You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ve...@apache.org on 2021/02/04 15:30:53 UTC
[ranger] branch ranger-2.2 updated (52a0f3d -> 0c72d21)
This is an automated email from the ASF dual-hosted git repository.
vel pushed a change to branch ranger-2.2
in repository https://gitbox.apache.org/repos/asf/ranger.git.
from 52a0f3d RANGER-3153: Updated TLS version to 1.2 for ranger
new 036fe4d RANGER-3124: Search filter with user name having non latin character is not working on Audit>>Access tab
new 345296f RANGER-3105 : Upgrade Ranger Tomcat to 8.5 or 9.0
new 0c72d21 RANGER-3149 : Adding exisitng policy check for PatchForKafkaServiceDefUpdate_J10033
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
embeddedwebserver/pom.xml | 10 -
.../ranger/server/tomcat/EmbeddedServer.java | 2 +-
pom.xml | 2 +-
.../java/org/apache/ranger/common/StringUtil.java | 4 +-
.../PatchForKafkaServiceDefUpdate_J10033.java | 207 ++++++++++++---------
.../src/main/webapp/META-INF/context.xml | 6 +-
6 files changed, 125 insertions(+), 106 deletions(-)
[ranger] 03/03: RANGER-3149 : Adding exisitng policy check for
PatchForKafkaServiceDefUpdate_J10033
Posted by ve...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
vel pushed a commit to branch ranger-2.2
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 0c72d21ca917327ce25ef4bfb54ff0316de643d0
Author: Dhaval B. Shah <dh...@gmail.com>
AuthorDate: Tue Jan 12 21:50:32 2021 +0530
RANGER-3149 : Adding exisitng policy check for PatchForKafkaServiceDefUpdate_J10033
Signed-off-by: Velmurugan Periasamy <ve...@apache.org>
---
.../PatchForKafkaServiceDefUpdate_J10033.java | 207 ++++++++++++---------
1 file changed, 118 insertions(+), 89 deletions(-)
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10033.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10033.java
index 5b80cc2..6a869ce 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10033.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10033.java
@@ -17,6 +17,7 @@
package org.apache.ranger.patch;
+import org.apache.commons.collections.CollectionUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.log4j.Logger;
import org.apache.ranger.authorization.utils.JsonUtils;
@@ -266,7 +267,7 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
Long xServiceDefId = xXServiceDefObj.getId();
List<XXService> xxServices = daoMgr.getXXService().findByServiceDefId(xServiceDefId);
-
+
for (XXService xxService : xxServices) {
int resourceMapOrder = 0;
XXPolicy xxPolicy = new XXPolicy();
@@ -284,105 +285,133 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
xxPolicy.setPolicyText(JsonUtils.objectToJson(rangerPolicy));
xxPolicy.setResourceSignature(rangerPolicy.getResourceSignature());
xxPolicy.setZoneId(1L);
- XXPolicy createdPolicy = daoMgr.getXXPolicy().create(xxPolicy);
-
- XXPolicyItem xxPolicyItem = new XXPolicyItem();
- xxPolicyItem.setIsEnabled(Boolean.TRUE);
- xxPolicyItem.setDelegateAdmin(Boolean.TRUE);
- xxPolicyItem.setItemType(0);
- xxPolicyItem.setOrder(0);
- xxPolicyItem.setAddedByUserId(currentUserId);
- xxPolicyItem.setUpdatedByUserId(currentUserId);
- xxPolicyItem.setPolicyId(createdPolicy.getId());
- XXPolicyItem createdXXPolicyItem = daoMgr.getXXPolicyItem().create(xxPolicyItem);
-
- List<String> accessTypes = getAccessTypes();
- for (int i = 0; i < accessTypes.size(); i++) {
- XXAccessTypeDef xAccTypeDef = daoMgr.getXXAccessTypeDef().findByNameAndServiceId(accessTypes.get(i),
- xxPolicy.getService());
- if (xAccTypeDef == null) {
- throw new RuntimeException(accessTypes.get(i) + ": is not a valid access-type. policy='"
- + xxPolicy.getName() + "' service='" + xxPolicy.getService() + "'");
- }
- XXPolicyItemAccess xPolItemAcc = new XXPolicyItemAccess();
- xPolItemAcc.setIsAllowed(Boolean.TRUE);
- xPolItemAcc.setType(xAccTypeDef.getId());
- xPolItemAcc.setOrder(i);
- xPolItemAcc.setAddedByUserId(currentUserId);
- xPolItemAcc.setUpdatedByUserId(currentUserId);
- xPolItemAcc.setPolicyitemid(createdXXPolicyItem.getId());
- daoMgr.getXXPolicyItemAccess().create(xPolItemAcc);
- }
+ boolean policyExist = false;
+ try {
+ List<RangerPolicy> rangerpolicies = svcDBStore.getPoliciesByResourceSignature(xxService.getName(),
+ rangerPolicy.getResourceSignature(), true);
+ if (CollectionUtils.isNotEmpty(rangerpolicies)) {
+ for (RangerPolicy rPolicy : rangerpolicies) {
+ if (rangerPolicy != null) {
+ if (logger.isDebugEnabled()) {
+ logger.debug("print Policy: " + rPolicy);
+ logger.debug("policy found with resource " + rPolicy.getResources()
+ + " and ResourceSignature " + rPolicy.getResourceSignature()
+ + " service name : " + rPolicy.getService());
+ }
- for (int i = 0; i < DEFAULT_POLICY_USERS.size(); i++) {
- String user = DEFAULT_POLICY_USERS.get(i);
- if (StringUtils.isBlank(user)) {
- continue;
- }
- XXUser xxUser = daoMgr.getXXUser().findByUserName(user);
- if (xxUser == null) {
- throw new RuntimeException(user + ": user does not exist. policy='" + xxPolicy.getName()
- + "' service='" + xxPolicy.getService() + "' user='" + user + "'");
+ if (rPolicy.getResourceSignature().equalsIgnoreCase(rangerPolicy.getResourceSignature())) {
+ policyExist = true;
+ }
+
+ }
+ }
}
- XXPolicyItemUserPerm xUserPerm = new XXPolicyItemUserPerm();
- xUserPerm.setUserId(xxUser.getId());
- xUserPerm.setPolicyItemId(createdXXPolicyItem.getId());
- xUserPerm.setOrder(i);
- xUserPerm.setAddedByUserId(currentUserId);
- xUserPerm.setUpdatedByUserId(currentUserId);
- daoMgr.getXXPolicyItemUserPerm().create(xUserPerm);
+ } catch (Exception ex) {
+ logger.error(" Error while getting policy using Resource Signature, Servie Name and policy enabled flag" + ex);
}
+
+ if(!policyExist) {
+ XXPolicy createdPolicy = daoMgr.getXXPolicy().create(xxPolicy);
+
+ XXPolicyItem xxPolicyItem = new XXPolicyItem();
+ xxPolicyItem.setIsEnabled(Boolean.TRUE);
+ xxPolicyItem.setDelegateAdmin(Boolean.TRUE);
+ xxPolicyItem.setItemType(0);
+ xxPolicyItem.setOrder(0);
+ xxPolicyItem.setAddedByUserId(currentUserId);
+ xxPolicyItem.setUpdatedByUserId(currentUserId);
+ xxPolicyItem.setPolicyId(createdPolicy.getId());
+ XXPolicyItem createdXXPolicyItem = daoMgr.getXXPolicyItem().create(xxPolicyItem);
+
+ List<String> accessTypes = getAccessTypes();
+ for (int i = 0; i < accessTypes.size(); i++) {
+ XXAccessTypeDef xAccTypeDef = daoMgr.getXXAccessTypeDef().findByNameAndServiceId(accessTypes.get(i),
+ xxPolicy.getService());
+ if (xAccTypeDef == null) {
+ throw new RuntimeException(accessTypes.get(i) + ": is not a valid access-type. policy='"
+ + xxPolicy.getName() + "' service='" + xxPolicy.getService() + "'");
+ }
+ XXPolicyItemAccess xPolItemAcc = new XXPolicyItemAccess();
+ xPolItemAcc.setIsAllowed(Boolean.TRUE);
+ xPolItemAcc.setType(xAccTypeDef.getId());
+ xPolItemAcc.setOrder(i);
+ xPolItemAcc.setAddedByUserId(currentUserId);
+ xPolItemAcc.setUpdatedByUserId(currentUserId);
+ xPolItemAcc.setPolicyitemid(createdXXPolicyItem.getId());
+ daoMgr.getXXPolicyItemAccess().create(xPolItemAcc);
+ }
- for (int i = 0; i < DEFAULT_POLICY_GROUP.size(); i++) {
- String group = DEFAULT_POLICY_GROUP.get(i);
- if (StringUtils.isBlank(group)) {
- continue;
+ for (int i = 0; i < DEFAULT_POLICY_USERS.size(); i++) {
+ String user = DEFAULT_POLICY_USERS.get(i);
+ if (StringUtils.isBlank(user)) {
+ continue;
+ }
+ XXUser xxUser = daoMgr.getXXUser().findByUserName(user);
+ if (xxUser == null) {
+ throw new RuntimeException(user + ": user does not exist. policy='" + xxPolicy.getName()
+ + "' service='" + xxPolicy.getService() + "' user='" + user + "'");
+ }
+ XXPolicyItemUserPerm xUserPerm = new XXPolicyItemUserPerm();
+ xUserPerm.setUserId(xxUser.getId());
+ xUserPerm.setPolicyItemId(createdXXPolicyItem.getId());
+ xUserPerm.setOrder(i);
+ xUserPerm.setAddedByUserId(currentUserId);
+ xUserPerm.setUpdatedByUserId(currentUserId);
+ daoMgr.getXXPolicyItemUserPerm().create(xUserPerm);
}
- XXGroup xxGroup = daoMgr.getXXGroup().findByGroupName(group);
- if (xxGroup == null) {
- throw new RuntimeException(group + ": group does not exist. policy='" + xxPolicy.getName()
- + "' service='" + xxPolicy.getService() + "' group='" + group + "'");
+
+ for (int i = 0; i < DEFAULT_POLICY_GROUP.size(); i++) {
+ String group = DEFAULT_POLICY_GROUP.get(i);
+ if (StringUtils.isBlank(group)) {
+ continue;
+ }
+ XXGroup xxGroup = daoMgr.getXXGroup().findByGroupName(group);
+ if (xxGroup == null) {
+ throw new RuntimeException(group + ": group does not exist. policy='" + xxPolicy.getName()
+ + "' service='" + xxPolicy.getService() + "' group='" + group + "'");
+ }
+ XXPolicyItemGroupPerm xGroupPerm = new XXPolicyItemGroupPerm();
+ xGroupPerm.setGroupId(xxGroup.getId());
+ xGroupPerm.setPolicyItemId(createdXXPolicyItem.getId());
+ xGroupPerm.setOrder(i);
+ xGroupPerm.setAddedByUserId(currentUserId);
+ xGroupPerm.setUpdatedByUserId(currentUserId);
+ daoMgr.getXXPolicyItemGroupPerm().create(xGroupPerm);
}
- XXPolicyItemGroupPerm xGroupPerm = new XXPolicyItemGroupPerm();
- xGroupPerm.setGroupId(xxGroup.getId());
- xGroupPerm.setPolicyItemId(createdXXPolicyItem.getId());
- xGroupPerm.setOrder(i);
- xGroupPerm.setAddedByUserId(currentUserId);
- xGroupPerm.setUpdatedByUserId(currentUserId);
- daoMgr.getXXPolicyItemGroupPerm().create(xGroupPerm);
- }
- String policyResourceName = CONSUMERGROUP_RESOURCE_NAME;
+ String policyResourceName = CONSUMERGROUP_RESOURCE_NAME;
- XXResourceDef xResDef = daoMgr.getXXResourceDef().findByNameAndPolicyId(policyResourceName,
- createdPolicy.getId());
- if (xResDef == null) {
- throw new RuntimeException(policyResourceName + ": is not a valid resource-type. policy='"
- + createdPolicy.getName() + "' service='" + createdPolicy.getService() + "'");
- }
+ XXResourceDef xResDef = daoMgr.getXXResourceDef().findByNameAndPolicyId(policyResourceName,
+ createdPolicy.getId());
+ if (xResDef == null) {
+ throw new RuntimeException(policyResourceName + ": is not a valid resource-type. policy='"
+ + createdPolicy.getName() + "' service='" + createdPolicy.getService() + "'");
+ }
- XXPolicyResource xPolRes = new XXPolicyResource();
-
- xPolRes.setAddedByUserId(currentUserId);
- xPolRes.setUpdatedByUserId(currentUserId);
- xPolRes.setIsExcludes(Boolean.FALSE);
- xPolRes.setIsRecursive(Boolean.FALSE);
- xPolRes.setPolicyId(createdPolicy.getId());
- xPolRes.setResDefId(xResDef.getId());
- xPolRes = daoMgr.getXXPolicyResource().create(xPolRes);
-
- XXPolicyResourceMap xPolResMap = new XXPolicyResourceMap();
- xPolResMap.setResourceId(xPolRes.getId());
- xPolResMap.setValue("*");
- xPolResMap.setOrder(resourceMapOrder);
- xPolResMap.setAddedByUserId(currentUserId);
- xPolResMap.setUpdatedByUserId(currentUserId);
- daoMgr.getXXPolicyResourceMap().create(xPolResMap);
- resourceMapOrder++;
- logger.info("Creating policy for service id : " + xxService.getId());
+ XXPolicyResource xPolRes = new XXPolicyResource();
+
+ xPolRes.setAddedByUserId(currentUserId);
+ xPolRes.setUpdatedByUserId(currentUserId);
+ xPolRes.setIsExcludes(Boolean.FALSE);
+ xPolRes.setIsRecursive(Boolean.FALSE);
+ xPolRes.setPolicyId(createdPolicy.getId());
+ xPolRes.setResDefId(xResDef.getId());
+ xPolRes = daoMgr.getXXPolicyResource().create(xPolRes);
+
+ XXPolicyResourceMap xPolResMap = new XXPolicyResourceMap();
+ xPolResMap.setResourceId(xPolRes.getId());
+ xPolResMap.setValue("*");
+ xPolResMap.setOrder(resourceMapOrder);
+ xPolResMap.setAddedByUserId(currentUserId);
+ xPolResMap.setUpdatedByUserId(currentUserId);
+ daoMgr.getXXPolicyResourceMap().create(xPolResMap);
+ resourceMapOrder++;
+ logger.info("Creating policy for service id : " + xxService.getId());
+ }
+ logger.info("<== createDefaultPolicyForNewResources ");
}
- logger.info("<== createDefaultPolicyForNewResources ");
+
}
[ranger] 02/03: RANGER-3105 : Upgrade Ranger Tomcat to 8.5 or 9.0
Posted by ve...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
vel pushed a commit to branch ranger-2.2
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 345296fa876c2dc120c9d806bbb5cad815c6b1e0
Author: mateenmansoori <ma...@gmail.com>
AuthorDate: Thu Jan 21 15:39:34 2021 +0530
RANGER-3105 : Upgrade Ranger Tomcat to 8.5 or 9.0
Signed-off-by: Velmurugan Periasamy <ve...@apache.org>
---
embeddedwebserver/pom.xml | 10 ----------
.../java/org/apache/ranger/server/tomcat/EmbeddedServer.java | 2 +-
pom.xml | 2 +-
security-admin/src/main/webapp/META-INF/context.xml | 6 +++---
4 files changed, 5 insertions(+), 15 deletions(-)
diff --git a/embeddedwebserver/pom.xml b/embeddedwebserver/pom.xml
index 3a98041..8d623fa 100644
--- a/embeddedwebserver/pom.xml
+++ b/embeddedwebserver/pom.xml
@@ -50,16 +50,6 @@
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
- <artifactId>tomcat-embed-logging-juli</artifactId>
- <version>${tomcat.embed.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.tomcat.embed</groupId>
- <artifactId>tomcat-embed-logging-log4j</artifactId>
- <version>${tomcat.embed.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-websocket</artifactId>
<version>${tomcat.embed.version}</version>
</dependency>
diff --git a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java
index 8edcbbb..b1b242d 100644
--- a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java
+++ b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java
@@ -388,7 +388,6 @@ public class EmbeddedServer {
server.getConnector().setAllowTrace(Boolean.valueOf(EmbeddedServerUtil.getConfig("ranger.service.http.connector.attrib.allowTrace", "false")));
server.getConnector().setAsyncTimeout(EmbeddedServerUtil.getLongConfig("ranger.service.http.connector.attrib.asyncTimeout", 10000L));
server.getConnector().setEnableLookups(Boolean.valueOf(EmbeddedServerUtil.getConfig("ranger.service.http.connector.attrib.enableLookups", "false")));
- server.getConnector().setMaxHeaderCount(EmbeddedServerUtil.getIntConfig("ranger.service.http.connector.attrib.maxHeaderCount", 100));
server.getConnector().setMaxParameterCount(EmbeddedServerUtil.getIntConfig("ranger.service.http.connector.attrib.maxParameterCount", 10000));
server.getConnector().setMaxPostSize(EmbeddedServerUtil.getIntConfig("ranger.service.http.connector.attrib.maxPostSize", 2097152));
server.getConnector().setMaxSavePostSize(EmbeddedServerUtil.getIntConfig("ranger.service.http.connector.attrib.maxSavePostSize", 4096));
@@ -396,6 +395,7 @@ public class EmbeddedServer {
server.getConnector().setURIEncoding(EmbeddedServerUtil.getConfig("ranger.service.http.connector.attrib.URIEncoding", "UTF-8"));
server.getConnector().setXpoweredBy(false);
server.getConnector().setAttribute("server", "Apache Ranger");
+ server.getConnector().setProperty("sendReasonPhrase",EmbeddedServerUtil.getConfig("ranger.service.http.connector.property.sendReasonPhrase", "true"));
Iterator<Object> iterator = EmbeddedServerUtil.getRangerConfigProperties().keySet().iterator();
String key = null;
String property = null;
diff --git a/pom.xml b/pom.xml
index dc21e53..fc858d7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -188,7 +188,7 @@
<sqoop.version>1.99.7</sqoop.version>
<storm.version>1.2.0</storm.version>
<sun-jersey-bundle.version>1.19</sun-jersey-bundle.version>
- <tomcat.embed.version>7.0.105</tomcat.embed.version>
+ <tomcat.embed.version>8.5.61</tomcat.embed.version>
<testng.version>6.9.4</testng.version>
<velocity.version>1.7</velocity.version>
<zookeeper.version>3.4.14</zookeeper.version>
diff --git a/security-admin/src/main/webapp/META-INF/context.xml b/security-admin/src/main/webapp/META-INF/context.xml
index 9c7ea95..30c37cb 100644
--- a/security-admin/src/main/webapp/META-INF/context.xml
+++ b/security-admin/src/main/webapp/META-INF/context.xml
@@ -14,7 +14,7 @@
See the License for the specific language governing permissions and
limitations under the License.
-->
-<Context allowLinking="true" useHttpOnly="true">
- <Loader className="org.apache.catalina.loader.VirtualWebappLoader"
- virtualClasspath="webapp/WEB-INF/classes/conf;webapp/WEB-INF/classes/lib/*" />
+<Context useHttpOnly="true">
+ <JarScanner scanManifest="false" />
+ <Resources allowLinking="true" />
</Context>
[ranger] 01/03: RANGER-3124: Search filter with user name having
non latin character is not working on Audit>>Access tab
Posted by ve...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
vel pushed a commit to branch ranger-2.2
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 036fe4df863f6becc6e404b2a20b6d5136025eea
Author: BHAGYASHRI KOKATE <bh...@freestoneinfotech.com>
AuthorDate: Wed Dec 23 12:10:51 2020 +0530
RANGER-3124: Search filter with user name having non latin character is not working on Audit>>Access tab
Signed-off-by: Velmurugan Periasamy <ve...@apache.org>
---
security-admin/src/main/java/org/apache/ranger/common/StringUtil.java | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
index 97f0d2a..eec6c40 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
@@ -37,8 +37,8 @@ public class StringUtil implements Serializable {
static final public int MIN_PASSWORD_LENGTH = 8;
- static final public String VALIDATION_NAME = "^([A-Za-z0-9_]|[\u00C0-\u017F])([a-zA-Z0-9\\s_. -@]|[\u00C0-\u017F])+$";
- static final public String VALIDATION_TEXT = "[a-zA-Z0-9\\ \"!@#$%^&*()-_=+;:'"|~`<>?/{}\\.\\,\\-\\?<>]*";
+ static final public String VALIDATION_NAME = "^([A-Za-z0-9_]|[\u00C0-\u017F])([a-zA-Z0-9\\s_. -@]|[\u00C0-\u017F])+$";
+ static final public String VALIDATION_TEXT = "[a-zA-Z0-9\\ \"!@#$%^&*()-_=+;:'"|~`<>?/{}\\.\\,\\-\\?<>\\x00-\\x7F\\p{L}-]*";
static final public String VALIDATION_LOGINID = "^([A-Za-z0-9_]|[\u00C0-\u017F])([a-z0-9,._\\-+/@= ]|[\u00C0-\u017F])+$";
static final public String VALIDATION_ALPHA = "[a-z,A-Z]*";