You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by sp...@apache.org on 2020/07/28 23:25:17 UTC
[ranger] branch master updated: RANGER-2922: Minor change of moving
solr plugin initialization inside synchronized block
This is an automated email from the ASF dual-hosted git repository.
spolavarapu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new b91d21d RANGER-2922: Minor change of moving solr plugin initialization inside synchronized block
b91d21d is described below
commit b91d21d194a64fb29d45058cf8bf8a0a289263a9
Author: Sailaja Polavarapu <sp...@cloudera.com>
AuthorDate: Tue Jul 28 15:34:55 2020 -0700
RANGER-2922: Minor change of moving solr plugin initialization inside synchronized block
---
.../solr/authorizer/RangerSolrAuthorizer.java | 82 +++++++++++++++++++---
.../src/main/webapp/scripts/utils/XAEnums.js | 8 ++-
.../src/main/webapp/scripts/utils/XAViewUtils.js | 5 +-
3 files changed, 81 insertions(+), 14 deletions(-)
diff --git a/plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java b/plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java
index 5b9241a..d7ac119 100644
--- a/plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java
+++ b/plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java
@@ -41,6 +41,7 @@ import org.apache.commons.logging.LogFactory;
import org.apache.ranger.audit.provider.MiscUtil;
import org.apache.ranger.plugin.contextenricher.RangerContextEnricher;
import org.apache.ranger.plugin.contextenricher.RangerUserStoreEnricher;
+import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.policyengine.RangerAccessRequestImpl;
import org.apache.ranger.plugin.policyengine.RangerAccessResourceImpl;
import org.apache.ranger.plugin.policyengine.RangerAccessResult;
@@ -110,8 +111,6 @@ public class RangerSolrAuthorizer extends SearchComponent implements Authorizati
private static volatile RangerBasePlugin solrPlugin = null;
- private RangerSolrAuditHandler auditHandler = null;
-
boolean useProxyIP = false;
String proxyIPHeader = "HTTP_X_FORWARDED_FOR";
String solrAppName = "Client";
@@ -202,12 +201,12 @@ public class RangerSolrAuthorizer extends SearchComponent implements Authorizati
logger.info("Creating RangerSolrPlugin");
me = solrPlugin = new RangerBasePlugin("solr", "solr");
}
+ logger.info("Calling solrPlugin.init()");
+ solrPlugin.init();
+ solrPlugin.setResultProcessor(new RangerSolrAuditHandler(solrPlugin.getConfig()));
}
}
- logger.info("Calling solrPlugin.init()");
- solrPlugin.init();
- auditHandler = new RangerSolrAuditHandler(solrPlugin.getConfig());
- solrPlugin.setResultProcessor(auditHandler);
+
useProxyIP = solrPlugin.getConfig().getBoolean(
PROP_USE_PROXY_IP, useProxyIP);
proxyIPHeader = solrPlugin.getConfig().get(
@@ -268,6 +267,8 @@ public class RangerSolrAuthorizer extends SearchComponent implements Authorizati
logAuthorizationConext(context);
}
+ RangerSolrAuditHandler auditHandler = new RangerSolrAuditHandler(solrPlugin.getConfig());
+
RangerPerfTracer perf = null;
if(RangerPerfTracer.isPerfTraceEnabled(PERF_SOLRAUTH_REQUEST_LOG)) {
@@ -373,6 +374,8 @@ public class RangerSolrAuthorizer extends SearchComponent implements Authorizati
if (SUPERUSER.equals(userName)) {
return;
}
+ RangerSolrAuditHandler auditHandler = new RangerSolrAuditHandler(solrPlugin.getConfig());
+ boolean isDenied = false;
if (attrsEnabled) {
if (logger.isDebugEnabled()) {
@@ -380,7 +383,7 @@ public class RangerSolrAuthorizer extends SearchComponent implements Authorizati
}
if (getUserStoreEnricher() == null || getUserStoreEnricher().getRangerUserStore() == null) {
logger.error("No User store enricher to read the ldap attributes");
- return;
+ isDenied = true;
}
// Ranger UserStore info for user/group attributes
Map<String, Map<String, String>> userAttrMapping = getUserStoreEnricher().getRangerUserStore().getUserAttrMapping();
@@ -418,10 +421,51 @@ public class RangerSolrAuthorizer extends SearchComponent implements Authorizati
}
} else {
- throw new SolrException(SolrException.ErrorCode.UNAUTHORIZED,
- "Request from user: " + userName + " rejected because user is not associated with any roles");
+ isDenied = true;
}
}
+ HttpServletRequest httpServletRequest = (HttpServletRequest) rb.req.getContext().get("httpRequest");
+ if (httpServletRequest == null) {
+ }
+ String ip = null;
+ Date eventTime = new Date();
+ // Set the IP
+ if (useProxyIP) {
+ ip = httpServletRequest.getHeader("X-Forwarded-For");
+ }
+
+ if (ip == null) {
+ ip = httpServletRequest.getRemoteAddr();
+ }
+
+ try {
+
+ RangerAccessRequestImpl rangerRequest = createQueryRequest(
+ userName, getGroupsForUser(userName), ip, eventTime, rb.req);
+ if (isDenied == true) {
+ RangerAccessResult result = new RangerAccessResult(RangerPolicy.POLICY_TYPE_ACCESS, solrPlugin.getServiceName(), solrPlugin.getServiceDef(), rangerRequest);
+ result.setIsAllowed(false);
+ result.setPolicyId(-1);
+ result.setIsAccessDetermined(true);
+ result.setIsAudited(true);
+ auditHandler.processResult(result);
+ } else {
+ RangerAccessResult result = solrPlugin.isAccessAllowed(
+ rangerRequest, auditHandler);
+ if (logger.isDebugEnabled()) {
+ logger.debug("rangerRequest=" + result);
+ }
+ if (result == null) {
+ isDenied = true;
+ }
+ }
+ } finally {
+ auditHandler.flushAudit();
+ }
+ if (isDenied == true) {
+ throw new SolrException(SolrException.ErrorCode.UNAUTHORIZED,
+ "Permission denied for user: " + userName);
+ }
}
@Override
@@ -547,6 +591,26 @@ public class RangerSolrAuthorizer extends SearchComponent implements Authorizati
return rangerRequest;
}
+ private RangerAccessRequestImpl createQueryRequest(String userName,
+ Set<String> userGroups, String ip, Date eventTime,
+ SolrQueryRequest queryRequest) {
+
+ String accessType = ACCESS_TYPE_OTHERS;
+ String action = ACCESS_TYPE_QUERY;
+ RangerAccessRequestImpl rangerRequest = createBaseRequest(userName,
+ userGroups, ip, eventTime);
+ RangerAccessResourceImpl rangerResource = new RangerAccessResourceImpl();
+ rangerResource.setServiceDef(solrPlugin.getServiceDef());
+ rangerResource.setValue(KEY_COLLECTION, queryRequest.getCore().getCoreDescriptor().getCollectionName());
+ rangerRequest.setResource(rangerResource);
+ rangerRequest.setAccessType(accessType);
+ rangerRequest.setAction(action);
+ rangerRequest.setRequestData(queryRequest.getParams().toLocalParamsString());
+ rangerRequest.setClusterName(solrPlugin.getClusterName());
+
+ return rangerRequest;
+ }
+
private RangerAccessRequestImpl createBaseRequest(String userName,
Set<String> userGroups, String ip, Date eventTime) {
RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl();
diff --git a/security-admin/src/main/webapp/scripts/utils/XAEnums.js b/security-admin/src/main/webapp/scripts/utils/XAEnums.js
index fd711fa..d1edbcb 100644
--- a/security-admin/src/main/webapp/scripts/utils/XAEnums.js
+++ b/security-admin/src/main/webapp/scripts/utils/XAEnums.js
@@ -120,7 +120,8 @@ define(function(require) {
ASSET_HIVE:{value:3, label:'Hive', rbkey:'xa.enum.AssetType.ASSET_HIVE', tt: 'lbl.AssetType_ASSET_HIVE'},
ASSET_AGENT:{value:4, label:'Agent', rbkey:'xa.enum.AssetType.ASSET_KNOX', tt: 'lbl.AssetType_ASSET_KNOX'},
ASSET_KNOX:{value:5, label:'Knox', rbkey:'xa.enum.AssetType.ASSET_KNOX', tt: 'lbl.AssetType_ASSET_KNOX'},
- ASSET_STORM:{value:6, label:'Storm', rbkey:'xa.enum.AssetType.ASSET_STORM', tt: 'lbl.AssetType_ASSET_STORM'}
+ ASSET_STORM:{value:6, label:'Storm', rbkey:'xa.enum.AssetType.ASSET_STORM', tt: 'lbl.AssetType_ASSET_STORM'},
+ ASSET_SOLR:{value:7, label:'Solr', rbkey:'xa.enum.AssetType.ASSET_SOLR', tt: 'lbl.AssetType_ASSET_SOLR'}
});
XAEnums.ServiceType = mergeParams(XAEnums.ServiceType, {
@@ -130,8 +131,9 @@ define(function(require) {
Service_HBASE:{value:3, label:'hbase', rbkey:'xa.enum.AssetType.ASSET_HBASE', tt: 'lbl.AssetType_ASSET_HBASE'},
Service_KNOX:{value:4, label:'knox', rbkey:'xa.enum.AssetType.ASSET_KNOX', tt: 'lbl.AssetType_ASSET_KNOX'},
Service_STORM:{value:5, label:'storm', rbkey:'xa.enum.AssetType.ASSET_STORM', tt: 'lbl.AssetType_ASSET_STORM'},
- SERVICE_TAG:{value:6, label:'tag', rbkey:'xa.enum.ServiceType.SERVICE_TAG', tt: 'lbl.ServiceType_SERVICE_TAG'},
- Service_KMS:{value:7, label:'kms', rbkey:'xa.enum.ServiceType.SERVICE_KMS', tt: 'lbl.ServiceType_SERVICE_KMS'}
+ Service_SOLR:{value:6, label:'solr', rbkey:'xa.enum.AssetType.ASSET_SOLR', tt: 'lbl.AssetType_ASSET_SOLR'},
+ SERVICE_TAG:{value:7, label:'tag', rbkey:'xa.enum.ServiceType.SERVICE_TAG', tt: 'lbl.ServiceType_SERVICE_TAG'},
+ Service_KMS:{value:8, label:'kms', rbkey:'xa.enum.ServiceType.SERVICE_KMS', tt: 'lbl.ServiceType_SERVICE_KMS'}
});
XAEnums.AuthStatus = mergeParams(XAEnums.AuthStatus, {
diff --git a/security-admin/src/main/webapp/scripts/utils/XAViewUtils.js b/security-admin/src/main/webapp/scripts/utils/XAViewUtils.js
index 9c2af5f..d8251a4 100644
--- a/security-admin/src/main/webapp/scripts/utils/XAViewUtils.js
+++ b/security-admin/src/main/webapp/scripts/utils/XAViewUtils.js
@@ -31,7 +31,7 @@ define(function(require) {
XAViewUtil.resourceTypeFormatter = function(rawValue, model){
var resourcePath = _.isUndefined(model.get('resourcePath')) ? undefined : model.get('resourcePath');
var resourceType = _.isUndefined(model.get('resourceType')) ? undefined : model.get('resourceType');
- if((model.get('serviceType') === XAEnums.ServiceType.Service_HIVE.label || model.get('serviceType') === XAEnums.ServiceType.Service_HBASE.label)
+ if((model.get('serviceType') === XAEnums.ServiceType.Service_HIVE.label || model.get('serviceType') === XAEnums.ServiceType.Service_HBASE.label || model.get('serviceType') === XAEnums.ServiceType.Service_SOLR.label)
&& model.get('aclEnforcer') === "ranger-acl"
&& model.get('requestData')){
if(resourcePath && !_.isEmpty(model.get('requestData'))) {
@@ -65,12 +65,13 @@ define(function(require) {
};
XAViewUtil.showQueryPopup = function(model, that){
- if((model.get('serviceType') === XAEnums.ServiceType.Service_HIVE.label || model.get('serviceType') === XAEnums.ServiceType.Service_HBASE.label)
+ if((model.get('serviceType') === XAEnums.ServiceType.Service_HIVE.label || model.get('serviceType') === XAEnums.ServiceType.Service_HBASE.label || model.get('serviceType') === XAEnums.ServiceType.Service_SOLR.label)
&& model.get('aclEnforcer') === "ranger-acl"
&& model.get('requestData') && !_.isEmpty(model.get('requestData'))){
var titleMap = {};
titleMap[XAEnums.ServiceType.Service_HIVE.label] = 'Hive Query';
titleMap[XAEnums.ServiceType.Service_HBASE.label] = 'HBase Audit Data';
+ titleMap[XAEnums.ServiceType.Service_SOLR.label] = 'Solr Query';
var msg = '<div class="pull-right link-tag query-icon copyQuery btn btn-mini" title="Copy Query"><i class="icon-copy"></i></div><div class="query-content">'+model.get('requestData')+'</div>';
var $elements = that.$el.find('table [data-name = "queryInfo"][data-id = "'+model.id+'"]');
$elements.popover({