName)) {
- roleMember.setIsAdmin(isAdmin);
- }
- roleRoles.add(roleMember);
- }
+ for (RangerRole.RoleMember roleMember : role.getRoles()) {
+ String roleName = roleMember.getName();
+
+ if (roles.contains(roleName)) {
+ roleMember.setIsAdmin(isAdmin);
+ }
+
+ roleRoles.add(roleMember);
+ }
Set<String> existingRolenames = getRoleNames(role);
+
for (String newRole : roles) {
if (!existingRolenames.contains(newRole)) {
roleRoles.add(new RangerRole.RoleMember(newRole, isAdmin));
}
}
+
role.setUsers(new ArrayList<>(roleUsers));
role.setGroups(new ArrayList<>(roleGroups));
role.setRoles(new ArrayList<>(roleRoles));
role = roleStore.updateRole(role, false);
-
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("addUsersGroupsAndRoles() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
if (LOG.isDebugEnabled()) {
- LOG.debug("<== addUsersGroupsAndRoles(name=" + role.getName() + ", users=" + Arrays.toString(users.toArray()) + ", roles=" + Arrays.toString(roles.toArray()) + ", isAdmin=" + isAdmin + ")");
+ LOG.debug("<== addUsersGroupsAndRoles(name={}, users={}, roles={}, isAdmin={})", role.getName(), Arrays.toString(users.toArray()), Arrays.toString(roles.toArray()), isAdmin);
}
return role;
@@ -1364,15 +1450,17 @@ public class RoleREST {
private RangerRole removeUsersGroupsAndRoles(RangerRole role, Set<String> users, Set<String> groups, Set<String> roles) {
if (LOG.isDebugEnabled()) {
- LOG.debug("==> removeUsersGroupsAndRoles(name=" + role.getName() + ", users=" + Arrays.toString(users.toArray()) + ", roles=" + Arrays.toString(roles.toArray()) + ")");
+ LOG.debug("==> removeUsersGroupsAndRoles(name={}, users={}, roles={})", role.getName(), Arrays.toString(users.toArray()), Arrays.toString(roles.toArray()));
}
try {
// Real processing
for (String user : users) {
Iterator<RangerRole.RoleMember> iter = role.getUsers().iterator();
+
while (iter.hasNext()) {
RangerRole.RoleMember member = iter.next();
+
if (StringUtils.equals(member.getName(), user)) {
iter.remove();
break;
@@ -1382,8 +1470,10 @@ public class RoleREST {
for (String group : groups) {
Iterator<RangerRole.RoleMember> iter = role.getGroups().iterator();
+
while (iter.hasNext()) {
RangerRole.RoleMember member = iter.next();
+
if (StringUtils.equals(member.getName(), group)) {
iter.remove();
break;
@@ -1393,8 +1483,10 @@ public class RoleREST {
for (String newRole : roles) {
Iterator<RangerRole.RoleMember> iter = role.getRoles().iterator();
+
while (iter.hasNext()) {
RangerRole.RoleMember member = iter.next();
+
if (StringUtils.equals(member.getName(), newRole)) {
iter.remove();
break;
@@ -1403,16 +1495,16 @@ public class RoleREST {
}
role = roleStore.updateRole(role, false);
-
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("removeUsersGroupsAndRoles() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
+
if (LOG.isDebugEnabled()) {
- LOG.debug("<== removeUsersGroupsAndRoles(name=" + role.getName() + ", users=" + Arrays.toString(users.toArray()) + ", roles=" + Arrays.toString(roles.toArray()) + ")");
+ LOG.debug("<== removeUsersGroupsAndRoles(name={}, users={}, roles={})", role.getName(), Arrays.toString(users.toArray()), Arrays.toString(roles.toArray()));
}
return role;
@@ -1420,8 +1512,9 @@ public class RoleREST {
private RangerRole removeAdminFromUsersGroupsAndRoles(RangerRole role, Set<String> users, Set<String> groups, Set<String> roles) {
if (LOG.isDebugEnabled()) {
- LOG.debug("==> removeAdminFromUsersGroupsAndRoles(name=" + role + ", users=" + Arrays.toString(users.toArray()) + ", roles=" + Arrays.toString(roles.toArray()) + ")");
+ LOG.debug("==> removeAdminFromUsersGroupsAndRoles(name={}, users={}, roles={})", role.getName(), Arrays.toString(users.toArray()), Arrays.toString(roles.toArray()));
}
+
try {
// Real processing
for (String user : users) {
@@ -1431,6 +1524,7 @@ public class RoleREST {
}
}
}
+
for (String group : groups) {
for (RangerRole.RoleMember member : role.getGroups()) {
if (StringUtils.equals(member.getName(), group) && member.getIsAdmin()) {
@@ -1448,75 +1542,81 @@ public class RoleREST {
}
role = roleStore.updateRole(role, false);
-
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
+ } catch (Throwable excp) {
LOG.error("removeAdminFromUsersGroupsAndRoles() failed", excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
if (LOG.isDebugEnabled()) {
- LOG.debug("<== removeAdminFromUsersGroupsAndRoles(name=" + role.getName() + ", users=" + Arrays.toString(users.toArray()) + ", roles=" + Arrays.toString(roles.toArray()) + ")");
+ LOG.debug("<== removeAdminFromUsersGroupsAndRoles(name={}, users={}, roles={})", role.getName(), Arrays.toString(users.toArray()), Arrays.toString(roles.toArray()));
}
return role;
}
private Set<String> getUserNames(RangerRole role) {
-
Set<String> usernames = new HashSet<>();
+
for (RangerRole.RoleMember user : role.getUsers()) {
usernames.add(user.getName());
}
+
return usernames;
}
private Set<String> getGroupNames(RangerRole role) {
-
Set<String> groupnames = new HashSet<>();
+
for (RangerRole.RoleMember group : role.getGroups()) {
groupnames.add(group.getName());
}
+
return groupnames;
}
private Set<String> getRoleNames(RangerRole role) {
Set<String> rolenames = new HashSet<>();
+
for (RangerRole.RoleMember roleMember : role.getRoles()) {
rolenames.add(roleMember.getName());
}
+
return rolenames;
}
private void getRoleMemberNames(Set<String> roleMembers, RangerRole role) throws Exception {
- for (RangerRole.RoleMember roleMember : role.getRoles()) {
- roleMembers.add(roleMember.getName());
- getRoleMemberNames(roleMembers, roleStore.getRole(roleMember.getName()));
+ for (RangerRole.RoleMember roleMember : role.getRoles()) {
+ roleMembers.add(roleMember.getName());
+
+ getRoleMemberNames(roleMembers, roleStore.getRole(roleMember.getName()));
}
}
private void getRoleMembers(Set<RangerRole.RoleMember> roleMembers, RangerRole role) throws Exception {
for (RangerRole.RoleMember roleMember : role.getRoles()) {
roleMembers.add(roleMember);
+
getRoleMembers(roleMembers, roleStore.getRole(roleMember.getName()));
}
}
- private void validateUsersGroupsAndRoles(GrantRevokeRoleRequest request){
+ private void validateUsersGroupsAndRoles(GrantRevokeRoleRequest request) {
if (request == null) {
throw restErrorUtil.createRESTException("Invalid grant/revoke role request");
}
- if(CollectionUtils.isEmpty(request.getUsers()) && CollectionUtils.isEmpty(request.getGroups()) && CollectionUtils.isEmpty(request.getRoles())) {
+ if (CollectionUtils.isEmpty(request.getUsers()) && CollectionUtils.isEmpty(request.getGroups()) && CollectionUtils.isEmpty(request.getRoles())) {
throw restErrorUtil.createRESTException("Grantee users/groups/roles list is empty");
}
+
if (request.getUsers() == null) {
request.setUsers(new HashSet<>());
}
- if (request.getGroups() == null ) {
+ if (request.getGroups() == null) {
request.setGroups(new HashSet<>());
}
@@ -1525,82 +1625,44 @@ public class RoleREST {
}
}
- protected List<RangerRole> getAllFilteredRoleList(HttpServletRequest request) throws Exception {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getAllFilteredRoleList()");
- }
- String roleNames = null;
- List<String> roleNameList = null;
- List<RangerRole> roleLists = new ArrayList<>();
-
- if (request.getParameter(PARAM_ROLE_NAME) != null) {
- roleNames = request.getParameter(PARAM_ROLE_NAME);
- }
- if (StringUtils.isNotEmpty(roleNames)) {
- roleNameList = new ArrayList<String>(Arrays.asList(roleNames.split(",")));
- }
-
- List<RangerRole> rangerRoleList = new ArrayList<RangerRole>();
- SearchFilter filter = new SearchFilter();
-
- rangerRoleList = roleStore.getRoles(filter);
-
- if (!CollectionUtils.isEmpty(rangerRoleList)) {
- for (RangerRole role : rangerRoleList) {
- if (role != null) {
- if (CollectionUtils.isNotEmpty(roleNameList)) {
- if (roleNameList.contains(role.getName())) {
- // set createTime & updateTime Time as null since exported Roles don't need this
- role.setCreateTime(null);
- role.setUpdateTime(null);
- roleLists.add(role);
- roleNameList.remove(role.getName());
- if (roleNameList.size() == 0) {
- break;
- }
- }
- } else {
- // set createTime & updateTime Time as null since exported Roles don't need this
- role.setCreateTime(null);
- role.setUpdateTime(null);
- roleLists.add(role);
- }
- }
- }
- }
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getAllFilteredRoleList()" + roleLists.size());
- }
- return roleLists;
- }
-
- private List<String> getRoleNameList(HttpServletRequest request, List<String> roleNameList) throws Exception {
- SearchFilter filter = searchUtil.getSearchFilter(request, roleService.sortFields);
- roleNameList = roleStore.getRoleNames(filter);
- return roleNameList;
- }
-
- private RangerExportRoleList processRoleInputJsonForMetaData(InputStream uploadedInputStream,
- RangerExportRoleList rangerExportRoleList) throws Exception {
- String rolesString = IOUtils.toString(uploadedInputStream);
- rolesString = rolesString.trim();
- if (StringUtils.isNotEmpty(rolesString)) {
- rangerExportRoleList = JsonUtilsV2.jsonToObj(rolesString, RangerExportRoleList.class);
- } else {
- LOG.error("Provided json file is empty!!");
- throw restErrorUtil.createRESTException("Provided json file is empty!!");
- }
- return rangerExportRoleList;
- }
-
- private List<RangerRole> getRolesFromProvidedJson(RangerExportRoleList rangerExportRoleList) {
- List<RangerRole> roles = null;
- if (rangerExportRoleList != null && !CollectionUtils.sizeIsEmpty(rangerExportRoleList.getSecurityRoles())) {
- roles = rangerExportRoleList.getSecurityRoles();
- } else {
- LOG.error("Provided json file does not contain any role!!");
- throw restErrorUtil.createRESTException("Provided json file does not contain any role!!");
- }
- return roles;
- }
+ private List<String> getRoleNameList(HttpServletRequest request, List<String> roleNameList) throws Exception {
+ SearchFilter filter = searchUtil.getSearchFilter(request, roleService.sortFields);
+
+ roleNameList = roleStore.getRoleNames(filter);
+
+ return roleNameList;
+ }
+
+ private RangerExportRoleList processRoleInputJsonForMetaData(InputStream uploadedInputStream, RangerExportRoleList rangerExportRoleList) throws Exception {
+ String rolesString = IOUtils.toString(uploadedInputStream).trim();
+
+ if (StringUtils.isNotEmpty(rolesString)) {
+ rangerExportRoleList = JsonUtilsV2.jsonToObj(rolesString, RangerExportRoleList.class);
+ } else {
+ LOG.error("Provided json file is empty!!");
+
+ throw restErrorUtil.createRESTException("Provided json file is empty!!");
+ }
+
+ return rangerExportRoleList;
+ }
+
+ private List<RangerRole> getRolesFromProvidedJson(RangerExportRoleList rangerExportRoleList) {
+ List<RangerRole> roles;
+
+ if (rangerExportRoleList != null && !CollectionUtils.sizeIsEmpty(rangerExportRoleList.getSecurityRoles())) {
+ roles = rangerExportRoleList.getSecurityRoles();
+ } else {
+ LOG.error("Provided json file does not contain any role!!");
+
+ throw restErrorUtil.createRESTException("Provided json file does not contain any role!!");
+ }
+
+ return roles;
+ }
+
+ static {
+ INVALID_USERS.add(RangerPolicyEngine.USER_CURRENT);
+ INVALID_USERS.add(RangerPolicyEngine.RESOURCE_OWNER);
+ }
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java b/security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java
index dab430bfd..668967505 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java
@@ -19,36 +19,9 @@
package org.apache.ranger.rest;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-
-import javax.persistence.OptimisticLockException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.QueryParam;
-
import org.apache.hadoop.thirdparty.com.google.common.collect.Sets;
-import org.apache.ranger.biz.RangerPolicyAdmin;
import org.apache.ranger.biz.RangerBizUtil;
+import org.apache.ranger.biz.RangerPolicyAdmin;
import org.apache.ranger.biz.SecurityZoneDBStore;
import org.apache.ranger.biz.ServiceDBStore;
import org.apache.ranger.biz.ServiceMgr;
@@ -61,21 +34,21 @@ import org.apache.ranger.db.RangerDaoManager;
import org.apache.ranger.entity.XXService;
import org.apache.ranger.entity.XXServiceDef;
import org.apache.ranger.plugin.model.RangerSecurityZone;
+import org.apache.ranger.plugin.model.RangerSecurityZone.RangerSecurityZoneService;
+import org.apache.ranger.plugin.model.RangerSecurityZone.SecurityZoneSummary;
import org.apache.ranger.plugin.model.RangerSecurityZoneHeaderInfo;
import org.apache.ranger.plugin.model.RangerSecurityZoneV2;
-import org.apache.ranger.plugin.model.RangerSecurityZone.SecurityZoneSummary;
+import org.apache.ranger.plugin.model.RangerSecurityZoneV2.RangerSecurityZoneChangeRequest;
+import org.apache.ranger.plugin.model.RangerSecurityZoneV2.RangerSecurityZoneResource;
import org.apache.ranger.plugin.model.validation.RangerSecurityZoneValidator;
import org.apache.ranger.plugin.model.validation.RangerValidator;
+import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil;
import org.apache.ranger.plugin.store.PList;
import org.apache.ranger.plugin.util.RangerSecurityZoneHelper;
import org.apache.ranger.plugin.util.RangerSecurityZoneHelper.RangerSecurityZoneServiceHelper;
import org.apache.ranger.plugin.util.SearchFilter;
import org.apache.ranger.service.RangerSecurityZoneServiceService;
-import org.apache.ranger.plugin.model.RangerSecurityZone.RangerSecurityZoneService;
-import org.apache.ranger.plugin.model.RangerSecurityZoneV2.RangerSecurityZoneChangeRequest;
-import org.apache.ranger.plugin.model.RangerSecurityZoneV2.RangerSecurityZoneResource;
import org.apache.ranger.view.RangerSecurityZoneList;
-import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
@@ -84,13 +57,39 @@ import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;
+import javax.persistence.OptimisticLockException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.DefaultValue;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Context;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
@Path("zones")
@Component
@Scope("request")
@Transactional(propagation = Propagation.REQUIRES_NEW)
public class SecurityZoneREST {
- private static final Logger LOG = LoggerFactory.getLogger(SecurityZoneREST.class);
+ private static final Logger LOG = LoggerFactory.getLogger(SecurityZoneREST.class);
+
private static final String STR_USER_NOT_AUTHORIZED_TO_ACCESS_ZONE = "User is not authorized to access zone(s).";
private static final String ERR_ANOTHER_SEC_ZONE_OPER_IN_PROGRESS = "Another security zone operation is already in progress";
@@ -107,7 +106,7 @@ public class SecurityZoneREST {
ServiceDBStore svcStore;
@Autowired
- RangerSearchUtil searchUtil;
+ RangerSearchUtil searchUtil;
@Autowired
RangerValidatorFactory validatorFactory;
@@ -115,25 +114,24 @@ public class SecurityZoneREST {
@Autowired
RangerBizUtil bizUtil;
- @Autowired
- ServiceREST serviceRest;
+ @Autowired
+ ServiceREST serviceRest;
- @Autowired
- RangerDaoManager daoManager;
+ @Autowired
+ RangerDaoManager daoManager;
- @Autowired
- ServiceMgr serviceMgr;
+ @Autowired
+ ServiceMgr serviceMgr;
@POST
@Path("/zones")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
+ @Consumes("application/json")
+ @Produces("application/json")
public RangerSecurityZone createSecurityZone(RangerSecurityZone securityZone) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> createSecurityZone("+ securityZone + ")");
- }
+ LOG.debug("==> createSecurityZone({})", securityZone);
RangerSecurityZone ret;
+
try {
RangerSecurityZoneHelper zoneHelper = new RangerSecurityZoneHelper(securityZone, bizUtil.getCurrentUserLoginId()); // this populates resourcesBaseInfo
@@ -141,35 +139,35 @@ public class SecurityZoneREST {
ensureAdminAccess(securityZone);
removeEmptyEntries(securityZone);
+
RangerSecurityZoneValidator validator = validatorFactory.getSecurityZoneValidator(svcStore, securityZoneStore);
+
validator.validate(securityZone, RangerValidator.Action.CREATE);
+
ret = securityZoneStore.createSecurityZone(securityZone);
} catch (OptimisticLockException | org.eclipse.persistence.exceptions.OptimisticLockException excp) {
- LOG.error("createSecurityZone(" + securityZone + ") failed", excp);
+ LOG.error("createSecurityZone({}) failed", securityZone, excp);
throw restErrorUtil.createRESTException(HttpServletResponse.SC_CONFLICT, ERR_ANOTHER_SEC_ZONE_OPER_IN_PROGRESS, true);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("createSecurityZone(" + securityZone + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("createSecurityZone({}) failed:", securityZone, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== createSecurityZone("+ securityZone + "):" + ret);
- }
+
+ LOG.debug("<== createSecurityZone({}):{}", securityZone, ret);
+
return ret;
}
@PUT
@Path("/zones/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- public RangerSecurityZone updateSecurityZone(@PathParam("id") Long zoneId,
- RangerSecurityZone securityZone) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> updateSecurityZone(id=" + zoneId +", " + securityZone + ")");
- }
+ @Consumes("application/json")
+ @Produces("application/json")
+ public RangerSecurityZone updateSecurityZone(@PathParam("id") Long zoneId, RangerSecurityZone securityZone) {
+ LOG.debug("==> updateSecurityZone(id={}, {})", zoneId, securityZone);
if (zoneId != null && zoneId.equals(RangerSecurityZone.RANGER_UNZONED_SECURITY_ZONE_ID)) {
throw restErrorUtil.createRESTException("Cannot update unzoned zone");
@@ -181,129 +179,130 @@ public class SecurityZoneREST {
ensureUserAllowOperationOnServiceForZone(securityZone);
removeEmptyEntries(securityZone);
+
if (securityZone.getId() != null && !zoneId.equals(securityZone.getId())) {
throw restErrorUtil.createRESTException("zoneId mismatch!!");
} else {
securityZone.setId(zoneId);
}
+
RangerSecurityZone ret;
+
try {
RangerSecurityZoneValidator validator = validatorFactory.getSecurityZoneValidator(svcStore, securityZoneStore);
+
validator.validate(securityZone, RangerValidator.Action.UPDATE);
+
ret = securityZoneStore.updateSecurityZoneById(securityZone);
} catch (OptimisticLockException | org.eclipse.persistence.exceptions.OptimisticLockException excp) {
- LOG.error("updateSecurityZone(" + securityZone + ") failed", excp);
+ LOG.error("updateSecurityZone({}) failed", securityZone, excp);
throw restErrorUtil.createRESTException(HttpServletResponse.SC_CONFLICT, ERR_ANOTHER_SEC_ZONE_OPER_IN_PROGRESS, true);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("updateSecurityZone(" + securityZone + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("updateSecurityZone({}) failed", securityZone, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== updateSecurityZone(id=" + zoneId +", " + securityZone + "):" + ret);
- }
+
+ LOG.debug("<== updateSecurityZone(id={}, {}):{}", zoneId, securityZone, ret);
+
return ret;
}
@DELETE
@Path("/zones/name/{name}")
public void deleteSecurityZone(@PathParam("name") String zoneName) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> deleteSecurityZone(name=" + zoneName + ")");
- }
+ LOG.debug("==> deleteSecurityZone(name={})", zoneName);
+
try {
- ensureAdminAccess();
+ ensureAdminAccess();
+
RangerSecurityZoneValidator validator = validatorFactory.getSecurityZoneValidator(svcStore, securityZoneStore);
+
validator.validate(zoneName, RangerValidator.Action.DELETE);
+
securityZoneStore.deleteSecurityZoneByName(zoneName);
} catch (OptimisticLockException | org.eclipse.persistence.exceptions.OptimisticLockException excp) {
- LOG.error("deleteSecurityZone(" + zoneName + ") failed", excp);
+ LOG.error("deleteSecurityZone({}) failed", zoneName, excp);
throw restErrorUtil.createRESTException(HttpServletResponse.SC_CONFLICT, ERR_ANOTHER_SEC_ZONE_OPER_IN_PROGRESS, true);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("deleteSecurityZone(" + zoneName + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("deleteSecurityZone({}) failed", zoneName, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== deleteSecurityZone(name=" + zoneName + ")");
- }
+
+ LOG.debug("<== deleteSecurityZone(name=={})", zoneName);
}
@DELETE
@Path("/zones/{id}")
public void deleteSecurityZone(@PathParam("id") Long zoneId) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> deleteSecurityZone(id=" + zoneId + ")");
- }
+ LOG.debug("==> deleteSecurityZone(id={})", zoneId);
+
if (zoneId != null && zoneId.equals(RangerSecurityZone.RANGER_UNZONED_SECURITY_ZONE_ID)) {
throw restErrorUtil.createRESTException("Cannot delete unzoned zone");
}
+
try {
- ensureAdminAccess();
+ ensureAdminAccess();
+
RangerSecurityZoneValidator validator = validatorFactory.getSecurityZoneValidator(svcStore, securityZoneStore);
+
validator.validate(zoneId, RangerValidator.Action.DELETE);
+
securityZoneStore.deleteSecurityZoneById(zoneId);
} catch (OptimisticLockException | org.eclipse.persistence.exceptions.OptimisticLockException excp) {
- LOG.error("deleteSecurityZone(" + zoneId + ") failed", excp);
+ LOG.error("deleteSecurityZone({}) failed", zoneId, excp);
throw restErrorUtil.createRESTException(HttpServletResponse.SC_CONFLICT, ERR_ANOTHER_SEC_ZONE_OPER_IN_PROGRESS, true);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("deleteSecurityZone(" + zoneId + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("deleteSecurityZone({}) failed", zoneId, excp);
- throw restErrorUtil.createRESTException(
- "Data Not Found for given Id",
- MessageEnums.DATA_NOT_FOUND, zoneId, null,
- "readResource : No Object found with given id.");
- }
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== deleteSecurityZone(id=" + zoneId + ")");
+ throw restErrorUtil.createRESTException("Data Not Found for given Id", MessageEnums.DATA_NOT_FOUND, zoneId, null, "readResource : No Object found with given id.");
}
+
+ LOG.debug("<== deleteSecurityZone(id={})", zoneId);
}
@GET
@Path("/zones/name/{name}")
- @Produces({ "application/json" })
+ @Produces("application/json")
public RangerSecurityZone getSecurityZone(@PathParam("name") String zoneName) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getSecurityZone(name=" + zoneName + ")");
- }
+ LOG.debug("==> getSecurityZone(name={})", zoneName);
if (!bizUtil.hasModuleAccess(RangerConstants.MODULE_SECURITY_ZONE)) {
throw restErrorUtil.createRESTException(STR_USER_NOT_AUTHORIZED_TO_ACCESS_ZONE, MessageEnums.OPER_NO_PERMISSION);
}
RangerSecurityZone ret;
+
try {
ret = securityZoneStore.getSecurityZoneByName(zoneName);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("getSecurityZone(" + zoneName + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("getSecurityZone({}) failed", zoneName, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getSecurityZone(name=" + zoneName + "):" + ret);
- }
+ LOG.debug("<== getSecurityZone(name={}):{}", zoneName, ret);
+
return ret;
}
@GET
@Path("/zones/{id}")
- @Produces({ "application/json" })
+ @Produces("application/json")
public RangerSecurityZone getSecurityZone(@PathParam("id") Long id) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getSecurityZone(id=" + id + ")");
- }
+ LOG.debug("==> getSecurityZone(id={})", id);
if (!bizUtil.hasModuleAccess(RangerConstants.MODULE_SECURITY_ZONE)) {
throw restErrorUtil.createRESTException(STR_USER_NOT_AUTHORIZED_TO_ACCESS_ZONE, MessageEnums.OPER_NO_PERMISSION);
@@ -314,39 +313,39 @@ public class SecurityZoneREST {
}
RangerSecurityZone ret;
+
try {
ret = securityZoneStore.getSecurityZone(id);
- } catch(WebApplicationException excp) {
+ } catch (WebApplicationException excp) {
throw excp;
- } catch(Throwable excp) {
- LOG.error("getSecurityZone(" + id + ") failed", excp);
+ } catch (Throwable excp) {
+ LOG.error("getSecurityZone({}) failed", id, excp);
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getSecurityZone(id=" + id + "):" + ret);
- }
+ LOG.debug("<== getSecurityZone(id={}):{}", id, ret);
+
return ret;
}
@GET
@Path("/zones")
- @Produces({ "application/json" })
+ @Produces("application/json")
public RangerSecurityZoneList getAllZones(@Context HttpServletRequest request) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getAllZones()");
- }
+ LOG.debug("==> getAllZones()");
if (!bizUtil.hasModuleAccess(RangerConstants.MODULE_SECURITY_ZONE)) {
throw restErrorUtil.createRESTException(STR_USER_NOT_AUTHORIZED_TO_ACCESS_ZONE, MessageEnums.OPER_NO_PERMISSION);
}
- RangerSecurityZoneList ret = new RangerSecurityZoneList();
- SearchFilter filter = searchUtil.getSearchFilter(request, securityZoneService.sortFields);
+ RangerSecurityZoneList ret = new RangerSecurityZoneList();
+ SearchFilter filter = searchUtil.getSearchFilter(request, securityZoneService.sortFields);
try {
List<RangerSecurityZone> securityZones = securityZoneStore.getSecurityZones(filter);
+
ret.setSecurityZoneList(securityZones);
+
if (securityZones != null) {
ret.setTotalCount(securityZones.size());
ret.setSortBy(filter.getSortBy());
@@ -361,23 +360,19 @@ public class SecurityZoneREST {
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getAllZones():" + ret);
- }
+ LOG.debug("<== getAllZones():{}", ret);
+
return ret;
}
@GET
@Path("/zone-names/{serviceName}/resource")
- @Produces({ "application/json" })
+ @Produces("application/json")
public Collection<String> getZoneNamesForResource(@PathParam("serviceName") String serviceName, @Context HttpServletRequest request) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> SecurityZoneREST.getZoneNamesForResource(" + serviceName + ")");
- }
+ LOG.debug("==> SecurityZoneREST.getZoneNamesForResource({})", serviceName);
if (!serviceRest.isServiceAdmin(serviceName)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN,
- "User '" + bizUtil.getCurrentUserLoginId() + "' does not have privilege", true);
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN, "User '" + bizUtil.getCurrentUserLoginId() + "' does not have privilege", true);
}
Collection<String> ret = null;
@@ -390,22 +385,16 @@ public class SecurityZoneREST {
ret = policyAdmin.getZoneNamesForResource(resource);
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== SecurityZoneREST.getZoneNamesForResource(" + serviceName + "): ret=" + ret);
- }
+ LOG.debug("<== SecurityZoneREST.getZoneNamesForResource(serviceName={}):{}", serviceName, ret);
return ret;
}
@GET
@Path("/zones/zone-headers/for-service/{serviceId}")
- @Produces({ "application/json" })
- public List<RangerSecurityZoneHeaderInfo> getSecurityZoneHeaderInfoListByServiceId(@PathParam("serviceId") Long serviceId,
- @DefaultValue("false") @QueryParam ("isTagService") Boolean isTagService,
- @Context HttpServletRequest request) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> SecurityZoneREST.getSecurityZoneHeaderInfoListByServiceId() serviceId:{}, isTagService:{}",serviceId,isTagService);
- }
+ @Produces("application/json")
+ public List<RangerSecurityZoneHeaderInfo> getSecurityZoneHeaderInfoListByServiceId(@PathParam("serviceId") Long serviceId, @DefaultValue("false") @QueryParam("isTagService") Boolean isTagService, @Context HttpServletRequest request) {
+ LOG.debug("==> SecurityZoneREST.getSecurityZoneHeaderInfoListByServiceId() serviceId:{}, isTagService:{}", serviceId, isTagService);
List<RangerSecurityZoneHeaderInfo> ret;
@@ -418,27 +407,24 @@ public class SecurityZoneREST {
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== SecurityZoneREST.getSecurityZoneHeaderInfoListByServiceId():" + ret);
- }
+ LOG.debug("<== SecurityZoneREST.getSecurityZoneHeaderInfoListByServiceId():{}", ret);
return ret;
}
@GET
@Path("/summary")
- @Produces({ "application/json" })
+ @Produces("application/json")
public PList<SecurityZoneSummary> getZonesSummary(@Context HttpServletRequest request) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> getZonesSummary()");
- }
+ LOG.debug("==> getZonesSummary()");
if (!bizUtil.hasModuleAccess(RangerConstants.MODULE_SECURITY_ZONE)) {
throw restErrorUtil.createRESTException(STR_USER_NOT_AUTHORIZED_TO_ACCESS_ZONE, MessageEnums.OPER_NO_PERMISSION);
}
- PList<SecurityZoneSummary> ret = null;
- SearchFilter filter = searchUtil.getSearchFilter(request, securityZoneService.sortFields);
+ PList<SecurityZoneSummary> ret;
+ SearchFilter filter = searchUtil.getSearchFilter(request, securityZoneService.sortFields);
+
try {
ret = securityZoneStore.getZonesSummary(filter);
} catch (WebApplicationException excp) {
@@ -449,9 +435,8 @@ public class SecurityZoneREST {
throw restErrorUtil.createRESTException(excp.getMessage());
}
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== getZonesSummary():" + ret);
- }
+ LOG.debug("<== getZonesSummary():{}", ret);
+
return ret;
}
@@ -486,8 +471,8 @@ public class SecurityZoneREST {
RangerSecurityZone zone = getSecurityZone(zoneId);
RangerSecurityZoneHelper zoneHelper = new RangerSecurityZoneHelper(zone, bizUtil.getCurrentUserLoginId());
RangerSecurityZone updatedZone = zoneHelper.updateZone(changeData);
+ RangerSecurityZone retV1 = updateSecurityZone(zoneId, updatedZone);
- RangerSecurityZone retV1 = updateSecurityZone(zoneId, updatedZone);
ret = retV1 != null;
} catch (WebApplicationException excp) {
throw excp;
@@ -571,221 +556,191 @@ public class SecurityZoneREST {
return ret;
}
- private void ensureAdminAccess(){
- if(!bizUtil.isAdmin()){
- String userName = bizUtil.getCurrentUserLoginId();
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN, "Ranger Security Zone is not accessible for user '" + userName + "'.", true);
- }
- }
-
- private void ensureUserAllowOperationOnServiceForZone(
- RangerSecurityZone securityZone){
- if (!bizUtil.isAdmin()) {
- String userName = bizUtil.getCurrentUserLoginId();
- RangerSecurityZone existingSecurityZone = null;
- try {
- existingSecurityZone = svcStore
- .getSecurityZone(securityZone.getId());
- } catch (Exception ex) {
- LOG.error("Unable to get Security Zone with id : " + securityZone.getId(), ex);
- throw restErrorUtil.createRESTException(ex.getMessage());
- }
- if (existingSecurityZone != null) {
- /* Validation for non service related fields of security zone */
-
-
- if (!Objects.equals(securityZone.getName(), existingSecurityZone.getName())) {
- throwRestError("User : " + userName
- + " is not allowed to edit zone name of zone : " + existingSecurityZone.getName());
- } else if (!Objects.equals(securityZone.getDescription(), existingSecurityZone.getDescription())) {
- throwRestError("User : " + userName
- + " is not allowed to edit zone description of zone : " + existingSecurityZone.getName());
- }
- if (!serviceMgr.isZoneAdmin(existingSecurityZone.getName())) {
- if (!Objects.equals(securityZone.getAdminUserGroups(), existingSecurityZone.getAdminUserGroups())) {
- throwRestError("User : "
- + userName
- + " is not allowed to edit zone Admin User Group of zone : " + existingSecurityZone.getName());
- } else if (!Objects.equals(securityZone.getAdminUsers(), existingSecurityZone.getAdminUsers())) {
- throwRestError("User : " + userName
- + " is not allowed to edit zone Admin User of zone : " + existingSecurityZone.getName());
+ private void ensureAdminAccess() {
+ if (!bizUtil.isAdmin()) {
+ String userName = bizUtil.getCurrentUserLoginId();
+
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN, "Ranger Security Zone is not accessible for user '" + userName + "'.", true);
+ }
+ }
+
+ private void ensureUserAllowOperationOnServiceForZone(RangerSecurityZone securityZone) {
+ if (!bizUtil.isAdmin()) {
+ String userName = bizUtil.getCurrentUserLoginId();
+ RangerSecurityZone existingSecurityZone;
+
+ try {
+ existingSecurityZone = svcStore.getSecurityZone(securityZone.getId());
+ } catch (Exception ex) {
+ LOG.error("Unable to get Security Zone with id : {}", securityZone.getId(), ex);
+
+ throw restErrorUtil.createRESTException(ex.getMessage());
+ }
+
+ if (existingSecurityZone != null) {
+ /* Validation for non service related fields of security zone */
+ if (!Objects.equals(securityZone.getName(), existingSecurityZone.getName())) {
+ throwRestError("User : " + userName + " is not allowed to edit zone name of zone : " + existingSecurityZone.getName());
+ } else if (!Objects.equals(securityZone.getDescription(), existingSecurityZone.getDescription())) {
+ throwRestError("User : " + userName + " is not allowed to edit zone description of zone : " + existingSecurityZone.getName());
+ }
+
+ if (!serviceMgr.isZoneAdmin(existingSecurityZone.getName())) {
+ if (!Objects.equals(securityZone.getAdminUserGroups(), existingSecurityZone.getAdminUserGroups())) {
+ throwRestError("User : " + userName + " is not allowed to edit zone Admin User Group of zone : " + existingSecurityZone.getName());
+ } else if (!Objects.equals(securityZone.getAdminUsers(), existingSecurityZone.getAdminUsers())) {
+ throwRestError("User : " + userName + " is not allowed to edit zone Admin User of zone : " + existingSecurityZone.getName());
} else if (!Objects.equals(securityZone.getAdminRoles(), existingSecurityZone.getAdminRoles())) {
- throwRestError("User : " + userName
- + " is not allowed to edit zone Admin Roles of zone : " + existingSecurityZone.getName());
- } else if (!Objects.equals(securityZone.getAuditUsers(), existingSecurityZone.getAuditUsers())) {
- throwRestError("User : " + userName
- + " is not allowed to edit zone Audit User of zone : " + existingSecurityZone.getName());
- } else if (!Objects.equals(securityZone.getAuditUserGroups(), existingSecurityZone.getAuditUserGroups())) {
- throwRestError("User : "
- + userName
- + " is not allowed to edit zone Audit User Group of zone : " + existingSecurityZone.getName());
+ throwRestError("User : " + userName + " is not allowed to edit zone Admin Roles of zone : " + existingSecurityZone.getName());
+ } else if (!Objects.equals(securityZone.getAuditUsers(), existingSecurityZone.getAuditUsers())) {
+ throwRestError("User : " + userName + " is not allowed to edit zone Audit User of zone : " + existingSecurityZone.getName());
+ } else if (!Objects.equals(securityZone.getAuditUserGroups(), existingSecurityZone.getAuditUserGroups())) {
+ throwRestError("User : " + userName + " is not allowed to edit zone Audit User Group of zone : " + existingSecurityZone.getName());
} else if (!Objects.equals(securityZone.getAuditRoles(), existingSecurityZone.getAuditRoles())) {
- throwRestError("User : "
- + userName
- + " is not allowed to edit zone Audit Roles of zone : " + existingSecurityZone.getName());
- }
- }
-
- /*
- * Validation on tag service association / disassociation with
- * security zone
- * */
-
- List<String> dbTagServices = existingSecurityZone
- .getTagServices();
- List<String> uiTagServices = securityZone.getTagServices();
- List<String> addRmvTagSvc = new ArrayList<String>();
- if (!dbTagServices.equals(uiTagServices)) {
- for (String svc : dbTagServices) {
- if (!uiTagServices.contains(svc)) {
- addRmvTagSvc.add(svc);
- }
- }
-
- for (String svc : uiTagServices) {
- if (!dbTagServices.contains(svc)) {
- addRmvTagSvc.add(svc);
- }
- }
- }
- if (!addRmvTagSvc.isEmpty()) {
- for (String svc : addRmvTagSvc) {
- /*
- * if user is neither svc admin nor admin then
- * add/remove of svc in zone is not allowed
- */
- if (!svcStore.isServiceAdminUser(svc, userName)) {
- throwRestError("User : "
- + userName
- + " is not allowed to add/remove tag service : "
- + svc + " in Ranger Security zone : " + existingSecurityZone.getName());
-
- }
- }
- }
-
-
- /*
- * Validation on service association / disassociation with
- * security zone
- */
- Set<String> existingRangerSecurityZoneService = existingSecurityZone
- .getServices().keySet();
- Set<String> newRangerSecurityZoneService = securityZone.getServices()
- .keySet();
- Set<String> diffServiceSet = new HashSet<>(Sets.difference(
- newRangerSecurityZoneService,
- existingRangerSecurityZoneService));
- diffServiceSet.addAll(Sets.difference(
- existingRangerSecurityZoneService,
- newRangerSecurityZoneService));
-
- if (diffServiceSet != null && diffServiceSet.size() > 0) {
- for (String svc : diffServiceSet) {
- /*
- * if user is neither svc admin nor admin then
- * add/remove of svc in zone is not allowed
- */
- if (!svcStore.isServiceAdminUser(svc, userName)) {
- throwRestError("User : "
- + userName
- + " is not allowed to add/remove service : "
- + svc + " in Ranger Security zone : " + existingSecurityZone.getName());
-
- }
- }
- }
-
- /* Validation for resources on existing svc in security zone */
- for (String svc : existingRangerSecurityZoneService) {
- RangerSecurityZoneService rangerSecurityZnSvcFromDB = existingSecurityZone
- .getServices().get(svc);
-
- RangerSecurityZoneService rangerSecurityZnSvcFromUI = securityZone
- .getServices().get(svc);
-
- if (rangerSecurityZnSvcFromUI != null) {
- if (!Objects.equals(rangerSecurityZnSvcFromDB.getResources(), rangerSecurityZnSvcFromUI.getResources())) {
- if (!svcStore.isServiceAdminUser(svc, userName)) {
- throwRestError("User : "
- + userName
- + " is not allowed to edit resource in service : "
- + svc + " in Ranger Security zone : " + existingSecurityZone.getName());
- }
- }
- }
-
- }
- }
-
- }
- }
-
- private void throwRestError(String message){
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN, message, true);
- }
-
-
- private void ensureAdminAccess(RangerSecurityZone securityZone) {
- if (!bizUtil.isAdmin()) {
- String userName = bizUtil.getCurrentUserLoginId();
- throw restErrorUtil.createRESTException(
- "Ranger Securtiy Zone is not accessible for user '" + userName + "'.",
- MessageEnums.OPER_NO_PERMISSION);
- }
- else {
- blockAdminFromKMSService(securityZone);
- }
- }
-
- private void blockAdminFromKMSService(RangerSecurityZone securityZone) {
- if(securityZone != null) {
- Map<String, RangerSecurityZoneService> serviceMap = securityZone.getServices();
- if (serviceMap != null) {
- for (String serviceName : serviceMap.keySet()) {
- XXService xService = daoManager.getXXService().findByName(serviceName);
- if (xService != null) {
- XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
- if (EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(xServiceDef.getImplclassname())) {
- throw restErrorUtil.createRESTException(
- "KMS Services/Service-Defs are not accessible for Zone operations",
- MessageEnums.OPER_NOT_ALLOWED_FOR_ENTITY);
- }
- }
- }
- }
- }
- }
-
- private void removeEmptyEntries(RangerSecurityZone securityZone) {
- bizUtil.removeEmptyStrings(securityZone.getTagServices());
- bizUtil.removeEmptyStrings(securityZone.getAdminUsers());
- bizUtil.removeEmptyStrings(securityZone.getAdminUserGroups());
+ throwRestError("User : " + userName + " is not allowed to edit zone Audit Roles of zone : " + existingSecurityZone.getName());
+ }
+ }
+
+ /*
+ * Validation on tag service association / disassociation with
+ * security zone
+ * */
+
+ List<String> dbTagServices = existingSecurityZone.getTagServices();
+ List<String> uiTagServices = securityZone.getTagServices();
+ List<String> addRmvTagSvc = new ArrayList<>();
+
+ if (!dbTagServices.equals(uiTagServices)) {
+ for (String svc : dbTagServices) {
+ if (!uiTagServices.contains(svc)) {
+ addRmvTagSvc.add(svc);
+ }
+ }
+
+ for (String svc : uiTagServices) {
+ if (!dbTagServices.contains(svc)) {
+ addRmvTagSvc.add(svc);
+ }
+ }
+ }
+
+ if (!addRmvTagSvc.isEmpty()) {
+ for (String svc : addRmvTagSvc) {
+ /*
+ * if user is neither svc admin nor admin then
+ * add/remove of svc in zone is not allowed
+ */
+ if (!svcStore.isServiceAdminUser(svc, userName)) {
+ throwRestError("User : " + userName + " is not allowed to add/remove tag service : " + svc + " in Ranger Security zone : " + existingSecurityZone.getName());
+ }
+ }
+ }
+
+ /*
+ * Validation on service association / disassociation with
+ * security zone
+ */
+ Set<String> existingRangerSecurityZoneService = existingSecurityZone.getServices().keySet();
+ Set<String> newRangerSecurityZoneService = securityZone.getServices().keySet();
+ Set<String> diffServiceSet = new HashSet<>(Sets.difference(newRangerSecurityZoneService, existingRangerSecurityZoneService));
+
+ diffServiceSet.addAll(Sets.difference(existingRangerSecurityZoneService, newRangerSecurityZoneService));
+
+ if (!diffServiceSet.isEmpty()) {
+ for (String svc : diffServiceSet) {
+ /*
+ * if user is neither svc admin nor admin then
+ * add/remove of svc in zone is not allowed
+ */
+ if (!svcStore.isServiceAdminUser(svc, userName)) {
+ throwRestError("User : " + userName + " is not allowed to add/remove service : " + svc + " in Ranger Security zone : " + existingSecurityZone.getName());
+ }
+ }
+ }
+
+ /* Validation for resources on existing svc in security zone */
+ for (String svc : existingRangerSecurityZoneService) {
+ RangerSecurityZoneService rangerSecurityZnSvcFromDB = existingSecurityZone.getServices().get(svc);
+ RangerSecurityZoneService rangerSecurityZnSvcFromUI = securityZone.getServices().get(svc);
+
+ if (rangerSecurityZnSvcFromUI != null) {
+ if (!Objects.equals(rangerSecurityZnSvcFromDB.getResources(), rangerSecurityZnSvcFromUI.getResources())) {
+ if (!svcStore.isServiceAdminUser(svc, userName)) {
+ throwRestError("User : " + userName + " is not allowed to edit resource in service : " + svc + " in Ranger Security zone : " + existingSecurityZone.getName());
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+
+ private void throwRestError(String message) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN, message, true);
+ }
+
+ private void ensureAdminAccess(RangerSecurityZone securityZone) {
+ if (!bizUtil.isAdmin()) {
+ String userName = bizUtil.getCurrentUserLoginId();
+
+ throw restErrorUtil.createRESTException("Ranger Security Zone is not accessible for user '" + userName + "'.", MessageEnums.OPER_NO_PERMISSION);
+ } else {
+ blockAdminFromKMSService(securityZone);
+ }
+ }
+
+ private void blockAdminFromKMSService(RangerSecurityZone securityZone) {
+ if (securityZone != null) {
+ Map<String, RangerSecurityZoneService> serviceMap = securityZone.getServices();
+
+ if (serviceMap != null) {
+ for (String serviceName : serviceMap.keySet()) {
+ XXService xService = daoManager.getXXService().findByName(serviceName);
+
+ if (xService != null) {
+ XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
+
+ if (EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(xServiceDef.getImplclassname())) {
+ throw restErrorUtil.createRESTException("KMS Services/Service-Defs are not accessible for Zone operations", MessageEnums.OPER_NOT_ALLOWED_FOR_ENTITY);
+ }
+ }
+ }
+ }
+ }
+ }
+
+ private void removeEmptyEntries(RangerSecurityZone securityZone) {
+ bizUtil.removeEmptyStrings(securityZone.getTagServices());
+ bizUtil.removeEmptyStrings(securityZone.getAdminUsers());
+ bizUtil.removeEmptyStrings(securityZone.getAdminUserGroups());
bizUtil.removeEmptyStrings(securityZone.getAdminRoles());
- bizUtil.removeEmptyStrings(securityZone.getAuditUsers());
- bizUtil.removeEmptyStrings(securityZone.getAuditUserGroups());
+ bizUtil.removeEmptyStrings(securityZone.getAuditUsers());
+ bizUtil.removeEmptyStrings(securityZone.getAuditUserGroups());
bizUtil.removeEmptyStrings(securityZone.getAdminRoles());
- Map<String, RangerSecurityZoneService> serviceResouceMap=securityZone.getServices();
- if(serviceResouceMap!=null) {
- Set<Map.Entry<String, RangerSecurityZoneService>> serviceResouceMapEntries = serviceResouceMap.entrySet();
- Iterator<Map.Entry<String, RangerSecurityZoneService>> iterator=serviceResouceMapEntries.iterator();
- while (iterator.hasNext()){
- Map.Entry<String, RangerSecurityZoneService> serviceResouceMapEntry = iterator.next();
- RangerSecurityZoneService rangerSecurityZoneService=serviceResouceMapEntry.getValue();
- List<HashMap<String, List<String>>> resources=rangerSecurityZoneService.getResources();
- if(resources!=null) {
- for (Map<String, List<String>> resource : resources) {
- if (resource!=null) {
- for (Map.Entry<String, List<String>> entry : resource.entrySet()) {
- List<String> resourceValues = entry.getValue();
- bizUtil.removeEmptyStrings(resourceValues);
- }
- }
- }
- }
- }
- }
- }
+
+ Map<String, RangerSecurityZoneService> serviceResouceMap = securityZone.getServices();
+
+ if (serviceResouceMap != null) {
+ Set<Map.Entry<String, RangerSecurityZoneService>> serviceResouceMapEntries = serviceResouceMap.entrySet();
+
+ for (Map.Entry<String, RangerSecurityZoneService> serviceResouceMapEntry : serviceResouceMapEntries) {
+ RangerSecurityZoneService rangerSecurityZoneService = serviceResouceMapEntry.getValue();
+ List<HashMap<String, List<String>>> resources = rangerSecurityZoneService.getResources();
+
+ if (resources != null) {
+ for (Map<String, List<String>> resource : resources) {
+ if (resource != null) {
+ for (Map.Entry<String, List<String>> entry : resource.entrySet()) {
+ List<String> resourceValues = entry.getValue();
+
+ bizUtil.removeEmptyStrings(resourceValues);
+ }
+ }
+ }
+ }
+ }
+ }
+ }
private PList<RangerSecurityZoneResource> getResources(RangerSecurityZone zone, String serviceName, @Context HttpServletRequest request) {
RangerSecurityZoneHelper zoneHelper = new RangerSecurityZoneHelper(zone, bizUtil.getCurrentUserLoginId());
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
index 9d2730937..fb1a72995 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
@@ -19,31 +19,9 @@
package org.apache.ranger.rest;
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.SecureRandom;
-import java.util.*;
-import java.util.Map.Entry;
-import java.util.stream.IntStream;
-
-import javax.annotation.Nonnull;
-import javax.annotation.PostConstruct;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-
+import com.google.gson.JsonSyntaxException;
+import com.sun.jersey.core.header.FormDataContentDisposition;
+import com.sun.jersey.multipart.FormDataParam;
import org.apache.commons.collections.CollectionUtils;
import org.apache.commons.collections.MapUtils;
import org.apache.commons.io.IOUtils;
@@ -55,8 +33,8 @@ import org.apache.ranger.authorization.hadoop.config.RangerAdminConfig;
import org.apache.ranger.authorization.utils.StringUtil;
import org.apache.ranger.biz.AssetMgr;
import org.apache.ranger.biz.PolicyRefUpdater;
-import org.apache.ranger.biz.RangerPolicyAdmin;
import org.apache.ranger.biz.RangerBizUtil;
+import org.apache.ranger.biz.RangerPolicyAdmin;
import org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions;
import org.apache.ranger.biz.RoleDBStore;
import org.apache.ranger.biz.SecurityZoneDBStore;
@@ -79,19 +57,28 @@ import org.apache.ranger.common.SortField.SORT_ORDER;
import org.apache.ranger.common.UserSessionBase;
import org.apache.ranger.common.db.RangerTransactionSynchronizationAdapter;
import org.apache.ranger.db.RangerDaoManager;
+import org.apache.ranger.db.XXRoleDao;
import org.apache.ranger.entity.XXPolicy;
import org.apache.ranger.entity.XXPolicyExportAudit;
+import org.apache.ranger.entity.XXPolicyLabel;
+import org.apache.ranger.entity.XXRole;
import org.apache.ranger.entity.XXSecurityZone;
import org.apache.ranger.entity.XXSecurityZoneRefService;
import org.apache.ranger.entity.XXSecurityZoneRefTagService;
import org.apache.ranger.entity.XXService;
import org.apache.ranger.entity.XXServiceDef;
import org.apache.ranger.entity.XXTrxLogV2;
-import org.apache.ranger.entity.XXRole;
-import org.apache.ranger.plugin.model.*;
+import org.apache.ranger.plugin.model.RangerPluginInfo;
+import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemAccess;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyResource;
+import org.apache.ranger.plugin.model.RangerPolicyDelta;
+import org.apache.ranger.plugin.model.RangerPolicyResourceSignature;
+import org.apache.ranger.plugin.model.RangerService;
+import org.apache.ranger.plugin.model.RangerServiceDef;
+import org.apache.ranger.plugin.model.RangerServiceHeaderInfo;
+import org.apache.ranger.plugin.model.ServiceDeleteResponse;
import org.apache.ranger.plugin.model.validation.RangerPolicyValidator;
import org.apache.ranger.plugin.model.validation.RangerServiceDefHelper;
import org.apache.ranger.plugin.model.validation.RangerServiceDefValidator;
@@ -140,4533 +127,4528 @@ import org.springframework.stereotype.Component;
import org.springframework.transaction.annotation.Propagation;
import org.springframework.transaction.annotation.Transactional;
-import com.google.gson.JsonSyntaxException;
-import com.sun.jersey.core.header.FormDataContentDisposition;
-import com.sun.jersey.multipart.FormDataParam;
+import javax.annotation.Nonnull;
+import javax.annotation.PostConstruct;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.DefaultValue;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MediaType;
-import static org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_GDS_NAME;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.ListIterator;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.Objects;
+import java.util.Set;
+import java.util.TreeMap;
+import java.util.stream.IntStream;
+import static org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_GDS_NAME;
@Path("plugins")
@Component
@Scope("request")
@Transactional(propagation = Propagation.REQUIRES_NEW)
public class ServiceREST {
- private static final Logger LOG = LoggerFactory.getLogger(ServiceREST.class);
- private static final Logger PERF_LOG = RangerPerfTracer.getPerfLogger("rest.ServiceREST");
-
- final static public String PARAM_SERVICE_NAME = "serviceName";
- final static public String PARAM_SERVICE_TYPE = "serviceType";
- final static public String PARAM_POLICY_NAME = "policyName";
- final static public String PARAM_ZONE_NAME = "zoneName";
- final static public String PARAM_UPDATE_IF_EXISTS = "updateIfExists";
- final static public String PARAM_MERGE_IF_EXISTS = "mergeIfExists";
- final static public String PARAM_DELETE_IF_EXISTS = "deleteIfExists";
- final static public String PARAM_IMPORT_IN_PROGRESS = "importInProgress";
- public static final String Allowed_User_List_For_Download = "policy.download.auth.users";
- public static final String Allowed_User_List_For_Grant_Revoke = "policy.grantrevoke.auth.users";
-
- public static final String isCSRF_ENABLED = "ranger.rest-csrf.enabled";
- public static final String BROWSER_USER_AGENT_PARAM = "ranger.rest-csrf.browser-useragents-regex";
- public static final String CUSTOM_METHODS_TO_IGNORE_PARAM = "ranger.rest-csrf.methods-to-ignore";
- public static final String CUSTOM_HEADER_PARAM = "ranger.rest-csrf.custom-header";
- public static final String CSRF_TOKEN_LENGTH = "ranger.rest-csrf.token.length";
- final static public String POLICY_MATCHING_ALGO_BY_POLICYNAME = "matchByName";
- final static public String POLICY_MATCHING_ALGO_BY_RESOURCE = "matchByPolicySignature";
- final static public String PARAM_POLICY_MATCHING_ALGORITHM = "policyMatchingAlgorithm";
-
- public static final String PURGE_RECORD_TYPE_LOGIN_LOGS = "login_records";
- public static final String PURGE_RECORD_TYPE_TRX_LOGS = "trx_records";
- public static final String PURGE_RECORD_TYPE_POLICY_EXPORT_LOGS = "policy_export_logs";
-
- @Autowired
- RESTErrorUtil restErrorUtil;
-
- @Autowired
- ServiceMgr serviceMgr;
-
- @Autowired
- XUserService xUserService;
-
- @Autowired
- AssetMgr assetMgr;
-
- @Autowired
- XUserMgr userMgr;
-
- @Autowired
- ServiceDBStore svcStore;
-
- @Autowired
- RoleDBStore roleDBStore;
-
- @Autowired
- SecurityZoneDBStore zoneStore;
-
- @Autowired
- ServiceUtil serviceUtil;
-
- @Autowired
- RangerPolicyService policyService;
-
- @Autowired
- RangerPolicyLabelsService policyLabelsService;
-
- @Autowired
- RangerServiceService svcService;
-
- @Autowired
- RangerServiceDefService serviceDefService;
-
- @Autowired
+ private static final Logger LOG = LoggerFactory.getLogger(ServiceREST.class);
+ private static final Logger PERF_LOG = RangerPerfTracer.getPerfLogger("rest.ServiceREST");
+
+ public static final String PARAM_SERVICE_NAME = "serviceName";
+ public static final String PARAM_SERVICE_TYPE = "serviceType";
+ public static final String PARAM_POLICY_NAME = "policyName";
+ public static final String PARAM_ZONE_NAME = "zoneName";
+ public static final String PARAM_UPDATE_IF_EXISTS = "updateIfExists";
+ public static final String PARAM_MERGE_IF_EXISTS = "mergeIfExists";
+ public static final String PARAM_DELETE_IF_EXISTS = "deleteIfExists";
+ public static final String PARAM_IMPORT_IN_PROGRESS = "importInProgress";
+ public static final String Allowed_User_List_For_Download = "policy.download.auth.users";
+ public static final String Allowed_User_List_For_Grant_Revoke = "policy.grantrevoke.auth.users";
+ public static final String isCSRF_ENABLED = "ranger.rest-csrf.enabled";
+ public static final String BROWSER_USER_AGENT_PARAM = "ranger.rest-csrf.browser-useragents-regex";
+ public static final String CUSTOM_METHODS_TO_IGNORE_PARAM = "ranger.rest-csrf.methods-to-ignore";
+ public static final String CUSTOM_HEADER_PARAM = "ranger.rest-csrf.custom-header";
+ public static final String CSRF_TOKEN_LENGTH = "ranger.rest-csrf.token.length";
+ public static final String POLICY_MATCHING_ALGO_BY_POLICYNAME = "matchByName";
+ public static final String POLICY_MATCHING_ALGO_BY_RESOURCE = "matchByPolicySignature";
+ public static final String PARAM_POLICY_MATCHING_ALGORITHM = "policyMatchingAlgorithm";
+ public static final String PURGE_RECORD_TYPE_LOGIN_LOGS = "login_records";
+ public static final String PURGE_RECORD_TYPE_TRX_LOGS = "trx_records";
+ public static final String PURGE_RECORD_TYPE_POLICY_EXPORT_LOGS = "policy_export_logs";
+
+ private final RangerAdminConfig config = RangerAdminConfig.getInstance();
+ private final int maxPolicyNameLength = config.getInt("ranger.policyname.maxlength", 255);
+ private final boolean isPolicyNameLengthValidationEnabled = config.getBoolean("ranger.policyname.maxlength.validation.enabled", true);
+
+ @Autowired
+ RESTErrorUtil restErrorUtil;
+
+ @Autowired
+ ServiceMgr serviceMgr;
+
+ @Autowired
+ XUserService xUserService;
+
+ @Autowired
+ AssetMgr assetMgr;
+
+ @Autowired
+ XUserMgr userMgr;
+
+ @Autowired
+ ServiceDBStore svcStore;
+
+ @Autowired
+ RoleDBStore roleDBStore;
+
+ @Autowired
+ SecurityZoneDBStore zoneStore;
+
+ @Autowired
+ ServiceUtil serviceUtil;
+
+ @Autowired
+ RangerPolicyService policyService;
+
+ @Autowired
+ RangerPolicyLabelsService<XXPolicyLabel, ?> policyLabelsService;
+
+ @Autowired
+ RangerServiceService svcService;
+
+ @Autowired
+ RangerServiceDefService serviceDefService;
+
+ @Autowired
RangerPluginInfoService pluginInfoService;
- @Autowired
- RangerSearchUtil searchUtil;
-
+ @Autowired
+ RangerSearchUtil searchUtil;
+
@Autowired
RangerBizUtil bizUtil;
- @Autowired
- GUIDUtil guidUtil;
-
- @Autowired
- RangerValidatorFactory validatorFactory;
-
- @Autowired
- RangerDaoManager daoManager;
-
- @Autowired
- TagDBStore tagStore;
-
- @Autowired
- RangerTransactionSynchronizationAdapter rangerTransactionSynchronizationAdapter;
-
- private RangerPolicyEngineOptions delegateAdminOptions;
- private RangerPolicyEngineOptions policySearchAdminOptions;
- private RangerPolicyEngineOptions defaultAdminOptions;
- private final RangerAdminConfig config = RangerAdminConfig.getInstance();
-
- private final int maxPolicyNameLength = config.getInt("ranger.policyname.maxlength", 255);
- private final boolean isPolicyNameLengthValidationEnabled = config.getBoolean("ranger.policyname.maxlength.validation.enabled", true);
-
- public ServiceREST() {
- }
-
- @PostConstruct
- public void initStore() {
- tagStore.setServiceStore(svcStore);
- delegateAdminOptions = getDelegatedAdminPolicyEngineOptions();
- policySearchAdminOptions = getPolicySearchRangerAdminPolicyEngineOptions();
- defaultAdminOptions = getDefaultRangerAdminPolicyEngineOptions();
- }
-
- @POST
- @Path("/definitions")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_SERVICE_DEF + "\")")
- public RangerServiceDef createServiceDef(RangerServiceDef serviceDef) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.createServiceDef(" + serviceDef + ")");
- }
-
- RangerServiceDef ret = null;
- RangerPerfTracer perf = null;
-
- /**
- * If display name is blank (EMPTY String or NULL), use name.
- */
- if (StringUtils.isBlank(serviceDef.getDisplayName())) {
- serviceDef.setDisplayName(serviceDef.getName());
- }
-
- try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.createServiceDef(serviceDefName=" + serviceDef.getName() + ")");
- }
- RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
- validator.validate(serviceDef, Action.CREATE);
-
- bizUtil.hasAdminPermissions("Service-Def");
- bizUtil.hasKMSPermissions("Service-Def", serviceDef.getImplClass());
- bizUtil.blockAuditorRoleUser();
- ret = svcStore.createServiceDef(serviceDef);
- } catch(WebApplicationException excp) {
- throw excp;
- } catch(Throwable excp) {
- LOG.error("createServiceDef(" + serviceDef + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.createServiceDef(" + serviceDef + "): " + ret);
- }
-
- return ret;
- }
-
- @PUT
- @Path("/definitions/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_SERVICE_DEF + "\")")
- public RangerServiceDef updateServiceDef(RangerServiceDef serviceDef, @PathParam("id") Long id) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.updateServiceDef(serviceDefName=" + serviceDef.getName() + ")");
- }
-
- // if serviceDef.id and param 'id' are specified, serviceDef.id should be same as the param 'id'
- // if serviceDef.id is null, then set param 'id' into serviceDef Object
- if (serviceDef.getId() == null) {
- serviceDef.setId(id);
- } else if(StringUtils.isBlank(serviceDef.getName()) && !serviceDef.getId().equals(id)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST , "serviceDef Id mismatch", true);
- }
-
- RangerServiceDef ret = null;
- RangerPerfTracer perf = null;
-
- try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.updateServiceDef(" + serviceDef.getName() + ")");
- }
-
- /**
- * If display name is blank (EMPTY String or NULL), use previous display name.
- */
- if (StringUtils.isBlank(serviceDef.getDisplayName())) {
- RangerServiceDef rangerServiceDef = svcStore.getServiceDef(serviceDef.getId());
-
- // If previous display name is blank (EMPTY String or NULL), user name.
- if (Objects.isNull(rangerServiceDef) || StringUtils.isBlank(rangerServiceDef.getDisplayName())) {
- serviceDef.setDisplayName(serviceDef.getName());
- } else {
- serviceDef.setDisplayName(rangerServiceDef.getDisplayName());
- }
- }
-
- RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
- validator.validate(serviceDef, Action.UPDATE);
-
- bizUtil.hasAdminPermissions("Service-Def");
- bizUtil.hasKMSPermissions("Service-Def", serviceDef.getImplClass());
- bizUtil.blockAuditorRoleUser();
- ret = svcStore.updateServiceDef(serviceDef);
- } catch(WebApplicationException excp) {
- throw excp;
- } catch(Throwable excp) {
- LOG.error("updateServiceDef(" + serviceDef + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.updateServiceDef(" + serviceDef + "): " + ret);
- }
-
- return ret;
- }
-
- @DELETE
- @Path("/definitions/{id}")
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DELETE_SERVICE_DEF + "\")")
- public void deleteServiceDef(@PathParam("id") Long id, @Context HttpServletRequest request) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.deleteServiceDef(" + id + ")");
- }
- RangerPerfTracer perf = null;
-
- try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.deleteServiceDef(serviceDefId=" + id + ")");
- }
- RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
- validator.validate(id, Action.DELETE);
-
- bizUtil.hasAdminPermissions("Service-Def");
- XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(id);
- if (xServiceDef != null) {
- bizUtil.hasKMSPermissions("Service-Def", xServiceDef.getImplclassname());
-
- String forceDeleteStr = request.getParameter("forceDelete");
- boolean forceDelete = false;
- if (!StringUtils.isEmpty(forceDeleteStr) && "true".equalsIgnoreCase(forceDeleteStr)) {
- forceDelete = true;
- }
-
- svcStore.deleteServiceDef(id, forceDelete);
- } else {
- LOG.error("Cannot retrieve service-definition:[" + id + "] for deletion");
- throw new Exception("deleteServiceDef(" + id + ") failed");
- }
- } catch(WebApplicationException excp) {
- throw excp;
- } catch(Throwable excp) {
- LOG.error("deleteServiceDef(" + id + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.deleteServiceDef(" + id + ")");
- }
- }
-
- @GET
- @Path("/definitions/{id}")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_SERVICE_DEF + "\")")
- public RangerServiceDef getServiceDef(@PathParam("id") Long id) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.getServiceDef(" + id + ")");
- }
-
- RangerServiceDef ret = null;
- RangerPerfTracer perf = null;
-
- try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.getServiceDef(serviceDefId=" + id + ")");
- }
- XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(id);
- if (xServiceDef != null) {
- if (EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME.equals(xServiceDef.getName())) {
- if (!bizUtil.hasModuleAccess(RangerConstants.MODULE_TAG_BASED_POLICIES)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN,
- "User is not having permissions on the tag module.", true);
- }
- }
- if (!bizUtil.hasAccess(xServiceDef, null)) {
- throw restErrorUtil.createRESTException(
- "User is not allowed to access service-def, id: " + xServiceDef.getId(),
- MessageEnums.OPER_NO_PERMISSION);
- }
- }
-
- ret = svcStore.getServiceDef(id);
- } catch(WebApplicationException excp) {
- throw excp;
- } catch(Throwable excp) {
- LOG.error("getServiceDef(" + id + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if(ret == null) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "Not found", true);
- }
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.getServiceDef(" + id + "): " + ret);
- }
-
- return ret;
- }
-
- @GET
- @Path("/definitions/name/{name}")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_SERVICE_DEF_BY_NAME + "\")")
- public RangerServiceDef getServiceDefByName(@PathParam("name") String name) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.getServiceDefByName(serviceDefName=" + name + ")");
- }
-
- RangerServiceDef ret = null;
- RangerPerfTracer perf = null;
-
- try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.getServiceDefByName(" + name + ")");
- }
- XXServiceDef xServiceDef = daoManager.getXXServiceDef().findByName(name);
- if (xServiceDef != null) {
- if(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME.equals(xServiceDef.getName())) {
- if (!bizUtil.hasModuleAccess(RangerConstants.MODULE_TAG_BASED_POLICIES)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN, "User is not having permissions on the tag module", true);
- }
- }
- if (!bizUtil.hasAccess(xServiceDef, null)) {
- throw restErrorUtil.createRESTException(
- "User is not allowed to access service-def: " + xServiceDef.getName(),
- MessageEnums.OPER_NO_PERMISSION);
- }
- }
-
- ret = svcStore.getServiceDefByName(name);
- } catch(WebApplicationException excp) {
- throw excp;
- } catch(Throwable excp) {
- LOG.error("getServiceDefByName(" + name + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if(ret == null) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "Not found", true);
- }
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.getServiceDefByName(" + name + "): " + ret);
- }
-
- return ret;
- }
-
- @GET
- @Path("/definitions")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_SERVICE_DEFS + "\")")
- public RangerServiceDefList getServiceDefs(@Context HttpServletRequest request) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.getServiceDefs()");
- }
-
- if (!bizUtil.hasModuleAccess(RangerConstants.MODULE_RESOURCE_BASED_POLICIES)) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN, "User is not having permissions on the "+RangerConstants.MODULE_RESOURCE_BASED_POLICIES+" module.", true);
- }
-
- RangerServiceDefList ret = null;
- RangerPerfTracer perf = null;
-
- PList<RangerServiceDef> paginatedSvcDefs = null;
-
- SearchFilter filter = searchUtil.getSearchFilter(request, serviceDefService.sortFields);
- String pageSource= null;
- pageSource=request.getParameter("pageSource");
- if(pageSource!=null)
- filter.setParam("pageSource",pageSource);
-
- try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.getServiceDefs()");
- }
- paginatedSvcDefs = svcStore.getPaginatedServiceDefs(filter);
-
- if(paginatedSvcDefs != null) {
- ret = new RangerServiceDefList();
-
- ret.setServiceDefs(paginatedSvcDefs.getList());
- ret.setPageSize(paginatedSvcDefs.getPageSize());
- ret.setResultSize(paginatedSvcDefs.getResultSize());
- ret.setStartIndex(paginatedSvcDefs.getStartIndex());
- ret.setTotalCount(paginatedSvcDefs.getTotalCount());
- ret.setSortBy(paginatedSvcDefs.getSortBy());
- ret.setSortType(paginatedSvcDefs.getSortType());
- }
- } catch(WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("getServiceDefs() failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.getServiceDefs(): count=" + (ret == null ? 0 : ret.getListSize()));
- }
- return ret;
- }
-
- @GET
- @Path("/policies/{serviceDefName}/for-resource")
- @Produces({ "application/json" })
- public List<RangerPolicy> getPoliciesForResource(@PathParam("serviceDefName") String serviceDefName,
- @DefaultValue("") @QueryParam("serviceName") String serviceName,
- @Context HttpServletRequest request) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.getPoliciesForResource(service-type=" + serviceDefName + ", service-name=" + serviceName + ")");
- }
-
- List<RangerPolicy> ret = new ArrayList<>();
-
- List<RangerService> services = new ArrayList<>();
- Map<String, Object> resource = new HashMap<>();
-
- String validationMessage = validateResourcePoliciesRequest(serviceDefName, serviceName, request, services, resource);
-
- if (StringUtils.isNotEmpty(validationMessage)) {
- LOG.error("Invalid request: [" + validationMessage + "]");
- throw restErrorUtil.createRESTException(validationMessage,
- MessageEnums.INVALID_INPUT_DATA);
- } else {
- RangerService service = services.get(0);
- if (LOG.isDebugEnabled()) {
- LOG.debug("getServicePolicies with service-name=" + service.getName());
- }
-
- RangerPolicyAdmin policyAdmin = null;
-
- try {
- policyAdmin = getPolicyAdminForSearch(service.getName());
- } catch (Exception e) {
- LOG.error("Cannot initialize Policy-Engine", e);
- throw restErrorUtil.createRESTException("Cannot initialize Policy Engine",
- MessageEnums.ERROR_SYSTEM);
- }
-
- if (policyAdmin != null) {
- ret = policyAdmin.getMatchingPolicies(new RangerAccessResourceImpl(resource));
- ret = applyAdminAccessFilter(ret);
- }
-
- }
-
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.getPoliciesForResource(service-type=" + serviceDefName + ", service-name=" + serviceName + ") : " + ret.toString());
- }
- return ret;
- }
-
- private String validateResourcePoliciesRequest(String serviceDefName, String serviceName, HttpServletRequest request, List<RangerService> services, Map<String, Object> resource) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.validatePoliciesForResourceRequest(service-type=" + serviceDefName + ", service-name=" + serviceName + ")");
- }
- final String ret;
-
- if (MapUtils.isNotEmpty(request.getParameterMap())) {
- for (Entry<String, String[]> e : request.getParameterMap().entrySet()) {
- String name = e.getKey();
- String[] values = e.getValue();
-
- if (!StringUtils.isEmpty(name) && !ArrayUtils.isEmpty(values)
- && name.startsWith(SearchFilter.RESOURCE_PREFIX)) {
- resource.put(name.substring(SearchFilter.RESOURCE_PREFIX.length()), values[0]);
- }
- }
- }
- if (MapUtils.isEmpty(resource)) {
- ret = "No resource specified";
- } else {
- RangerServiceDef serviceDef = null;
- try {
- serviceDef = svcStore.getServiceDefByName(serviceDefName);
- } catch (Exception e) {
- LOG.error("Invalid service-type:[" + serviceDefName + "]", e);
- }
- if (serviceDef == null) {
- ret = "Invalid service-type:[" + serviceDefName + "]";
- } else {
- Set<String> resourceDefNames = resource.keySet();
- RangerServiceDefHelper serviceDefHelper = new RangerServiceDefHelper(serviceDef);
- Set<List<RangerServiceDef.RangerResourceDef>> resourceHierarchies = serviceDefHelper.getResourceHierarchies(RangerPolicy.POLICY_TYPE_ACCESS, resourceDefNames);
- if (CollectionUtils.isEmpty(resourceHierarchies)) {
- ret = "Invalid resource specified: resource-names:" + resourceDefNames +" are not part of any valid resource hierarchy for service-type:[" + serviceDefName + "]";
- } else {
- if (StringUtils.isNotBlank(serviceName)) {
- RangerService service = null;
- try {
- service = svcStore.getServiceByName(serviceName);
- } catch (Exception e) {
- LOG.error("Invalid service-name:[" + serviceName + "]");
- }
- if (service == null || !StringUtils.equals(service.getType(), serviceDefName)) {
- ret = "Invalid service-name:[" + serviceName + "] or service-type:[" + serviceDefName + "]";
- } else {
- services.add(service);
- ret = StringUtils.EMPTY;
- }
- } else {
- SearchFilter filter = new SearchFilter();
- filter.setParam(SearchFilter.SERVICE_TYPE, serviceDefName);
- List<RangerService> serviceList = null;
- try {
- serviceList = svcStore.getServices(filter);
- } catch (Exception e) {
- LOG.error("Cannot find service of service-type:[" + serviceDefName + "]");
- }
- if (CollectionUtils.isEmpty(serviceList) || serviceList.size() != 1) {
- ret = "Either 0 or more than 1 services found for service-type :[" + serviceDefName + "]";
- } else {
- services.add(serviceList.get(0));
- ret = StringUtils.EMPTY;
- }
- }
- }
- }
- }
-
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.validatePoliciesForResourceRequest(service-type=" + serviceDefName + ", service-name=" + serviceName + ") : " + ret);
- }
- return ret;
- }
-
- @POST
- @Path("/services")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_SERVICE + "\")")
- public RangerService createService(RangerService service) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.createService(" + service + ")");
- }
-
- RangerService ret = null;
- RangerPerfTracer perf = null;
-
- /**
- * If display name is blank (EMPTY String or NULL), use name.
- */
- if (StringUtils.isBlank(service.getDisplayName())) {
- service.setDisplayName(service.getName());
- }
-
- try {
-
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.createService(serviceName=" + service.getName() + ")");
- }
- RangerServiceValidator validator = validatorFactory.getServiceValidator(svcStore);
- validator.validate(service, Action.CREATE);
-
- if(!StringUtils.isEmpty(service.getName().trim())){
- service.setName(service.getName().trim());
- }
-
- if(!StringUtils.isEmpty(service.getDisplayName().trim())){
- service.setDisplayName(service.getDisplayName().trim());
- }
-
- UserSessionBase session = ContextUtil.getCurrentUserSession();
- XXServiceDef xxServiceDef = daoManager.getXXServiceDef().findByName(service.getType());
- if(session != null && !session.isSpnegoEnabled()){
- bizUtil.hasAdminPermissions("Services");
-
- // TODO: As of now we are allowing SYS_ADMIN to create all the
- // services including KMS
- bizUtil.hasKMSPermissions("Service", xxServiceDef.getImplclassname());
- }
- if(session != null && session.isSpnegoEnabled()){
- if (session.isKeyAdmin() && !EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(xxServiceDef.getImplclassname())) {
- throw restErrorUtil.createRESTException("KeyAdmin can create/update/delete only KMS ",
- MessageEnums.OPER_NO_PERMISSION);
- }
- if ((!session.isKeyAdmin() && !session.isUserAdmin()) && EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(xxServiceDef.getImplclassname())) {
- throw restErrorUtil.createRESTException("User cannot create/update/delete KMS Service",
- MessageEnums.OPER_NO_PERMISSION);
- }
- }
- bizUtil.blockAuditorRoleUser();
-
- String serviceType = xxServiceDef != null ? xxServiceDef.getName() : null;
-
- if (StringUtils.isBlank(service.getTagService()) &&
- !StringUtils.equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME, serviceType) &&
- !StringUtils.equals(EMBEDDED_SERVICEDEF_GDS_NAME, serviceType) &&
- !StringUtils.equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME , serviceType)) {
- createOrGetLinkedServices(service);
- }
-
- ret = svcStore.createService(service);
- } catch(WebApplicationException excp) {
- throw excp;
- } catch(Throwable excp) {
- LOG.error("createService(" + service + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.createService(" + service + "): " + ret);
- }
-
- return ret;
- }
-
- @PUT
- @Path("/services/{id}")
- @Consumes({ "application/json" })
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_SERVICE + "\")")
- public RangerService updateService(RangerService service,
- @Context HttpServletRequest request) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.updateService(): " + service);
- }
-
- RangerService ret = null;
- RangerPerfTracer perf = null;
-
- try {
-
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.updateService(serviceName=" + service.getName() + ")");
- }
-
- /**
- * If display name is blank (EMPTY String or NULL), use previous display name.
- */
- if (StringUtils.isBlank(service.getDisplayName())) {
- RangerService rangerService = svcStore.getService(service.getId());
-
- // If previous display name is blank (EMPTY String or NULL), user name.
- if (Objects.isNull(rangerService) || StringUtils.isBlank(rangerService.getDisplayName())) {
- service.setDisplayName(service.getName());
- } else {
- service.setDisplayName(rangerService.getDisplayName());
- }
- }
-
- RangerServiceValidator validator = validatorFactory.getServiceValidator(svcStore);
- validator.validate(service, Action.UPDATE);
-
- if(!StringUtils.isEmpty(service.getName().trim())){
- service.setName(service.getName().trim());
- }
-
- if(!StringUtils.isEmpty(service.getDisplayName().trim())){
- service.setDisplayName(service.getDisplayName().trim());
- }
-
- bizUtil.hasAdminPermissions("Services");
-
- // TODO: As of now we are allowing SYS_ADMIN to create all the
- // services including KMS
-
- XXServiceDef xxServiceDef = daoManager.getXXServiceDef().findByName(service.getType());
- bizUtil.hasKMSPermissions("Service", xxServiceDef.getImplclassname());
- bizUtil.blockAuditorRoleUser();
- Map<String, Object> options = getOptions(request);
+ @Autowired
+ GUIDUtil guidUtil;
- ret = svcStore.updateService(service, options);
- } catch(WebApplicationException excp) {
- throw excp;
- } catch(Throwable excp) {
- LOG.error("updateService(" + service + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.updateService(" + service + "): " + ret);
- }
-
- return ret;
- }
-
- @DELETE
- @Path("/services/{id}")
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DELETE_SERVICE + "\")")
- public void deleteService(@PathParam("id") Long id) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.deleteService(" + id + ")");
- }
-
- String deletedServiceName = deleteServiceById(id);
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.deleteService() - [id="+deletedServiceName + "],[deletedServiceName="+deletedServiceName+"]");
- }
- }
-
- @GET
- @Path("/services/{id}")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_SERVICE + "\")")
- public RangerService getService(@PathParam("id") Long id) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.getService(" + id + ")");
- }
-
- RangerService ret = null;
- RangerPerfTracer perf = null;
-
- try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.getService(serviceId=" + id + ")");
- }
- ret = svcStore.getService(id);
-
- if (ret != null) {
- UserSessionBase userSession = ContextUtil
- .getCurrentUserSession();
- if (userSession != null && userSession.getLoginId() != null) {
- VXUser loggedInVXUser = xUserService
- .getXUserByUserName(userSession.getLoginId());
- if (loggedInVXUser != null) {
- if (loggedInVXUser.getUserRoleList().size() == 1
- && loggedInVXUser.getUserRoleList().contains(
- RangerConstants.ROLE_USER)) {
-
- ret = hideCriticalServiceDetailsForRoleUser(ret);
- }
- }
- }
- }
- } catch(WebApplicationException excp) {
- throw excp;
- } catch(Throwable excp) {
- LOG.error("getService(" + id + ") failed", excp);
-
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
- }
-
- if(ret == null) {
- throw restErrorUtil.createRESTException(HttpServletResponse.SC_NOT_FOUND, "Not found", true);
- }
-
- if(LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceREST.getService(" + id + "): " + ret);
- }
-
- return ret;
- }
-
- @GET
- @Path("/services/name/{name}")
- @Produces({ "application/json" })
- @PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.GET_SERVICE_BY_NAME + "\")")
- public RangerService getServiceByName(@PathParam("name") String name) {
- if(LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceREST.getServiceByName(" + name + ")");
- }
-
- RangerService ret = null;
- RangerPerfTracer perf = null;
-
- try {
- if(RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
... 17656 lines suppressed ...