You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2015/06/08 10:14:36 UTC
[1/6] incubator-ranger git commit: RANGER-534: fix upgrade issue in
policy migration
Repository: incubator-ranger
Updated Branches:
refs/heads/tag-policy f7ec8219d -> f360a3ba3
RANGER-534: fix upgrade issue in policy migration
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/104d1b89
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/104d1b89
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/104d1b89
Branch: refs/heads/tag-policy
Commit: 104d1b897e33159f1019a1691bbca6b063332a5d
Parents: 9d15be5
Author: Madhan Neethiraj <ma...@apache.org>
Authored: Fri Jun 5 17:16:42 2015 -0700
Committer: Madhan Neethiraj <ma...@apache.org>
Committed: Fri Jun 5 17:16:42 2015 -0700
----------------------------------------------------------------------
.../org/apache/ranger/common/ServiceUtil.java | 2 +-
.../ranger/patch/PatchMigration_J10002.java | 230 +++++++++++++------
2 files changed, 159 insertions(+), 73 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/104d1b89/security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java b/security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java
index 2a84d6c..7c2bbdc 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java
@@ -421,7 +421,7 @@ public class ServiceUtil {
return ret;
}
- private static String toAccessType(int permType) {
+ public static String toAccessType(int permType) {
String ret = null;
for(Map.Entry<String, Integer> e : mapAccessTypeToPermType.entrySet()) {
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/104d1b89/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
index 6df5b73..c33b39d 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
@@ -18,33 +18,38 @@
package org.apache.ranger.patch;
import java.util.ArrayList;
-import java.util.Arrays;
+import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
+import java.util.Map.Entry;
+import org.apache.commons.lang.StringUtils;
import org.apache.log4j.Logger;
import org.apache.ranger.biz.RangerBizUtil;
import org.apache.ranger.biz.ServiceDBStore;
import org.apache.ranger.common.AppConstants;
import org.apache.ranger.common.JSONUtil;
+import org.apache.ranger.common.RangerCommonEnums;
import org.apache.ranger.common.SearchCriteria;
+import org.apache.ranger.common.ServiceUtil;
import org.apache.ranger.common.StringUtil;
import org.apache.ranger.db.RangerDaoManager;
import org.apache.ranger.entity.XXAsset;
import org.apache.ranger.entity.XXAuditMap;
+import org.apache.ranger.entity.XXGroup;
import org.apache.ranger.entity.XXPolicy;
import org.apache.ranger.entity.XXPolicyConditionDef;
import org.apache.ranger.entity.XXPortalUser;
import org.apache.ranger.entity.XXResource;
import org.apache.ranger.entity.XXServiceConfigDef;
import org.apache.ranger.entity.XXServiceDef;
+import org.apache.ranger.entity.XXUser;
import org.apache.ranger.patch.BaseLoader;
import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerService;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemAccess;
-import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemCondition;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyResource;
import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil;
import org.apache.ranger.service.RangerPolicyService;
@@ -52,7 +57,6 @@ import org.apache.ranger.service.XPermMapService;
import org.apache.ranger.service.XPolicyService;
import org.apache.ranger.util.CLIUtil;
import org.apache.ranger.view.VXPermMap;
-import org.apache.ranger.view.VXPermObj;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
@@ -207,10 +211,12 @@ public class PatchMigration_J10002 extends BaseLoader {
RangerPolicy policy = new RangerPolicy();
policy = mapXResourceToPolicy(policy, xRes, service);
- policy = svcDBStore.createPolicy(policy);
+ if(policy != null) {
+ policy = svcDBStore.createPolicy(policy);
- policyCounter++;
- logger.info("New policy created. policyName: " + policy.getName());
+ policyCounter++;
+ logger.info("New policy created. policyName: " + policy.getName());
+ }
}
svcDBStore.setPopulateExistingBaseFields(false);
} catch (Exception e) {
@@ -299,9 +305,8 @@ public class PatchMigration_J10002 extends BaseLoader {
}
private RangerPolicy mapXResourceToPolicy(RangerPolicy policy, XXResource xRes, RangerService service) {
-
String serviceName = service.getName();
- String serviceDef = service.getType();
+ String serviceType = service.getType();
String name = xRes.getPolicyName();
String description = xRes.getDescription();
Boolean isAuditEnabled = true;
@@ -309,6 +314,14 @@ public class PatchMigration_J10002 extends BaseLoader {
Map<String, RangerPolicyResource> resources = new HashMap<String, RangerPolicyResource>();
List<RangerPolicyItem> policyItems = new ArrayList<RangerPolicyItem>();
+ XXServiceDef svcDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
+ if(svcDef == null) {
+ logger.error(serviceType + ": service-def not found. Skipping policy '" + name + "'");
+
+ return null;
+ }
+
List<XXAuditMap> auditMapList = daoMgr.getXXAuditMap().findByResourceId(xRes.getId());
if (stringUtil.isEmpty(auditMapList)) {
isAuditEnabled = false;
@@ -317,38 +330,29 @@ public class PatchMigration_J10002 extends BaseLoader {
isEnabled = false;
}
- boolean tableExcludes = false;
- boolean columnExcludes = false;
-
- if (xRes.getTableType() == AppConstants.POLICY_EXCLUSION) {
- tableExcludes = true;
- }
- if (xRes.getColumnType() == AppConstants.POLICY_EXCLUSION) {
- columnExcludes = true;
- }
-
- if (serviceDef.equalsIgnoreCase("hdfs")) {
- resources.put("path", new RangerPolicyResource(Arrays.asList(xRes.getName()), false, AppConstants
- .getBooleanFor_BooleanValue(xRes.getIsRecursive())));
-
- } else if (serviceDef.equalsIgnoreCase("hbase")) {
- resources.put("table", new RangerPolicyResource(Arrays.asList(xRes.getTables()), tableExcludes, false));
- resources.put("column", new RangerPolicyResource(Arrays.asList(xRes.getColumns()), columnExcludes, false));
- resources.put("column-family", new RangerPolicyResource(Arrays.asList(xRes.getColumnFamilies()), false, false));
-
- } else if (serviceDef.equalsIgnoreCase("hive")) {
- resources.put("table", new RangerPolicyResource(Arrays.asList(xRes.getTables()), tableExcludes, false));
- resources.put("column", new RangerPolicyResource(Arrays.asList(xRes.getColumns()), columnExcludes, false));
- resources.put("database", new RangerPolicyResource(Arrays.asList(xRes.getDatabases()), false, false));
- resources.put("udf", new RangerPolicyResource(Arrays.asList(xRes.getUdfs()), false, false));
- } else if (serviceDef.equalsIgnoreCase("knox")) {
- resources.put("topology", new RangerPolicyResource(Arrays.asList(xRes.getTopologies()), false, false));
- resources.put("service", new RangerPolicyResource(Arrays.asList(xRes.getServices()), false, false));
- } else if (serviceDef.equalsIgnoreCase("storm")) {
- resources.put("topology", new RangerPolicyResource(Arrays.asList(xRes.getTopologies()), false, false));
+ Boolean isPathRecursive = xRes.getIsRecursive() == RangerCommonEnums.BOOL_TRUE;
+ Boolean isTableExcludes = xRes.getTableType() == RangerCommonEnums.POLICY_EXCLUSION;
+ Boolean isColumnExcludes = xRes.getColumnType() == RangerCommonEnums.POLICY_EXCLUSION;
+
+ if (StringUtils.equalsIgnoreCase(serviceType, "hdfs")) {
+ toRangerResourceList(xRes.getName(), "path", Boolean.FALSE, isPathRecursive, resources);
+ } else if (StringUtils.equalsIgnoreCase(serviceType, "hbase")) {
+ toRangerResourceList(xRes.getTables(), "table", isTableExcludes, Boolean.FALSE, resources);
+ toRangerResourceList(xRes.getColumnFamilies(), "column-family", Boolean.FALSE, Boolean.FALSE, resources);
+ toRangerResourceList(xRes.getColumns(), "column", isColumnExcludes, Boolean.FALSE, resources);
+ } else if (StringUtils.equalsIgnoreCase(serviceType, "hive")) {
+ toRangerResourceList(xRes.getDatabases(), "database", Boolean.FALSE, Boolean.FALSE, resources);
+ toRangerResourceList(xRes.getTables(), "table", isTableExcludes, Boolean.FALSE, resources);
+ toRangerResourceList(xRes.getColumns(), "column", isColumnExcludes, Boolean.FALSE, resources);
+ toRangerResourceList(xRes.getUdfs(), "udf", Boolean.FALSE, Boolean.FALSE, resources);
+ } else if (StringUtils.equalsIgnoreCase(serviceType, "knox")) {
+ toRangerResourceList(xRes.getTopologies(), "topology", Boolean.FALSE, Boolean.FALSE, resources);
+ toRangerResourceList(xRes.getServices(), "service", Boolean.FALSE, Boolean.FALSE, resources);
+ } else if (StringUtils.equalsIgnoreCase(serviceType, "storm")) {
+ toRangerResourceList(xRes.getTopologies(), "topology", Boolean.FALSE, Boolean.FALSE, resources);
}
- policyItems = getPolicyItemListForRes(xRes, serviceDef);
+ policyItems = getPolicyItemListForRes(xRes, svcDef);
policy.setService(serviceName);
policy.setName(name);
@@ -376,60 +380,107 @@ public class PatchMigration_J10002 extends BaseLoader {
return policy;
}
- private List<RangerPolicyItem> getPolicyItemListForRes(XXResource xRes, String serviceDefName) {
+ private Map<String, RangerPolicy.RangerPolicyResource> toRangerResourceList(String resourceString, String resourceType, Boolean isExcludes, Boolean isRecursive, Map<String, RangerPolicy.RangerPolicyResource> resources) {
+ Map<String, RangerPolicy.RangerPolicyResource> ret = resources == null ? new HashMap<String, RangerPolicy.RangerPolicyResource>() : resources;
+
+ if(StringUtils.isNotBlank(resourceString)) {
+ RangerPolicy.RangerPolicyResource resource = ret.get(resourceType);
+
+ if(resource == null) {
+ resource = new RangerPolicy.RangerPolicyResource();
+ resource.setIsExcludes(isExcludes);
+ resource.setIsRecursive(isRecursive);
+
+ ret.put(resourceType, resource);
+ }
+
+ for(String res : resourceString.split(",")) {
+ resource.getValues().add(res);
+ }
+ }
+
+ return ret;
+ }
+
+ private List<RangerPolicyItem> getPolicyItemListForRes(XXResource xRes, XXServiceDef svcDef) {
List<RangerPolicyItem> policyItems = new ArrayList<RangerPolicyItem>();
SearchCriteria sc = new SearchCriteria();
+
sc.addParam("resourceId", xRes.getId());
List<VXPermMap> permMapList = xPermMapService.searchXPermMaps(sc).getVXPermMaps();
- List<VXPermObj> permObjList = xPolService.mapPermMapToPermObj(permMapList);
- XXServiceDef svcDef = daoMgr.getXXServiceDef().findByName(serviceDefName);
- if (svcDef == null) {
- return new ArrayList<RangerPolicyItem>();
- }
+ HashMap<String, List<VXPermMap>> sortedPermMap = new HashMap<String, List<VXPermMap>>();
- XXPolicyConditionDef policyCond = daoMgr.getXXPolicyConditionDef().findByServiceDefIdAndName(svcDef.getId(),
- "ip-range");
+ // re-group the list with permGroup as the key
+ if (permMapList != null) {
+ for(VXPermMap permMap : permMapList) {
+ String permGrp = permMap.getPermGroup();
+ List<VXPermMap> sortedList = sortedPermMap.get(permGrp);
- for (VXPermObj permObj : permObjList) {
+ if(sortedList == null) {
+ sortedList = new ArrayList<VXPermMap>();
+ sortedPermMap.put(permGrp, sortedList);
+ }
- List<String> permList = permObj.getPermList();
- if (permList == null) {
- continue;
+ sortedList.add(permMap);
}
+ }
- RangerPolicyItem policyItem = new RangerPolicyItem();
- List<RangerPolicyItemAccess> accesses = new ArrayList<RangerPolicyItemAccess>();
- List<RangerPolicyItemCondition> conditions = new ArrayList<RangerPolicyItemCondition>();
+ for (Entry<String, List<VXPermMap>> entry : sortedPermMap.entrySet()) {
+ List<String> userList = new ArrayList<String>();
+ List<String> groupList = new ArrayList<String>();
+ List<RangerPolicyItemAccess> accessList = new ArrayList<RangerPolicyItemAccess>();
+ String ipAddress = null;
- if (permObj.getPermList().contains("Admin")) {
- policyItem.setDelegateAdmin(true);
- }
+ RangerPolicy.RangerPolicyItem policyItem = new RangerPolicy.RangerPolicyItem();
- for (String perm : permList) {
- RangerPolicyItemAccess access = new RangerPolicyItemAccess();
- access.setIsAllowed(true);
- access.setType(perm);
- accesses.add(access);
- }
- if (!stringUtil.isEmpty(permObj.getIpAddress()) && policyCond != null) {
- RangerPolicyItemCondition condition = new RangerPolicyItemCondition();
- condition.setType("ip-range");
+ for(VXPermMap permMap : entry.getValue()) {
+ if(permMap.getPermFor() == AppConstants.XA_PERM_FOR_USER) {
+ String userName = getUserName(permMap);
+
+ if (! userList.contains(userName)) {
+ userList.add(userName);
+ }
+ } else if(permMap.getPermFor() == AppConstants.XA_PERM_FOR_GROUP) {
+ String groupName = getGroupName(permMap);
- List<String> ipRangeList = Arrays.asList(permObj.getIpAddress());
+ if (! groupList.contains(groupName)) {
+ groupList.add(groupName);
+ }
+ }
+
+ String accessType = ServiceUtil.toAccessType(permMap.getPermType());
+
+ if(StringUtils.equalsIgnoreCase(accessType, "Admin")) {
+ policyItem.setDelegateAdmin(Boolean.TRUE);
+ if ( svcDef.getId() == EmbeddedServiceDefsUtil.instance().getHBaseServiceDefId()) {
+ accessList.add(new RangerPolicyItemAccess(accessType));
+ }
+ } else {
+ accessList.add(new RangerPolicyItemAccess(accessType));
+ }
- condition.setValues(ipRangeList);
- conditions.add(condition);
+ ipAddress = permMap.getIpAddress();
}
- policyItem.setUsers(permObj.getUserList());
- policyItem.setGroups(permObj.getGroupList());
- policyItem.setAccesses(accesses);
- policyItem.setConditions(conditions);
+ policyItem.setUsers(userList);
+ policyItem.setGroups(groupList);
+ policyItem.setAccesses(accessList);
+
+ if(ipAddress != null && !ipAddress.isEmpty()) {
+ XXPolicyConditionDef policyCond = daoMgr.getXXPolicyConditionDef().findByServiceDefIdAndName(svcDef.getId(), "ip-range");
+
+ if(policyCond != null) {
+ RangerPolicy.RangerPolicyItemCondition ipCondition = new RangerPolicy.RangerPolicyItemCondition("ip-range", Collections.singletonList(ipAddress));
+
+ policyItem.getConditions().add(ipCondition);
+ }
+ }
policyItems.add(policyItem);
}
+
return policyItems;
}
@@ -477,4 +528,39 @@ public class PatchMigration_J10002 extends BaseLoader {
}
+ private String getUserName(VXPermMap permMap) {
+ String userName = permMap.getUserName();
+
+ if(userName == null || userName.isEmpty()) {
+ Long userId = permMap.getUserId();
+
+ if(userId != null) {
+ XXUser xxUser = daoMgr.getXXUser().getById(userId);
+
+ if(xxUser != null) {
+ userName = xxUser.getName();
+ }
+ }
+ }
+
+ return userName;
+ }
+
+ private String getGroupName(VXPermMap permMap) {
+ String groupName = permMap.getGroupName();
+
+ if(groupName == null || groupName.isEmpty()) {
+ Long groupId = permMap.getGroupId();
+
+ if(groupId != null) {
+ XXGroup xxGroup = daoMgr.getXXGroup().getById(groupId);
+
+ if(xxGroup != null) {
+ groupName = xxGroup.getName();
+ }
+ }
+ }
+
+ return groupName;
+ }
}
\ No newline at end of file
[6/6] incubator-ranger git commit: Merge branch 'master' into
tag-policy
Posted by ma...@apache.org.
Merge branch 'master' into tag-policy
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/f360a3ba
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/f360a3ba
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/f360a3ba
Branch: refs/heads/tag-policy
Commit: f360a3ba30dc56c958cb1162566f82a72205ae82
Parents: f7ec821 0512610
Author: Madhan Neethiraj <ma...@apache.org>
Authored: Mon Jun 8 01:14:27 2015 -0700
Committer: Madhan Neethiraj <ma...@apache.org>
Committed: Mon Jun 8 01:14:27 2015 -0700
----------------------------------------------------------------------
.../apache/ranger/audit/provider/MiscUtil.java | 1 -
.../ranger/audit/queue/AuditAsyncQueue.java | 2 +-
.../ranger/audit/queue/AuditBatchQueue.java | 2 +-
.../ranger/audit/queue/AuditFileSpool.java | 22 +-
.../ranger/audit/queue/AuditSummaryQueue.java | 2 +-
.../hadoop/crypto/key/RangerKeyStore.java | 235 ++++------------
.../crypto/key/RangerKeyStoreProvider.java | 4 +-
.../kafka/authorizer/RangerKafkaAuthorizer.java | 6 +
.../org/apache/ranger/biz/RangerBizUtil.java | 50 ++--
.../org/apache/ranger/biz/ServiceDBStore.java | 1 +
.../org/apache/ranger/common/AppConstants.java | 8 +
.../org/apache/ranger/common/ServiceUtil.java | 2 +-
.../org/apache/ranger/common/db/BaseDao.java | 21 ++
.../java/org/apache/ranger/db/XXPolicyDao.java | 10 +
.../java/org/apache/ranger/db/XXServiceDao.java | 13 +-
.../org/apache/ranger/db/XXServiceDefDao.java | 21 ++
.../ranger/patch/PatchMigration_J10002.java | 268 +++++++++++--------
.../resources/META-INF/jpa_named_queries.xml | 4 +
18 files changed, 334 insertions(+), 338 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/f360a3ba/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/f360a3ba/security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java
----------------------------------------------------------------------
diff --cc security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java
index 5a38aaa,0a0e44a..adc13c6
--- a/security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java
+++ b/security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java
@@@ -69,16 -71,13 +71,25 @@@ public class XXServiceDao extends BaseD
}
}
+ public List<XXService> findByTagServiceId(Long tagServiceId) {
+ if (tagServiceId == null) {
+ return new ArrayList<XXService>();
+ }
+ try {
+ return getEntityManager().createNamedQuery("XXService.findByTagServiceId", tClass)
+ .setParameter("tagServiceId", tagServiceId).getResultList();
+ } catch (NoResultException e) {
+ return new ArrayList<XXService>();
+ }
+ }
+
- }
+ public void updateSequence() {
+ Long maxId = getMaxIdOfXXService();
+
+ if(maxId == null) {
+ return;
+ }
+
+ updateSequence("X_SERVICE_SEQ", maxId + 1);
+ }
-}
++}
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/f360a3ba/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
----------------------------------------------------------------------
[5/6] incubator-ranger git commit: RANGER-537: next-ID sequence
updated after creating service-def with pre-defined ID
Posted by ma...@apache.org.
RANGER-537: next-ID sequence updated after creating service-def with pre-defined ID
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/0512610e
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/0512610e
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/0512610e
Branch: refs/heads/tag-policy
Commit: 0512610e19c69188ca9f0e44a0f7701888c1b404
Parents: e3bc661
Author: Madhan Neethiraj <ma...@apache.org>
Authored: Mon Jun 8 00:16:15 2015 -0700
Committer: Madhan Neethiraj <ma...@apache.org>
Committed: Mon Jun 8 00:16:15 2015 -0700
----------------------------------------------------------------------
.../org/apache/ranger/biz/RangerBizUtil.java | 50 ++++++++++----------
.../org/apache/ranger/biz/ServiceDBStore.java | 1 +
.../org/apache/ranger/common/AppConstants.java | 8 ++++
.../org/apache/ranger/common/db/BaseDao.java | 21 ++++++++
.../java/org/apache/ranger/db/XXPolicyDao.java | 10 ++++
.../java/org/apache/ranger/db/XXServiceDao.java | 11 +++++
.../org/apache/ranger/db/XXServiceDefDao.java | 21 ++++++++
.../ranger/patch/PatchMigration_J10002.java | 44 ++---------------
.../resources/META-INF/jpa_named_queries.xml | 4 ++
9 files changed, 104 insertions(+), 66 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
index 2cae01d..6ffcd66 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
@@ -31,6 +31,7 @@ import java.util.Set;
import org.apache.commons.io.FilenameUtils;
import org.apache.commons.io.IOCase;
+import org.apache.commons.lang.StringUtils;
import org.apache.log4j.Logger;
import org.apache.ranger.common.AppConstants;
import org.apache.ranger.common.ContextUtil;
@@ -1344,38 +1345,37 @@ public class RangerBizUtil {
}
public static int getDBFlavor() {
+ String[] propertyNames = { "xa.db.flavor",
+ "ranger.jpa.jdbc.dialect",
+ "ranger.jpa.jdbc.url",
+ "ranger.jpa.jdbc.driver"
+ };
- String dbFlavor = "";
- boolean dbFlavorPropFound = true;
+ for(String propertyName : propertyNames) {
+ String propertyValue = PropertiesUtil.getProperty(propertyName);
- dbFlavor = PropertiesUtil.getProperty("xa.db.flavor");
- if (dbFlavor == null || dbFlavor.trim().isEmpty()) {
- dbFlavor = PropertiesUtil.getProperty("ranger.jpa.jdbc.dialect");
- dbFlavorPropFound = false;
- }
+ if(StringUtils.isBlank(propertyValue)) {
+ continue;
+ }
- if (dbFlavor != null && !dbFlavor.trim().isEmpty()) {
- if (dbFlavorPropFound) {
- if ("MYSQL".equalsIgnoreCase(dbFlavor)) {
- return AppConstants.DB_FLAVOR_MYSQL;
- } else if ("ORACLE".equalsIgnoreCase(dbFlavor)) {
- return AppConstants.DB_FLAVOR_ORACLE;
- } else {
- return AppConstants.DB_FLAVOR_UNKNOWN;
- }
+ if (StringUtils.containsIgnoreCase(propertyValue, "mysql")) {
+ return AppConstants.DB_FLAVOR_MYSQL;
+ } else if (StringUtils.containsIgnoreCase(propertyValue, "oracle")) {
+ return AppConstants.DB_FLAVOR_ORACLE;
+ } else if (StringUtils.containsIgnoreCase(propertyValue, "postgresql")) {
+ return AppConstants.DB_FLAVOR_POSTGRES;
+ } else if (StringUtils.containsIgnoreCase(propertyValue, "sqlserver")) {
+ return AppConstants.DB_FLAVOR_SQLSERVER;
} else {
- if (dbFlavor.toUpperCase().contains("MYSQL")) {
- return AppConstants.DB_FLAVOR_MYSQL;
- } else if (dbFlavor.toUpperCase().contains("ORACLE")) {
- return AppConstants.DB_FLAVOR_ORACLE;
- } else {
- return AppConstants.DB_FLAVOR_UNKNOWN;
+ if(logger.isDebugEnabled()) {
+ logger.debug("DB Falvor could not be determined from property - " + propertyName + "=" + propertyValue);
}
}
- } else {
- logger.error("Property : xa.db.flavor or ranger.jpa.jdbc.dialect, not found");
- return AppConstants.DB_FLAVOR_UNKNOWN;
}
+
+ logger.error("DB Falvor could not be determined");
+
+ return AppConstants.DB_FLAVOR_UNKNOWN;
}
public String getAuditDBType() {
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
index e213937..d57f0be 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
@@ -263,6 +263,7 @@ public class ServiceDBStore implements ServiceStore {
svcDefServiceWithAssignedId.setPopulateExistingBaseFields(true);
svcDefServiceWithAssignedId.create(serviceDef);
svcDefServiceWithAssignedId.setPopulateExistingBaseFields(false);
+ daoMgr.getXXServiceDef().updateSequence();
} else {
// following fields will be auto populated
serviceDef.setId(null);
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/java/org/apache/ranger/common/AppConstants.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/common/AppConstants.java b/security-admin/src/main/java/org/apache/ranger/common/AppConstants.java
index 59ab3db..491726f 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/AppConstants.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/AppConstants.java
@@ -364,6 +364,14 @@ public class AppConstants extends RangerCommonEnums {
* DB Favor Oracle
*/
public static final int DB_FLAVOR_ORACLE = 2;
+ /**
+ * DB Favor Postgres
+ */
+ public static final int DB_FLAVOR_POSTGRES = 3;
+ /**
+ * DB Favor SQLServer
+ */
+ public static final int DB_FLAVOR_SQLSERVER = 4;
/***************************************************************
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/java/org/apache/ranger/common/db/BaseDao.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/common/db/BaseDao.java b/security-admin/src/main/java/org/apache/ranger/common/db/BaseDao.java
index 8ef9e08..bfa4c40 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/db/BaseDao.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/db/BaseDao.java
@@ -32,6 +32,8 @@ import javax.persistence.Query;
import javax.persistence.TypedQuery;
import org.apache.log4j.Logger;
+import org.apache.ranger.biz.RangerBizUtil;
+import org.apache.ranger.common.AppConstants;
import org.apache.ranger.db.RangerDaoManager;
import org.apache.ranger.db.RangerDaoManagerBase;
@@ -210,4 +212,23 @@ public abstract class BaseDao<T> {
return ret;
}
+ public void updateSequence(String seqName, long nextValue) {
+ if(RangerBizUtil.getDBFlavor() == AppConstants.DB_FLAVOR_ORACLE) {
+ String[] queries = {
+ "ALTER SEQUENCE " + seqName + " INCREMENT BY " + (nextValue - 1),
+ "select " + seqName + ".nextval from dual",
+ "ALTER SEQUENCE " + seqName + " INCREMENT BY 1 NOCACHE NOCYCLE"
+ };
+
+ for(String query : queries) {
+ getEntityManager().createNativeQuery(query).executeUpdate();
+ }
+ } else if(RangerBizUtil.getDBFlavor() == AppConstants.DB_FLAVOR_POSTGRES) {
+ String query = "SELECT setval('" + seqName + "', " + nextValue + ")";
+
+ getEntityManager().createNativeQuery(query).getSingleResult();
+ }
+
+ }
+
}
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java b/security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java
index 9901832..006964c 100644
--- a/security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java
+++ b/security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java
@@ -113,4 +113,14 @@ public class XXPolicyDao extends BaseDao<XXPolicy> {
}
}
+ public void updateSequence() {
+ Long maxId = getMaxIdOfXXPolicy();
+
+ if(maxId == null) {
+ return;
+ }
+
+ updateSequence("X_POLICY_SEQ", maxId + 1);
+ }
+
}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java b/security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java
index 4f35ad3..0a0e44a 100644
--- a/security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java
+++ b/security-admin/src/main/java/org/apache/ranger/db/XXServiceDao.java
@@ -22,6 +22,8 @@ import java.util.List;
import javax.persistence.NoResultException;
+import org.apache.ranger.biz.RangerBizUtil;
+import org.apache.ranger.common.AppConstants;
import org.apache.ranger.common.db.BaseDao;
import org.apache.ranger.entity.XXService;
@@ -69,4 +71,13 @@ public class XXServiceDao extends BaseDao<XXService> {
}
}
+ public void updateSequence() {
+ Long maxId = getMaxIdOfXXService();
+
+ if(maxId == null) {
+ return;
+ }
+
+ updateSequence("X_SERVICE_SEQ", maxId + 1);
+ }
}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/java/org/apache/ranger/db/XXServiceDefDao.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/db/XXServiceDefDao.java b/security-admin/src/main/java/org/apache/ranger/db/XXServiceDefDao.java
index 1affbf7..d4f182c 100644
--- a/security-admin/src/main/java/org/apache/ranger/db/XXServiceDefDao.java
+++ b/security-admin/src/main/java/org/apache/ranger/db/XXServiceDefDao.java
@@ -17,6 +17,9 @@
package org.apache.ranger.db;
+import java.util.ArrayList;
+import java.util.List;
+
import javax.persistence.NoResultException;
import org.apache.ranger.common.db.BaseDao;
@@ -44,4 +47,22 @@ public class XXServiceDefDao extends BaseDao<XXServiceDef> {
}
}
+ public Long getMaxIdOfXXServiceDef() {
+ try {
+ return (Long) getEntityManager().createNamedQuery("XXServiceDef.getMaxIdOfXXServiceDef").getSingleResult();
+ } catch (NoResultException e) {
+ return null;
+ }
+ }
+
+ public void updateSequence() {
+ Long maxId = getMaxIdOfXXServiceDef();
+
+ if(maxId == null) {
+ return;
+ }
+
+ updateSequence("X_SERVICE_DEF_SEQ", maxId + 1);
+ }
+
}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
index c33b39d..1747324 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
@@ -485,47 +485,9 @@ public class PatchMigration_J10002 extends BaseLoader {
}
private void updateSequences() {
-
- if(RangerBizUtil.getDBFlavor() != AppConstants.DB_FLAVOR_ORACLE) {
- return;
- }
-
- List<String> queryList = new ArrayList<String>();
- String policySequence = "X_POLICY_SEQ";
- String svcSequence = "X_SERVICE_SEQ";
-
- if(serviceCounter > 0) {
-
- Long maxSvcId = daoMgr.getXXService().getMaxIdOfXXService();
-
- if(maxSvcId != null) {
- String query1 = "ALTER SEQUENCE " + svcSequence + " INCREMENT BY " + maxSvcId;
- String query2 = "select " + svcSequence + ".nextval from dual";
- String query3 = "ALTER SEQUENCE " + svcSequence + " INCREMENT BY 1 NOCACHE NOCYCLE";
- queryList.add(query1);
- queryList.add(query2);
- queryList.add(query3);
- }
- }
-
- if(policyCounter > 0) {
-
- Long maxPolId = daoMgr.getXXPolicy().getMaxIdOfXXPolicy();
-
- if(maxPolId != null) {
- String query1 = "ALTER SEQUENCE " + policySequence + " INCREMENT BY " + maxPolId;
- String query2 = "select " + policySequence + ".nextval from dual";
- String query3 = "ALTER SEQUENCE " + policySequence + " INCREMENT BY 1 NOCACHE NOCYCLE";
- queryList.add(query1);
- queryList.add(query2);
- queryList.add(query3);
- }
- }
-
- for(String query : queryList) {
- daoMgr.getEntityManager().createNativeQuery(query).executeUpdate();
- }
-
+ daoMgr.getXXServiceDef().updateSequence();
+ daoMgr.getXXService().updateSequence();
+ daoMgr.getXXPolicy().updateSequence();
}
private String getUserName(VXPermMap permMap) {
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/0512610e/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
----------------------------------------------------------------------
diff --git a/security-admin/src/main/resources/META-INF/jpa_named_queries.xml b/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
index 054a0bd..7761756 100644
--- a/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
+++ b/security-admin/src/main/resources/META-INF/jpa_named_queries.xml
@@ -227,6 +227,10 @@
<query>select obj from XXServiceDef obj where obj.name = :name</query>
</named-query>
+ <named-query name="XXServiceDef.getMaxIdOfXXServiceDef">
+ <query>select MAX(obj.id) from XXServiceDef obj</query>
+ </named-query>
+
<!-- XXResourceDef -->
<named-query name="XXResourceDef.findByNameAndDefId">
<query>select obj from XXResourceDef obj where obj.name = :name and obj.defId = :defId order by obj.level</query>
[4/6] incubator-ranger git commit: RANGER-246 Review feedback and
allow kafka consumer groups
Posted by ma...@apache.org.
RANGER-246 Review feedback and allow kafka consumer groups
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/e3bc6613
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/e3bc6613
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/e3bc6613
Branch: refs/heads/tag-policy
Commit: e3bc6613e778219fa182ebba2007f762a52f8930
Parents: 94cf87d
Author: Don Bosco Durai <bo...@apache.org>
Authored: Sat Jun 6 19:31:44 2015 -0700
Committer: Don Bosco Durai <bo...@apache.org>
Committed: Sat Jun 6 19:31:44 2015 -0700
----------------------------------------------------------------------
.../authorization/kafka/authorizer/RangerKafkaAuthorizer.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/e3bc6613/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java
----------------------------------------------------------------------
diff --git a/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java b/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java
index 9ce38a9..3341f84 100644
--- a/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java
+++ b/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java
@@ -137,7 +137,7 @@ public class RangerKafkaAuthorizer implements Authorizer {
}
//TODO: If resource type if consumer group, then allow it by default
- if(resource.resourceType().equals(ResourceType.CLUSTER)) {
+ if(resource.resourceType().equals(ResourceType.CONSUMER_GROUP)) {
return true;
}
[2/6] incubator-ranger git commit: RANGER-535: keystore source
modified to adhere to coding standards
Posted by ma...@apache.org.
RANGER-535: keystore source modified to adhere to coding standards
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/8cf18577
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/8cf18577
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/8cf18577
Branch: refs/heads/tag-policy
Commit: 8cf18577a99539c32b1f674c45c26a53eb40df80
Parents: 104d1b8
Author: sneethiraj <sn...@apache.org>
Authored: Sat Jun 6 11:34:40 2015 -0400
Committer: sneethiraj <sn...@apache.org>
Committed: Sat Jun 6 11:34:40 2015 -0400
----------------------------------------------------------------------
.../hadoop/crypto/key/RangerKeyStore.java | 235 ++++---------------
.../crypto/key/RangerKeyStoreProvider.java | 4 +-
2 files changed, 52 insertions(+), 187 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/8cf18577/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java
----------------------------------------------------------------------
diff --git a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java
index b63aa01..f38f8b0 100644
--- a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java
+++ b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java
@@ -44,11 +44,8 @@ import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.util.Date;
import java.util.Enumeration;
-import java.util.HashMap;
import java.util.Hashtable;
import java.util.List;
-import java.util.Map;
-import java.util.Properties;
import javax.crypto.SealedObject;
import javax.xml.bind.DatatypeConverter;
@@ -61,10 +58,6 @@ import org.apache.ranger.kms.dao.RangerKMSDao;
/**
* This class provides the Database store implementation.
- *
- *
- * @see KeyProtector
- *
*/
public class RangerKeyStore extends KeyStoreSpi {
@@ -89,46 +82,27 @@ public class RangerKeyStore extends KeyStoreSpi {
int version;
}
- /**
- * keys are stored in a hashtable.
- * Hash entries are keyed by alias names.
- */
- private final Hashtable<String, Object> entries;
+ private final Hashtable<String, Object> keyEntries ;
RangerKeyStore() {
- entries = new Hashtable<String, Object>();
+ keyEntries = new Hashtable<String, Object>();
}
RangerKeyStore(DaoManager daoManager) {
- entries = new Hashtable<String, Object>();
+ keyEntries = new Hashtable<String, Object>();
this.daoManager = daoManager;
}
- // convert an alias to internal form, overridden in subclasses:
String convertAlias(String alias){
return alias.toLowerCase();
}
- /**
- * Returns the key associated with the given alias, using the given
- * password to recover it.
- *
- * @param alias the alias name
- * @param password the password for recovering the key
- *
- * @return the requested key, or null if the given alias does not exist
- * or does not identify a <i>key entry</i>.
- *
- * @exception NoSuchAlgorithmException if the algorithm for recovering the
- * key cannot be found
- * @exception UnrecoverableKeyException if the key cannot be recovered
- * (e.g., the given password is wrong).
- */
+ @Override
public Key engineGetKey(String alias, char[] password)throws NoSuchAlgorithmException, UnrecoverableKeyException
{
Key key = null;
- Object entry = entries.get(alias.toLowerCase());
+ Object entry = keyEntries.get(alias.toLowerCase());
if (!(entry instanceof SecretKeyEntry)) {
return null;
@@ -150,16 +124,9 @@ public class RangerKeyStore extends KeyStoreSpi {
return key;
}
- /**
- * Returns the creation date of the entry identified by the given alias.
- *
- * @param alias the alias name
- *
- * @return the creation date of this entry, or null if the given alias does
- * not exist
- */
+ @Override
public Date engineGetCreationDate(String alias) {
- Object entry = entries.get(convertAlias(alias));
+ Object entry = keyEntries.get(convertAlias(alias));
if (entry != null) {
return new Date(((KeyEntry)entry).date.getTime());
} else {
@@ -167,34 +134,11 @@ public class RangerKeyStore extends KeyStoreSpi {
}
}
- /**
- * Assigns the given key to the given alias, protecting
- * it with the given password as defined in PKCS8.
- *
- * <p>The given java.security.PrivateKey <code>key</code> must
- * be accompanied by a certificate chain certifying the
- * corresponding public key.
- *
- * <p>If the given alias already exists, the keystore information
- * associated with it is overridden by the given key and certificate
- * chain.
- *
- * @param alias the alias name
- * @param key the key to be associated with the alias
- * @param password the password to protect the key
- * @param cipher the cipher used for the key
- * @param bitLength bit length for the key
- * @param description Description for the key
- * @param version Key version
- * @param attributes key attributes
- *
- * @exception KeyStoreException if the given key is not a private key,
- * cannot be protected, or this operation fails for some other reason
- */
- public void engineSetKeyEntry(String alias, Key key, char[] password, String cipher, int bitLength, String description, int version, String attributes)
+
+ public void addKeyEntry(String alias, Key key, char[] password, String cipher, int bitLength, String description, int version, String attributes)
throws KeyStoreException
{
- synchronized(entries) {
+ synchronized(keyEntries) {
try {
Class<?> c = null;
@@ -221,7 +165,7 @@ public class RangerKeyStore extends KeyStoreSpi {
entry.description = description;
entry.version = version;
entry.attributes = attributes;
- entries.put(alias.toLowerCase(), entry);
+ keyEntries.put(alias.toLowerCase(), entry);
} catch (Exception e) {
logger.error(e.getMessage());
throw new KeyStoreException(e.getMessage());
@@ -229,22 +173,17 @@ public class RangerKeyStore extends KeyStoreSpi {
}
}
- /**
- * Deletes the entry identified by the given alias from this database.
- *
- * @param alias the alias name
- *
- * @exception KeyStoreException if the entry cannot be removed.
- */
+ @Override
public void engineDeleteEntry(String alias)
throws KeyStoreException
{
- synchronized(entries) {
+ synchronized(keyEntries) {
dbOperationDelete(convertAlias(alias));
- entries.remove(convertAlias(alias));
+ keyEntries.remove(convertAlias(alias));
}
}
+
private void dbOperationDelete(String alias) {
try{
if(daoManager != null){
@@ -257,61 +196,36 @@ public class RangerKeyStore extends KeyStoreSpi {
}
}
- /**
- * Lists all the alias names of this database.
- *
- * @return enumeration of the alias names
- */
+
+ @Override
public Enumeration<String> engineAliases() {
- return entries.keys();
+ return keyEntries.keys();
}
- /**
- * Checks if the given alias exists in this database.
- *
- * @param alias the alias name
- *
- * @return true if the alias exists, false otherwise
- */
+ @Override
public boolean engineContainsAlias(String alias) {
- return entries.containsKey(convertAlias(alias));
+ return keyEntries.containsKey(convertAlias(alias));
}
- /**
- * Retrieves the number of entries in this database.
- *
- * @return the number of entries in this database
- */
+ @Override
public int engineSize() {
- return entries.size();
+ return keyEntries.size();
}
- /**
- * Stores this keystore to the provided ranger database, and protects its
- * integrity with the given password.
- *
- * @param stream null.
- * @param password the password to generate the keystore integrity check
- *
- * @exception IOException if there was an I/O problem with data
- * @exception NoSuchAlgorithmException if the appropriate data integrity
- * algorithm could not be found
- * @exception CertificateException if any of the certificates included in
- * the keystore data could not be stored
- */
+ @Override
public void engineStore(OutputStream stream, char[] password)
throws IOException, NoSuchAlgorithmException, CertificateException
{
- synchronized(entries) {
+ synchronized(keyEntries) {
// password is mandatory when storing
if (password == null) {
throw new IllegalArgumentException("Ranger Master Key can't be null");
}
- MessageDigest md = getPreKeyedHash(password);
+ MessageDigest md = getKeyedMessageDigest(password);
byte digest[] = md.digest();
- for (Enumeration<String> e = entries.keys(); e.hasMoreElements();) {
+ for (Enumeration<String> e = keyEntries.keys(); e.hasMoreElements();) {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
DataOutputStream dos = new DataOutputStream(new DigestOutputStream(baos, md));
@@ -319,16 +233,11 @@ public class RangerKeyStore extends KeyStoreSpi {
try{
String alias = e.nextElement();
- Object entry = entries.get(alias);
+ Object entry = keyEntries.get(alias);
- // write the sealed key
oos = new ObjectOutputStream(dos);
oos.writeObject(((SecretKeyEntry)entry).sealedKey);
- /*
- * Write the keyed hash which is used to detect tampering with
- * the keystore (such as deleting or modifying key or
- * certificate entries).
- */
+
dos.write(digest);
dos.flush();
Long creationDate = ((SecretKeyEntry)entry).date.getTime();
@@ -397,27 +306,12 @@ public class RangerKeyStore extends KeyStoreSpi {
return xxRangerKeyStore;
}
- /**
- * Loads the keystore from the given ranger database.
- *
- * <p>If a password is given, it is used to check the integrity of the
- * keystore data. Otherwise, the integrity of the keystore is not checked.
- *
- * @param stream the input stream from which the keystore is loaded
- * @param password the (optional) password used to check the integrity of
- * the keystore.
- *
- * @exception IOException if there is an I/O or format problem with the
- * keystore data
- * @exception NoSuchAlgorithmException if the algorithm used to check
- * the integrity of the keystore cannot be found
- * @exception CertificateException if any of the certificates in the
- * keystore could not be loaded
- */
- public void engineLoad(InputStream stream, char[] password)
+
+ @Override
+ public void engineLoad(InputStream stream, char[] password)
throws IOException , NoSuchAlgorithmException, CertificateException
{
- synchronized(entries) {
+ synchronized(keyEntries) {
List<XXRangerKeyStore> rangerKeyDetails = dbOperationLoad();
DataInputStream dis;
MessageDigest md = null;
@@ -426,8 +320,8 @@ public class RangerKeyStore extends KeyStoreSpi {
return;
}
- entries.clear();
- md = getPreKeyedHash(password);
+ keyEntries.clear();
+ md = getKeyedMessageDigest(password);
byte computed[];
computed = md.digest();
@@ -441,11 +335,6 @@ public class RangerKeyStore extends KeyStoreSpi {
logger.error("No Key found for alias "+rangerKey.getAlias());
}
- /*
- * If a password has been provided, we check the keyed digest
- * at the end. If this check fails, the store has been tampered
- * with
- */
if (computed != null) {
int counter = 0;
for (int i = computed.length-1; i >= 0; i--) {
@@ -493,7 +382,7 @@ public class RangerKeyStore extends KeyStoreSpi {
}
//Add the entry to the list
- entries.put(alias, entry);
+ keyEntries.put(alias, entry);
}finally {
if (ois != null) {
ois.close();
@@ -521,28 +410,30 @@ public class RangerKeyStore extends KeyStoreSpi {
* To guard against tampering with the keystore, we append a keyed
* hash with a bit of whitener.
*/
- private MessageDigest getPreKeyedHash(char[] password)
+
+ private final String SECRET_KEY_HASH_WORD = "Apache Ranger" ;
+
+ private MessageDigest getKeyedMessageDigest(char[] aKeyPassword)
throws NoSuchAlgorithmException, UnsupportedEncodingException
{
int i, j;
MessageDigest md = MessageDigest.getInstance("SHA");
- byte[] passwdBytes = new byte[password.length * 2];
- for (i=0, j=0; i<password.length; i++) {
- passwdBytes[j++] = (byte)(password[i] >> 8);
- passwdBytes[j++] = (byte)password[i];
+ byte[] keyPasswordBytes = new byte[aKeyPassword.length * 2];
+ for (i=0, j=0; i<aKeyPassword.length; i++) {
+ keyPasswordBytes[j++] = (byte)(aKeyPassword[i] >> 8);
+ keyPasswordBytes[j++] = (byte)aKeyPassword[i];
}
- md.update(passwdBytes);
- for (i=0; i<passwdBytes.length; i++)
- passwdBytes[i] = 0;
- md.update("Mighty Aphrodite".getBytes("UTF8"));
+ md.update(keyPasswordBytes);
+ for (i=0; i<keyPasswordBytes.length; i++)
+ keyPasswordBytes[i] = 0;
+ md.update(SECRET_KEY_HASH_WORD.getBytes("UTF8"));
return md;
}
@Override
public void engineSetKeyEntry(String arg0, byte[] arg1, Certificate[] arg2)
throws KeyStoreException {
-
}
@Override
@@ -579,33 +470,7 @@ public class RangerKeyStore extends KeyStoreSpi {
public void engineSetKeyEntry(String alias, Key key, char[] password,
Certificate[] chain) throws KeyStoreException {
}
-
- public Map<String, String> getPropertiesWithPrefix(Properties props, String prefix) {
- Map<String, String> prefixedProperties = new HashMap<String, String>();
-
- if(props != null && prefix != null) {
- for(String key : props.stringPropertyNames()) {
- if(key == null) {
- continue;
- }
-
- String val = props.getProperty(key);
- if(key.startsWith(prefix)) {
- key = key.substring(prefix.length());
-
- if(key == null) {
- continue;
- }
-
- prefixedProperties.put(key, val);
- }
- }
- }
-
- return prefixedProperties;
- }
-
//
// The method is created to support JKS migration (from hadoop-common KMS keystore to RangerKMS keystore)
//
@@ -616,13 +481,13 @@ public class RangerKeyStore extends KeyStoreSpi {
public void engineLoadKeyStoreFile(InputStream stream, char[] storePass, char[] keyPass, char[] masterKey, String fileFormat)
throws IOException, NoSuchAlgorithmException, CertificateException
{
- synchronized(entries) {
+ synchronized(keyEntries) {
KeyStore ks;
try {
ks = KeyStore.getInstance(fileFormat);
ks.load(stream, storePass);
- entries.clear();
+ keyEntries.clear();
for (Enumeration<String> name = ks.aliases(); name.hasMoreElements();){
SecretKeyEntry entry = new SecretKeyEntry();
String alias = (String) name.nextElement();
@@ -665,7 +530,7 @@ public class RangerKeyStore extends KeyStoreSpi {
entry.date = ks.getCreationDate(alias);
entry.version = (alias.split("@").length == 2)?(Integer.parseInt(alias.split("@")[1])):0;
entry.description = k.getFormat()+" - "+ks.getType();
- entries.put(alias, entry);
+ keyEntries.put(alias, entry);
System.out.println("+ adding key alias [" + alias + "]") ;
}
} catch (Throwable t) {
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/8cf18577/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java
----------------------------------------------------------------------
diff --git a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java
index 66356b2..ee48c7c 100755
--- a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java
+++ b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java
@@ -158,7 +158,7 @@ public class RangerKeyStoreProvider extends KeyProvider{
try {
ObjectMapper om = new ObjectMapper();
String attribute = om.writeValueAsString(attributes);
- dbStore.engineSetKeyEntry(versionName, new SecretKeySpec(material, cipher), masterKey, cipher, bitLength, description, version, attribute);
+ dbStore.addKeyEntry(versionName, new SecretKeySpec(material, cipher), masterKey, cipher, bitLength, description, version, attribute);
} catch (KeyStoreException e) {
throw new IOException("Can't store key " + versionName,e);
}
@@ -205,7 +205,7 @@ public class RangerKeyStoreProvider extends KeyProvider{
Metadata metadata = entry.getValue();
ObjectMapper om = new ObjectMapper();
String attributes = om.writeValueAsString(metadata.getAttributes());
- dbStore.engineSetKeyEntry(entry.getKey(), new KeyMetadata(metadata), masterKey, metadata.getAlgorithm(), metadata.getBitLength(), metadata.getDescription(), metadata.getVersions(), attributes);
+ dbStore.addKeyEntry(entry.getKey(), new KeyMetadata(metadata), masterKey, metadata.getAlgorithm(), metadata.getBitLength(), metadata.getDescription(), metadata.getVersions(), attributes);
} catch (KeyStoreException e) {
throw new IOException("Can't set metadata key " + entry.getKey(),e );
}
[3/6] incubator-ranger git commit: RANGER-246 Review feedback and
allow kafka consumer groups
Posted by ma...@apache.org.
RANGER-246 Review feedback and allow kafka consumer groups
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/94cf87d8
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/94cf87d8
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/94cf87d8
Branch: refs/heads/tag-policy
Commit: 94cf87d8854873d6db4b94fc634ec996fc406f52
Parents: 8cf1857
Author: Don Bosco Durai <bo...@apache.org>
Authored: Sat Jun 6 19:21:31 2015 -0700
Committer: Don Bosco Durai <bo...@apache.org>
Committed: Sat Jun 6 19:21:31 2015 -0700
----------------------------------------------------------------------
.../apache/ranger/audit/provider/MiscUtil.java | 1 -
.../ranger/audit/queue/AuditAsyncQueue.java | 2 +-
.../ranger/audit/queue/AuditBatchQueue.java | 2 +-
.../ranger/audit/queue/AuditFileSpool.java | 22 +++++++++++---------
.../ranger/audit/queue/AuditSummaryQueue.java | 2 +-
.../kafka/authorizer/RangerKafkaAuthorizer.java | 6 ++++++
6 files changed, 21 insertions(+), 14 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/94cf87d8/agents-audit/src/main/java/org/apache/ranger/audit/provider/MiscUtil.java
----------------------------------------------------------------------
diff --git a/agents-audit/src/main/java/org/apache/ranger/audit/provider/MiscUtil.java b/agents-audit/src/main/java/org/apache/ranger/audit/provider/MiscUtil.java
index 907b9b8..6eee55c 100644
--- a/agents-audit/src/main/java/org/apache/ranger/audit/provider/MiscUtil.java
+++ b/agents-audit/src/main/java/org/apache/ranger/audit/provider/MiscUtil.java
@@ -420,7 +420,6 @@ public class MiscUtil {
logger.info("Setting UGI=" + newUGI );
} else {
logger.error("UGI is null. Not setting it.");
- ugiLoginUser = null;
}
logger.info("Setting SUBJECT");
subjectLoginUser = newSubject;
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/94cf87d8/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditAsyncQueue.java
----------------------------------------------------------------------
diff --git a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditAsyncQueue.java b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditAsyncQueue.java
index 9b4fcbd..e7adef2 100644
--- a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditAsyncQueue.java
+++ b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditAsyncQueue.java
@@ -127,7 +127,7 @@ public class AuditAsyncQueue extends AuditQueue implements Runnable {
@Override
public void run() {
try {
- if (isConsumerDestination) {
+ if (isConsumerDestination && MiscUtil.getUGILoginUser() != null) {
PrivilegedAction<Void> action = new PrivilegedAction<Void>() {
public Void run() {
runDoAs();
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/94cf87d8/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditBatchQueue.java
----------------------------------------------------------------------
diff --git a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditBatchQueue.java b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditBatchQueue.java
index dca3030..e625d16 100644
--- a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditBatchQueue.java
+++ b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditBatchQueue.java
@@ -209,7 +209,7 @@ public class AuditBatchQueue extends AuditQueue implements Runnable {
@Override
public void run() {
try {
- if (isConsumerDestination) {
+ if (isConsumerDestination && MiscUtil.getUGILoginUser() != null) {
PrivilegedAction<Void> action = new PrivilegedAction<Void>() {
public Void run() {
runDoAs();
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/94cf87d8/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java
----------------------------------------------------------------------
diff --git a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java
index 4a4e707..b83329a 100644
--- a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java
+++ b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditFileSpool.java
@@ -109,8 +109,6 @@ public class AuditFileSpool implements Runnable {
boolean isDrain = false;
boolean isDestDown = true;
- int ugiVersion = -1;
-
private Gson gson = null;
public AuditFileSpool(AuditQueue queueProvider,
@@ -755,15 +753,19 @@ public class AuditFileSpool implements Runnable {
@Override
public void run() {
try {
- PrivilegedAction<Void> action = new PrivilegedAction<Void>() {
- public Void run() {
- runDoAs();
- return null;
+ if (MiscUtil.getUGILoginUser() != null) {
+ PrivilegedAction<Void> action = new PrivilegedAction<Void>() {
+ public Void run() {
+ runDoAs();
+ return null;
+ };
};
- };
- logger.info("Running fileSpool " + consumerProvider.getName()
- + " as user " + MiscUtil.getUGILoginUser());
- MiscUtil.getUGILoginUser().doAs(action);
+ logger.info("Running fileSpool " + consumerProvider.getName()
+ + " as user " + MiscUtil.getUGILoginUser());
+ MiscUtil.getUGILoginUser().doAs(action);
+ } else {
+ runDoAs();
+ }
} catch (Throwable t) {
logger.fatal("Exited thread without abnormaly. queue="
+ consumerProvider.getName(), t);
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/94cf87d8/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditSummaryQueue.java
----------------------------------------------------------------------
diff --git a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditSummaryQueue.java b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditSummaryQueue.java
index 56ba55e..70c322d 100644
--- a/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditSummaryQueue.java
+++ b/agents-audit/src/main/java/org/apache/ranger/audit/queue/AuditSummaryQueue.java
@@ -147,7 +147,7 @@ public class AuditSummaryQueue extends AuditQueue implements Runnable {
@Override
public void run() {
try {
- if (isConsumerDestination) {
+ if (isConsumerDestination && MiscUtil.getUGILoginUser() != null) {
PrivilegedAction<Void> action = new PrivilegedAction<Void>() {
public Void run() {
runDoAs();
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/94cf87d8/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java
----------------------------------------------------------------------
diff --git a/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java b/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java
index f982bbf..9ce38a9 100644
--- a/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java
+++ b/plugin-kafka/src/main/java/org/apache/ranger/authorization/kafka/authorizer/RangerKafkaAuthorizer.java
@@ -135,6 +135,12 @@ public class RangerKafkaAuthorizer implements Authorizer {
"Authorizer is still not initialized");
return false;
}
+
+ //TODO: If resource type if consumer group, then allow it by default
+ if(resource.resourceType().equals(ResourceType.CLUSTER)) {
+ return true;
+ }
+
String userName = null;
if (session.principal() != null) {
userName = session.principal().getName();