[jira] [Commented] (RANGER-874) Deny & allow/deny exceptions in policies should be optional

["Madhan Neethiraj (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/RANGER-874?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15231294#comment-15231294 ] 

Madhan Neethiraj commented on RANGER-874:
-----------------------------------------

To enable deny & allow/deny exceptions for a servicedef, update "options" attribute of the servicedef with the entry shown below:

{code}
"options": {
  "enableDenyAndExceptionsInPolicies":true
}
{code}


> Deny & allow/deny exceptions in policies should be optional
> -----------------------------------------------------------
>
>                 Key: RANGER-874
>                 URL: https://issues.apache.org/jira/browse/RANGER-874
>             Project: Ranger
>          Issue Type: Sub-task
>          Components: admin
>    Affects Versions: 0.6.0
>            Reporter: Madhan Neethiraj
>            Assignee: Madhan Neethiraj
>             Fix For: 0.6.0
>
>         Attachments: 0001-RANGER-874-deny-and-exceptions-in-policy-items-made-.patch
>
>
> Ranger policy model in 0.5 release and earlier supported the ability to specify the conditions (user/group/ip/custom-condtions) to allow an access to a resource. The policy model has been updated for the next release (0.6), with ability to specify conditions to deny an access to a resource on specified conditions (users/groups/custom-conditions).
> To support this update, Ranger Policy UI has been enhanced to show policy-items in 4 groups: allow, allow-exceptions, deny and deny-exceptions. Comments earlier in RANGER-606 suggested that introduction of deny and exceptions adds complexity. To address this concern, the enhancements will be made optional via servicedef. Only servicedefs that opt-in (for deny and exceptions in policies) will be able to use these enhancements. For servicedefs that don't opt-in, Ranger Admin will not show deny and exception policy-item groups; also the policy-engine will ignore dent and exception policy-items if found in policies - there by maintaining the simplicity of the current policy model.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)