You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2025/01/07 02:00:38 UTC
(ranger) branch RANGER-5061_pradeep updated: RANGER-5061: checkstyle compliance updates - security-admin module - org.apache.ranger.patch package
This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch RANGER-5061_pradeep
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/RANGER-5061_pradeep by this push:
new 6842d1044 RANGER-5061: checkstyle compliance updates - security-admin module - org.apache.ranger.patch package
6842d1044 is described below
commit 6842d10441596724eb5a7d8c86a1fd712b7db889
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Mon Jan 6 17:47:16 2025 -0800
RANGER-5061: checkstyle compliance updates - security-admin module - org.apache.ranger.patch package
---
.../PatchForHBaseServiceDefUpdate_J10035.java | 1 -
.../patch/PatchForHiveServiceDefUpdate_J10006.java | 62 +++--
.../patch/PatchForHiveServiceDefUpdate_J10007.java | 65 +++--
.../patch/PatchForHiveServiceDefUpdate_J10009.java | 62 +++--
.../patch/PatchForHiveServiceDefUpdate_J10010.java | 47 ++--
.../patch/PatchForHiveServiceDefUpdate_J10017.java | 49 ++--
.../patch/PatchForHiveServiceDefUpdate_J10027.java | 63 +++--
.../patch/PatchForHiveServiceDefUpdate_J10030.java | 45 ++--
.../PatchForKafkaServiceDefUpdate_J10015.java | 66 ++++--
.../PatchForKafkaServiceDefUpdate_J10025.java | 137 ++++++++---
.../PatchForKafkaServiceDefUpdate_J10033.java | 166 +++++++++----
...atchForMigratingOldRegimePolicyJson_J10046.java | 78 ++++--
...chForMigratingRangerServiceResource_J10037.java | 51 ++--
.../PatchForNifiResourceUpdateExclude_J10011.java | 33 ++-
.../PatchForOzoneDefaultPoliciesUpdate_J10044.java | 28 ++-
...PatchForOzoneServiceDefConfigUpdate_J10051.java | 63 +++--
.../PatchForOzoneServiceDefUpdate_J10041.java | 89 +++++--
.../PatchForPrestoToSupportPresto333_J10038.java | 38 ++-
.../patch/PatchForServiceVersionInfo_J10004.java | 12 +-
...PatchForSolrSvcDefAndPoliciesUpdate_J10055.java | 261 ++++++++++++++-------
.../patch/PatchForSyncSourceUpdate_J10054.java | 76 ++++--
.../patch/PatchForTagServiceDefUpdate_J10008.java | 54 +++--
.../patch/PatchForTagServiceDefUpdate_J10028.java | 66 ++++--
.../patch/PatchForTrinoSvcDefUpdate_J10062.java | 198 ++++++++++------
...orUpdatingAtlasSvcDefAndTagPolicies_J10063.java | 48 +++-
.../patch/PatchForUpdatingPolicyJson_J10019.java | 127 +++++-----
.../patch/PatchForUpdatingTagsJson_J10020.java | 86 +++----
.../ranger/patch/PatchForXGlobalState_J10036.java | 15 +-
...chGrantAuditPermissionToKeyRoleUser_J10014.java | 29 ++-
.../apache/ranger/patch/PatchMigration_J10002.java | 123 ++++++----
.../patch/PatchPasswordEncryption_J10001.java | 21 +-
.../ranger/patch/PatchPermissionModel_J10003.java | 72 ++++--
...tchPreSql_057_ForUpdateToUniqueGUID_J10052.java | 34 ++-
...ForUpdateToUniqueResoureceSignature_J10053.java | 42 +++-
.../patch/PatchSetAccessTypeCategory_J10061.java | 2 +-
.../patch/PatchTagModulePermission_J10005.java | 23 +-
36 files changed, 1679 insertions(+), 753 deletions(-)
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHBaseServiceDefUpdate_J10035.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHBaseServiceDefUpdate_J10035.java
index 60bacd8ad..7f9b2a6e9 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHBaseServiceDefUpdate_J10035.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHBaseServiceDefUpdate_J10035.java
@@ -247,7 +247,6 @@ public class PatchForHBaseServiceDefUpdate_J10035 extends BaseLoader {
if (REFRESH_ACCESS_TYPE_NAME.equals(accessTypeDef.getName())) {
ret = true;
break;
-
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10006.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10006.java
index 3cebe20f4..998a82722 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10006.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10006.java
@@ -45,8 +45,10 @@ import java.util.Map;
@Component
public class PatchForHiveServiceDefUpdate_J10006 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10006.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10006.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
+
@Autowired
RangerDaoManager daoMgr;
@@ -79,13 +81,18 @@ public class PatchForHiveServiceDefUpdate_J10006 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForHiveServiceDefUpdate_J10006 loader = (PatchForHiveServiceDefUpdate_J10006) CLIUtil.getBean(PatchForHiveServiceDefUpdate_J10006.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
@@ -106,16 +113,19 @@ public class PatchForHiveServiceDefUpdate_J10006 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForHiveServiceDefUpdate.execLoad()");
+
try {
updateHiveServiceDef();
} catch (Exception e) {
logger.error("Error whille updateHiveServiceDef()data.", e);
}
+
logger.info("<== PatchForHiveServiceDefUpdate.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -125,15 +135,19 @@ public class PatchForHiveServiceDefUpdate_J10006 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
@@ -142,56 +156,62 @@ public class PatchForHiveServiceDefUpdate_J10006 extends BaseLoader {
}
private void updateHiveServiceDef() {
- RangerServiceDef ret = null;
- RangerServiceDef embeddedHiveServiceDef = null;
- RangerServiceDef dbHiveServiceDef = null;
- RangerDataMaskDef dataMaskDef = null;
- RangerRowFilterDef rowFilterDef = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (embeddedHiveServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
Map<String, String> serviceDefOptionsPreUpdate = null;
- String jsonStrPreUpdate = null;
+
if (xXServiceDefObj != null) {
- jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+ String jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+
serviceDefOptionsPreUpdate = jsonStringToMap(jsonStrPreUpdate);
- xXServiceDefObj = null;
}
- dataMaskDef = embeddedHiveServiceDef.getDataMaskDef();
- rowFilterDef = embeddedHiveServiceDef.getRowFilterDef();
- dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerDataMaskDef dataMaskDef = embeddedHiveServiceDef.getDataMaskDef();
+ RangerRowFilterDef rowFilterDef = embeddedHiveServiceDef.getRowFilterDef();
if (dbHiveServiceDef != null) {
if (dataMaskDef != null) {
dbHiveServiceDef.setDataMaskDef(dataMaskDef);
}
+
if (rowFilterDef != null) {
dbHiveServiceDef.setRowFilterDef(rowFilterDef);
}
+
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbHiveServiceDef, Action.UPDATE);
- ret = svcStore.updateServiceDef(dbHiveServiceDef);
+ RangerServiceDef ret = svcStore.updateServiceDef(dbHiveServiceDef);
+
if (ret == null) {
logger.error("Error while updating {} service-def", SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
System.exit(1);
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
@@ -205,6 +225,7 @@ public class PatchForHiveServiceDefUpdate_J10006 extends BaseLoader {
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -212,6 +233,7 @@ public class PatchForHiveServiceDefUpdate_J10006 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, excp);
}
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10007.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10007.java
index c7527e4d1..7157435f1 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10007.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10007.java
@@ -44,9 +44,11 @@ import java.util.Map;
@Component
public class PatchForHiveServiceDefUpdate_J10007 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10007.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
- public static final String URL_RESOURCE_NAME = "url";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10007.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
+ public static final String URL_RESOURCE_NAME = "url";
+
@Autowired
RangerDaoManager daoMgr;
@@ -79,16 +81,22 @@ public class PatchForHiveServiceDefUpdate_J10007 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForHiveServiceDefUpdate_J10007 loader = (PatchForHiveServiceDefUpdate_J10007) CLIUtil.getBean(PatchForHiveServiceDefUpdate_J10007.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -106,16 +114,19 @@ public class PatchForHiveServiceDefUpdate_J10007 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForHiveServiceDefUpdate.execLoad()");
+
try {
updateHiveServiceDef();
} catch (Exception e) {
logger.error("Error whille updateHiveServiceDef()data.", e);
}
+
logger.info("<== PatchForHiveServiceDefUpdate.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -125,15 +136,19 @@ public class PatchForHiveServiceDefUpdate_J10007 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
@@ -142,34 +157,31 @@ public class PatchForHiveServiceDefUpdate_J10007 extends BaseLoader {
}
private void updateHiveServiceDef() {
- RangerServiceDef ret = null;
- RangerServiceDef embeddedHiveServiceDef = null;
- RangerServiceDef dbHiveServiceDef = null;
- List<RangerServiceDef.RangerResourceDef> embeddedHiveResourceDefs = null;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (embeddedHiveServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
Map<String, String> serviceDefOptionsPreUpdate = null;
- String jsonStrPreUpdate = null;
+ String jsonStrPreUpdate;
+
if (xXServiceDefObj != null) {
jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
serviceDefOptionsPreUpdate = jsonStringToMap(jsonStrPreUpdate);
- xXServiceDefObj = null;
}
- dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
+ RangerServiceDef dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (dbHiveServiceDef != null) {
- embeddedHiveResourceDefs = embeddedHiveServiceDef.getResources();
- embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
+ List<RangerServiceDef.RangerResourceDef> embeddedHiveResourceDefs = embeddedHiveServiceDef.getResources();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
if (checkURLresourcePresent(embeddedHiveResourceDefs)) {
// This is to check if URL def is added to the resource definition, if so update the resource def and accessType def
if (embeddedHiveResourceDefs != null) {
dbHiveServiceDef.setResources(embeddedHiveResourceDefs);
}
+
if (embeddedHiveAccessTypes != null) {
if (!embeddedHiveAccessTypes.toString().equalsIgnoreCase(dbHiveServiceDef.getAccessTypes().toString())) {
dbHiveServiceDef.setAccessTypes(embeddedHiveAccessTypes);
@@ -178,26 +190,35 @@ public class PatchForHiveServiceDefUpdate_J10007 extends BaseLoader {
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbHiveServiceDef, Action.UPDATE);
- ret = svcStore.updateServiceDef(dbHiveServiceDef);
+ RangerServiceDef ret = svcStore.updateServiceDef(dbHiveServiceDef);
+
if (ret == null) {
logger.error("Error while updating {} service-def", SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
throw new RuntimeException("Error while updating " + SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME + "service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
@@ -211,17 +232,20 @@ public class PatchForHiveServiceDefUpdate_J10007 extends BaseLoader {
private boolean checkURLresourcePresent(List<RangerServiceDef.RangerResourceDef> resourceDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
if (URL_RESOURCE_NAME.equals(resourceDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -229,6 +253,7 @@ public class PatchForHiveServiceDefUpdate_J10007 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, excp);
}
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10009.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10009.java
index 07c5508e0..b234a7929 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10009.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10009.java
@@ -44,9 +44,10 @@ import java.util.Map;
@Component
public class PatchForHiveServiceDefUpdate_J10009 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10009.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
- public static final String URL_RESOURCE_NAME = "url";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10009.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
+ public static final String URL_RESOURCE_NAME = "url";
@Autowired
RangerDaoManager daoMgr;
@@ -80,16 +81,22 @@ public class PatchForHiveServiceDefUpdate_J10009 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForHiveServiceDefUpdate_J10009 loader = (PatchForHiveServiceDefUpdate_J10009) CLIUtil.getBean(PatchForHiveServiceDefUpdate_J10009.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -107,16 +114,19 @@ public class PatchForHiveServiceDefUpdate_J10009 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForHiveServiceDefUpdate.execLoad()");
+
try {
updateHiveServiceDef();
} catch (Exception e) {
logger.error("Error whille updateHiveServiceDef()data.", e);
}
+
logger.info("<== PatchForHiveServiceDefUpdate.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -126,69 +136,81 @@ public class PatchForHiveServiceDefUpdate_J10009 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
}
+
return ret;
}
private void updateHiveServiceDef() {
- RangerServiceDef ret = null;
- RangerServiceDef embeddedHiveServiceDef = null;
- RangerServiceDef dbHiveServiceDef = null;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (embeddedHiveServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
Map<String, String> serviceDefOptionsPreUpdate = null;
- String jsonStrPreUpdate = null;
+ String jsonStrPreUpdate;
+
if (xXServiceDefObj != null) {
jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
serviceDefOptionsPreUpdate = jsonStringToMap(jsonStrPreUpdate);
- xXServiceDefObj = null;
}
- dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
+ RangerServiceDef dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (dbHiveServiceDef != null) {
- embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
+
if (checkHiveAccessType(embeddedHiveAccessTypes)) {
// This is to check if HiveServiceDef AccessType has the new AccessType and if Present update the dbHiveServiceDef along with new Admin accessType.
dbHiveServiceDef.setAccessTypes(embeddedHiveAccessTypes);
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbHiveServiceDef, Action.UPDATE);
- ret = svcStore.updateServiceDef(dbHiveServiceDef);
+ RangerServiceDef ret = svcStore.updateServiceDef(dbHiveServiceDef);
+
if (ret == null) {
logger.error("Error while updating {} service-def", SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
throw new RuntimeException("Error while updating " + SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME + "service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
@@ -202,17 +224,20 @@ public class PatchForHiveServiceDefUpdate_J10009 extends BaseLoader {
private boolean checkHiveAccessType(List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes) {
boolean ret = false;
+
for (RangerServiceDef.RangerAccessTypeDef embeddedHiveAccessType : embeddedHiveAccessTypes) {
if (embeddedHiveAccessType.getName().equals("repladmin")) {
ret = true;
break;
}
}
+
return ret;
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -220,6 +245,7 @@ public class PatchForHiveServiceDefUpdate_J10009 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, excp);
}
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10010.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10010.java
index 1a0092963..013cb60c4 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10010.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10010.java
@@ -43,9 +43,11 @@ import java.util.Map;
@Component
public class PatchForHiveServiceDefUpdate_J10010 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10010.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
- public static final String HIVE_SERVICE_RESOURCE_NAME = "hiveservice";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10010.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
+ public static final String HIVE_SERVICE_RESOURCE_NAME = "hiveservice";
+
@Autowired
RangerDaoManager daoMgr;
@@ -78,16 +80,22 @@ public class PatchForHiveServiceDefUpdate_J10010 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForHiveServiceDefUpdate_J10010 loader = (PatchForHiveServiceDefUpdate_J10010) CLIUtil.getBean(PatchForHiveServiceDefUpdate_J10010.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -105,33 +113,33 @@ public class PatchForHiveServiceDefUpdate_J10010 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForHiveServiceDefUpdateForResourceSpecificAccesses.execLoad()");
+
try {
updateHiveServiceDef();
} catch (Exception e) {
logger.error("Error whille updateHiveServiceDef()data.", e);
}
+
logger.info("<== PatchForHiveServiceDefUpdateForResourceSpecificAccesses.execLoad()");
}
private void updateHiveServiceDef() {
- RangerServiceDef embeddedHiveServiceDef = null;
- RangerServiceDef dbHiveServiceDef = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (embeddedHiveServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (xXServiceDefObj == null) {
logger.error("Service def for {} is not found!!", SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
return;
}
String jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPreUpdate = jsonUtil.jsonToMap(jsonStrPreUpdate);
String valueBeforeUpdate = serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
-
- dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (dbHiveServiceDef != null) {
boolean isServiceDefUpdated = updateServiceDef(dbHiveServiceDef, embeddedHiveServiceDef);
@@ -150,7 +158,9 @@ public class PatchForHiveServiceDefUpdate_J10010 extends BaseLoader {
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, valueBeforeUpdate);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
@@ -165,27 +175,28 @@ public class PatchForHiveServiceDefUpdate_J10010 extends BaseLoader {
private boolean updateServiceDef(RangerServiceDef serviceDef, RangerServiceDef embeddedHiveServiceDef) throws Exception {
boolean ret = false;
- List<RangerServiceDef.RangerResourceDef> embeddedHiveResourceDefs = null;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = null;
-
- embeddedHiveResourceDefs = embeddedHiveServiceDef.getResources();
- embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
+ List<RangerServiceDef.RangerResourceDef> embeddedHiveResourceDefs = embeddedHiveServiceDef.getResources();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
if (checkHiveServiceresourcePresent(embeddedHiveResourceDefs)) {
// This is to check if HIVESERVICE def is added to the resource definition, if so update the resource def and accessType def
if (embeddedHiveResourceDefs != null) {
serviceDef.setResources(embeddedHiveResourceDefs);
}
+
if (embeddedHiveAccessTypes != null) {
if (!embeddedHiveAccessTypes.toString().equalsIgnoreCase(serviceDef.getAccessTypes().toString())) {
serviceDef.setAccessTypes(embeddedHiveAccessTypes);
}
}
+
ret = true;
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(serviceDef, Action.UPDATE);
+
svcStore.updateServiceDef(serviceDef);
return ret;
@@ -193,20 +204,24 @@ public class PatchForHiveServiceDefUpdate_J10010 extends BaseLoader {
private boolean checkHiveServiceresourcePresent(List<RangerServiceDef.RangerResourceDef> resourceDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
if (HIVE_SERVICE_RESOURCE_NAME.equals(resourceDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
- private String mapToJsonString(Map<String, String> map) throws Exception {
+ private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
ret = jsonUtil.readMapToString(map);
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10017.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10017.java
index 30b1a93c2..fca40b511 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10017.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10017.java
@@ -43,9 +43,11 @@ import java.util.Map;
@Component
public class PatchForHiveServiceDefUpdate_J10017 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10017.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
- public static final String HIVE_GLOBAL_RESOURCE_NAME = "global";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10017.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
+ public static final String HIVE_GLOBAL_RESOURCE_NAME = "global";
+
@Autowired
RangerDaoManager daoMgr;
@@ -78,16 +80,22 @@ public class PatchForHiveServiceDefUpdate_J10017 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForHiveServiceDefUpdate_J10017 loader = (PatchForHiveServiceDefUpdate_J10017) CLIUtil.getBean(PatchForHiveServiceDefUpdate_J10017.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -105,25 +113,26 @@ public class PatchForHiveServiceDefUpdate_J10017 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForHiveServiceDefUpdateForResourceSpecificAccesses.execLoad()");
+
try {
updateHiveServiceDef();
} catch (Exception e) {
logger.error("Error whille updateHiveServiceDef()data.", e);
}
+
logger.info("<== PatchForHiveServiceDefUpdateForResourceSpecificAccesses.execLoad()");
}
private void updateHiveServiceDef() {
- RangerServiceDef embeddedHiveServiceDef = null;
- RangerServiceDef dbHiveServiceDef = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (embeddedHiveServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (xXServiceDefObj == null) {
logger.error("Service def for {} is not found!!", SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
return;
}
@@ -131,7 +140,7 @@ public class PatchForHiveServiceDefUpdate_J10017 extends BaseLoader {
Map<String, String> serviceDefOptionsPreUpdate = jsonUtil.jsonToMap(jsonStrPreUpdate);
String valueBeforeUpdate = serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
- dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (dbHiveServiceDef != null) {
boolean isServiceDefUpdated = updateServiceDef(dbHiveServiceDef, embeddedHiveServiceDef);
@@ -150,7 +159,9 @@ public class PatchForHiveServiceDefUpdate_J10017 extends BaseLoader {
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, valueBeforeUpdate);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
@@ -163,29 +174,29 @@ public class PatchForHiveServiceDefUpdate_J10017 extends BaseLoader {
}
private boolean updateServiceDef(RangerServiceDef serviceDef, RangerServiceDef embeddedHiveServiceDef) throws Exception {
- boolean ret = false;
-
- List<RangerServiceDef.RangerResourceDef> embeddedHiveResourceDefs = null;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = null;
-
- embeddedHiveResourceDefs = embeddedHiveServiceDef.getResources();
- embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
+ boolean ret = false;
+ List<RangerServiceDef.RangerResourceDef> embeddedHiveResourceDefs = embeddedHiveServiceDef.getResources();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
if (checkHiveGlobalresourcePresent(embeddedHiveResourceDefs)) {
// This is to check if HIVESERVICE def is added to the resource definition, if so update the resource def and accessType def
if (embeddedHiveResourceDefs != null) {
serviceDef.setResources(embeddedHiveResourceDefs);
}
+
if (embeddedHiveAccessTypes != null) {
if (!embeddedHiveAccessTypes.toString().equalsIgnoreCase(serviceDef.getAccessTypes().toString())) {
serviceDef.setAccessTypes(embeddedHiveAccessTypes);
}
}
+
ret = true;
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(serviceDef, Action.UPDATE);
+
svcStore.updateServiceDef(serviceDef);
return ret;
@@ -193,20 +204,24 @@ public class PatchForHiveServiceDefUpdate_J10017 extends BaseLoader {
private boolean checkHiveGlobalresourcePresent(List<RangerServiceDef.RangerResourceDef> resourceDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
if (HIVE_GLOBAL_RESOURCE_NAME.equals(resourceDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
- private String mapToJsonString(Map<String, String> map) throws Exception {
+ private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
ret = jsonUtil.readMapToString(map);
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10027.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10027.java
index 08b4e3c18..0865d53b7 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10027.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10027.java
@@ -44,9 +44,11 @@ import java.util.Map;
@Component
public class PatchForHiveServiceDefUpdate_J10027 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10027.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
- public static final String REFRESH_ACCESS_TYPE_NAME = "refresh";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10027.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
+ public static final String REFRESH_ACCESS_TYPE_NAME = "refresh";
+
@Autowired
RangerDaoManager daoMgr;
@@ -79,16 +81,22 @@ public class PatchForHiveServiceDefUpdate_J10027 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForHiveServiceDefUpdate_J10027 loader = (PatchForHiveServiceDefUpdate_J10027) CLIUtil.getBean(PatchForHiveServiceDefUpdate_J10027.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting.");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -109,17 +117,21 @@ public class PatchForHiveServiceDefUpdate_J10027 extends BaseLoader {
try {
if (!updateHiveServiceDef()) {
logger.error("Failed to apply the patch.");
+
System.exit(1);
}
} catch (Exception e) {
logger.error("Error while updateHiveServiceDef()data.", e);
+
System.exit(1);
}
+
logger.info("<== PatchForHiveServiceDefUpdate.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -129,15 +141,19 @@ public class PatchForHiveServiceDefUpdate_J10027 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
@@ -146,16 +162,10 @@ public class PatchForHiveServiceDefUpdate_J10027 extends BaseLoader {
}
private boolean updateHiveServiceDef() throws Exception {
- RangerServiceDef ret;
- RangerServiceDef embeddedHiveServiceDef;
- RangerServiceDef dbHiveServiceDef;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes;
- XXServiceDef xXServiceDefObj;
-
- embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (embeddedHiveServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
Map<String, String> serviceDefOptionsPreUpdate;
String jsonPreUpdate;
@@ -164,12 +174,14 @@ public class PatchForHiveServiceDefUpdate_J10027 extends BaseLoader {
serviceDefOptionsPreUpdate = jsonStringToMap(jsonPreUpdate);
} else {
logger.error("Hive service-definition does not exist in the Ranger DAO. No patching is needed!!");
+
return true;
}
- dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
+ RangerServiceDef dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (dbHiveServiceDef != null) {
- embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedHiveAccessTypes = embeddedHiveServiceDef.getAccessTypes();
if (embeddedHiveAccessTypes != null) {
if (checkNewHiveAccessTypesPresent(embeddedHiveAccessTypes)) {
@@ -180,55 +192,71 @@ public class PatchForHiveServiceDefUpdate_J10027 extends BaseLoader {
}
} else {
logger.error("Hive service-definition does not exist in the db store.");
+
return false;
}
+
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbHiveServiceDef, RangerValidator.Action.UPDATE);
- ret = svcStore.updateServiceDef(dbHiveServiceDef);
+ RangerServiceDef ret = svcStore.updateServiceDef(dbHiveServiceDef);
+
if (ret == null) {
throw new RuntimeException("Error while updating " + SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME + " service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
} else {
logger.error("Hive service-definition does not exist in the Ranger DAO.");
+
return false;
}
} else {
logger.error("The embedded Hive service-definition does not exist.");
+
return false;
}
+
return true;
}
private static boolean checkNewHiveAccessTypesPresent(List<RangerServiceDef.RangerAccessTypeDef> accessTypeDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerAccessTypeDef accessTypeDef : accessTypeDefs) {
if (REFRESH_ACCESS_TYPE_NAME.equals(accessTypeDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -236,6 +264,7 @@ public class PatchForHiveServiceDefUpdate_J10027 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, ex);
}
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10030.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10030.java
index 40b756bad..c7273bb3d 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10030.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForHiveServiceDefUpdate_J10030.java
@@ -43,9 +43,11 @@ import java.util.Map;
@Component
public class PatchForHiveServiceDefUpdate_J10030 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10030.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
- public static final String HIVE_URL_MATCHER = "RangerURLResourceMatcher";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForHiveServiceDefUpdate_J10030.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME = "hive";
+ public static final String HIVE_URL_MATCHER = "RangerURLResourceMatcher";
+
@Autowired
RangerDaoManager daoMgr;
@@ -78,16 +80,22 @@ public class PatchForHiveServiceDefUpdate_J10030 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForHiveServiceDefUpdate_J10030 loader = (PatchForHiveServiceDefUpdate_J10030) CLIUtil.getBean(PatchForHiveServiceDefUpdate_J10030.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -105,25 +113,26 @@ public class PatchForHiveServiceDefUpdate_J10030 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForHiveServiceDefUpdateForURLTypeResourceUpdate.execLoad()");
+
try {
updateHiveServiceDef();
} catch (Exception e) {
logger.error("Error whille updateHiveServiceDef()data.", e);
}
+
logger.info("<== PatchForHiveServiceDefUpdateForURLTypeResourceUpdate.execLoad()");
}
private void updateHiveServiceDef() {
- RangerServiceDef embeddedHiveServiceDef = null;
- RangerServiceDef dbHiveServiceDef = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef embeddedHiveServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (embeddedHiveServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
if (xXServiceDefObj == null) {
logger.error("Service def for {} is not found!!", SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+
return;
}
@@ -131,7 +140,7 @@ public class PatchForHiveServiceDefUpdate_J10030 extends BaseLoader {
Map<String, String> serviceDefOptionsPreUpdate = jsonUtil.jsonToMap(jsonStrPreUpdate);
String valueBeforeUpdate = serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
- dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
+ RangerServiceDef dbHiveServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_HIVE_NAME);
if (dbHiveServiceDef != null) {
boolean isServiceDefUpdated = updateServiceDef(dbHiveServiceDef, embeddedHiveServiceDef);
@@ -150,7 +159,9 @@ public class PatchForHiveServiceDefUpdate_J10030 extends BaseLoader {
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, valueBeforeUpdate);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
@@ -163,22 +174,22 @@ public class PatchForHiveServiceDefUpdate_J10030 extends BaseLoader {
}
private boolean updateServiceDef(RangerServiceDef serviceDef, RangerServiceDef embeddedHiveServiceDef) throws Exception {
- boolean ret = false;
-
- List<RangerServiceDef.RangerResourceDef> embeddedHiveResourceDefs = null;
-
- embeddedHiveResourceDefs = embeddedHiveServiceDef.getResources();
+ boolean ret = false;
+ List<RangerServiceDef.RangerResourceDef> embeddedHiveResourceDefs = embeddedHiveServiceDef.getResources();
if (checkHiveURLResourceMatcherPresent(embeddedHiveResourceDefs)) {
// This is to check if URL resource matcher is added to the resource definition, if so update the resource def
if (embeddedHiveResourceDefs != null) {
serviceDef.setResources(embeddedHiveResourceDefs);
}
+
ret = true;
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(serviceDef, Action.UPDATE);
+
svcStore.updateServiceDef(serviceDef);
return ret;
@@ -186,18 +197,22 @@ public class PatchForHiveServiceDefUpdate_J10030 extends BaseLoader {
private boolean checkHiveURLResourceMatcherPresent(List<RangerServiceDef.RangerResourceDef> resourceDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
String urlResourceMatcher = resourceDef.getMatcher();
+
if (StringUtils.isNotEmpty(urlResourceMatcher) && urlResourceMatcher.endsWith(HIVE_URL_MATCHER)) {
ret = true;
break;
}
}
+
return ret;
}
- private String mapToJsonString(Map<String, String> map) throws Exception {
+ private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
ret = jsonUtil.readMapToString(map);
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10015.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10015.java
index 96cd5b288..60d021278 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10015.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10015.java
@@ -44,9 +44,11 @@ import java.util.Map;
@Component
public class PatchForKafkaServiceDefUpdate_J10015 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForKafkaServiceDefUpdate_J10015.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME = "kafka";
- public static final String TRANSACTIONALID_RESOURCE_NAME = "transactionalid";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForKafkaServiceDefUpdate_J10015.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME = "kafka";
+ public static final String TRANSACTIONALID_RESOURCE_NAME = "transactionalid";
+
@Autowired
RangerDaoManager daoMgr;
@@ -79,16 +81,22 @@ public class PatchForKafkaServiceDefUpdate_J10015 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForKafkaServiceDefUpdate_J10015 loader = (PatchForKafkaServiceDefUpdate_J10015) CLIUtil.getBean(PatchForKafkaServiceDefUpdate_J10015.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -106,16 +114,19 @@ public class PatchForKafkaServiceDefUpdate_J10015 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForKafkaServiceDefUpdate_J10015.execLoad()");
+
try {
updateHiveServiceDef();
} catch (Exception e) {
logger.error("Error while applying PatchForKafkaServiceDefUpdate_J10015...", e);
}
+
logger.info("<== PatchForKafkaServiceDefUpdate_J10015.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -125,15 +136,19 @@ public class PatchForKafkaServiceDefUpdate_J10015 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
@@ -142,34 +157,31 @@ public class PatchForKafkaServiceDefUpdate_J10015 extends BaseLoader {
}
private void updateHiveServiceDef() {
- RangerServiceDef ret = null;
- RangerServiceDef embeddedKafkaServiceDef = null;
- RangerServiceDef dbKafkaServiceDef = null;
- List<RangerServiceDef.RangerResourceDef> embeddedKafkaResourceDefs = null;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedKafkaAccessTypes = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedKafkaServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+ RangerServiceDef embeddedKafkaServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
if (embeddedKafkaServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
Map<String, String> serviceDefOptionsPreUpdate = null;
- String jsonStrPreUpdate = null;
+
if (xXServiceDefObj != null) {
- jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+ String jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+
serviceDefOptionsPreUpdate = jsonStringToMap(jsonStrPreUpdate);
- xXServiceDefObj = null;
}
- dbKafkaServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
+ RangerServiceDef dbKafkaServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
if (dbKafkaServiceDef != null) {
- embeddedKafkaResourceDefs = embeddedKafkaServiceDef.getResources();
- embeddedKafkaAccessTypes = embeddedKafkaServiceDef.getAccessTypes();
+ List<RangerServiceDef.RangerResourceDef> embeddedKafkaResourceDefs = embeddedKafkaServiceDef.getResources();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedKafkaAccessTypes = embeddedKafkaServiceDef.getAccessTypes();
if (checkNewKafkaresourcePresent(embeddedKafkaResourceDefs)) {
// This is to check if URL def is added to the resource definition, if so update the resource def and accessType def
if (embeddedKafkaResourceDefs != null) {
dbKafkaServiceDef.setResources(embeddedKafkaResourceDefs);
}
+
if (embeddedKafkaAccessTypes != null) {
if (!embeddedKafkaAccessTypes.toString().equalsIgnoreCase(dbKafkaServiceDef.getAccessTypes().toString())) {
dbKafkaServiceDef.setAccessTypes(embeddedKafkaAccessTypes);
@@ -178,26 +190,34 @@ public class PatchForKafkaServiceDefUpdate_J10015 extends BaseLoader {
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbKafkaServiceDef, Action.UPDATE);
- ret = svcStore.updateServiceDef(dbKafkaServiceDef);
+ RangerServiceDef ret = svcStore.updateServiceDef(dbKafkaServiceDef);
+
if (ret == null) {
logger.error("Error while updating {} service-def", SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
throw new RuntimeException("Error while updating " + SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME + "service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
@@ -211,17 +231,20 @@ public class PatchForKafkaServiceDefUpdate_J10015 extends BaseLoader {
private boolean checkNewKafkaresourcePresent(List<RangerServiceDef.RangerResourceDef> resourceDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
if (TRANSACTIONALID_RESOURCE_NAME.equals(resourceDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -229,6 +252,7 @@ public class PatchForKafkaServiceDefUpdate_J10015 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, excp);
}
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10025.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10025.java
index 16d6b392a..4f6bdff1a 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10025.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10025.java
@@ -56,8 +56,6 @@ import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.TransactionDefinition;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.ArrayList;
@@ -69,14 +67,17 @@ import java.util.Map;
@Component
public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForKafkaServiceDefUpdate_J10025.class);
+ private static final Logger logger = LoggerFactory.getLogger(PatchForKafkaServiceDefUpdate_J10025.class);
+
public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME = "kafka";
public static final String CLUSTER_RESOURCE_NAME = "cluster";
+
private static final List<String> POLICY_NAMES = new ArrayList<>(Arrays.asList("all - cluster", "all - delegationtoken"));
private static final String LOGIN_ID_ADMIN = "admin";
private static final String KAFKA_RESOURCE_CLUSTER = "cluster";
private static final String KAFKA_RESOURCE_DELEGATIONTOKEN = "delegationtoken";
- private static final List<String> DEFAULT_POLICY_USERS = new ArrayList<>(Arrays.asList("kafka", "rangerlookup"));
+ private static final List<String> DEFAULT_POLICY_USERS = new ArrayList<>(Arrays.asList("kafka", "rangerlookup"));
+
@Autowired
RangerDaoManager daoMgr;
@@ -119,16 +120,22 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForKafkaServiceDefUpdate_J10025 loader = (PatchForKafkaServiceDefUpdate_J10025) CLIUtil.getBean(PatchForKafkaServiceDefUpdate_J10025.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -146,16 +153,19 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForKafkaServiceDefUpdate_J10025.execLoad()");
+
try {
updateKafkaServiceDef();
} catch (Exception e) {
logger.error("Error while applying PatchForKafkaServiceDefUpdate_J10025...", e);
}
+
logger.info("<== PatchForKafkaServiceDefUpdate_J10025.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -165,15 +175,19 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
@@ -182,34 +196,31 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
}
private void updateKafkaServiceDef() {
- RangerServiceDef ret = null;
- RangerServiceDef embeddedKafkaServiceDef = null;
- RangerServiceDef dbKafkaServiceDef = null;
- List<RangerServiceDef.RangerResourceDef> embeddedKafkaResourceDefs = null;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedKafkaAccessTypes = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedKafkaServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+ RangerServiceDef embeddedKafkaServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
if (embeddedKafkaServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
Map<String, String> serviceDefOptionsPreUpdate = null;
- String jsonStrPreUpdate = null;
+
if (xXServiceDefObj != null) {
- jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+ String jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+
serviceDefOptionsPreUpdate = jsonStringToMap(jsonStrPreUpdate);
- xXServiceDefObj = null;
}
- dbKafkaServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
+ RangerServiceDef dbKafkaServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
if (dbKafkaServiceDef != null) {
- embeddedKafkaResourceDefs = embeddedKafkaServiceDef.getResources();
- embeddedKafkaAccessTypes = embeddedKafkaServiceDef.getAccessTypes();
+ List<RangerServiceDef.RangerResourceDef> embeddedKafkaResourceDefs = embeddedKafkaServiceDef.getResources();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedKafkaAccessTypes = embeddedKafkaServiceDef.getAccessTypes();
if (checkNewKafkaresourcePresent(embeddedKafkaResourceDefs)) {
// This is to check if CLUSTER resource is added to the resource definition, if so update the resource def and accessType def
if (embeddedKafkaResourceDefs != null) {
dbKafkaServiceDef.setResources(embeddedKafkaResourceDefs);
}
+
if (embeddedKafkaAccessTypes != null) {
if (!embeddedKafkaAccessTypes.toString().equalsIgnoreCase(dbKafkaServiceDef.getAccessTypes().toString())) {
dbKafkaServiceDef.setAccessTypes(embeddedKafkaAccessTypes);
@@ -218,29 +229,39 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbKafkaServiceDef, Action.UPDATE);
- ret = svcStore.updateServiceDef(dbKafkaServiceDef);
+ RangerServiceDef ret = svcStore.updateServiceDef(dbKafkaServiceDef);
+
if (ret == null) {
logger.error("Error while updating {} service-def", SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
throw new RuntimeException("Error while updating " + SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME + "service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
+
createDefaultPolicyForNewResources();
}
}
@@ -252,17 +273,20 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
private boolean checkNewKafkaresourcePresent(List<RangerServiceDef.RangerResourceDef> resourceDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
if (CLUSTER_RESOURCE_NAME.equals(resourceDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -270,17 +294,20 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, excp);
}
}
+
return ret;
}
private void createDefaultPolicyForNewResources() {
logger.info("==> createDefaultPolicyForNewResources ");
- XXPortalUser xxPortalUser = daoMgr.getXXPortalUser().findByLoginId(LOGIN_ID_ADMIN);
- Long currentUserId = xxPortalUser.getId();
+ XXPortalUser xxPortalUser = daoMgr.getXXPortalUser().findByLoginId(LOGIN_ID_ADMIN);
+ Long currentUserId = xxPortalUser.getId();
XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KAFKA_NAME);
+
if (xXServiceDefObj == null) {
logger.debug("ServiceDef not fount with name :{}", EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KAFKA_NAME);
+
return;
}
@@ -289,8 +316,10 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
for (XXService xxService : xxServices) {
int resourceMapOrder = 0;
+
for (String newResource : POLICY_NAMES) {
XXPolicy xxPolicy = new XXPolicy();
+
xxPolicy.setName(newResource);
xxPolicy.setDescription(newResource);
xxPolicy.setService(xxService.getId());
@@ -301,13 +330,17 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
xxPolicy.setGuid(guidUtil.genGUID());
xxPolicy.setAddedByUserId(currentUserId);
xxPolicy.setUpdatedByUserId(currentUserId);
+
RangerPolicy rangerPolicy = getRangerPolicy(newResource, xxPortalUser, xxService);
+
xxPolicy.setPolicyText(JsonUtils.objectToJson(rangerPolicy));
xxPolicy.setResourceSignature(rangerPolicy.getResourceSignature());
xxPolicy.setZoneId(1L);
+
XXPolicy createdPolicy = daoMgr.getXXPolicy().create(xxPolicy);
XXPolicyItem xxPolicyItem = new XXPolicyItem();
+
xxPolicyItem.setIsEnabled(Boolean.TRUE);
xxPolicyItem.setDelegateAdmin(Boolean.TRUE);
xxPolicyItem.setItemType(0);
@@ -315,63 +348,79 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
xxPolicyItem.setAddedByUserId(currentUserId);
xxPolicyItem.setUpdatedByUserId(currentUserId);
xxPolicyItem.setPolicyId(createdPolicy.getId());
+
XXPolicyItem createdXXPolicyItem = daoMgr.getXXPolicyItem().create(xxPolicyItem);
+ List<String> accessTypes = getAccessTypes();
- List<String> accessTypes = getAccessTypes();
for (int i = 0; i < accessTypes.size(); i++) {
XXAccessTypeDef xAccTypeDef = daoMgr.getXXAccessTypeDef().findByNameAndServiceId(accessTypes.get(i), xxPolicy.getService());
+
if (xAccTypeDef == null) {
throw new RuntimeException(accessTypes.get(i) + ": is not a valid access-type. policy='" + xxPolicy.getName() + "' service='" + xxPolicy.getService() + "'");
}
+
XXPolicyItemAccess xPolItemAcc = new XXPolicyItemAccess();
+
xPolItemAcc.setIsAllowed(Boolean.TRUE);
xPolItemAcc.setType(xAccTypeDef.getId());
xPolItemAcc.setOrder(i);
xPolItemAcc.setAddedByUserId(currentUserId);
xPolItemAcc.setUpdatedByUserId(currentUserId);
xPolItemAcc.setPolicyitemid(createdXXPolicyItem.getId());
+
daoMgr.getXXPolicyItemAccess().create(xPolItemAcc);
}
for (int i = 0; i < DEFAULT_POLICY_USERS.size(); i++) {
String user = DEFAULT_POLICY_USERS.get(i);
+
if (StringUtils.isBlank(user)) {
continue;
}
+
XXUser xxUser = daoMgr.getXXUser().findByUserName(user);
+
if (null == xxUser) {
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- xUserMgr.createServiceConfigUserSynchronously(user);
- return null;
- }
+ txTemplate.execute(status -> {
+ xUserMgr.createServiceConfigUserSynchronously(user);
+
+ return null;
});
} catch (Exception exception) {
logger.error("Cannot create ServiceConfigUser({})", user, exception);
}
}
+
xxUser = daoMgr.getXXUser().findByUserName(user);
+
if (null == xxUser) {
throw new RuntimeException(user + ": user does not exist. policy='" + xxPolicy.getName() + "' service='" + xxPolicy.getService() + "' user='" + user + "'");
}
+
XXPolicyItemUserPerm xUserPerm = new XXPolicyItemUserPerm();
+
xUserPerm.setUserId(xxUser.getId());
xUserPerm.setPolicyItemId(createdXXPolicyItem.getId());
xUserPerm.setOrder(i);
xUserPerm.setAddedByUserId(currentUserId);
xUserPerm.setUpdatedByUserId(currentUserId);
+
daoMgr.getXXPolicyItemUserPerm().create(xUserPerm);
}
String policyResourceName = KAFKA_RESOURCE_CLUSTER;
+
if ("all - delegationtoken".equals(newResource)) {
policyResourceName = KAFKA_RESOURCE_DELEGATIONTOKEN;
}
+
XXResourceDef xResDef = daoMgr.getXXResourceDef().findByNameAndPolicyId(policyResourceName, createdPolicy.getId());
+
if (xResDef == null) {
throw new RuntimeException(policyResourceName + ": is not a valid resource-type. policy='" + createdPolicy.getName() + "' service='" + createdPolicy.getService() + "'");
}
@@ -384,31 +433,36 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
xPolRes.setIsRecursive(Boolean.FALSE);
xPolRes.setPolicyId(createdPolicy.getId());
xPolRes.setResDefId(xResDef.getId());
+
xPolRes = daoMgr.getXXPolicyResource().create(xPolRes);
XXPolicyResourceMap xPolResMap = new XXPolicyResourceMap();
+
xPolResMap.setResourceId(xPolRes.getId());
xPolResMap.setValue("*");
xPolResMap.setOrder(resourceMapOrder);
xPolResMap.setAddedByUserId(currentUserId);
xPolResMap.setUpdatedByUserId(currentUserId);
+
daoMgr.getXXPolicyResourceMap().create(xPolResMap);
+
resourceMapOrder++;
+
logger.info("Creating policy for service id : {}", xxService.getId());
}
}
+
logger.info("<== createDefaultPolicyForNewResources ");
}
private RangerPolicy getRangerPolicy(String newResource, XXPortalUser xxPortalUser, XXService xxService) {
- RangerPolicy policy = new RangerPolicy();
-
List<RangerPolicy.RangerPolicyItemAccess> accesses = getPolicyItemAccesses();
List<String> users = new ArrayList<>(DEFAULT_POLICY_USERS);
List<String> groups = new ArrayList<>();
List<RangerPolicy.RangerPolicyItemCondition> conditions = new ArrayList<>();
List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<>();
RangerPolicy.RangerPolicyItem rangerPolicyItem = new RangerPolicy.RangerPolicyItem();
+
rangerPolicyItem.setAccesses(accesses);
rangerPolicyItem.setConditions(conditions);
rangerPolicyItem.setGroups(groups);
@@ -419,14 +473,21 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
Map<String, RangerPolicy.RangerPolicyResource> policyResource = new HashMap<>();
RangerPolicy.RangerPolicyResource rangerPolicyResource = new RangerPolicy.RangerPolicyResource();
+
rangerPolicyResource.setIsExcludes(false);
rangerPolicyResource.setIsRecursive(false);
rangerPolicyResource.setValue("*");
+
String policyResourceName = KAFKA_RESOURCE_CLUSTER;
+
if ("all - delegationtoken".equals(newResource)) {
policyResourceName = KAFKA_RESOURCE_DELEGATIONTOKEN;
}
+
policyResource.put(policyResourceName, rangerPolicyResource);
+
+ RangerPolicy policy = new RangerPolicy();
+
policy.setCreateTime(new Date());
policy.setDescription(newResource);
policy.setIsEnabled(true);
@@ -443,24 +504,30 @@ public class PatchForKafkaServiceDefUpdate_J10025 extends BaseLoader {
policy.setGuid("");
policy.setPolicyLabels(new ArrayList<>());
policy.setVersion(1L);
+
RangerPolicyResourceSignature resourceSignature = new RangerPolicyResourceSignature(policy);
+
policy.setResourceSignature(resourceSignature.getSignature());
+
return policy;
}
private List<String> getAccessTypes() {
- List<String> accessTypes = Arrays.asList("create", "delete", "configure", "alter_configs", "describe", "describe_configs", "consume", "publish", "kafka_admin", "idempotent_write");
- return accessTypes;
+ return Arrays.asList("create", "delete", "configure", "alter_configs", "describe", "describe_configs", "consume", "publish", "kafka_admin", "idempotent_write");
}
private ArrayList<RangerPolicy.RangerPolicyItemAccess> getPolicyItemAccesses() {
ArrayList<RangerPolicy.RangerPolicyItemAccess> rangerPolicyItemAccesses = new ArrayList<>();
+
for (String type : getAccessTypes()) {
RangerPolicy.RangerPolicyItemAccess policyItemAccess = new RangerPolicy.RangerPolicyItemAccess();
+
policyItemAccess.setType(type);
policyItemAccess.setIsAllowed(true);
+
rangerPolicyItemAccesses.add(policyItemAccess);
}
+
return rangerPolicyItemAccesses;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10033.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10033.java
index 2d2b35cb3..c6645e83c 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10033.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForKafkaServiceDefUpdate_J10033.java
@@ -59,8 +59,6 @@ import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.TransactionDefinition;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.ArrayList;
@@ -73,13 +71,16 @@ import java.util.Map;
@Component
public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForKafkaServiceDefUpdate_J10033.class);
+ private static final Logger logger = LoggerFactory.getLogger(PatchForKafkaServiceDefUpdate_J10033.class);
+
public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME = "kafka";
public static final String CONSUMERGROUP_RESOURCE_NAME = "consumergroup";
- private static final String POLICY_NAME = "all - consumergroup";
- private static final String LOGIN_ID_ADMIN = "admin";
+
+ private static final String POLICY_NAME = "all - consumergroup";
+ private static final String LOGIN_ID_ADMIN = "admin";
private static final List<String> DEFAULT_POLICY_USERS = new ArrayList<>(Arrays.asList("kafka", "rangerlookup"));
private static final List<String> DEFAULT_POLICY_GROUP = new ArrayList<>(Collections.singletonList("public"));
+
@Autowired
RangerDaoManager daoMgr;
@@ -122,16 +123,22 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForKafkaServiceDefUpdate_J10033 loader = (PatchForKafkaServiceDefUpdate_J10033) CLIUtil.getBean(PatchForKafkaServiceDefUpdate_J10033.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -149,16 +156,19 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForKafkaServiceDefUpdate_J10033.execLoad()");
+
try {
updateKafkaServiceDef();
} catch (Exception e) {
logger.error("Error while applying PatchForKafkaServiceDefUpdate_J10033...", e);
}
+
logger.info("<== PatchForKafkaServiceDefUpdate_J10033.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -168,15 +178,19 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
@@ -185,34 +199,31 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
}
private void updateKafkaServiceDef() {
- RangerServiceDef ret = null;
- RangerServiceDef embeddedKafkaServiceDef = null;
- RangerServiceDef dbKafkaServiceDef = null;
- List<RangerServiceDef.RangerResourceDef> embeddedKafkaResourceDefs = null;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedKafkaAccessTypes = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedKafkaServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+ RangerServiceDef embeddedKafkaServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
if (embeddedKafkaServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
Map<String, String> serviceDefOptionsPreUpdate = null;
- String jsonStrPreUpdate = null;
+
if (xXServiceDefObj != null) {
- jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+ String jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+
serviceDefOptionsPreUpdate = jsonStringToMap(jsonStrPreUpdate);
- xXServiceDefObj = null;
}
- dbKafkaServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
+ RangerServiceDef dbKafkaServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
if (dbKafkaServiceDef != null) {
- embeddedKafkaResourceDefs = embeddedKafkaServiceDef.getResources();
- embeddedKafkaAccessTypes = embeddedKafkaServiceDef.getAccessTypes();
+ List<RangerServiceDef.RangerResourceDef> embeddedKafkaResourceDefs = embeddedKafkaServiceDef.getResources();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedKafkaAccessTypes = embeddedKafkaServiceDef.getAccessTypes();
if (checkNewKafkaresourcePresent(embeddedKafkaResourceDefs)) {
// This is to check if CONSUMERGROUP resource is added to the resource definition, if so update the resource def and accessType def
if (embeddedKafkaResourceDefs != null) {
dbKafkaServiceDef.setResources(embeddedKafkaResourceDefs);
}
+
if (embeddedKafkaAccessTypes != null) {
if (!embeddedKafkaAccessTypes.toString().equalsIgnoreCase(dbKafkaServiceDef.getAccessTypes().toString())) {
dbKafkaServiceDef.setAccessTypes(embeddedKafkaAccessTypes);
@@ -221,29 +232,39 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbKafkaServiceDef, Action.UPDATE);
- ret = svcStore.updateServiceDef(dbKafkaServiceDef);
+ RangerServiceDef ret = svcStore.updateServiceDef(dbKafkaServiceDef);
+
if (ret == null) {
logger.error("Error while updating {} service-def", SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
throw new RuntimeException("Error while updating " + SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME + "service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_KAFKA_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
+
createDefaultPolicyForNewResources();
}
}
@@ -255,17 +276,20 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
private boolean checkNewKafkaresourcePresent(List<RangerServiceDef.RangerResourceDef> resourceDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
if (CONSUMERGROUP_RESOURCE_NAME.equals(resourceDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -273,17 +297,20 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, excp);
}
}
+
return ret;
}
private void createDefaultPolicyForNewResources() {
logger.info("==> createDefaultPolicyForNewResources ");
- XXPortalUser xxPortalUser = daoMgr.getXXPortalUser().findByLoginId(LOGIN_ID_ADMIN);
- Long currentUserId = xxPortalUser.getId();
+ XXPortalUser xxPortalUser = daoMgr.getXXPortalUser().findByLoginId(LOGIN_ID_ADMIN);
+ Long currentUserId = xxPortalUser.getId();
XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KAFKA_NAME);
+
if (xXServiceDefObj == null) {
logger.debug("ServiceDef not fount with name :{}", EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KAFKA_NAME);
+
return;
}
@@ -293,6 +320,7 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
for (XXService xxService : xxServices) {
int resourceMapOrder = 0;
XXPolicy xxPolicy = new XXPolicy();
+
xxPolicy.setName(POLICY_NAME);
xxPolicy.setDescription(POLICY_NAME);
xxPolicy.setService(xxService.getId());
@@ -303,16 +331,21 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
xxPolicy.setGuid(guidUtil.genGUID());
xxPolicy.setAddedByUserId(currentUserId);
xxPolicy.setUpdatedByUserId(currentUserId);
+
RangerPolicy rangerPolicy = getRangerPolicy(POLICY_NAME, xxPortalUser, xxService);
+
xxPolicy.setPolicyText(JsonUtils.objectToJson(rangerPolicy));
xxPolicy.setResourceSignature(rangerPolicy.getResourceSignature());
xxPolicy.setZoneId(1L);
+
boolean policyExist = false;
+
try {
List<RangerPolicy> rangerpolicies = svcDBStore.getPoliciesByResourceSignature(xxService.getName(), rangerPolicy.getResourceSignature(), true);
+
if (CollectionUtils.isNotEmpty(rangerpolicies)) {
for (RangerPolicy rPolicy : rangerpolicies) {
- if (rangerPolicy != null) {
+ if (rPolicy != null) {
logger.debug("print Policy: {}", rPolicy);
logger.debug("policy found with resource {} and ResourceSignature {} service name:{}", rPolicy.getResources(), rPolicy.getResourceSignature(), rPolicy.getService());
@@ -340,83 +373,99 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
XXPolicyItem createdXXPolicyItem = daoMgr.getXXPolicyItem().create(xxPolicyItem);
List<String> accessTypes = getAccessTypes();
+
for (int i = 0; i < accessTypes.size(); i++) {
XXAccessTypeDef xAccTypeDef = daoMgr.getXXAccessTypeDef().findByNameAndServiceId(accessTypes.get(i), xxPolicy.getService());
+
if (xAccTypeDef == null) {
throw new RuntimeException(accessTypes.get(i) + ": is not a valid access-type. policy='" + xxPolicy.getName() + "' service='" + xxPolicy.getService() + "'");
}
+
XXPolicyItemAccess xPolItemAcc = new XXPolicyItemAccess();
+
xPolItemAcc.setIsAllowed(Boolean.TRUE);
xPolItemAcc.setType(xAccTypeDef.getId());
xPolItemAcc.setOrder(i);
xPolItemAcc.setAddedByUserId(currentUserId);
xPolItemAcc.setUpdatedByUserId(currentUserId);
xPolItemAcc.setPolicyitemid(createdXXPolicyItem.getId());
+
daoMgr.getXXPolicyItemAccess().create(xPolItemAcc);
}
for (int i = 0; i < DEFAULT_POLICY_USERS.size(); i++) {
String user = DEFAULT_POLICY_USERS.get(i);
+
if (StringUtils.isBlank(user)) {
continue;
}
+
XXUser xxUser = daoMgr.getXXUser().findByUserName(user);
- Long userId = null;
+
if (xxUser == null) {
- if (null == xxUser) {
- logger.info("{} user is not found, adding user: {}", user, user);
- TransactionTemplate txTemplate = new TransactionTemplate(txManager);
- txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
- try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- xUserMgr.createServiceConfigUserSynchronously(user);
- return null;
- }
- });
- } catch (Exception exception) {
- logger.error("Cannot create ServiceConfigUser({})", user, exception);
- }
+ logger.info("{} user is not found, adding user: {}", user, user);
+
+ TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
+ txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
+ try {
+ txTemplate.execute(status -> {
+ xUserMgr.createServiceConfigUserSynchronously(user);
+
+ return null;
+ });
+ } catch (Exception exception) {
+ logger.error("Cannot create ServiceConfigUser({})", user, exception);
}
xxUser = daoMgr.getXXUser().findByUserName(user);
+
if (xxUser == null) {
throw new RuntimeException(user + ": user does not exist. policy='" + xxPolicy.getName() + "' service='" + xxPolicy.getService() + "' user='" + user + "'");
}
}
- userId = xxUser.getId();
+
+ Long userId = xxUser.getId();
XXPolicyItemUserPerm xUserPerm = new XXPolicyItemUserPerm();
+
xUserPerm.setUserId(userId);
xUserPerm.setPolicyItemId(createdXXPolicyItem.getId());
xUserPerm.setOrder(i);
xUserPerm.setAddedByUserId(currentUserId);
xUserPerm.setUpdatedByUserId(currentUserId);
+
daoMgr.getXXPolicyItemUserPerm().create(xUserPerm);
}
for (int i = 0; i < DEFAULT_POLICY_GROUP.size(); i++) {
String group = DEFAULT_POLICY_GROUP.get(i);
+
if (StringUtils.isBlank(group)) {
continue;
}
+
XXGroup xxGroup = daoMgr.getXXGroup().findByGroupName(group);
+
if (xxGroup == null) {
throw new RuntimeException(group + ": group does not exist. policy='" + xxPolicy.getName() + "' service='" + xxPolicy.getService() + "' group='" + group + "'");
}
+
XXPolicyItemGroupPerm xGroupPerm = new XXPolicyItemGroupPerm();
+
xGroupPerm.setGroupId(xxGroup.getId());
xGroupPerm.setPolicyItemId(createdXXPolicyItem.getId());
xGroupPerm.setOrder(i);
xGroupPerm.setAddedByUserId(currentUserId);
xGroupPerm.setUpdatedByUserId(currentUserId);
+
daoMgr.getXXPolicyItemGroupPerm().create(xGroupPerm);
}
- String policyResourceName = CONSUMERGROUP_RESOURCE_NAME;
+ String policyResourceName = CONSUMERGROUP_RESOURCE_NAME;
+ XXResourceDef xResDef = daoMgr.getXXResourceDef().findByNameAndPolicyId(policyResourceName, createdPolicy.getId());
- XXResourceDef xResDef = daoMgr.getXXResourceDef().findByNameAndPolicyId(policyResourceName, createdPolicy.getId());
if (xResDef == null) {
throw new RuntimeException(policyResourceName + ": is not a valid resource-type. policy='" + createdPolicy.getName() + "' service='" + createdPolicy.getService() + "'");
}
@@ -429,31 +478,36 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
xPolRes.setIsRecursive(Boolean.FALSE);
xPolRes.setPolicyId(createdPolicy.getId());
xPolRes.setResDefId(xResDef.getId());
+
xPolRes = daoMgr.getXXPolicyResource().create(xPolRes);
XXPolicyResourceMap xPolResMap = new XXPolicyResourceMap();
+
xPolResMap.setResourceId(xPolRes.getId());
xPolResMap.setValue("*");
xPolResMap.setOrder(resourceMapOrder);
xPolResMap.setAddedByUserId(currentUserId);
xPolResMap.setUpdatedByUserId(currentUserId);
+
daoMgr.getXXPolicyResourceMap().create(xPolResMap);
+
resourceMapOrder++;
+
logger.info("Creating policy for service id : {}", xxService.getId());
}
+
logger.info("<== createDefaultPolicyForNewResources ");
}
}
private RangerPolicy getRangerPolicy(String newResource, XXPortalUser xxPortalUser, XXService xxService) {
- RangerPolicy policy = new RangerPolicy();
-
List<RangerPolicy.RangerPolicyItemAccess> accesses = getPolicyItemAccesses();
List<String> users = new ArrayList<>(DEFAULT_POLICY_USERS);
List<String> groups = new ArrayList<>(DEFAULT_POLICY_GROUP);
List<RangerPolicy.RangerPolicyItemCondition> conditions = new ArrayList<>();
List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<>();
RangerPolicy.RangerPolicyItem rangerPolicyItem = new RangerPolicy.RangerPolicyItem();
+
rangerPolicyItem.setAccesses(accesses);
rangerPolicyItem.setConditions(conditions);
rangerPolicyItem.setGroups(groups);
@@ -464,11 +518,15 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
Map<String, RangerPolicy.RangerPolicyResource> policyResource = new HashMap<>();
RangerPolicy.RangerPolicyResource rangerPolicyResource = new RangerPolicy.RangerPolicyResource();
+
rangerPolicyResource.setIsExcludes(false);
rangerPolicyResource.setIsRecursive(false);
rangerPolicyResource.setValue("*");
- String policyResourceName = CONSUMERGROUP_RESOURCE_NAME;
- policyResource.put(policyResourceName, rangerPolicyResource);
+
+ policyResource.put(CONSUMERGROUP_RESOURCE_NAME, rangerPolicyResource);
+
+ RangerPolicy policy = new RangerPolicy();
+
policy.setCreateTime(new Date());
policy.setDescription(newResource);
policy.setIsEnabled(true);
@@ -485,24 +543,30 @@ public class PatchForKafkaServiceDefUpdate_J10033 extends BaseLoader {
policy.setGuid("");
policy.setPolicyLabels(new ArrayList<>());
policy.setVersion(1L);
+
RangerPolicyResourceSignature resourceSignature = new RangerPolicyResourceSignature(policy);
+
policy.setResourceSignature(resourceSignature.getSignature());
+
return policy;
}
private List<String> getAccessTypes() {
- List<String> accessTypes = Arrays.asList("consume", "describe", "delete");
- return accessTypes;
+ return Arrays.asList("consume", "describe", "delete");
}
private ArrayList<RangerPolicy.RangerPolicyItemAccess> getPolicyItemAccesses() {
ArrayList<RangerPolicy.RangerPolicyItemAccess> rangerPolicyItemAccesses = new ArrayList<>();
+
for (String type : getAccessTypes()) {
RangerPolicy.RangerPolicyItemAccess policyItemAccess = new RangerPolicy.RangerPolicyItemAccess();
+
policyItemAccess.setType(type);
policyItemAccess.setIsAllowed(true);
+
rangerPolicyItemAccesses.add(policyItemAccess);
}
+
return rangerPolicyItemAccesses;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForMigratingOldRegimePolicyJson_J10046.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForMigratingOldRegimePolicyJson_J10046.java
index 71d9f906a..646532727 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForMigratingOldRegimePolicyJson_J10046.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForMigratingOldRegimePolicyJson_J10046.java
@@ -63,8 +63,6 @@ import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.TransactionDefinition;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.HashMap;
@@ -82,26 +80,33 @@ import java.util.Set;
@Component
public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
private static final Logger logger = LoggerFactory.getLogger(PatchForMigratingOldRegimePolicyJson_J10046.class);
+
private final Map<String, Long> groupIdMap = new HashMap<>();
private final Map<String, Long> userIdMap = new HashMap<>();
private final Map<String, Map<String, Long>> resourceNameIdMap = new HashMap<>();
private final Map<String, Map<String, Long>> accessTypeIdMap = new HashMap<>();
private final Map<String, Map<String, Long>> conditionNameIdMap = new HashMap<>();
private final Map<String, Map<String, Long>> dataMaskTypeIdMap = new HashMap<>();
+
@Autowired
RangerDaoManager daoMgr;
+
@Autowired
ServiceDBStore svcStore;
+
@Autowired
@Qualifier(value = "transactionManager")
PlatformTransactionManager txManager;
+
@Autowired
PolicyRefUpdater policyRefUpdater;
+
@Autowired
XUserMgr xUserMgr;
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForMigratingOldRegimePolicyJson_J10046 loader = (PatchForMigratingOldRegimePolicyJson_J10046) CLIUtil.getBean(PatchForMigratingOldRegimePolicyJson_J10046.class);
@@ -116,6 +121,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -138,6 +144,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
migrateRangerPolicyTableWithPolicyJson();
} catch (Exception e) {
logger.error("Error while PatchForMigratingOldRegimePolicyJson()", e);
+
System.exit(1);
}
@@ -150,7 +157,9 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
if (policyId == null) {
return false;
}
+
logger.info("==> cleanupOldRefTables() ");
+
daoMgr.getXXPolicyItemGroupPerm().deleteByPolicyId(policyId);
daoMgr.getXXPolicyItemUserPerm().deleteByPolicyId(policyId);
daoMgr.getXXPolicyItemAccess().deleteByPolicyId(policyId);
@@ -160,25 +169,34 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
daoMgr.getXXPolicyItem().deleteByPolicyId(policyId);
daoMgr.getXXPolicyResourceMap().deleteByPolicyId(policyId);
daoMgr.getXXPolicyResource().deleteByPolicyId(policyId);
+
logger.info("<== cleanupOldRefTables() ");
+
return true;
}
private void migrateRangerPolicyTableWithPolicyJson() throws Exception {
logger.info("==> updateRangerPolicyTableWithPolicyJson() ");
+
List<XXPolicy> xxPolicyList = daoMgr.getXXPolicy().getAllByPolicyItem();
+
if (CollectionUtils.isNotEmpty(xxPolicyList)) {
for (XXPolicy xxPolicy : xxPolicyList) {
logger.info("XXPolicy : {}", xxPolicy);
+
RangerPolicy policy = svcStore.getPolicy(xxPolicy.getId());
+
if (policy != null) {
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
RangerService service = svcStore.getServiceByName(policy.getService());
PolicyUpdaterThread updaterThread = new PolicyUpdaterThread(txTemplate, service, policy);
+
updaterThread.setDaemon(true);
updaterThread.start();
updaterThread.join();
+
String errorMsg = updaterThread.getErrorMsg();
+
if (StringUtils.isNotEmpty(errorMsg)) {
throw new Exception(errorMsg);
}
@@ -187,6 +205,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
} else {
logger.info("no old XXPolicyItems found ");
}
+
logger.info("<== updateRangerPolicyTableWithPolicyJson() ");
}
@@ -230,7 +249,8 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
addDataMaskDefRef(serviceType, policy.getId(), dataMasks);
} catch (Exception e) {
logger.error("portPolicy(id={}) failed!!", policy.getId());
- logger.error("Offending policy:", policyText);
+ logger.error("Offending policy:{}", policyText);
+
throw e;
}
@@ -248,6 +268,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
resourceNameIdMap.put(serviceType, serviceDefResourceNameIDMap);
XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
if (dbServiceDef != null) {
for (XXResourceDef resourceDef : daoMgr.getXXResourceDef().findByServiceDefId(dbServiceDef.getId())) {
serviceDefResourceNameIDMap.put(resourceDef.getName(), resourceDef.getId());
@@ -283,7 +304,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
}
private void addUserNameRef(Long policyId, Set<String> users) throws Exception {
- logger.info("==> addUserNameRef(id=)", policyId);
+ logger.info("==> addUserNameRef(id={})", policyId);
XXPolicyRefUserDao policyRefUserDao = daoMgr.getXXPolicyRefUser();
XXUserDao userDao = daoMgr.getXXUser();
@@ -297,26 +318,30 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
if (userObject == null) {
logger.info("user is not found, adding user: {}", user);
+
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- xUserMgr.createServiceConfigUserSynchronously(user);
- return null;
- }
+ txTemplate.execute(status -> {
+ xUserMgr.createServiceConfigUserSynchronously(user);
+
+ return null;
});
} catch (Exception exception) {
logger.error("Cannot create ServiceConfigUser({})", user, exception);
}
+
userObject = userDao.findByUserName(user);
+
if (userObject == null) {
throw new Exception(user + ": unknown user in policy [id=" + policyId + "]");
}
}
userId = userObject.getId();
+
logger.info("userId:{}", userId);
userIdMap.put(user, userId);
@@ -380,6 +405,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
accessTypeIdMap.put(serviceType, serviceDefAccessTypeIDMap);
XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
if (dbServiceDef != null) {
for (XXAccessTypeDef accessTypeDef : daoMgr.getXXAccessTypeDef().findByServiceDefId(dbServiceDef.getId())) {
serviceDefAccessTypeIDMap.put(accessTypeDef.getName(), accessTypeDef.getId());
@@ -420,6 +446,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
conditionNameIdMap.put(serviceType, serviceDefConditionNameIDMap);
XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
if (dbServiceDef != null) {
for (XXPolicyConditionDef conditionDef : daoMgr.getXXPolicyConditionDef().findByServiceDefId(dbServiceDef.getId())) {
serviceDefConditionNameIDMap.put(conditionDef.getName(), conditionDef.getId());
@@ -461,6 +488,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
dataMaskTypeIdMap.put(serviceType, serviceDefDataMaskTypeIDMap);
XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
if (dbServiceDef != null) {
for (XXDataMaskTypeDef dataMaskTypeDef : daoMgr.getXXDataMaskTypeDef().findByServiceDefId(dbServiceDef.getId())) {
serviceDefDataMaskTypeIDMap.put(dataMaskTypeDef.getName(), dataMaskTypeDef.getId());
@@ -514,7 +542,7 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
final TransactionTemplate txTemplate;
final RangerService service;
final RangerPolicy policy;
- String errorMsg;
+ String errorMsg;
PolicyUpdaterThread(TransactionTemplate txTemplate, final RangerService service, final RangerPolicy policy) {
this.txTemplate = txTemplate;
@@ -529,20 +557,22 @@ public class PatchForMigratingOldRegimePolicyJson_J10046 extends BaseLoader {
@Override
public void run() {
- errorMsg = txTemplate.execute(new TransactionCallback<String>() {
- @Override
- public String doInTransaction(TransactionStatus status) {
- String ret = null;
- try {
- policyRefUpdater.cleanupRefTables(policy);
- portPolicy(service.getType(), policy);
- cleanupOldRefTables(policy);
- } catch (Throwable e) {
- logger.error("PortPolicy failed for policy:[{}]", policy, e);
- ret = e.toString();
- }
- return ret;
+ errorMsg = txTemplate.execute(status -> {
+ String ret = null;
+
+ try {
+ policyRefUpdater.cleanupRefTables(policy);
+
+ portPolicy(service.getType(), policy);
+
+ cleanupOldRefTables(policy);
+ } catch (Throwable e) {
+ logger.error("PortPolicy failed for policy:[{}]", policy, e);
+
+ ret = e.toString();
}
+
+ return ret;
});
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForMigratingRangerServiceResource_J10037.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForMigratingRangerServiceResource_J10037.java
index 83c37e152..0e84333a7 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForMigratingRangerServiceResource_J10037.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForMigratingRangerServiceResource_J10037.java
@@ -41,8 +41,6 @@ import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.TransactionDefinition;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.List;
@@ -63,6 +61,7 @@ public class PatchForMigratingRangerServiceResource_J10037 extends BaseLoader {
public static void main(String[] args) {
logger.info("main() starts");
+
try {
PatchForMigratingRangerServiceResource_J10037 loader = (PatchForMigratingRangerServiceResource_J10037) CLIUtil.getBean(PatchForMigratingRangerServiceResource_J10037.class);
@@ -77,6 +76,7 @@ public class PatchForMigratingRangerServiceResource_J10037 extends BaseLoader {
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -99,6 +99,7 @@ public class PatchForMigratingRangerServiceResource_J10037 extends BaseLoader {
updateRangerServiceResourceSignature();
} catch (Exception e) {
logger.error("Error while updateRangerServiceResourceSignature()", e);
+
System.exit(1);
}
@@ -123,11 +124,9 @@ public class PatchForMigratingRangerServiceResource_J10037 extends BaseLoader {
int numOfChunks = (serviceResourceGuids.size() / chunkSize) + 1;
for (int chunkIndex = 0; chunkIndex < numOfChunks; chunkIndex++) {
- List<String> chunk = serviceResourceGuids.subList(chunkIndex * chunkSize, (chunkIndex == numOfChunks - 1 ? serviceResourceGuids.size() : (chunkIndex + 1) * chunkSize));
-
+ List<String> chunk = serviceResourceGuids.subList(chunkIndex * chunkSize, (chunkIndex == numOfChunks - 1 ? serviceResourceGuids.size() : (chunkIndex + 1) * chunkSize));
ServiceResourceUpdaterThread updaterThread = new ServiceResourceUpdaterThread(txTemplate, chunk);
-
- String errorMsg = runThread(updaterThread);
+ String errorMsg = runThread(updaterThread);
if (StringUtils.isNotEmpty(errorMsg)) {
throw new Exception(errorMsg);
@@ -148,13 +147,14 @@ public class PatchForMigratingRangerServiceResource_J10037 extends BaseLoader {
updaterThread.setDaemon(true);
updaterThread.start();
updaterThread.join();
+
return updaterThread.getErrorMsg();
}
private class ServiceResourceUpdaterThread extends Thread {
final TransactionTemplate txTemplate;
final List<String> entityGuids;
- String errorMsg;
+ String errorMsg;
ServiceResourceUpdaterThread(TransactionTemplate txTemplate, final List<String> entityGuids) {
this.txTemplate = txTemplate;
@@ -170,28 +170,27 @@ public class PatchForMigratingRangerServiceResource_J10037 extends BaseLoader {
public void run() {
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
- errorMsg = txTemplate.execute(new TransactionCallback<String>() {
- @Override
- public String doInTransaction(TransactionStatus status) {
- String ret = null;
- try {
- if (CollectionUtils.isNotEmpty(entityGuids)) {
- for (String entityGuid : entityGuids) {
- XXServiceResource entityObject = daoMgr.getXXServiceResource().findByGuid(entityGuid);
- RangerServiceResource viewObject = serviceResourceService.getPopulatedViewObject(entityObject);
- RangerServiceResourceSignature serializer = new RangerServiceResourceSignature(viewObject);
-
- entityObject.setResourceSignature(serializer.getSignature());
-
- daoMgr.getXXServiceResource().update(entityObject);
- }
+ errorMsg = txTemplate.execute(status -> {
+ String ret = null;
+ try {
+ if (CollectionUtils.isNotEmpty(entityGuids)) {
+ for (String entityGuid : entityGuids) {
+ XXServiceResource entityObject = daoMgr.getXXServiceResource().findByGuid(entityGuid);
+ RangerServiceResource viewObject = serviceResourceService.getPopulatedViewObject(entityObject);
+ RangerServiceResourceSignature serializer = new RangerServiceResourceSignature(viewObject);
+
+ entityObject.setResourceSignature(serializer.getSignature());
+
+ daoMgr.getXXServiceResource().update(entityObject);
}
- } catch (Throwable e) {
- logger.error("signature update failed :[rangerServiceResource={}", entityGuids, e);
- ret = e.toString();
}
- return ret;
+ } catch (Throwable e) {
+ logger.error("signature update failed :[rangerServiceResource={}", entityGuids, e);
+
+ ret = e.toString();
}
+
+ return ret;
});
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForNifiResourceUpdateExclude_J10011.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForNifiResourceUpdateExclude_J10011.java
index 0df54c0d4..cd381c507 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForNifiResourceUpdateExclude_J10011.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForNifiResourceUpdateExclude_J10011.java
@@ -48,6 +48,7 @@ import java.util.List;
@Component
public class PatchForNifiResourceUpdateExclude_J10011 extends BaseLoader {
private static final Logger logger = LoggerFactory.getLogger(PatchForNifiResourceUpdateExclude_J10011.class);
+
@Autowired
RangerDaoManager daoMgr;
@@ -71,16 +72,22 @@ public class PatchForNifiResourceUpdateExclude_J10011 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForNifiResourceUpdateExclude_J10011 loader = (PatchForNifiResourceUpdateExclude_J10011) CLIUtil.getBean(PatchForNifiResourceUpdateExclude_J10011.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -98,22 +105,23 @@ public class PatchForNifiResourceUpdateExclude_J10011 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForNifiResourceUpdateExclude.execLoad()");
+
try {
updateNifiServiceDef();
} catch (Exception e) {
logger.error("Error whille updateNifiServiceDef()data.", e);
}
+
logger.info("<== PatchForNifiResourceUpdateExclude.execLoad()");
}
private void updateNifiServiceDef() {
- RangerServiceDef ret = null;
- RangerServiceDef dbNifiServiceDef = null;
try {
- dbNifiServiceDef = svcDBStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_NIFI_NAME);
+ RangerServiceDef dbNifiServiceDef = svcDBStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_NIFI_NAME);
+
if (dbNifiServiceDef != null) {
- List<RangerResourceDef> rRDefList = null;
- rRDefList = dbNifiServiceDef.getResources();
+ List<RangerResourceDef> rRDefList = dbNifiServiceDef.getResources();
+
if (CollectionUtils.isNotEmpty(rRDefList)) {
for (RangerResourceDef rRDef : rRDefList) {
if (rRDef.getExcludesSupported()) {
@@ -123,23 +131,30 @@ public class PatchForNifiResourceUpdateExclude_J10011 extends BaseLoader {
XXResourceDef sdf = daoMgr.getXXResourceDef().findByNameAndServiceDefId(rRDef.getName(), dbNifiServiceDef.getId());
long resourceDefId = sdf.getId();
List<XXPolicyResource> rangerPolicyResourceList = daoMgr.getXXPolicyResource().findByResDefId(resourceDefId);
+
if (CollectionUtils.isNotEmpty(rangerPolicyResourceList)) {
for (XXPolicyResource rangerPolicyResource : rangerPolicyResourceList) {
if (rangerPolicyResource.getIsexcludes()) {
RangerPolicy rPolicy = svcDBStore.getPolicy(rangerPolicyResource.getPolicyid());
+
rPolicy.setIsEnabled(false);
+
svcStore.updatePolicy(rPolicy);
}
}
}
}
}
+
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbNifiServiceDef, Action.UPDATE);
- ret = svcStore.updateServiceDef(dbNifiServiceDef);
- }
- if (ret == null) {
- logger.error("Error while updating {} service-def", EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_NIFI_NAME);
+
+ RangerServiceDef ret = svcStore.updateServiceDef(dbNifiServiceDef);
+
+ if (ret == null) {
+ logger.error("Error while updating {} service-def", EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_NIFI_NAME);
+ }
}
} catch (Exception e) {
logger.error("Error while updating {} service-def", EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_NIFI_NAME, e);
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneDefaultPoliciesUpdate_J10044.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneDefaultPoliciesUpdate_J10044.java
index 445dbd287..8b2e8a4c7 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneDefaultPoliciesUpdate_J10044.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneDefaultPoliciesUpdate_J10044.java
@@ -37,8 +37,10 @@ import java.util.List;
@Component
public class PatchForOzoneDefaultPoliciesUpdate_J10044 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForOzoneDefaultPoliciesUpdate_J10044.class);
- public static final String ACCESS_TYPE_ALL = "all";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForOzoneDefaultPoliciesUpdate_J10044.class);
+
+ public static final String ACCESS_TYPE_ALL = "all";
+
@Autowired
RangerDaoManager daoMgr;
@@ -47,16 +49,22 @@ public class PatchForOzoneDefaultPoliciesUpdate_J10044 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForOzoneDefaultPoliciesUpdate_J10044 loader = (PatchForOzoneDefaultPoliciesUpdate_J10044) CLIUtil.getBean(PatchForOzoneDefaultPoliciesUpdate_J10044.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting.");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -74,36 +82,43 @@ public class PatchForOzoneDefaultPoliciesUpdate_J10044 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForOzoneDefaultPoliciesUpdate.execLoad()");
+
try {
if (!updateOzoneDefaultPolicies()) {
logger.error("Failed to apply the patch.");
+
System.exit(1);
}
} catch (Exception e) {
logger.error("Error while updateOzoneDefaultPolicies()data.", e);
+
System.exit(1);
}
+
logger.info("<== PatchForOzoneDefaultPoliciesUpdate.execLoad()");
}
private boolean updateOzoneDefaultPolicies() throws Exception {
- RangerServiceDef embeddedOzoneServiceDef;
-
- embeddedOzoneServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
+ RangerServiceDef embeddedOzoneServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
if (embeddedOzoneServiceDef != null) {
List<XXService> dbServices = daoMgr.getXXService().findByServiceDefId(embeddedOzoneServiceDef.getId());
+
if (CollectionUtils.isNotEmpty(dbServices)) {
for (XXService dbService : dbServices) {
SearchFilter filter = new SearchFilter();
+
filter.setParam(SearchFilter.SERVICE_NAME, dbService.getName());
+
updateDefaultOzonePolicies(svcDBStore.getServicePolicies(dbService.getId(), filter));
}
}
} else {
logger.error("The embedded Ozone service-definition does not exist.");
+
return false;
}
+
return true;
}
@@ -112,11 +127,14 @@ public class PatchForOzoneDefaultPoliciesUpdate_J10044 extends BaseLoader {
for (RangerPolicy policy : policies) {
if (policy.getName().startsWith("all")) {
RangerPolicy.RangerPolicyItem policyItemOwner = new RangerPolicy.RangerPolicyItem();
+
policyItemOwner.setUsers(Collections.singletonList(RangerPolicyEngine.RESOURCE_OWNER));
policyItemOwner.setAccesses(Collections.singletonList(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_ALL)));
policyItemOwner.setDelegateAdmin(true);
+
policy.addPolicyItem(policyItemOwner);
}
+
svcDBStore.updatePolicy(policy);
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefConfigUpdate_J10051.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefConfigUpdate_J10051.java
index 5c2ebc7a4..c0fb990d8 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefConfigUpdate_J10051.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefConfigUpdate_J10051.java
@@ -75,16 +75,22 @@ public class PatchForOzoneServiceDefConfigUpdate_J10051 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForOzoneServiceDefConfigUpdate_J10051 loader = (PatchForOzoneServiceDefConfigUpdate_J10051) CLIUtil.getBean(PatchForOzoneServiceDefConfigUpdate_J10051.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting.");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -102,20 +108,25 @@ public class PatchForOzoneServiceDefConfigUpdate_J10051 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForOzoneServiceDefConfigUpdate.execLoad()");
+
try {
if (!updateOzoneServiceDef()) {
logger.error("Failed to apply the patch.");
+
System.exit(1);
}
} catch (Exception e) {
logger.error("Error while updateOzoneServiceDef()data.", e);
+
System.exit(1);
}
+
logger.info("<== PatchForOzoneServiceDefConfigUpdate.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -125,15 +136,19 @@ public class PatchForOzoneServiceDefConfigUpdate_J10051 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
@@ -142,78 +157,85 @@ public class PatchForOzoneServiceDefConfigUpdate_J10051 extends BaseLoader {
}
private boolean updateOzoneServiceDef() throws Exception {
- RangerServiceDef ret;
- RangerServiceDef embeddedOzoneServiceDef;
- RangerServiceDef dbOzoneServiceDef;
- List<RangerServiceDef.RangerServiceConfigDef> embeddedOzoneConfigDefs;
- XXServiceDef xXServiceDefObj;
-
- embeddedOzoneServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
+ RangerServiceDef embeddedOzoneServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
if (embeddedOzoneServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
- Map<String, String> serviceDefOptionsPreUpdate;
- String jsonPreUpdate;
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
- if (xXServiceDefObj != null) {
- jsonPreUpdate = xXServiceDefObj.getDefOptions();
- serviceDefOptionsPreUpdate = jsonStringToMap(jsonPreUpdate);
- } else {
+ if (xXServiceDefObj == null) {
logger.error("Ozone service-definition does not exist in the Ranger DAO. No patching is needed!!");
return true;
}
- dbOzoneServiceDef = svcDBStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
+
+ String jsonPreUpdate = xXServiceDefObj.getDefOptions();
+ Map<String, String> serviceDefOptionsPreUpdate = jsonStringToMap(jsonPreUpdate);
+ RangerServiceDef dbOzoneServiceDef = svcDBStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
if (dbOzoneServiceDef != null) {
// Update old Ozone configs
- embeddedOzoneConfigDefs = embeddedOzoneServiceDef.getConfigs();
+ List<RangerServiceDef.RangerServiceConfigDef> embeddedOzoneConfigDefs = embeddedOzoneServiceDef.getConfigs();
+
for (RangerServiceDef.RangerServiceConfigDef configDef : embeddedOzoneConfigDefs) {
if (StringUtils.equalsIgnoreCase(configDef.getName(), "hadoop.security.authorization")) {
configDef.setMandatory(false);
break;
}
}
+
dbOzoneServiceDef.setConfigs(embeddedOzoneConfigDefs);
} else {
logger.error("Ozone service-definition does not exist in the db store.");
+
return false;
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcDBStore);
+
validator.validate(dbOzoneServiceDef, RangerValidator.Action.UPDATE);
- ret = svcDBStore.updateServiceDef(dbOzoneServiceDef);
+ RangerServiceDef ret = svcDBStore.updateServiceDef(dbOzoneServiceDef);
+
if (ret == null) {
throw new RuntimeException("Error while updating " + EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME + " service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
} else {
logger.error("Ozone service-definition does not exist in the Ranger DAO.");
+
return false;
}
} else {
logger.error("The embedded Ozone service-definition does not exist.");
+
return false;
}
+
return true;
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -221,6 +243,7 @@ public class PatchForOzoneServiceDefConfigUpdate_J10051 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, ex);
}
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefUpdate_J10041.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefUpdate_J10041.java
index 6e8ef6b41..b55b51c3c 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefUpdate_J10041.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForOzoneServiceDefUpdate_J10041.java
@@ -51,7 +51,8 @@ import java.util.Map;
@Component
public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForOzoneServiceDefUpdate_J10041.class);
+ private static final Logger logger = LoggerFactory.getLogger(PatchForOzoneServiceDefUpdate_J10041.class);
+
private static final List<String> OZONE_CONFIGS = new ArrayList<>(Arrays.asList("dfs.datanode.kerberos.principal", "dfs.namenode.kerberos.principal", "dfs.secondary.namenode.kerberos.principal", "commonNameForCertificate"));
private static final String OZONE_RESOURCE_VOLUME = "volume";
private static final String OZONE_RESOURCE_KEY = "key";
@@ -87,16 +88,22 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForOzoneServiceDefUpdate_J10041 loader = (PatchForOzoneServiceDefUpdate_J10041) CLIUtil.getBean(PatchForOzoneServiceDefUpdate_J10041.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting.");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -114,20 +121,25 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForOzoneServiceDefUpdate.execLoad()");
+
try {
if (!updateOzoneServiceDef()) {
logger.error("Failed to apply the patch.");
+
System.exit(1);
}
} catch (Exception e) {
logger.error("Error while updateOzoneServiceDef()data.", e);
+
System.exit(1);
}
+
logger.info("<== PatchForOzoneServiceDefUpdate.execLoad()");
}
protected Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -137,62 +149,59 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
- String name = (nvArr != null && nvArr.length > 0) ? nvArr[0].trim() : null;
- String value = (nvArr != null && nvArr.length > 1) ? nvArr[1].trim() : null;
+ String name = nvArr.length > 0 ? nvArr[0].trim() : null;
+ String value = nvArr.length > 1 ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
- ret = new HashMap<String, String>();
+ ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
}
+
return ret;
}
private boolean updateOzoneServiceDef() throws Exception {
- RangerServiceDef ret;
- RangerServiceDef embeddedOzoneServiceDef;
- RangerServiceDef dbOzoneServiceDef;
- List<RangerServiceDef.RangerServiceConfigDef> embeddedOzoneConfigDefs;
- List<RangerServiceDef.RangerResourceDef> embeddedOzoneResourceDefs;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedOzoneAccessTypes;
- XXServiceDef xXServiceDefObj;
-
- embeddedOzoneServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
+ RangerServiceDef embeddedOzoneServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
if (embeddedOzoneServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
- Map<String, String> serviceDefOptionsPreUpdate;
- String jsonPreUpdate;
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
- if (xXServiceDefObj != null) {
- jsonPreUpdate = xXServiceDefObj.getDefOptions();
- serviceDefOptionsPreUpdate = jsonStringToMap(jsonPreUpdate);
- } else {
+ if (xXServiceDefObj == null) {
logger.error("Ozone service-definition does not exist in the Ranger DAO. No patching is needed!!");
return true;
}
- dbOzoneServiceDef = svcDBStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
+
+ String jsonPreUpdate = xXServiceDefObj.getDefOptions();
+ Map<String, String> serviceDefOptionsPreUpdate = jsonStringToMap(jsonPreUpdate);
+ RangerServiceDef dbOzoneServiceDef = svcDBStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
if (dbOzoneServiceDef != null) {
// Remove old Ozone configs
- embeddedOzoneConfigDefs = embeddedOzoneServiceDef.getConfigs();
+ List<RangerServiceDef.RangerServiceConfigDef> embeddedOzoneConfigDefs = embeddedOzoneServiceDef.getConfigs();
+
if (checkNotConfigPresent(embeddedOzoneConfigDefs)) {
dbOzoneServiceDef.setConfigs(embeddedOzoneConfigDefs);
}
// Update volume resource with recursive flag false and key resource with recursive flag true
- embeddedOzoneResourceDefs = embeddedOzoneServiceDef.getResources();
+ List<RangerServiceDef.RangerResourceDef> embeddedOzoneResourceDefs = embeddedOzoneServiceDef.getResources();
+
if (checkVolKeyResUpdate(embeddedOzoneResourceDefs)) {
dbOzoneServiceDef.setResources(embeddedOzoneResourceDefs);
}
// Add new access types
- embeddedOzoneAccessTypes = embeddedOzoneServiceDef.getAccessTypes();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedOzoneAccessTypes = embeddedOzoneServiceDef.getAccessTypes();
if (embeddedOzoneAccessTypes != null) {
if (checkAccessTypesPresent(embeddedOzoneAccessTypes)) {
@@ -203,84 +212,107 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
}
} else {
logger.error("Ozone service-definition does not exist in the db store.");
+
return false;
}
+
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcDBStore);
+
validator.validate(dbOzoneServiceDef, RangerValidator.Action.UPDATE);
- ret = svcDBStore.updateServiceDef(dbOzoneServiceDef);
+ RangerServiceDef ret = svcDBStore.updateServiceDef(dbOzoneServiceDef);
+
if (ret == null) {
throw new RuntimeException("Error while updating " + EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME + " service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_OZONE_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
} else {
logger.error("Ozone service-definition does not exist in the Ranger DAO.");
+
return false;
}
List<XXService> dbServices = daoMgr.getXXService().findByServiceDefId(embeddedOzoneServiceDef.getId());
+
if (CollectionUtils.isNotEmpty(dbServices)) {
for (XXService dbService : dbServices) {
SearchFilter filter = new SearchFilter();
+
filter.setParam(SearchFilter.SERVICE_NAME, dbService.getName());
+
updateExisitngOzonePolicies(svcDBStore.getServicePolicies(dbService.getId(), filter));
}
}
} else {
logger.error("The embedded Ozone service-definition does not exist.");
+
return false;
}
+
return true;
}
private boolean checkNotConfigPresent(List<RangerServiceDef.RangerServiceConfigDef> configDefs) {
boolean ret = false;
List<String> configNames = new ArrayList<>();
+
for (RangerServiceDef.RangerServiceConfigDef configDef : configDefs) {
configNames.add(configDef.getName());
}
+
for (String delConfig : OZONE_CONFIGS) {
if (!configNames.contains(delConfig)) {
ret = true;
break;
}
}
+
return ret;
}
private boolean checkVolKeyResUpdate(List<RangerServiceDef.RangerResourceDef> embeddedOzoneResDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resDef : embeddedOzoneResDefs) {
if ((resDef.getName().equals(OZONE_RESOURCE_VOLUME) && (!resDef.getRecursiveSupported() || resDef.getExcludesSupported())) || (resDef.getName().equals(OZONE_RESOURCE_KEY) && resDef.getRecursiveSupported())) {
ret = true;
break;
}
}
+
return ret;
}
private boolean checkAccessTypesPresent(List<RangerServiceDef.RangerAccessTypeDef> embeddedOzoneAccessTypes) {
boolean ret = false;
+
for (RangerServiceDef.RangerAccessTypeDef accessDef : embeddedOzoneAccessTypes) {
if (ACCESS_TYPE_READ_ACL.equals(accessDef.getName()) || ACCESS_TYPE_WRITE_ACL.equals(accessDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
@@ -288,6 +320,7 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
if (CollectionUtils.isNotEmpty(policies)) {
for (RangerPolicy policy : policies) {
List<RangerPolicy.RangerPolicyItem> policyItems = policy.getPolicyItems();
+
if (CollectionUtils.isNotEmpty(policyItems)) {
for (RangerPolicy.RangerPolicyItem policyItem : policyItems) {
// Add new access types
@@ -295,7 +328,9 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
policyItem.addAccess(new RangerPolicy.RangerPolicyItemAccess("write_acl"));
}
}
+
Map<String, RangerPolicy.RangerPolicyResource> policyResources = policy.getResources();
+
if (MapUtils.isNotEmpty(policyResources)) {
if (policyResources.containsKey(OZONE_RESOURCE_VOLUME)) {
// Set recursive flag as false for volume resource
@@ -303,11 +338,13 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
// Set exclude support flag as true for volume resource
policyResources.get(OZONE_RESOURCE_VOLUME).setIsExcludes(false);
}
+
if (policyResources.containsKey(OZONE_RESOURCE_KEY)) {
// Set is recursive flag as true for volume resource
policyResources.get(OZONE_RESOURCE_KEY).setIsRecursive(true);
}
}
+
svcDBStore.updatePolicy(policy);
}
}
@@ -315,6 +352,7 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -322,6 +360,7 @@ public class PatchForOzoneServiceDefUpdate_J10041 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, ex);
}
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForPrestoToSupportPresto333_J10038.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForPrestoToSupportPresto333_J10038.java
index e9067fd78..7d4c54972 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForPrestoToSupportPresto333_J10038.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForPrestoToSupportPresto333_J10038.java
@@ -75,16 +75,22 @@ public class PatchForPrestoToSupportPresto333_J10038 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForPrestoToSupportPresto333_J10038 loader = (PatchForPrestoToSupportPresto333_J10038) CLIUtil.getBean(PatchForPrestoToSupportPresto333_J10038.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -102,47 +108,49 @@ public class PatchForPrestoToSupportPresto333_J10038 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForPrestoToSupportPresto333.execLoad()");
+
try {
addPresto333Support();
} catch (Exception e) {
throw new RuntimeException("Error while updating " + EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME + " service-def");
}
+
logger.info("<== PatchForPrestoToSupportPresto333.execLoad()");
}
private void addPresto333Support() throws Exception {
- RangerServiceDef ret = null;
- RangerServiceDef embeddedPrestoServiceDef = null;
- XXServiceDef xXServiceDefObj = null;
- RangerServiceDef dbPrestoServiceDef = null;
- List<RangerServiceDef.RangerResourceDef> embeddedPrestoResourceDefs = null;
- List<RangerServiceDef.RangerAccessTypeDef> embeddedPrestoAccessTypes = null;
-
- embeddedPrestoServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME);
+ RangerServiceDef embeddedPrestoServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME);
if (embeddedPrestoServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME);
+
if (xXServiceDefObj == null) {
logger.info("service-def not found. No patching is needed");
+
return;
}
- dbPrestoServiceDef = svcDBStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME);
+ RangerServiceDef dbPrestoServiceDef = svcDBStore.getServiceDefByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME);
+ List<RangerServiceDef.RangerResourceDef> embeddedPrestoResourceDefs = embeddedPrestoServiceDef.getResources();
+ List<RangerServiceDef.RangerAccessTypeDef> embeddedPrestoAccessTypes = embeddedPrestoServiceDef.getAccessTypes();
- embeddedPrestoResourceDefs = embeddedPrestoServiceDef.getResources();
- embeddedPrestoAccessTypes = embeddedPrestoServiceDef.getAccessTypes();
if (checkResourcePresent(PRESTO_RESOURCES, embeddedPrestoResourceDefs)) {
dbPrestoServiceDef.setResources(embeddedPrestoResourceDefs);
+
if (checkAccessPresent(PRESTO_ACCESS_TYPES, embeddedPrestoAccessTypes)) {
dbPrestoServiceDef.setAccessTypes(embeddedPrestoAccessTypes);
}
}
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbPrestoServiceDef, RangerValidator.Action.UPDATE);
- ret = svcStore.updateServiceDef(dbPrestoServiceDef);
+
+ RangerServiceDef ret = svcStore.updateServiceDef(dbPrestoServiceDef);
+
if (ret == null) {
logger.error("Error while updating {} service-def", EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME);
+
throw new RuntimeException("Error while updating " + EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_PRESTO_NAME + " service-def");
}
}
@@ -150,23 +158,27 @@ public class PatchForPrestoToSupportPresto333_J10038 extends BaseLoader {
private boolean checkResourcePresent(List<String> resources, List<RangerServiceDef.RangerResourceDef> resourceDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
if (resources.contains(resourceDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
private boolean checkAccessPresent(List<String> accesses, List<RangerServiceDef.RangerAccessTypeDef> embeddedAtlasAccessTypes) {
boolean ret = false;
+
for (RangerServiceDef.RangerAccessTypeDef accessDef : embeddedAtlasAccessTypes) {
if (accesses.contains(accessDef.getName())) {
ret = true;
break;
}
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForServiceVersionInfo_J10004.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForServiceVersionInfo_J10004.java
index bdd9f3475..a04915237 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForServiceVersionInfo_J10004.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForServiceVersionInfo_J10004.java
@@ -42,13 +42,17 @@ public class PatchForServiceVersionInfo_J10004 extends BaseLoader {
PatchForServiceVersionInfo_J10004 loader = (PatchForServiceVersionInfo_J10004) CLIUtil.getBean(PatchForServiceVersionInfo_J10004.class);
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -65,7 +69,9 @@ public class PatchForServiceVersionInfo_J10004 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> ServiceVersionInfoPatch.execLoad()");
+
copyVersionsFromServiceToServiceVersionInfo();
+
logger.info("<== ServiceVersionInfoPatch.execLoad()");
}
@@ -80,8 +86,10 @@ public class PatchForServiceVersionInfo_J10004 extends BaseLoader {
if (serviceVersionInfoDbObj == null) {
needToCreateServiceVersionInfo = true;
serviceVersionInfoDbObj = new XXServiceVersionInfo();
+
serviceVersionInfoDbObj.setServiceId(xService.getId());
}
+
serviceVersionInfoDbObj.setPolicyVersion(xService.getPolicyVersion() == null ? 1L : xService.getPolicyVersion());
serviceVersionInfoDbObj.setTagVersion(xService.getTagVersion());
serviceVersionInfoDbObj.setPolicyUpdateTime(xService.getPolicyUpdateTime());
@@ -89,9 +97,11 @@ public class PatchForServiceVersionInfo_J10004 extends BaseLoader {
if (needToCreateServiceVersionInfo) {
daoManager.getXXServiceVersionInfo().create(serviceVersionInfoDbObj);
+
logger.info("Created serviceVesionInfo for serviceName [{}]", xService.getName());
} else {
daoManager.getXXServiceVersionInfo().update(serviceVersionInfoDbObj);
+
logger.info("Updated serviceVesionInfo for serviceName [{}]", xService.getName());
}
@@ -108,11 +118,11 @@ public class PatchForServiceVersionInfo_J10004 extends BaseLoader {
xService.setPolicyVersion(xService.getPolicyVersion() == null ? 2L : xService.getPolicyVersion() + 1);
xService.setTagVersion(xService.getTagVersion() + 1);
-
xService.setPolicyUpdateTime(now);
xService.setTagUpdateTime(now);
daoManager.getXXService().update(xService);
+
logger.info("Incremented policy and tag versions for serviceName [{}]", xService.getName());
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForSolrSvcDefAndPoliciesUpdate_J10055.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForSolrSvcDefAndPoliciesUpdate_J10055.java
index 78c4387d9..9d9fd9cdd 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForSolrSvcDefAndPoliciesUpdate_J10055.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForSolrSvcDefAndPoliciesUpdate_J10055.java
@@ -52,8 +52,6 @@ import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.TransactionDefinition;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.ArrayList;
@@ -66,27 +64,31 @@ import java.util.Set;
@Component
public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForSolrSvcDefAndPoliciesUpdate_J10055.class);
+ private static final Logger logger = LoggerFactory.getLogger(PatchForSolrSvcDefAndPoliciesUpdate_J10055.class);
+
private static final String ACCESS_TYPE_UPDATE = "update";
private static final String ACCESS_TYPE_QUERY = "query";
private static final String ACCESS_TYPE_ADMIN = "solr_admin";
private static final String ACCESS_TYPE_OTHERS = "others";
//TAG type solr:permissions
- private static final String ACCESS_TYPE_UPDATE_TAG = "solr:update";
- private static final String ACCESS_TYPE_QUERY_TAG = "solr:query";
- private static final String ACCESS_TYPE_ADMIN_TAG = "solr:solr_admin";
- private static final String ACCESS_TYPE_OTHERS_TAG = "solr:others";
+ private static final String ACCESS_TYPE_UPDATE_TAG = "solr:update";
+ private static final String ACCESS_TYPE_QUERY_TAG = "solr:query";
+ private static final String ACCESS_TYPE_ADMIN_TAG = "solr:solr_admin";
+ private static final String ACCESS_TYPE_OTHERS_TAG = "solr:others";
private static final String SVC_ACCESS_TYPE_CONFIG_SUFFIX = "accessTypes";
- private static final String SOLR_SVC_DEF_NAME = EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_SOLR_NAME;
- private static RangerServiceDef embeddedSolrServiceDef;
+ private static final String SOLR_SVC_DEF_NAME = EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_SOLR_NAME;
+
@Autowired
ServiceDBStore svcDBStore;
+
@Autowired
@Qualifier(value = "transactionManager")
PlatformTransactionManager txManager;
+
@Autowired
private RangerDaoManager daoMgr;
+
@Autowired
private SecurityZoneDBStore secZoneDBStore;
@@ -95,16 +97,22 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForSolrSvcDefAndPoliciesUpdate_J10055 loader = (PatchForSolrSvcDefAndPoliciesUpdate_J10055) CLIUtil.getBean(PatchForSolrSvcDefAndPoliciesUpdate_J10055.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -122,39 +130,45 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForSolrSvcDefAndPoliciesUpdate_J10055.execLoad()");
+
try {
- embeddedSolrServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SOLR_SVC_DEF_NAME);
+ RangerServiceDef embeddedSolrServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SOLR_SVC_DEF_NAME);
+
if (embeddedSolrServiceDef == null) {
logger.error("The embedded Solr service-definition does not exist.");
+
System.exit(1);
}
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- if (updateSolrSvcDef() == null) {
- throw new RuntimeException("Error while updating " + SOLR_SVC_DEF_NAME + " service-def");
- }
- return null;
+ txTemplate.execute(status -> {
+ if (updateSolrSvcDef() == null) {
+ throw new RuntimeException("Error while updating " + SOLR_SVC_DEF_NAME + " service-def");
}
+
+ return null;
});
} catch (Throwable ex) {
logger.error("Error while updating {} service-def", SOLR_SVC_DEF_NAME);
+
throw new RuntimeException("Error while updating " + SOLR_SVC_DEF_NAME + " service-def");
}
final Long resTypeSvcDefId = embeddedSolrServiceDef.getId();
final Long tagSvcDefId = EmbeddedServiceDefsUtil.instance().getTagServiceDefId();
+
updateExistingRangerResPolicy(resTypeSvcDefId);
updateExistingRangerTagPolicies(tagSvcDefId);
deleteOldAccessTypeRefs(resTypeSvcDefId);
deleteOldAccessTypeRefs(tagSvcDefId);
} catch (Exception e) {
- logger.error("Error whille executing PatchForSolrSvcDefAndPoliciesUpdate_J10055, Error - ", e);
+ logger.error("Error while executing PatchForSolrSvcDefAndPoliciesUpdate_J10055, Error - ", e);
+
System.exit(1);
}
@@ -163,6 +177,7 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
updateDefaultAuditFilter(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_ATLAS_NAME);
} catch (Throwable t) {
logger.error("Failed to update atlas default audit filter - ", t);
+
System.exit(1);
}
@@ -171,12 +186,16 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
private void updateExistingRangerResPolicy(Long svcDefId) throws Exception {
logger.info("<== PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateExistingRangerResPolicy(...)");
+
List<XXService> dbServices = daoMgr.getXXService().findByServiceDefId(svcDefId);
+
if (CollectionUtils.isNotEmpty(dbServices)) {
for (XXService dbService : dbServices) {
SearchFilter filter = new SearchFilter();
+
filter.setParam(SearchFilter.SERVICE_NAME, dbService.getName());
filter.setParam(SearchFilter.FETCH_ZONE_UNZONE_POLICIES, "true");
+
updateResPolicies(svcDBStore.getServicePolicies(dbService.getId(), filter));
updateZoneResourceMapping(dbService);
updateServiceConfig(dbService);
@@ -187,81 +206,102 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
private void updateZoneResourceMapping(final XXService solrDBSvc) throws Exception {
logger.info("==> PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateZoneResourceMapping(...)");
+
// Update Zone Resource Mapping For Solr Services
final String svcName = solrDBSvc.getName();
SearchFilter filter = new SearchFilter();
+
filter.setParam(SearchFilter.SERVICE_NAME, svcName);
+
List<RangerSecurityZone> secZoneList = this.secZoneDBStore.getSecurityZones(filter);
long index = 1;
+
for (RangerSecurityZone secZone : secZoneList) {
logger.info("updateZoneResourceMapping() processing: [{}/{}]", index, secZoneList.size());
+
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- try {
- updateZone(secZone, svcName);
- } catch (Exception e) {
- throw new RuntimeException(e);
- }
- return null;
+ txTemplate.execute(status -> {
+ try {
+ updateZone(secZone, svcName);
+ } catch (Exception e) {
+ throw new RuntimeException(e);
}
+
+ return null;
});
} catch (Throwable ex) {
logger.error("updateZoneResourceMapping(): Failed to update zone: {}", secZone.getName(), ex);
throw new RuntimeException(ex);
}
+
index++;
}
+
logger.info("<== PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateZoneResourceMapping(...)");
}
private void updateZone(RangerSecurityZone secZone, String svcName) throws Exception {
- RangerSecurityZoneService secZoneSvc = secZone.getServices().get(svcName); // get secZoneSvc only for this svcName
- List<HashMap<String, List<String>>> solrZoneSvcResourcesMapList = secZoneSvc.getResources();
+ RangerSecurityZoneService secZoneSvc = secZone.getServices().get(svcName); // get secZoneSvc only for this svcName
+ List<HashMap<String, List<String>>> solrZoneSvcResourcesMapList = secZoneSvc.getResources();
+ final Set<HashMap<String, List<String>>> updatedResMapSet = new HashSet<>();
- final Set<HashMap<String, List<String>>> updatedResMapSet = new HashSet<HashMap<String, List<String>>>();
for (HashMap<String, List<String>> existingResMap : solrZoneSvcResourcesMapList) {
boolean isAllResource = false;
+
for (Map.Entry<String, List<String>> resNameValueListMap : existingResMap.entrySet()) {
updatedResMapSet.add(existingResMap);
+
final List<String> resourceValueList = resNameValueListMap.getValue();
if (CollectionUtils.isNotEmpty(resourceValueList) && resourceValueList.contains("*")) {
updatedResMapSet.clear();
updatedResMapSet.add(existingResMap);
+
isAllResource = true;
break;
} else {
- HashMap<String, List<String>> updatedResMap = new HashMap<String, List<String>>();
+ HashMap<String, List<String>> updatedResMap = new HashMap<>();
+
updatedResMap.put(NEW_RESOURCE.schema.name(), resourceValueList);
+
updatedResMapSet.add(updatedResMap);
}
}
if (isAllResource) {
final List<String> allResVal = Collections.singletonList("*");
+
for (NEW_RESOURCE newRes : NEW_RESOURCE.values()) {
- HashMap<String, List<String>> updatedResMap = new HashMap<String, List<String>>();
+ HashMap<String, List<String>> updatedResMap = new HashMap<>();
+
updatedResMap.put(newRes.name(), allResVal);
+
updatedResMapSet.add(updatedResMap);
}
- secZoneSvc.setResources(new ArrayList<HashMap<String, List<String>>>(updatedResMapSet));
+
+ secZoneSvc.setResources(new ArrayList<>(updatedResMapSet));
break;
}
- secZoneSvc.setResources(new ArrayList<HashMap<String, List<String>>>(updatedResMapSet));
+
+ secZoneSvc.setResources(new ArrayList<>(updatedResMapSet));
}
+
this.secZoneDBStore.updateSecurityZoneById(secZone);
}
private void updateExistingRangerTagPolicies(Long svcDefId) throws Exception {
List<XXService> dbServices = daoMgr.getXXService().findByServiceDefId(svcDefId);
+
if (CollectionUtils.isNotEmpty(dbServices)) {
for (XXService dbService : dbServices) {
SearchFilter filter = new SearchFilter();
+
filter.setParam(SearchFilter.SERVICE_NAME, dbService.getName());
+
updateTagPolicies(svcDBStore.getServicePolicies(dbService.getId(), filter));
}
}
@@ -270,30 +310,35 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
private void updateTagPolicies(List<RangerPolicy> tagServicePolicies) {
if (CollectionUtils.isNotEmpty(tagServicePolicies)) {
long index = 1;
+
for (RangerPolicy exPolicy : tagServicePolicies) {
logger.info("updateTagPolicies() processing: [{}/{}]", index, tagServicePolicies.size());
+
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- updateTagPolicyItemAccess(exPolicy.getPolicyItems());
- updateTagPolicyItemAccess(exPolicy.getAllowExceptions());
- updateTagPolicyItemAccess(exPolicy.getDenyPolicyItems());
- updateTagPolicyItemAccess(exPolicy.getDenyExceptions());
- try {
- svcDBStore.updatePolicy(exPolicy);
- } catch (Exception e) {
- throw new RuntimeException(e);
- }
- return null;
+ txTemplate.execute(status -> {
+ updateTagPolicyItemAccess(exPolicy.getPolicyItems());
+ updateTagPolicyItemAccess(exPolicy.getAllowExceptions());
+ updateTagPolicyItemAccess(exPolicy.getDenyPolicyItems());
+ updateTagPolicyItemAccess(exPolicy.getDenyExceptions());
+
+ try {
+ svcDBStore.updatePolicy(exPolicy);
+ } catch (Exception e) {
+ throw new RuntimeException(e);
}
+
+ return null;
});
} catch (Throwable ex) {
logger.error("updateTagPolicies(): Failed to update policy:{}", exPolicy.getName(), ex);
+
throw new RuntimeException(ex);
}
+
index++;
}
}
@@ -302,22 +347,26 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
private void updateResPolicies(List<RangerPolicy> policies) {
if (CollectionUtils.isNotEmpty(policies)) {
long index = 1;
+
for (RangerPolicy exPolicy : policies) {
logger.info("updateResPolicies() processing: [{}/{}]", index, policies.size());
+
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- createOrUpdatePolicy(exPolicy);
- return null;
- }
+ txTemplate.execute(status -> {
+ createOrUpdatePolicy(exPolicy);
+
+ return null;
});
} catch (Throwable ex) {
logger.error("updateResPolicies(): Failed to create/update policy:{}", exPolicy.getName(), ex);
+
throw new RuntimeException(ex);
}
+
index++;
}
}
@@ -332,21 +381,26 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
// check if there is a need to create additional policies with
// admin/config/schema resource(s)
- final boolean splitPolicy = (filteredAllowPolciyItems.size() > 0 || filteredAllowExcpPolItems.size() > 0 || filteredDenyPolItems.size() > 0 || filteredDenyExcpPolItems.size() > 0);
+ final boolean splitPolicy = (!filteredAllowPolciyItems.isEmpty() || !filteredAllowExcpPolItems.isEmpty() || !filteredDenyPolItems.isEmpty() || !filteredDenyExcpPolItems.isEmpty());
+
if (splitPolicy) {
RangerPolicy newPolicyForNewResource = new RangerPolicy();
+
newPolicyForNewResource.setService(exPolicy.getService());
newPolicyForNewResource.setServiceType(exPolicy.getServiceType());
newPolicyForNewResource.setPolicyPriority(exPolicy.getPolicyPriority());
RangerPolicyResource newRes = new RangerPolicyResource();
boolean isAllResources = false;
+
// Only one entry expected
for (Map.Entry<String, RangerPolicyResource> entry : exPolicy.getResources().entrySet()) {
RangerPolicyResource exPolRes = entry.getValue();
+
newRes.setIsExcludes(exPolRes.getIsExcludes());
newRes.setIsRecursive(exPolRes.getIsRecursive());
newRes.setValues(exPolRes.getValues());
+
if (CollectionUtils.isNotEmpty(exPolRes.getValues()) && exPolRes.getValues().contains("*")) {
isAllResources = true;
}
@@ -384,6 +438,7 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
updateResPolicyItemAccess(exPolicy.getAllowExceptions());
updateResPolicyItemAccess(exPolicy.getDenyPolicyItems());
updateResPolicyItemAccess(exPolicy.getDenyExceptions());
+
this.svcDBStore.updatePolicy(exPolicy);
} catch (Exception e) {
throw new RuntimeException(e);
@@ -392,30 +447,37 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
private void createNewPolicy(final String resType, final RangerPolicy newPolicy, final RangerPolicyResource newRes, final String exPolicyName) throws Exception {
final String newPolicyName = resType + " - '" + exPolicyName + "'";
+
newPolicy.setName(newPolicyName);
newPolicy.setDescription(newPolicyName);
- final Map<String, RangerPolicy.RangerPolicyResource> resForNewPol = new HashMap<String, RangerPolicy.RangerPolicyResource>();
+ final Map<String, RangerPolicy.RangerPolicyResource> resForNewPol = new HashMap<>();
+
resForNewPol.put(resType, newRes);
+
newPolicy.setResources(resForNewPol);
newPolicy.setResourceSignature(null);
newPolicy.setGuid(null);
+
logger.debug("newPolicy:{}", newPolicy);
+
this.svcDBStore.createPolicy(newPolicy);
}
private void updateResPolicyItemAccess(List<RangerPolicyItem> policyItems) {
- Set<RangerPolicyItemAccess> newRangerPolicyItemAccess = new HashSet<RangerPolicyItemAccess>();
if (CollectionUtils.isNotEmpty(policyItems)) {
for (RangerPolicyItem exPolicyItem : policyItems) {
if (exPolicyItem != null) {
List<RangerPolicyItemAccess> exPolicyItemAccessList = exPolicyItem.getAccesses();
+
if (CollectionUtils.isNotEmpty(exPolicyItemAccessList)) {
- newRangerPolicyItemAccess = new HashSet<RangerPolicyItemAccess>();
+ Set<RangerPolicyItemAccess> newRangerPolicyItemAccess = new HashSet<>();
+
for (RangerPolicyItemAccess aPolicyItemAccess : exPolicyItemAccessList) {
if (aPolicyItemAccess != null) {
final String accessType = aPolicyItemAccess.getType();
final Boolean isAllowed = aPolicyItemAccess.getIsAllowed();
+
if (ACCESS_TYPE_ADMIN.equalsIgnoreCase(accessType)) {
newRangerPolicyItemAccess.add(new RangerPolicyItemAccess(ACCESS_TYPE_QUERY, isAllowed));
newRangerPolicyItemAccess.add(new RangerPolicyItemAccess(ACCESS_TYPE_UPDATE, isAllowed));
@@ -429,7 +491,8 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
}
}
}
- exPolicyItem.setAccesses(new ArrayList<RangerPolicy.RangerPolicyItemAccess>(newRangerPolicyItemAccess));
+
+ exPolicyItem.setAccesses(new ArrayList<>(newRangerPolicyItemAccess));
}
}
}
@@ -437,18 +500,21 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
}
private void updateTagPolicyItemAccess(List<RangerPolicyItem> policyItems) {
- List<RangerPolicy.RangerPolicyItem> newPolicyItems = new ArrayList<RangerPolicy.RangerPolicyItem>();
- Set<RangerPolicyItemAccess> newRangerPolicyItemAccess = new HashSet<RangerPolicyItemAccess>();
+ List<RangerPolicy.RangerPolicyItem> newPolicyItems = new ArrayList<>();
+
if (CollectionUtils.isNotEmpty(policyItems)) {
for (RangerPolicyItem exPolicyItem : policyItems) {
if (exPolicyItem != null) {
List<RangerPolicyItemAccess> exPolicyItemAccessList = exPolicyItem.getAccesses();
+
if (CollectionUtils.isNotEmpty(exPolicyItemAccessList)) {
- newRangerPolicyItemAccess = new HashSet<RangerPolicyItemAccess>();
+ Set<RangerPolicyItemAccess> newRangerPolicyItemAccess = new HashSet<>();
+
for (RangerPolicyItemAccess aPolicyItemAccess : exPolicyItemAccessList) {
if (aPolicyItemAccess != null) {
final String accessType = aPolicyItemAccess.getType();
final Boolean isAllowed = aPolicyItemAccess.getIsAllowed();
+
if (ACCESS_TYPE_ADMIN_TAG.equalsIgnoreCase(accessType)) {
newRangerPolicyItemAccess.add(new RangerPolicyItemAccess(ACCESS_TYPE_QUERY_TAG, isAllowed));
newRangerPolicyItemAccess.add(new RangerPolicyItemAccess(ACCESS_TYPE_UPDATE_TAG, isAllowed));
@@ -463,7 +529,9 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
}
}
}
- exPolicyItem.setAccesses(new ArrayList<RangerPolicy.RangerPolicyItemAccess>(newRangerPolicyItemAccess));
+
+ exPolicyItem.setAccesses(new ArrayList<>(newRangerPolicyItemAccess));
+
newPolicyItems.add(exPolicyItem);
}
}
@@ -473,48 +541,59 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
private List<RangerPolicy.RangerPolicyItem> filterPolicyItemsForAdminPermission(List<RangerPolicy.RangerPolicyItem> policyItems) {
// Add only those policy items who's access permission list contains 'solr_admin' permission
- List<RangerPolicy.RangerPolicyItem> filteredPolicyItems = new ArrayList<RangerPolicy.RangerPolicyItem>();
- Set<RangerPolicyItemAccess> newRangerPolicyItemAccess = new HashSet<RangerPolicyItemAccess>();
+ List<RangerPolicy.RangerPolicyItem> filteredPolicyItems = new ArrayList<>();
+ Set<RangerPolicyItemAccess> newRangerPolicyItemAccess = new HashSet<>();
+
policyItems.forEach(exPolicyItem -> exPolicyItem.getAccesses().forEach(polItemAcc -> {
if (ACCESS_TYPE_ADMIN.equalsIgnoreCase(polItemAcc.getType())) {
newRangerPolicyItemAccess.add(new RangerPolicyItemAccess(ACCESS_TYPE_QUERY, polItemAcc.getIsAllowed()));
newRangerPolicyItemAccess.add(new RangerPolicyItemAccess(ACCESS_TYPE_UPDATE, polItemAcc.getIsAllowed()));
- RangerPolicyItem newPolicyItem = new RangerPolicyItem(new ArrayList<RangerPolicy.RangerPolicyItemAccess>(newRangerPolicyItemAccess), exPolicyItem.getUsers(), exPolicyItem.getGroups(), exPolicyItem.getRoles(), exPolicyItem.getConditions(), exPolicyItem.getDelegateAdmin());
+
+ RangerPolicyItem newPolicyItem = new RangerPolicyItem(new ArrayList<>(newRangerPolicyItemAccess), exPolicyItem.getUsers(), exPolicyItem.getGroups(), exPolicyItem.getRoles(), exPolicyItem.getConditions(), exPolicyItem.getDelegateAdmin());
+
filteredPolicyItems.add(newPolicyItem);
}
}));
+
return filteredPolicyItems;
}
private RangerServiceDef updateSolrSvcDef() {
logger.info("==> PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateSolrSvcDef()");
- RangerServiceDef ret = null;
- RangerServiceDef embeddedSolrServiceDef = null;
- XXServiceDef xXServiceDefObj = null;
- RangerServiceDef dbSolrServiceDef = null;
- List<RangerServiceDef.RangerResourceDef> embeddedSolrResourceDefs = null;
+
+ RangerServiceDef ret = null;
+
try {
- embeddedSolrServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SOLR_SVC_DEF_NAME);
+ RangerServiceDef embeddedSolrServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SOLR_SVC_DEF_NAME);
+
if (embeddedSolrServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SOLR_SVC_DEF_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SOLR_SVC_DEF_NAME);
+
if (xXServiceDefObj == null) {
logger.info(" service-def not found. No patching is needed");
+
System.exit(0);
}
- embeddedSolrResourceDefs = embeddedSolrServiceDef.getResources(); // ResourcesType
- dbSolrServiceDef = this.svcDBStore.getServiceDefByName(SOLR_SVC_DEF_NAME);
+ List<RangerServiceDef.RangerResourceDef> embeddedSolrResourceDefs = embeddedSolrServiceDef.getResources(); // ResourcesType
+ RangerServiceDef dbSolrServiceDef = this.svcDBStore.getServiceDefByName(SOLR_SVC_DEF_NAME);
+
dbSolrServiceDef.setResources(embeddedSolrResourceDefs);
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(this.svcDBStore);
+
validator.validate(dbSolrServiceDef, Action.UPDATE);
+
ret = this.svcDBStore.updateServiceDef(dbSolrServiceDef);
}
} catch (Exception e) {
logger.error("Error while updating {} service-def", SOLR_SVC_DEF_NAME, e);
+
throw new RuntimeException(e);
}
+
logger.info("<== PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateSolrSvcDef()");
+
return ret;
}
@@ -523,38 +602,44 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
List<XXAccessTypeDef> solrAccessDefTypes = daoMgr.getXXAccessTypeDef().findByServiceDefId(svcDefId);
XXAccessTypeDefDao accessTypeDefDao = daoMgr.getXXAccessTypeDef();
XXAccessTypeDefGrantsDao xxAccessTypeDefGrantsDao = daoMgr.getXXAccessTypeDefGrants();
+
for (XXAccessTypeDef xXAccessTypeDef : solrAccessDefTypes) {
if (xXAccessTypeDef != null) {
final String accessTypeName = xXAccessTypeDef.getName();
final Long id = xXAccessTypeDef.getId(); // atd_id in x_access_type_def_grants tbl
+
// remove solr_admin refs from implied grants refs tbl
for (XXAccessTypeDefGrants xXAccessTypeDefGrants : xxAccessTypeDefGrantsDao.findByATDId(id)) {
if (xXAccessTypeDefGrants != null) {
xxAccessTypeDefGrantsDao.remove(xXAccessTypeDefGrants.getId());
}
}
+
// remove no longer supported accessTyeDef's (others,solr_admin, solr:others, solr:solr_admin)
if (ACCESS_TYPE_ADMIN.equalsIgnoreCase(accessTypeName) || ACCESS_TYPE_OTHERS.equalsIgnoreCase(accessTypeName) || ACCESS_TYPE_OTHERS_TAG.equalsIgnoreCase(accessTypeName) || ACCESS_TYPE_ADMIN_TAG.equalsIgnoreCase(accessTypeName)) {
accessTypeDefDao.remove(xXAccessTypeDef.getId());
}
}
}
+
logger.info("<== PatchForSolrSvcDefAndPoliciesUpdate_J10055.deleteOldAccessTypeRefs({})", svcDefId);
}
private void updateServiceConfig(final XXService dbService) throws Exception {
logger.info("==> PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateServiceConfig()");
- final RangerService rangerSvc = this.svcDBStore.getService(dbService.getId());
- final Map<String, String> configMap = rangerSvc != null ? rangerSvc.getConfigs() : null;
- Set<String> accessTypeSet = new HashSet<String>();
+
+ final RangerService rangerSvc = this.svcDBStore.getService(dbService.getId());
+ final Map<String, String> configMap = rangerSvc != null ? rangerSvc.getConfigs() : null;
if (MapUtils.isNotEmpty(configMap)) {
for (final Map.Entry<String, String> entry : configMap.entrySet()) {
- final String configKey = entry.getKey();
- final String configValue = entry.getValue();
- accessTypeSet = new HashSet<String>();
+ final String configKey = entry.getKey();
+ final String configValue = entry.getValue();
+ Set<String> accessTypeSet = new HashSet<>();
+
if (StringUtils.endsWith(configKey, SVC_ACCESS_TYPE_CONFIG_SUFFIX) && StringUtils.isNotEmpty(configValue)) {
final String[] accessTypeArray = configValue.split(",");
+
for (String access : accessTypeArray) {
if (!ACCESS_TYPE_OTHERS.equalsIgnoreCase(access) && !ACCESS_TYPE_ADMIN.equalsIgnoreCase(access)) {
accessTypeSet.add(access);
@@ -567,20 +652,25 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
}
}
}
+
configMap.put(configKey, StringUtils.join(accessTypeSet, ","));
}
}
+
rangerSvc.setConfigs(configMap);
+
this.svcDBStore.updateService(rangerSvc, null);
}
+
logger.info("<== PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateServiceConfig()");
}
private void updateDefaultAuditFilter(final String svcDefName) throws Exception {
logger.info("==> PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateAtlasDefaultAuditFilter()");
- final RangerServiceDef embeddedAtlasServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(svcDefName);
- final List<RangerServiceConfigDef> embdSvcConfDefList = embeddedAtlasServiceDef != null ? embeddedAtlasServiceDef.getConfigs() : new ArrayList<RangerServiceConfigDef>();
- String embdAuditFilterStr = StringUtils.EMPTY;
+
+ final RangerServiceDef embeddedAtlasServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(svcDefName);
+ final List<RangerServiceConfigDef> embdSvcConfDefList = embeddedAtlasServiceDef != null ? embeddedAtlasServiceDef.getConfigs() : new ArrayList<>();
+ String embdAuditFilterStr = StringUtils.EMPTY;
if (CollectionUtils.isNotEmpty(embdSvcConfDefList)) {
for (RangerServiceConfigDef embdSvcConfDef : embdSvcConfDefList) {
@@ -593,18 +683,23 @@ public class PatchForSolrSvcDefAndPoliciesUpdate_J10055 extends BaseLoader {
if (StringUtils.isNotEmpty(embdAuditFilterStr)) {
final RangerServiceDef serviceDbDef = this.svcDBStore.getServiceDefByName(svcDefName);
+
for (RangerServiceConfigDef dbSvcDefConfig : serviceDbDef.getConfigs()) {
if (dbSvcDefConfig != null && StringUtils.equals(dbSvcDefConfig.getName(), ServiceDBStore.RANGER_PLUGIN_AUDIT_FILTERS)) {
final String dbAuditFilterStr = dbSvcDefConfig.getDefaultValue();
+
if (!StringUtils.equalsIgnoreCase(dbAuditFilterStr, embdAuditFilterStr)) {
dbSvcDefConfig.setDefaultValue(embdAuditFilterStr);
+
this.svcDBStore.updateServiceDef(serviceDbDef);
+
logger.info("Updated {} service default audit filter.", serviceDbDef.getName());
}
break;
}
}
}
+
logger.info("<== PatchForSolrSvcDefAndPoliciesUpdate_J10055.updateAtlasDefaultAuditFilter()");
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForSyncSourceUpdate_J10054.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForSyncSourceUpdate_J10054.java
index c0fc75e50..2697ce86f 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForSyncSourceUpdate_J10054.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForSyncSourceUpdate_J10054.java
@@ -32,8 +32,6 @@ import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.TransactionDefinition;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.List;
@@ -42,24 +40,32 @@ import java.util.Map;
@Component
public class PatchForSyncSourceUpdate_J10054 extends BaseLoader {
private static final Logger logger = LoggerFactory.getLogger(PatchForSyncSourceUpdate_J10054.class);
+
@Autowired
RangerDaoManager daoManager;
+
@Autowired
@Qualifier(value = "transactionManager")
PlatformTransactionManager txManager;
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForSyncSourceUpdate_J10054 loader = (PatchForSyncSourceUpdate_J10054) CLIUtil.getBean(PatchForSyncSourceUpdate_J10054.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting.");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -75,54 +81,66 @@ public class PatchForSyncSourceUpdate_J10054 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForSyncSourceUpdate.execLoad()");
+
try {
if (!updateSyncSourceForUsers() || !updateSyncSourceForGroups()) {
logger.error("Failed to apply the patch.");
+
System.exit(1);
}
} catch (Exception e) {
logger.error("Error while PatchForSyncSourceUpdate()data.", e);
+
System.exit(1);
}
+
logger.info("<== PatchForSyncSourceUpdate.execLoad()");
}
public boolean updateSyncSourceForUsers() {
List<XXUser> users = daoManager.getXXUser().getAll();
+
for (XXUser xUser : users) {
String syncSource = xUser.getSyncSource();
String otherAttributes = xUser.getOtherAttributes();
+
if (StringUtils.isNotEmpty(otherAttributes) && StringUtils.isEmpty(syncSource)) {
syncSource = (String) JsonUtils.jsonToObject(otherAttributes, Map.class).get(UgsyncCommonConstants.SYNC_SOURCE);
+
xUser.setSyncSource(syncSource);
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
String finalSyncSource = syncSource;
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- if (StringUtils.isNotEmpty(finalSyncSource)) {
- XXPortalUser xXPortalUser = daoManager.getXXPortalUser().findByLoginId(xUser.getName());
- if (xXPortalUser != null && xXPortalUser.getUserSource() == 0) {
- /* updating the user source to external for users which had some sync source prior to upgrade
- but the user source was marked internal to due bugs which were fixed later.
- See RANGER-3297 for more info
- */
- xXPortalUser.setUserSource(1);
- daoManager.getXXPortalUser().update(xXPortalUser);
- logger.debug("USER: Name: {} userSource changed to External", xUser.getName());
- }
+ txTemplate.execute(status -> {
+ if (StringUtils.isNotEmpty(finalSyncSource)) {
+ XXPortalUser xXPortalUser = daoManager.getXXPortalUser().findByLoginId(xUser.getName());
+ if (xXPortalUser != null && xXPortalUser.getUserSource() == 0) {
+ /* updating the user source to external for users which had some sync source prior to upgrade
+ but the user source was marked internal to due bugs which were fixed later.
+ See RANGER-3297 for more info
+ */
+ xXPortalUser.setUserSource(1);
+
+ daoManager.getXXPortalUser().update(xXPortalUser);
+
+ logger.debug("USER: Name: {} userSource changed to External", xUser.getName());
}
- daoManager.getXXUser().update(xUser);
- logger.debug("USER: Name: {} syncSource updated to {}", xUser.getName(), finalSyncSource);
- return null;
}
+
+ daoManager.getXXUser().update(xUser);
+
+ logger.debug("USER: Name: {} syncSource updated to {}", xUser.getName(), finalSyncSource);
+
+ return null;
});
} catch (Throwable ex) {
logger.error("updateSyncSourceForUsers(): Failed to update DB for user: {}", xUser.getName(), ex);
+
throw new RuntimeException(ex);
}
} else {
@@ -134,36 +152,42 @@ public class PatchForSyncSourceUpdate_J10054 extends BaseLoader {
public boolean updateSyncSourceForGroups() {
List<XXGroup> groups = daoManager.getXXGroup().getAll();
+
for (XXGroup xGroup : groups) {
String syncSource = xGroup.getSyncSource();
String otherAttributes = xGroup.getOtherAttributes();
+
if (StringUtils.isNotEmpty(otherAttributes) && StringUtils.isEmpty(syncSource)) {
syncSource = (String) JsonUtils.jsonToObject(otherAttributes, Map.class).get(UgsyncCommonConstants.SYNC_SOURCE);
+
if (StringUtils.isNotEmpty(syncSource) && xGroup.getGroupSource() == 0) {
xGroup.setGroupSource(1);
logger.debug("GROUP: Name: {} groupSource changed to External", xGroup.getName());
}
+
xGroup.setSyncSource(syncSource);
+
logger.debug("GROUP: Name: {} syncSource updated to {}", xGroup.getName(), syncSource);
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- daoManager.getXXGroup().update(xGroup);
- return null;
- }
+ txTemplate.execute(status -> {
+ daoManager.getXXGroup().update(xGroup);
+ return null;
});
} catch (Throwable ex) {
- logger.error("updateSyncSourceForGroups(): Failed to update DB for group: ", xGroup.getName(), ex);
+ logger.error("updateSyncSourceForGroups(): Failed to update DB for group: {}", xGroup.getName(), ex);
+
throw new RuntimeException(ex);
}
} else {
logger.debug("Skipping syncSource update for group: {}", xGroup.getName());
}
}
+
return true;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTagServiceDefUpdate_J10008.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTagServiceDefUpdate_J10008.java
index 531de230d..185e4e4a1 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTagServiceDefUpdate_J10008.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTagServiceDefUpdate_J10008.java
@@ -43,9 +43,11 @@ import java.util.Map;
@Component
public class PatchForTagServiceDefUpdate_J10008 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForTagServiceDefUpdate_J10008.class);
- public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME = "tag";
- public static final String SCRIPT_POLICY_CONDITION_NAME = "expression";
+ private static final Logger logger = LoggerFactory.getLogger(PatchForTagServiceDefUpdate_J10008.class);
+
+ public static final String SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME = "tag";
+ public static final String SCRIPT_POLICY_CONDITION_NAME = "expression";
+
@Autowired
RangerDaoManager daoMgr;
@@ -78,16 +80,22 @@ public class PatchForTagServiceDefUpdate_J10008 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForTagServiceDefUpdate_J10008 loader = (PatchForTagServiceDefUpdate_J10008) CLIUtil.getBean(PatchForTagServiceDefUpdate_J10008.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -105,71 +113,82 @@ public class PatchForTagServiceDefUpdate_J10008 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForTagServiceDefUpdate.execLoad()");
+
try {
updateTagServiceDef();
} catch (Exception e) {
logger.error("Error whille updateTagServiceDef()data.", e);
}
+
logger.info("<== PatchForTagServiceDefUpdate.execLoad()");
}
private void updateTagServiceDef() {
- RangerServiceDef embeddedTagServiceDef = null;
- RangerServiceDef dbTagServiceDef = null;
- List<RangerServiceDef.RangerPolicyConditionDef> embeddedTagPolicyConditionDefs = null;
- XXServiceDef xXServiceDefObj = null;
try {
- embeddedTagServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+ RangerServiceDef embeddedTagServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+
if (embeddedTagServiceDef != null) {
- embeddedTagPolicyConditionDefs = embeddedTagServiceDef.getPolicyConditions();
+ List<RangerServiceDef.RangerPolicyConditionDef> embeddedTagPolicyConditionDefs = embeddedTagServiceDef.getPolicyConditions();
+
if (embeddedTagPolicyConditionDefs == null) {
logger.error("Policy Conditions are empyt in tag service def json");
+
return;
}
if (!checkScriptPolicyCondPresent(embeddedTagPolicyConditionDefs)) {
logger.error("{} policy condition not found!!", SCRIPT_POLICY_CONDITION_NAME);
+
return;
}
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+
if (xXServiceDefObj == null) {
logger.error("Service def for {} is not found!!", SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
return;
}
Map<String, String> serviceDefOptionsPreUpdate = null;
- String jsonStrPreUpdate = null;
- jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+ String jsonStrPreUpdate = xXServiceDefObj.getDefOptions();
+
if (!StringUtils.isEmpty(jsonStrPreUpdate)) {
serviceDefOptionsPreUpdate = jsonUtil.jsonToMap(jsonStrPreUpdate);
}
- xXServiceDefObj = null;
- dbTagServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+
+ RangerServiceDef dbTagServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
if (dbTagServiceDef != null) {
dbTagServiceDef.setPolicyConditions(embeddedTagPolicyConditionDefs);
+
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(svcStore);
+
validator.validate(dbTagServiceDef, Action.UPDATE);
svcStore.updateServiceDef(dbTagServiceDef);
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = null;
+
if (!StringUtils.isEmpty(jsonStrPostUpdate)) {
serviceDefOptionsPostUpdate = jsonUtil.jsonToMap(jsonStrPostUpdate);
}
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
@@ -183,20 +202,25 @@ public class PatchForTagServiceDefUpdate_J10008 extends BaseLoader {
private boolean checkScriptPolicyCondPresent(List<RangerServiceDef.RangerPolicyConditionDef> policyCondDefs) {
boolean ret = false;
+
for (RangerServiceDef.RangerPolicyConditionDef policyCondDef : policyCondDefs) {
if (SCRIPT_POLICY_CONDITION_NAME.equals(policyCondDef.getName())) {
ret = true;
+
break;
}
}
+
return ret;
}
- private String mapToJsonString(Map<String, String> map) throws Exception {
+ private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
ret = jsonUtil.readMapToString(map);
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTagServiceDefUpdate_J10028.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTagServiceDefUpdate_J10028.java
index 5db99400d..27c568863 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTagServiceDefUpdate_J10028.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTagServiceDefUpdate_J10028.java
@@ -45,7 +45,8 @@ import java.util.Map;
@Component
public class PatchForTagServiceDefUpdate_J10028 extends BaseLoader {
- private static final Logger logger = LoggerFactory.getLogger(PatchForTagServiceDefUpdate_J10028.class);
+ private static final Logger logger = LoggerFactory.getLogger(PatchForTagServiceDefUpdate_J10028.class);
+
private static final String SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME = "tag";
@Autowired
@@ -80,16 +81,22 @@ public class PatchForTagServiceDefUpdate_J10028 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForTagServiceDefUpdate_J10028 loader = (PatchForTagServiceDefUpdate_J10028) CLIUtil.getBean(PatchForTagServiceDefUpdate_J10028.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting.");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -107,82 +114,92 @@ public class PatchForTagServiceDefUpdate_J10028 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForTagServiceDefUpdate.execLoad()");
+
try {
if (!updateTagServiceDef()) {
logger.error("Failed to apply the patch.");
+
System.exit(1);
}
} catch (Exception e) {
logger.error("Error while updateTagServiceDef()data.", e);
+
System.exit(1);
}
+
logger.info("<== PatchForTagServiceDefUpdate.execLoad()");
}
private boolean updateTagServiceDef() throws Exception {
- RangerServiceDef ret;
- RangerServiceDef embeddedTagServiceDef;
- RangerServiceDef dbTagServiceDef;
- XXServiceDef xXServiceDefObj;
-
- embeddedTagServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+ RangerServiceDef embeddedTagServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
if (embeddedTagServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
- Map<String, String> serviceDefOptionsPreUpdate;
- String jsonPreUpdate;
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
- if (xXServiceDefObj != null) {
- jsonPreUpdate = xXServiceDefObj.getDefOptions();
- serviceDefOptionsPreUpdate = jsonStringToMap(jsonPreUpdate);
- } else {
+ if (xXServiceDefObj == null) {
logger.error("Tag service-definition does not exist in the Ranger DAO. No patching is needed");
return true;
}
- dbTagServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
- boolean isTagServiceUpdated;
+ String jsonPreUpdate = xXServiceDefObj.getDefOptions();
+ Map<String, String> serviceDefOptionsPreUpdate = jsonStringToMap(jsonPreUpdate);
+ RangerServiceDef dbTagServiceDef = svcDBStore.getServiceDefByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+ boolean isTagServiceUpdated;
+
if (dbTagServiceDef != null) {
isTagServiceUpdated = updateResourceInTagServiceDef(dbTagServiceDef);
} else {
logger.error("Tag service-definition does not exist in the db store.");
+
return false;
}
+
if (isTagServiceUpdated) {
- ret = svcStore.updateServiceDef(dbTagServiceDef);
+ RangerServiceDef ret = svcStore.updateServiceDef(dbTagServiceDef);
+
if (ret == null) {
throw new RuntimeException("Error while updating " + SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME + " service-def");
}
+
xXServiceDefObj = daoMgr.getXXServiceDef().findByName(SERVICEDBSTORE_SERVICEDEFBYNAME_TAG_NAME);
+
if (xXServiceDefObj != null) {
String jsonStrPostUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsPostUpdate = jsonStringToMap(jsonStrPostUpdate);
+
if (serviceDefOptionsPostUpdate != null && serviceDefOptionsPostUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
if (serviceDefOptionsPreUpdate == null || !serviceDefOptionsPreUpdate.containsKey(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES)) {
String preUpdateValue = serviceDefOptionsPreUpdate == null ? null : serviceDefOptionsPreUpdate.get(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
+
if (preUpdateValue == null) {
serviceDefOptionsPostUpdate.remove(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES);
} else {
serviceDefOptionsPostUpdate.put(RangerServiceDef.OPTION_ENABLE_DENY_AND_EXCEPTIONS_IN_POLICIES, preUpdateValue);
}
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsPostUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
}
}
} else {
logger.error("Tag service-definition does not exist in the Ranger DAO.");
+
return false;
}
}
} else {
logger.error("The embedded Tag service-definition does not exist.");
+
return false;
}
+
return true;
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -190,11 +207,13 @@ public class PatchForTagServiceDefUpdate_J10028 extends BaseLoader {
logger.warn("mapToJsonString() failed to convert map: {}", map, ex);
}
}
+
return ret;
}
private Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -204,26 +223,31 @@ public class PatchForTagServiceDefUpdate_J10028 extends BaseLoader {
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
String name = (nvArr.length > 0) ? nvArr[0].trim() : null;
String value = (nvArr.length > 1) ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
}
+
return ret;
}
private boolean updateResourceInTagServiceDef(RangerServiceDef tagServiceDef) {
logger.debug("==> PatchForTagServiceDefUpdate_J10028.updateResourceInTagServiceDef({})", tagServiceDef);
- boolean ret = false;
+ boolean ret = false;
final RangerServiceDef.RangerResourceDef accessPolicyTagResource = getResourceDefForTagResource(tagServiceDef.getResources());
if (accessPolicyTagResource != null) {
@@ -232,10 +256,12 @@ public class PatchForTagServiceDefUpdate_J10028 extends BaseLoader {
if (dataMaskDef != null) {
if (CollectionUtils.isNotEmpty(dataMaskDef.getAccessTypes())) {
addOrUpdateResourceDefForTagResource(dataMaskDef.getResources(), accessPolicyTagResource);
+
ret = true;
} else {
if (CollectionUtils.isNotEmpty(dataMaskDef.getResources())) {
dataMaskDef.setResources(null);
+
ret = true;
}
}
@@ -245,13 +271,16 @@ public class PatchForTagServiceDefUpdate_J10028 extends BaseLoader {
if (rowFilterDef != null) {
boolean autopropagateRowfilterdefToTag = config.getBoolean(AbstractServiceStore.AUTOPROPAGATE_ROWFILTERDEF_TO_TAG_PROP, AbstractServiceStore.AUTOPROPAGATE_ROWFILTERDEF_TO_TAG_PROP_DEFAULT);
+
if (autopropagateRowfilterdefToTag) {
if (CollectionUtils.isNotEmpty(rowFilterDef.getAccessTypes())) {
addOrUpdateResourceDefForTagResource(rowFilterDef.getResources(), accessPolicyTagResource);
+
ret = true;
} else {
if (CollectionUtils.isNotEmpty(rowFilterDef.getResources())) {
rowFilterDef.setResources(null);
+
ret = true;
}
}
@@ -273,6 +302,7 @@ public class PatchForTagServiceDefUpdate_J10028 extends BaseLoader {
for (RangerServiceDef.RangerResourceDef resourceDef : resourceDefs) {
if (resourceDef.getName().equals(RangerServiceTag.TAG_RESOURCE_NAME)) {
ret = resourceDef;
+
break;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10062.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10062.java
index 92504c84d..6a88d8175 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10062.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForTrinoSvcDefUpdate_J10062.java
@@ -37,8 +37,6 @@ import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.TransactionDefinition;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.ArrayList;
@@ -48,53 +46,66 @@ import java.util.Map;
@Component
public class PatchForTrinoSvcDefUpdate_J10062 extends BaseLoader {
- private static final Logger logger = Logger.getLogger(PatchForTrinoSvcDefUpdate_J10062.class);
- public static final String LOGIN_ID_ADMIN = "admin";
- public static final String WILDCARD_ASTERISK = "*";
- public static final String POlICY_NAME_FOR_ALL_SYSINFO = "all - sysinfo";
- public static final String POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION = "all - catalog, schema, schemafunction";
- public static final String POlICY_NAME_FOR_ALL_QUERY = "all - queryid";
- public static final String POlICY_NAME_FOR_ALL_ROLE = "all - role";
- public static final String RESOURCE_SYSINFO = "sysinfo";
- public static final String RESOURCE_CATALOG = "catalog";
- public static final String RESOURCE_SCHEMA = "schema";
- public static final String RESOURCE_QUERYID = "queryid";
- public static final String RESOURCE_ROLE = "role";
- public static final String RESOURCE_SCHEMAFUNCTION = "schemafunction";
- public static final String ACCESS_TYPE_READ_SYSINFO = "read_sysinfo";
- public static final String ACCESS_TYPE_WRITE_SYSINFO = "write_sysinfo";
- public static final String ACCESS_TYPE_CREATE = "create";
- public static final String ACCESS_TYPE_DROP = "drop";
- public static final String ACCESS_TYPE_SHOW = "show";
- public static final String ACCESS_TYPE_GRANT = "grant";
- public static final String ACCESS_TYPE_REVOKE = "revoke";
- public static final String ACCESS_TYPE_EXECUTE = "execute";
- public static final String ACCESS_TYPE_SELECT = "select";
- private static final String TRINO_SVC_DEF_NAME = EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TRINO_NAME;
+ private static final Logger logger = Logger.getLogger(PatchForTrinoSvcDefUpdate_J10062.class);
+
+ public static final String LOGIN_ID_ADMIN = "admin";
+ public static final String WILDCARD_ASTERISK = "*";
+ public static final String POlICY_NAME_FOR_ALL_SYSINFO = "all - sysinfo";
+ public static final String POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION = "all - catalog, schema, schemafunction";
+ public static final String POlICY_NAME_FOR_ALL_QUERY = "all - queryid";
+ public static final String POlICY_NAME_FOR_ALL_ROLE = "all - role";
+ public static final String RESOURCE_SYSINFO = "sysinfo";
+ public static final String RESOURCE_CATALOG = "catalog";
+ public static final String RESOURCE_SCHEMA = "schema";
+ public static final String RESOURCE_QUERYID = "queryid";
+ public static final String RESOURCE_ROLE = "role";
+ public static final String RESOURCE_SCHEMAFUNCTION = "schemafunction";
+ public static final String ACCESS_TYPE_READ_SYSINFO = "read_sysinfo";
+ public static final String ACCESS_TYPE_WRITE_SYSINFO = "write_sysinfo";
+ public static final String ACCESS_TYPE_CREATE = "create";
+ public static final String ACCESS_TYPE_DROP = "drop";
+ public static final String ACCESS_TYPE_SHOW = "show";
+ public static final String ACCESS_TYPE_GRANT = "grant";
+ public static final String ACCESS_TYPE_REVOKE = "revoke";
+ public static final String ACCESS_TYPE_EXECUTE = "execute";
+ public static final String ACCESS_TYPE_SELECT = "select";
+
+ private static final String TRINO_SVC_DEF_NAME = EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TRINO_NAME;
+
@Autowired
GUIDUtil guidUtil;
+
@Autowired
ServiceDBStore svcDBStore;
+
@Autowired
@Qualifier(value = "transactionManager")
PlatformTransactionManager txManager;
+
@Autowired
private RangerDaoManager daoMgr;
+
@Autowired
private RangerValidatorFactory validatorFactory;
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForTrinoSvcDefUpdate_J10062 loader = (PatchForTrinoSvcDefUpdate_J10062) CLIUtil.getBean(PatchForTrinoSvcDefUpdate_J10062.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -112,83 +123,104 @@ public class PatchForTrinoSvcDefUpdate_J10062 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PatchForTrinoSvcDefUpdate_J10062.execLoad()");
+
try {
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- RangerServiceDef dbRangerServiceDef = null;
- RangerServiceDef embeddedTrinoServiceDef = null;
- try {
- embeddedTrinoServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(TRINO_SVC_DEF_NAME);
- } catch (Exception ex) {
- logger.error("Error while loading service-def:" + TRINO_SVC_DEF_NAME, ex);
- }
- if (embeddedTrinoServiceDef == null) {
- logger.error("The embedded Trino service-definition does not exist.");
+ txTemplate.execute(status -> {
+ RangerServiceDef dbRangerServiceDef = null;
+ RangerServiceDef embeddedTrinoServiceDef = null;
+
+ try {
+ embeddedTrinoServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(TRINO_SVC_DEF_NAME);
+ } catch (Exception ex) {
+ logger.error("Error while loading service-def:" + TRINO_SVC_DEF_NAME, ex);
+ }
+
+ if (embeddedTrinoServiceDef == null) {
+ logger.error("The embedded Trino service-definition does not exist.");
+
+ throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def");
+ }
+
+ try {
+ dbRangerServiceDef = svcDBStore.getServiceDefByName(TRINO_SVC_DEF_NAME);
+ } catch (Exception e) {
+ logger.error("The Trino service-definition does not exist in ranger db.");
+ } finally {
+ if (dbRangerServiceDef == null) {
+ logger.error("The Trino service-definition does not exist.");
+
throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def");
}
- if (embeddedTrinoServiceDef != null) {
- try {
- dbRangerServiceDef = svcDBStore.getServiceDefByName(TRINO_SVC_DEF_NAME);
- } catch (Exception e) {
- logger.error("The Trino service-definition does not exist in ranger db.");
- } finally {
- if (dbRangerServiceDef == null) {
- logger.error("The Trino service-definition does not exist.");
- throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def");
- }
- }
- }
- dbRangerServiceDef = updateTrinoSvcDef(embeddedTrinoServiceDef, dbRangerServiceDef);
- if (dbRangerServiceDef != null) {
- try {
- createDefaultPolicies(dbRangerServiceDef);
- } catch (Exception e) {
- logger.error("Error while creating default ranger policies for " + TRINO_SVC_DEF_NAME + " service-def");
- throw new RuntimeException("Error while creating default ranger policies for " + TRINO_SVC_DEF_NAME + " service-def");
- }
- } else {
- logger.error("Error while updating " + TRINO_SVC_DEF_NAME + " service-def");
- throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def");
+ }
+
+ dbRangerServiceDef = updateTrinoSvcDef(embeddedTrinoServiceDef, dbRangerServiceDef);
+
+ if (dbRangerServiceDef != null) {
+ try {
+ createDefaultPolicies(dbRangerServiceDef);
+ } catch (Exception e) {
+ logger.error("Error while creating default ranger policies for " + TRINO_SVC_DEF_NAME + " service-def");
+
+ throw new RuntimeException("Error while creating default ranger policies for " + TRINO_SVC_DEF_NAME + " service-def");
}
- return null;
+ } else {
+ logger.error("Error while updating " + TRINO_SVC_DEF_NAME + " service-def");
+
+ throw new RuntimeException("Error while updating " + TRINO_SVC_DEF_NAME + " service-def");
}
+
+ return null;
});
} catch (Throwable ex) {
logger.error("Error while updating " + TRINO_SVC_DEF_NAME + " service-def");
+
throw new RuntimeException(ex.getMessage());
}
} catch (Exception e) {
logger.error("Error while executing PatchForTrinoSvcDefUpdate_J10062, Error - ", e);
+
throw new RuntimeException(e.getMessage());
}
+
logger.info("<== PatchForTrinoSvcDefUpdate_J10062.execLoad()");
}
private RangerServiceDef updateTrinoSvcDef(RangerServiceDef embeddedTrinoServiceDef, RangerServiceDef dbRangerServiceDef) {
logger.info("==> PatchForTrinoSvcDefUpdate_J10062.updateTrinoSvcDef()");
- RangerServiceDef ret = null;
+
+ RangerServiceDef ret;
+
try {
dbRangerServiceDef.setResources(embeddedTrinoServiceDef.getResources());
dbRangerServiceDef.setAccessTypes(embeddedTrinoServiceDef.getAccessTypes());
dbRangerServiceDef.setConfigs(embeddedTrinoServiceDef.getConfigs());
+
RangerServiceDefValidator validator = validatorFactory.getServiceDefValidator(this.svcDBStore);
+
validator.validate(dbRangerServiceDef, Action.UPDATE);
+
ret = this.svcDBStore.updateServiceDef(dbRangerServiceDef);
+
logger.info(TRINO_SVC_DEF_NAME + " service-def has been updated");
} catch (Exception e) {
logger.error("Error while updating" + TRINO_SVC_DEF_NAME + " service-def", e);
+
throw new RuntimeException(e);
}
+
logger.info("<== PatchForTrinoSvcDefUpdate_J10062.updateTrinoSvcDef()");
+
return ret;
}
private void createDefaultPolicies(RangerServiceDef dbRangerServiceDef) throws Exception {
List<XXService> dbServices = daoMgr.getXXService().findByServiceDefId(dbRangerServiceDef.getId());
+
if (CollectionUtils.isNotEmpty(dbServices)) {
for (XXService dbService : dbServices) {
addDefaultPolicies(dbService.getName(), null);
@@ -198,57 +230,81 @@ public class PatchForTrinoSvcDefUpdate_J10062 extends BaseLoader {
private void addDefaultPolicies(String serviceName, String zoneName) throws Exception {
logger.info("===> addDefaultPolicies ServiceName : " + serviceName + " ZoneName : " + zoneName);
+
List<String> resources = new ArrayList<>();
+
resources.add(RESOURCE_SYSINFO);
+
RangerPolicy allSysInfoPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_SYSINFO, resources);
List<RangerPolicy> policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allSysInfoPolicy.getResourceSignature(), true);
+
if (CollectionUtils.isEmpty(policies)) {
logger.info("No policy found with resource sysinfo = * creating new policy");
+
svcDBStore.createPolicy(allSysInfoPolicy);
}
resources.clear();
policies.clear();
+
resources.add(RESOURCE_CATALOG);
resources.add(RESOURCE_SCHEMA);
resources.add(RESOURCE_SCHEMAFUNCTION);
+
RangerPolicy allCatalogSchemaFunctionPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_CATALOG_SCHEMA_FUNCTION, resources);
+
policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allCatalogSchemaFunctionPolicy.getResourceSignature(), true);
+
if (CollectionUtils.isEmpty(policies)) {
logger.info("No policy found with resource catalog, schema, schemafunction = *; creating new policy");
+
svcDBStore.createPolicy(allCatalogSchemaFunctionPolicy);
}
resources.clear();
policies.clear();
+
resources.add(RESOURCE_QUERYID);
+
RangerPolicy allQueryIdPolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_QUERY, resources);
+
policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allQueryIdPolicy.getResourceSignature(), true);
+
if (CollectionUtils.isEmpty(policies)) {
logger.info("No policy found with resource queryId = *; creating new policy");
+
svcDBStore.createPolicy(allQueryIdPolicy);
}
resources.clear();
policies.clear();
+
resources.add(RESOURCE_ROLE);
+
RangerPolicy allRolePolicy = getPolicy(serviceName, zoneName, POlICY_NAME_FOR_ALL_ROLE, resources);
+
policies = svcDBStore.getPoliciesByResourceSignature(serviceName, allRolePolicy.getResourceSignature(), true);
+
if (CollectionUtils.isEmpty(policies)) {
logger.info("No policy found with resource role = *; creating new policy");
+
svcDBStore.createPolicy(allRolePolicy);
}
+
logger.info("<=== addDefaultPolicies");
}
private RangerPolicy getPolicy(String serviceName, String zoneName, String policyName, List<String> resources) {
logger.info("===> getPolicy ");
- RangerPolicy policy;
+
Map<String, RangerPolicy.RangerPolicyResource> policyResources = new HashMap<>();
+
for (String resource : resources) {
policyResources.put(resource, new RangerPolicy.RangerPolicyResource(WILDCARD_ASTERISK));
}
- policy = new RangerPolicy();
+
+ RangerPolicy policy = new RangerPolicy();
+
policy.setService(serviceName);
policy.setName(policyName);
policy.setDescription("Policy for " + policyName);
@@ -258,29 +314,38 @@ public class PatchForTrinoSvcDefUpdate_J10062 extends BaseLoader {
policy.setPolicyType(RangerPolicy.POLICY_TYPE_ACCESS);
policy.setGuid(guidUtil.genGUID());
policy.setZoneName(zoneName);
+
List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<>();
+
policyItems.add(getPolicyItem(policyName, "trino", true));
policyItems.add(getPolicyItem("select", "rangerlookup", false));
+
policy.setPolicyItems(policyItems);
policy.setResourceSignature(new RangerPolicyResourceSignature(policy).getSignature());
+
logger.debug("===> getPolicy policy ResourceSignature " + policy.getResourceSignature());
logger.debug("===> getPolicy policy : " + policy);
logger.info("<=== getPolicy ");
+
return policy;
}
private RangerPolicy.RangerPolicyItem getPolicyItem(String policyName, String user, boolean delegateAdmin) {
RangerPolicy.RangerPolicyItem policyItem = new RangerPolicy.RangerPolicyItem();
- List<String> users = new ArrayList<String>();
+ List<String> users = new ArrayList<>();
+
users.add(user);
+
policyItem.setUsers(users);
policyItem.setAccesses(getAccessList(policyName));
policyItem.setDelegateAdmin(delegateAdmin);
+
return policyItem;
}
private List<RangerPolicy.RangerPolicyItemAccess> getAccessList(String policyName) {
- List<RangerPolicy.RangerPolicyItemAccess> accessList = new ArrayList<RangerPolicy.RangerPolicyItemAccess>();
+ List<RangerPolicy.RangerPolicyItemAccess> accessList = new ArrayList<>();
+
switch (policyName) {
case POlICY_NAME_FOR_ALL_SYSINFO:
accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_READ_SYSINFO));
@@ -307,6 +372,7 @@ public class PatchForTrinoSvcDefUpdate_J10062 extends BaseLoader {
accessList.add(new RangerPolicy.RangerPolicyItemAccess(ACCESS_TYPE_SELECT));
break;
}
+
return accessList;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.java
index 11cd40348..89899fa59 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.java
@@ -60,16 +60,22 @@ public class PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063 extends BaseLoader
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063 loader = (PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063) CLIUtil.getBean(PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting.");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -87,35 +93,40 @@ public class PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063 extends BaseLoader
@Override
public void execLoad() {
logger.info("==> PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.execLoad()");
+
try {
if (updateAtlasServiceDef()) {
disableAtlasAccessForTagPolicies();
}
} catch (Exception e) {
logger.error("Error while updateTagServiceDef()data.", e);
+
System.exit(1);
}
+
logger.info("<== PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.execLoad()");
}
private boolean updateAtlasServiceDef() throws Exception {
logger.info("==> PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.updateAtlasServiceDef()");
- RangerServiceDef embeddedAtlasServiceDef;
- XXServiceDef xXServiceDefObj;
- embeddedAtlasServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_ATLAS_NAME);
+ RangerServiceDef embeddedAtlasServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_ATLAS_NAME);
if (embeddedAtlasServiceDef != null) {
- xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_ATLAS_NAME);
+ XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_ATLAS_NAME);
if (xXServiceDefObj != null) {
String jsonStrUpdate = xXServiceDefObj.getDefOptions();
Map<String, String> serviceDefOptionsUpdate = jsonStringToMap(jsonStrUpdate);
+
if (serviceDefOptionsUpdate == null) {
serviceDefOptionsUpdate = new HashMap<>();
}
+
serviceDefOptionsUpdate.put(RangerServiceDef.OPTION_ENABLE_TAG_BASED_POLICIES, "false");
+
xXServiceDefObj.setDefOptions(mapToJsonString(serviceDefOptionsUpdate));
+
daoMgr.getXXServiceDef().update(xXServiceDefObj);
} else {
logger.error("Atlas service-definition does not exist in the Ranger DAO.");
@@ -123,25 +134,33 @@ public class PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063 extends BaseLoader
}
} else {
logger.error("The embedded Atlas service-definition does not exist.");
+
return false;
}
+
logger.info("<== PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.updateAtlasServiceDef()");
+
return true;
}
private void disableAtlasAccessForTagPolicies() throws Exception {
logger.info("==> PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.disableAtlasAccessForTagPolicies()");
+
RangerServiceDef embeddedTagServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME);
+
if (embeddedTagServiceDef != null) {
List<XXPolicy> xxPolicies = daoMgr.getXXPolicy().findByServiceDefId(embeddedTagServiceDef.getId());
+
if (CollectionUtils.isNotEmpty(xxPolicies)) {
for (XXPolicy xxPolicy : xxPolicies) {
RangerPolicy rPolicy = svcStore.getPolicy(xxPolicy.getId());
+
if (CollectionUtils.isNotEmpty(rPolicy.getPolicyItems()) || CollectionUtils.isNotEmpty(rPolicy.getAllowExceptions()) || CollectionUtils.isNotEmpty(rPolicy.getDenyPolicyItems()) || CollectionUtils.isNotEmpty(rPolicy.getDenyExceptions())) {
updateAccessTypeForTagPolicies(rPolicy.getPolicyItems());
updateAccessTypeForTagPolicies(rPolicy.getAllowExceptions());
updateAccessTypeForTagPolicies(rPolicy.getDenyPolicyItems());
updateAccessTypeForTagPolicies(rPolicy.getDenyExceptions());
+
svcStore.updatePolicy(rPolicy);
}
}
@@ -152,45 +171,56 @@ public class PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063 extends BaseLoader
// delete XXAccessTypeDef records of tagDef where name startWith Atlas
List<XXAccessTypeDef> xxAccessTypes = daoMgr.getXXAccessTypeDef().findByServiceDefId(embeddedTagServiceDef.getId());
+
for (XXAccessTypeDef xAccess : xxAccessTypes) {
if (xAccess != null && xAccess.getName().startsWith(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_ATLAS_NAME)) {
svcStore.deleteXXAccessTypeDef(xAccess);
}
}
+
logger.info("<== PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063.disableAtlasAccessForTagPolicies()");
}
private void updateAccessTypeForTagPolicies(List<RangerPolicyItem> policyItems) throws Exception {
logger.info("==> PatchForDisableAccessTypeForTagPolicies_J10063.updateAccessTypeForTagPolicies() {}", policyItems);
+
if (CollectionUtils.isEmpty(policyItems)) {
logger.info("==> PatchForDisableAccessTypeForTagPolicies_J10063.updateAccessTypeForTagPolicies() policy items collection was null/empty");
} else {
- List<RangerPolicy.RangerPolicyItem> removePolicyItem = new ArrayList<RangerPolicy.RangerPolicyItem>();
+ List<RangerPolicy.RangerPolicyItem> removePolicyItem = new ArrayList<>();
+
for (RangerPolicyItem policyItem : policyItems) {
if (policyItem != null && policyItem.getAccesses() != null) {
- List<RangerPolicy.RangerPolicyItemAccess> accessesToRemove = new ArrayList<RangerPolicy.RangerPolicyItemAccess>();
+ List<RangerPolicy.RangerPolicyItemAccess> accessesToRemove = new ArrayList<>();
+
for (RangerPolicyItemAccess access : policyItem.getAccesses()) {
if (access != null) {
String[] svcDefAccType = access.getType().split(":");
String serviceDefName = svcDefAccType.length > 0 ? svcDefAccType[0] : null;
+
if (serviceDefName != null && serviceDefName.equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_ATLAS_NAME)) {
accessesToRemove.add(access);
}
}
}
+
policyItem.getAccesses().removeAll(accessesToRemove);
}
+
if (policyItem != null && CollectionUtils.isEmpty(policyItem.getAccesses())) {
removePolicyItem.add(policyItem);
}
}
+
policyItems.removeAll(removePolicyItem);
}
+
logger.info("<== PatchForDisableAccessTypeForTagPolicies_J10063.updateAccessTypeForTagPolicies() {}", policyItems);
}
private String mapToJsonString(Map<String, String> map) {
String ret = null;
+
if (map != null) {
try {
ret = jsonUtil.readMapToString(map);
@@ -198,11 +228,13 @@ public class PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063 extends BaseLoader
logger.warn("mapToJsonString() failed to convert map: {}", map, ex);
}
}
+
return ret;
}
private Map<String, String> jsonStringToMap(String jsonStr) {
Map<String, String> ret = null;
+
if (!StringUtils.isEmpty(jsonStr)) {
try {
ret = jsonUtil.jsonToMap(jsonStr);
@@ -212,15 +244,19 @@ public class PatchForUpdatingAtlasSvcDefAndTagPolicies_J10063 extends BaseLoader
if (StringUtils.isEmpty(optionString)) {
continue;
}
+
String[] nvArr = optionString.split("=");
String name = (nvArr.length > 0) ? nvArr[0].trim() : null;
String value = (nvArr.length > 1) ? nvArr[1].trim() : null;
+
if (StringUtils.isEmpty(name)) {
continue;
}
+
if (ret == null) {
ret = new HashMap<>();
}
+
ret.put(name, value);
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingPolicyJson_J10019.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingPolicyJson_J10019.java
index 580bd09b3..a2c8af0fd 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingPolicyJson_J10019.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingPolicyJson_J10019.java
@@ -86,8 +86,6 @@ import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
import org.springframework.transaction.TransactionDefinition;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.ArrayList;
@@ -107,28 +105,36 @@ import java.util.Set;
@Component
public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
private static final Logger logger = LoggerFactory.getLogger(PatchForUpdatingPolicyJson_J10019.class);
+
private final Map<String, Long> groupIdMap = new HashMap<>();
private final Map<String, Long> userIdMap = new HashMap<>();
private final Map<String, Map<String, Long>> resourceNameIdMap = new HashMap<>();
private final Map<String, Map<String, Long>> accessTypeIdMap = new HashMap<>();
private final Map<String, Map<String, Long>> conditionNameIdMap = new HashMap<>();
private final Map<String, Map<String, Long>> dataMaskTypeIdMap = new HashMap<>();
+
@Autowired
RangerDaoManager daoMgr;
+
@Autowired
ServiceDBStore svcStore;
+
@Autowired
@Qualifier(value = "transactionManager")
PlatformTransactionManager txManager;
+
@Autowired
PolicyRefUpdater policyRefUpdater;
+
@Autowired
XUserMgr xUserMgr;
+
@Autowired
RangerDataHistService dataHistService;
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForUpdatingPolicyJson_J10019 loader = (PatchForUpdatingPolicyJson_J10019) CLIUtil.getBean(PatchForUpdatingPolicyJson_J10019.class);
@@ -143,6 +149,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -165,6 +172,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
updateRangerPolicyTableWithPolicyJson();
} catch (Exception e) {
logger.error("Error while updateRangerPolicyTableWithPolicyJson()", e);
+
System.exit(1);
}
@@ -193,11 +201,13 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
XXPolicy xPolicy = daoMgr.getXXPolicy().getById(policy.getId());
if (xPolicy != null && StringUtil.isEmpty(xPolicy.getPolicyText())) {
PolicyUpdaterThread updaterThread = new PolicyUpdaterThread(txTemplate, service, policy);
+
updaterThread.setDaemon(true);
updaterThread.start();
updaterThread.join();
String errorMsg = updaterThread.getErrorMsg();
+
if (StringUtils.isNotEmpty(errorMsg)) {
throw new Exception(errorMsg);
}
@@ -248,10 +258,12 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
addAccessDefRef(serviceType, policy.getId(), accesses);
addPolicyConditionDefRef(serviceType, policy.getId(), conditions);
addDataMaskDefRef(serviceType, policy.getId(), dataMasks);
+
dataHistService.createObjectDataHistory(policy, RangerDataHistService.ACTION_UPDATE);
} catch (Exception e) {
logger.error("portPolicy(id={}) failed!!", policy.getId());
logger.error("Offending policy:{}", policyText);
+
throw e;
}
@@ -269,6 +281,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
resourceNameIdMap.put(serviceType, serviceDefResourceNameIDMap);
XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
if (dbServiceDef != null) {
for (XXResourceDef resourceDef : daoMgr.getXXResourceDef().findByServiceDefId(dbServiceDef.getId())) {
serviceDefResourceNameIDMap.put(resourceDef.getName(), resourceDef.getId());
@@ -318,26 +331,30 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
if (userObject == null) {
logger.info("user is not found, adding user: {}", user);
+
TransactionTemplate txTemplate = new TransactionTemplate(txManager);
+
txTemplate.setPropagationBehavior(TransactionDefinition.PROPAGATION_REQUIRES_NEW);
+
try {
- txTemplate.execute(new TransactionCallback<Object>() {
- @Override
- public Object doInTransaction(TransactionStatus status) {
- xUserMgr.createServiceConfigUserSynchronously(user);
- return null;
- }
+ txTemplate.execute(status -> {
+ xUserMgr.createServiceConfigUserSynchronously(user);
+
+ return null;
});
} catch (Exception exception) {
logger.error("Cannot create ServiceConfigUser({})", user, exception);
}
+
userObject = userDao.findByUserName(user);
+
if (userObject == null) {
throw new Exception(user + ": unknown user in policy [id=" + policyId + "]");
}
}
userId = userObject.getId();
+
logger.info("userId:{}", userId);
userIdMap.put(user, userId);
@@ -401,6 +418,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
accessTypeIdMap.put(serviceType, serviceDefAccessTypeIDMap);
XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
if (dbServiceDef != null) {
for (XXAccessTypeDef accessTypeDef : daoMgr.getXXAccessTypeDef().findByServiceDefId(dbServiceDef.getId())) {
serviceDefAccessTypeIDMap.put(accessTypeDef.getName(), accessTypeDef.getId());
@@ -441,6 +459,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
conditionNameIdMap.put(serviceType, serviceDefConditionNameIDMap);
XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
if (dbServiceDef != null) {
for (XXPolicyConditionDef conditionDef : daoMgr.getXXPolicyConditionDef().findByServiceDefId(dbServiceDef.getId())) {
serviceDefConditionNameIDMap.put(conditionDef.getName(), conditionDef.getId());
@@ -482,6 +501,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
dataMaskTypeIdMap.put(serviceType, serviceDefDataMaskTypeIDMap);
XXServiceDef dbServiceDef = daoMgr.getXXServiceDef().findByName(serviceType);
+
if (dbServiceDef != null) {
for (XXDataMaskTypeDef dataMaskTypeDef : daoMgr.getXXDataMaskTypeDef().findByServiceDefId(dbServiceDef.getId())) {
serviceDefDataMaskTypeIDMap.put(dataMaskTypeDef.getName(), dataMaskTypeDef.getId());
@@ -535,18 +555,15 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
static final Logger LOG = LoggerFactory.getLogger(RangerPolicyRetriever.class);
static final Logger PERF_LOG = RangerPerfTracer.getPerfLogger("db.RangerPolicyRetriever");
- private final RangerDaoManager daoMgr;
- private final LookupCache lookupCache = new LookupCache();
-
- private final PlatformTransactionManager txManager;
- private final TransactionTemplate txTemplate;
+ private final RangerDaoManager daoMgr;
+ private final LookupCache lookupCache = new LookupCache();
+ private final TransactionTemplate txTemplate;
RangerPolicyRetriever(RangerDaoManager daoMgr, PlatformTransactionManager txManager) {
- this.daoMgr = daoMgr;
- this.txManager = txManager;
+ this.daoMgr = daoMgr;
- if (this.txManager != null) {
- this.txTemplate = new TransactionTemplate(this.txManager);
+ if (txManager != null) {
+ this.txTemplate = new TransactionTemplate(txManager);
this.txTemplate.setReadOnly(true);
} else {
@@ -555,7 +572,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
}
static List<XXPolicy> asList(XXPolicy policy) {
- List<XXPolicy> ret = new ArrayList<XXPolicy>();
+ List<XXPolicy> ret = new ArrayList<>();
if (policy != null) {
ret.add(policy);
@@ -590,6 +607,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
PolicyLoaderThread t = new PolicyLoaderThread(txTemplate, xService);
t.start();
t.join();
+
ret = t.getPolicies();
}
} else {
@@ -598,7 +616,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
RangerPerfTracer.log(perf);
- LOG.debug("<== RangerPolicyRetriever.getServicePolicies(serviceName={}, serviceId={}): policyCount=" + (ret == null ? 0 : ret.size()), serviceName, serviceId);
+ LOG.debug("<== RangerPolicyRetriever.getServicePolicies(serviceName={}, serviceId={}): policyCount={}", (ret == null ? 0 : ret.size()), serviceName, serviceId);
return ret;
}
@@ -606,7 +624,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
private class PolicyLoaderThread extends Thread {
final TransactionTemplate txTemplate;
final XXService xService;
- List<RangerPolicy> policies;
+ List<RangerPolicy> policies;
PolicyLoaderThread(TransactionTemplate txTemplate, final XXService xService) {
this.txTemplate = txTemplate;
@@ -620,25 +638,23 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
@Override
public void run() {
txTemplate.setReadOnly(true);
- policies = txTemplate.execute(new TransactionCallback<List<RangerPolicy>>() {
- @Override
- public List<RangerPolicy> doInTransaction(TransactionStatus status) {
- RetrieverContext ctx = new RetrieverContext(xService);
- return ctx.getAllPolicies();
- }
+ policies = txTemplate.execute(status -> {
+ RetrieverContext ctx = new RetrieverContext(xService);
+
+ return ctx.getAllPolicies();
});
}
}
class LookupCache {
- final Map<Long, String> userNames = new HashMap<Long, String>();
- final Map<Long, String> userScreenNames = new HashMap<Long, String>();
- final Map<Long, String> groupNames = new HashMap<Long, String>();
- final Map<Long, String> accessTypes = new HashMap<Long, String>();
- final Map<Long, String> conditions = new HashMap<Long, String>();
- final Map<Long, String> resourceDefs = new HashMap<Long, String>();
- final Map<Long, String> dataMasks = new HashMap<Long, String>();
- final Map<Long, String> policyLabels = new HashMap<Long, String>();
+ final Map<Long, String> userNames = new HashMap<>();
+ final Map<Long, String> userScreenNames = new HashMap<>();
+ final Map<Long, String> groupNames = new HashMap<>();
+ final Map<Long, String> accessTypes = new HashMap<>();
+ final Map<Long, String> conditions = new HashMap<>();
+ final Map<Long, String> resourceDefs = new HashMap<>();
+ final Map<Long, String> dataMasks = new HashMap<>();
+ final Map<Long, String> policyLabels = new HashMap<>();
String getUserName(Long userId) {
String ret = null;
@@ -938,7 +954,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
}
List<RangerPolicy> getAllPolicies() {
- List<RangerPolicy> ret = new ArrayList<RangerPolicy>();
+ List<RangerPolicy> ret = new ArrayList<>();
while (iterPolicy.hasNext()) {
RangerPolicy policy = getNextPolicy();
@@ -964,12 +980,11 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
List<XXPolicy> xPolicies = daoMgr.getXXPolicy().findByServiceId(service.getId());
if (CollectionUtils.isNotEmpty(xPolicies)) {
- ret = new ArrayList<RangerPolicy>(xPolicies.size());
+ ret = new ArrayList<>(xPolicies.size());
for (XXPolicy xPolicy : xPolicies) {
- RetrieverContext ctx = new RetrieverContext(xPolicy, service);
-
- RangerPolicy policy = ctx.getNextPolicy();
+ RetrieverContext ctx = new RetrieverContext(xPolicy, service);
+ RangerPolicy policy = ctx.getNextPolicy();
if (policy != null) {
ret.add(policy);
@@ -982,19 +997,24 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
}
private void getPolicyLabels(RangerPolicy ret) {
- List<String> xPolicyLabels = new ArrayList<String>();
+ List<String> xPolicyLabels = new ArrayList<>();
+
while (iterPolicyLabels.hasNext()) {
XXPolicyLabelMap xPolicyLabel = iterPolicyLabels.next();
+
if (xPolicyLabel.getPolicyId().equals(ret.getId())) {
String policyLabel = lookupCache.getPolicyLabelName(xPolicyLabel.getPolicyLabelId());
+
if (policyLabel != null) {
xPolicyLabels.add(policyLabel);
}
+
ret.setPolicyLabels(xPolicyLabels);
} else {
if (iterPolicyLabels.hasPrevious()) {
iterPolicyLabels.previous();
}
+
break;
}
}
@@ -1209,7 +1229,7 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
final TransactionTemplate txTemplate;
final RangerService service;
final RangerPolicy policy;
- String errorMsg;
+ String errorMsg;
PolicyUpdaterThread(TransactionTemplate txTemplate, final RangerService service, final RangerPolicy policy) {
this.txTemplate = txTemplate;
@@ -1224,19 +1244,20 @@ public class PatchForUpdatingPolicyJson_J10019 extends BaseLoader {
@Override
public void run() {
- errorMsg = txTemplate.execute(new TransactionCallback<String>() {
- @Override
- public String doInTransaction(TransactionStatus status) {
- String ret = null;
- try {
- policyRefUpdater.cleanupRefTables(policy);
- portPolicy(service.getType(), policy);
- } catch (Throwable e) {
- logger.error("PortPolicy failed for policy:[{}]", policy, e);
- ret = e.toString();
- }
- return ret;
+ errorMsg = txTemplate.execute(status -> {
+ String ret = null;
+
+ try {
+ policyRefUpdater.cleanupRefTables(policy);
+
+ portPolicy(service.getType(), policy);
+ } catch (Throwable e) {
+ logger.error("PortPolicy failed for policy:[{}]", policy, e);
+
+ ret = e.toString();
}
+
+ return ret;
});
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingTagsJson_J10020.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingTagsJson_J10020.java
index cbbd6e71c..ed14f2c47 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingTagsJson_J10020.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForUpdatingTagsJson_J10020.java
@@ -63,8 +63,6 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.stereotype.Component;
import org.springframework.transaction.PlatformTransactionManager;
-import org.springframework.transaction.TransactionStatus;
-import org.springframework.transaction.support.TransactionCallback;
import org.springframework.transaction.support.TransactionTemplate;
import java.util.ArrayList;
@@ -101,6 +99,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchForUpdatingTagsJson_J10020 loader = (PatchForUpdatingTagsJson_J10020) CLIUtil.getBean(PatchForUpdatingTagsJson_J10020.class);
@@ -115,6 +114,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -137,6 +137,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
updateRangerTagsTablesWithTagsJson();
} catch (Exception e) {
logger.error("Error while UpdateRangerTagsTablesWithTagsJson()", e);
+
System.exit(1);
}
@@ -172,6 +173,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
if (xTagDef != null && StringUtils.isEmpty(xTagDef.getTagAttrDefs())) {
TagsUpdaterThread updaterThread = new TagsUpdaterThread(txTemplate, null, null, tagDef);
String errorMsg = runThread(updaterThread);
+
if (StringUtils.isNotEmpty(errorMsg)) {
throw new Exception(errorMsg);
}
@@ -189,6 +191,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
if (xTag != null && StringUtils.isEmpty(xTag.getTagAttrs())) {
TagsUpdaterThread updaterThread = new TagsUpdaterThread(txTemplate, null, tag, null);
String errorMsg = runThread(updaterThread);
+
if (StringUtils.isNotEmpty(errorMsg)) {
throw new Exception(errorMsg);
}
@@ -205,6 +208,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
if (xServiceResource != null && StringUtils.isEmpty(xServiceResource.getServiceResourceElements())) {
TagsUpdaterThread updaterThread = new TagsUpdaterThread(txTemplate, serviceResource, null, null);
String errorMsg = runThread(updaterThread);
+
if (StringUtils.isNotEmpty(errorMsg)) {
throw new Exception(errorMsg);
}
@@ -221,6 +225,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
updaterThread.setDaemon(true);
updaterThread.start();
updaterThread.join();
+
return updaterThread.getErrorMsg();
}
@@ -234,6 +239,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
private void portServiceResource(RangerServiceResource serviceResource) throws Exception {
serviceResourceService.update(serviceResource);
+
tagStore.refreshServiceResource(serviceResource.getId());
}
@@ -258,38 +264,38 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
@Override
public void run() {
- errorMsg = txTemplate.execute(new TransactionCallback<String>() {
- @Override
- public String doInTransaction(TransactionStatus status) {
- String ret = null;
- try {
- if (serviceResource != null) {
- portServiceResource(serviceResource);
- }
- if (tag != null) {
- portTag(tag);
- }
- if (tagDef != null) {
- portTagDef(tagDef);
- }
- } catch (Throwable e) {
- logger.error("Port failed :[serviceResource={}, tag={}, tagDef={}]", serviceResource, tag, tagDef, e);
- ret = e.toString();
+ errorMsg = txTemplate.execute(status -> {
+ String ret = null;
+
+ try {
+ if (serviceResource != null) {
+ portServiceResource(serviceResource);
}
- return ret;
+
+ if (tag != null) {
+ portTag(tag);
+ }
+
+ if (tagDef != null) {
+ portTagDef(tagDef);
+ }
+ } catch (Throwable e) {
+ logger.error("Port failed :[serviceResource={}, tag={}, tagDef={}]", serviceResource, tag, tagDef, e);
+
+ ret = e.toString();
}
+
+ return ret;
});
}
}
- private class RangerTagDBRetriever {
+ private static class RangerTagDBRetriever {
Logger logger = LoggerFactory.getLogger(RangerTagDBRetriever.class);
private final RangerDaoManager daoMgr;
private final XXService xService;
private final RangerTagDBRetriever.LookupCache lookupCache;
- private final PlatformTransactionManager txManager;
- private final TransactionTemplate txTemplate;
private List<RangerServiceResource> serviceResources;
private Map<Long, RangerTagDef> tagDefs;
private Map<Long, RangerTag> tags;
@@ -298,17 +304,18 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
this.daoMgr = daoMgr;
this.xService = xService;
this.lookupCache = new RangerTagDBRetriever.LookupCache();
- this.txManager = txManager;
- if (this.txManager != null) {
- this.txTemplate = new TransactionTemplate(this.txManager);
- this.txTemplate.setReadOnly(true);
+ TransactionTemplate txTemplate;
+
+ if (txManager != null) {
+ txTemplate = new TransactionTemplate(txManager);
+ txTemplate.setReadOnly(true);
} else {
- this.txTemplate = null;
+ txTemplate = null;
}
if (this.daoMgr != null && this.xService != null) {
- if (this.txTemplate == null) {
+ if (txTemplate == null) {
logger.debug("Load Tags in the same thread and using an existing transaction");
if (!initializeTagCache(xService)) {
@@ -338,7 +345,6 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
}
private boolean initializeTagCache(XXService xService) {
- boolean ret;
RangerTagDBRetriever.TagRetrieverServiceResourceContext serviceResourceContext = new RangerTagDBRetriever.TagRetrieverServiceResourceContext(xService);
RangerTagDBRetriever.TagRetrieverTagDefContext tagDefContext = new RangerTagDBRetriever.TagRetrieverTagDefContext(xService);
RangerTagDBRetriever.TagRetrieverTagContext tagContext = new RangerTagDBRetriever.TagRetrieverTagContext(xService);
@@ -347,8 +353,7 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
tagDefs = tagDefContext.getAllTagDefs();
tags = tagContext.getAllTags();
- ret = true;
- return ret;
+ return true;
}
private <T> List<T> asList(T obj) {
@@ -432,17 +437,14 @@ public class PatchForUpdatingTagsJson_J10020 extends BaseLoader {
@Override
public void run() {
txTemplate.setReadOnly(true);
- Boolean result = txTemplate.execute(new TransactionCallback<Boolean>() {
- @Override
- public Boolean doInTransaction(TransactionStatus status) {
- boolean ret = initializeTagCache(xService);
-
- if (!ret) {
- status.setRollbackOnly();
- logger.error("Failed to get tags for service:[{}] in a new transaction", xService.getName());
- }
- return ret;
+ Boolean result = txTemplate.execute(status -> {
+ boolean ret = initializeTagCache(xService);
+
+ if (!ret) {
+ status.setRollbackOnly();
+ logger.error("Failed to get tags for service:[{}] in a new transaction", xService.getName());
}
+ return ret;
});
logger.debug("transaction result:[{}]", result);
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForXGlobalState_J10036.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForXGlobalState_J10036.java
index d204bdcdd..8eda85f3e 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForXGlobalState_J10036.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForXGlobalState_J10036.java
@@ -43,13 +43,17 @@ public class PatchForXGlobalState_J10036 extends BaseLoader {
PatchForXGlobalState_J10036 loader = (PatchForXGlobalState_J10036) CLIUtil.getBean(PatchForXGlobalState_J10036.class);
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -66,25 +70,32 @@ public class PatchForXGlobalState_J10036 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> ServiceVersionInfoPatch.execLoad()");
+
updateRangerRoleVersionToVersion();
+
logger.info("<== ServiceVersionInfoPatch.execLoad()");
}
public void updateRangerRoleVersionToVersion() {
XXGlobalState globalState = daoManager.getXXGlobalState().findByStateName("RangerRole");
+
if (globalState != null) {
logger.info("Updating globalstate with id = {}", globalState.getId());
if (StringUtils.isNotEmpty(globalState.getAppData())) {
- Map<String, String> appDataVersionJson = null;
- appDataVersionJson = JsonUtils.jsonToObject(globalState.getAppData(), Map.class);
+ Map<String, String> appDataVersionJson = JsonUtils.jsonToObject(globalState.getAppData(), Map.class);
+
if (MapUtils.isNotEmpty(appDataVersionJson)) {
logger.info("Updating globalstate appdata version for = {}", appDataVersionJson);
+
String roleVersion = appDataVersionJson.get("RangerRoleVersion");
+
if (StringUtils.isNotEmpty(roleVersion)) {
appDataVersionJson.put("Version", roleVersion);
appDataVersionJson.remove("RangerRoleVersion");
+
globalState.setAppData(JsonUtils.objectToJson(appDataVersionJson));
+
daoManager.getXXGlobalState().update(globalState);
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchGrantAuditPermissionToKeyRoleUser_J10014.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchGrantAuditPermissionToKeyRoleUser_J10014.java
index fbfc03b23..b6329b4de 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchGrantAuditPermissionToKeyRoleUser_J10014.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchGrantAuditPermissionToKeyRoleUser_J10014.java
@@ -48,17 +48,22 @@ public class PatchGrantAuditPermissionToKeyRoleUser_J10014 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchGrantAuditPermissionToKeyRoleUser_J10014 loader = (PatchGrantAuditPermissionToKeyRoleUser_J10014) CLIUtil.getBean(PatchGrantAuditPermissionToKeyRoleUser_J10014.class);
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -75,6 +80,7 @@ public class PatchGrantAuditPermissionToKeyRoleUser_J10014 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==>Starting : PatchGrantAuditPermissionToKeyRoleUser.execLoad()");
+
assignAuditAndUserGroupPermissionToKeyAdminRoleUser();
logger.info("<==Completed : PatchGrantAuditPermissionToKeyRoleUser.execLoad()");
@@ -82,32 +88,45 @@ public class PatchGrantAuditPermissionToKeyRoleUser_J10014 extends BaseLoader {
private void assignAuditAndUserGroupPermissionToKeyAdminRoleUser() {
try {
- int countUserPermissionUpdated = 0;
- XXModuleDef xAuditModDef = daoManager.getXXModuleDef().findByModuleName(RangerConstants.MODULE_AUDIT);
- XXModuleDef xUserGrpModDef = daoManager.getXXModuleDef().findByModuleName(RangerConstants.MODULE_USER_GROUPS);
+ int countUserPermissionUpdated = 0;
+ XXModuleDef xAuditModDef = daoManager.getXXModuleDef().findByModuleName(RangerConstants.MODULE_AUDIT);
+ XXModuleDef xUserGrpModDef = daoManager.getXXModuleDef().findByModuleName(RangerConstants.MODULE_USER_GROUPS);
+
logger.warn("Audit Module Object : {}", xAuditModDef);
logger.warn("USer Group Module Object : {}", xUserGrpModDef);
+
if (xAuditModDef == null && xUserGrpModDef == null) {
logger.warn("Audit Module and User Group module not found");
+
return;
}
+
List<XXPortalUser> allKeyAdminUsers = daoManager.getXXPortalUser().findByRole(RangerConstants.ROLE_KEY_ADMIN);
+
if (!CollectionUtils.isEmpty(allKeyAdminUsers)) {
for (XXPortalUser xPortalUser : allKeyAdminUsers) {
- boolean isUserUpdated = false;
- VXPortalUser vPortalUser = xPortalUserService.populateViewBean(xPortalUser);
+ boolean isUserUpdated = false;
+ VXPortalUser vPortalUser = xPortalUserService.populateViewBean(xPortalUser);
+
if (vPortalUser != null) {
vPortalUser.setUserRoleList(daoManager.getXXPortalUserRole().findXPortalUserRolebyXPortalUserId(vPortalUser.getId()));
+
if (xAuditModDef != null) {
xUserMgr.createOrUpdateUserPermisson(vPortalUser, xAuditModDef.getId(), true);
+
isUserUpdated = true;
+
logger.info("Added {} permission to user {}", xAuditModDef.getModule(), xPortalUser.getLoginId());
}
+
if (xUserGrpModDef != null) {
xUserMgr.createOrUpdateUserPermisson(vPortalUser, xUserGrpModDef.getId(), true);
+
isUserUpdated = true;
+
logger.info("Added {} permission to user {}", xUserGrpModDef.getModule(), xPortalUser.getLoginId());
}
+
if (isUserUpdated) {
countUserPermissionUpdated += 1;
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
index 21711f576..92473eb9e 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java
@@ -66,38 +66,54 @@ import java.util.Set;
@Component
public class PatchMigration_J10002 extends BaseLoader {
private static final Logger logger = LoggerFactory.getLogger(PatchMigration_J10002.class);
- static Set<String> unsupportedLegacyPermTypes = new HashSet<String>();
+
+ static Set<String> unsupportedLegacyPermTypes = new HashSet<>();
+
private static int policyCounter;
private static int serviceCounter;
+
@Autowired
RangerDaoManager daoMgr;
+
@Autowired
ServiceDBStore svcDBStore;
+
@Autowired
JSONUtil jsonUtil;
+
@Autowired
RangerPolicyService policyService;
+
@Autowired
StringUtil stringUtil;
+
@Autowired
XPolicyService xPolService;
+
@Autowired
XPermMapService xPermMapService;
+
@Autowired
RangerBizUtil bizUtil;
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchMigration_J10002 loader = (PatchMigration_J10002) CLIUtil.getBean(PatchMigration_J10002.class);
+
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -116,13 +132,15 @@ public class PatchMigration_J10002 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> MigrationPatch.execLoad()");
+
try {
migrateServicesToNewSchema();
migratePoliciesToNewSchema();
updateSequences();
} catch (Exception e) {
- logger.error("Error whille migrating data.", e);
+ logger.error("Error while migrating data.", e);
}
+
logger.info("<== MigrationPatch.execLoad()");
}
@@ -135,34 +153,37 @@ public class PatchMigration_J10002 extends BaseLoader {
if (repoList.isEmpty()) {
return;
}
- if (!repoList.isEmpty()) {
- EmbeddedServiceDefsUtil.instance().init(svcDBStore);
- }
+
+ EmbeddedServiceDefsUtil.instance().init(svcDBStore);
svcDBStore.setPopulateExistingBaseFields(true);
+
for (XXAsset xAsset : repoList) {
if (xAsset.getActiveStatus() == AppConstants.STATUS_DELETED) {
continue;
}
RangerService existing = svcDBStore.getServiceByName(xAsset.getName());
+
if (existing != null) {
logger.info("Repository/Service already exists. Ignoring migration of repo: {}", xAsset.getName());
continue;
}
RangerService service = new RangerService();
- service = mapXAssetToService(service, xAsset);
+ service = mapXAssetToService(service, xAsset);
service = svcDBStore.createService(service);
serviceCounter++;
+
logger.info("New Service created. ServiceName: {}", service.getName());
}
svcDBStore.setPopulateExistingBaseFields(false);
} catch (Exception e) {
throw new Exception("Error while migrating data to new Plugin Schema.", e);
}
+
logger.info("<== MigrationPatch.migrateServicesToNewSchema()");
}
@@ -171,17 +192,20 @@ public class PatchMigration_J10002 extends BaseLoader {
try {
List<XXResource> resList = daoMgr.getXXResource().getAll();
+
if (resList.isEmpty()) {
return;
}
svcDBStore.setPopulateExistingBaseFields(true);
+
for (XXResource xRes : resList) {
if (xRes.getResourceStatus() == AppConstants.STATUS_DELETED) {
continue;
}
XXAsset xAsset = daoMgr.getXXAsset().getById(xRes.getAssetId());
+
if (xAsset == null) {
logger.error("No Repository found for policyName: {}", xRes.getPolicyName());
continue;
@@ -195,55 +219,60 @@ public class PatchMigration_J10002 extends BaseLoader {
}
XXPolicy existing = daoMgr.getXXPolicy().findByNameAndServiceId(xRes.getPolicyName(), service.getId());
+
if (existing != null) {
logger.info("Policy already exists. Ignoring migration of policy: {}", existing.getName());
continue;
}
RangerPolicy policy = new RangerPolicy();
+
policy = mapXResourceToPolicy(policy, xRes, service);
if (policy != null) {
policy = svcDBStore.createPolicy(policy);
policyCounter++;
- logger.info("New policy created. policyName: {]", policy.getName());
+
+ logger.info("New policy created. policyName: {}", policy.getName());
}
}
+
svcDBStore.setPopulateExistingBaseFields(false);
} catch (Exception e) {
throw new Exception("Error while migrating data to new Plugin Schema.", e);
}
+
logger.info("<== MigrationPatch.migratePoliciesToNewSchema()");
}
private RangerService mapXAssetToService(RangerService service, XXAsset xAsset) throws Exception {
- String type = "";
- String name = xAsset.getName();
- String description = xAsset.getDescription();
- Map<String, String> configs = null;
-
- int typeInt = xAsset.getAssetType();
- XXServiceDef serviceDef = daoMgr.getXXServiceDef().findByName(AppConstants.getLabelFor_AssetType(typeInt).toLowerCase());
+ String name = xAsset.getName();
+ String description = xAsset.getDescription();
+ int typeInt = xAsset.getAssetType();
+ XXServiceDef serviceDef = daoMgr.getXXServiceDef().findByName(AppConstants.getLabelFor_AssetType(typeInt).toLowerCase());
if (serviceDef == null) {
throw new Exception("No ServiceDefinition found for repository: " + name);
}
- type = serviceDef.getName();
- configs = jsonUtil.jsonToMap(xAsset.getConfig());
+ String type = serviceDef.getName();
+ Map<String, String> configs = jsonUtil.jsonToMap(xAsset.getConfig());
List<XXServiceConfigDef> mandatoryConfigs = daoMgr.getXXServiceConfigDef().findByServiceDefName(type);
+
for (XXServiceConfigDef serviceConf : mandatoryConfigs) {
if (serviceConf.getIsMandatory()) {
if (!stringUtil.isEmpty(configs.get(serviceConf.getName()))) {
continue;
}
+
String dataType = serviceConf.getType();
String defaultValue = serviceConf.getDefaultvalue();
if (stringUtil.isEmpty(defaultValue)) {
defaultValue = getDefaultValueForDataType(dataType);
}
+
configs.put(serviceConf.getName(), defaultValue);
}
}
@@ -252,7 +281,6 @@ public class PatchMigration_J10002 extends BaseLoader {
service.setName(name);
service.setDescription(description);
service.setConfigs(configs);
-
service.setCreateTime(xAsset.getCreateTime());
service.setUpdateTime(xAsset.getUpdateTime());
@@ -262,9 +290,11 @@ public class PatchMigration_J10002 extends BaseLoader {
if (createdByUser != null) {
service.setCreatedBy(createdByUser.getLoginId());
}
+
if (updByUser != null) {
service.setUpdatedBy(updByUser.getLoginId());
}
+
service.setId(xAsset.getId());
return service;
@@ -272,6 +302,7 @@ public class PatchMigration_J10002 extends BaseLoader {
private String getDefaultValueForDataType(String dataType) {
String defaultValue = "";
+
switch (dataType) {
case "int":
defaultValue = "0";
@@ -291,20 +322,18 @@ public class PatchMigration_J10002 extends BaseLoader {
default:
break;
}
+
return defaultValue;
}
private RangerPolicy mapXResourceToPolicy(RangerPolicy policy, XXResource xRes, RangerService service) {
- String serviceName = service.getName();
- String serviceType = service.getType();
- String name = xRes.getPolicyName();
- String description = xRes.getDescription();
- Boolean isAuditEnabled = true;
- Boolean isEnabled = true;
- Map<String, RangerPolicyResource> resources = new HashMap<String, RangerPolicyResource>();
- List<RangerPolicyItem> policyItems = new ArrayList<RangerPolicyItem>();
-
- XXServiceDef svcDef = daoMgr.getXXServiceDef().findByName(serviceType);
+ String serviceName = service.getName();
+ String serviceType = service.getType();
+ String name = xRes.getPolicyName();
+ String description = xRes.getDescription();
+ boolean isAuditEnabled = true;
+ boolean isEnabled = true;
+ XXServiceDef svcDef = daoMgr.getXXServiceDef().findByName(serviceType);
if (svcDef == null) {
logger.error("{} service-def not found. Skipping policy {}", serviceType, name);
@@ -313,9 +342,11 @@ public class PatchMigration_J10002 extends BaseLoader {
}
List<XXAuditMap> auditMapList = daoMgr.getXXAuditMap().findByResourceId(xRes.getId());
+
if (stringUtil.isEmpty(auditMapList)) {
isAuditEnabled = false;
}
+
if (xRes.getResourceStatus() == AppConstants.STATUS_DISABLED) {
isEnabled = false;
}
@@ -324,6 +355,8 @@ public class PatchMigration_J10002 extends BaseLoader {
Boolean isTableExcludes = xRes.getTableType() == RangerCommonEnums.POLICY_EXCLUSION;
Boolean isColumnExcludes = xRes.getColumnType() == RangerCommonEnums.POLICY_EXCLUSION;
+ Map<String, RangerPolicyResource> resources = new HashMap<>();
+
if (StringUtils.equalsIgnoreCase(serviceType, "hdfs")) {
toRangerResourceList(xRes.getName(), "path", Boolean.FALSE, isPathRecursive, resources);
} else if (StringUtils.equalsIgnoreCase(serviceType, "hbase")) {
@@ -342,7 +375,7 @@ public class PatchMigration_J10002 extends BaseLoader {
toRangerResourceList(xRes.getTopologies(), "topology", Boolean.FALSE, Boolean.FALSE, resources);
}
- policyItems = getPolicyItemListForRes(xRes, svcDef);
+ List<RangerPolicyItem> policyItems = getPolicyItemListForRes(xRes, svcDef);
policy.setService(serviceName);
policy.setName(name);
@@ -351,7 +384,6 @@ public class PatchMigration_J10002 extends BaseLoader {
policy.setIsEnabled(isEnabled);
policy.setResources(resources);
policy.setPolicyItems(policyItems);
-
policy.setCreateTime(xRes.getCreateTime());
policy.setUpdateTime(xRes.getUpdateTime());
@@ -361,6 +393,7 @@ public class PatchMigration_J10002 extends BaseLoader {
if (createdByUser != null) {
policy.setCreatedBy(createdByUser.getLoginId());
}
+
if (updByUser != null) {
policy.setUpdatedBy(updByUser.getLoginId());
}
@@ -371,13 +404,14 @@ public class PatchMigration_J10002 extends BaseLoader {
}
private Map<String, RangerPolicy.RangerPolicyResource> toRangerResourceList(String resourceString, String resourceType, Boolean isExcludes, Boolean isRecursive, Map<String, RangerPolicy.RangerPolicyResource> resources) {
- Map<String, RangerPolicy.RangerPolicyResource> ret = resources == null ? new HashMap<String, RangerPolicy.RangerPolicyResource>() : resources;
+ Map<String, RangerPolicy.RangerPolicyResource> ret = resources == null ? new HashMap<>() : resources;
if (StringUtils.isNotBlank(resourceString)) {
RangerPolicy.RangerPolicyResource resource = ret.get(resourceType);
if (resource == null) {
resource = new RangerPolicy.RangerPolicyResource();
+
resource.setIsExcludes(isExcludes);
resource.setIsRecursive(isRecursive);
@@ -391,36 +425,30 @@ public class PatchMigration_J10002 extends BaseLoader {
}
private List<RangerPolicyItem> getPolicyItemListForRes(XXResource xRes, XXServiceDef svcDef) {
- List<RangerPolicyItem> policyItems = new ArrayList<RangerPolicyItem>();
-
- SearchCriteria sc = new SearchCriteria();
+ List<RangerPolicyItem> policyItems = new ArrayList<>();
+ SearchCriteria sc = new SearchCriteria();
sc.addParam("resourceId", xRes.getId());
+
List<VXPermMap> permMapList = xPermMapService.searchXPermMaps(sc).getVXPermMaps();
- HashMap<String, List<VXPermMap>> sortedPermMap = new HashMap<String, List<VXPermMap>>();
+ HashMap<String, List<VXPermMap>> sortedPermMap = new HashMap<>();
// re-group the list with permGroup as the key
if (permMapList != null) {
for (VXPermMap permMap : permMapList) {
String permGrp = permMap.getPermGroup();
- List<VXPermMap> sortedList = sortedPermMap.get(permGrp);
-
- if (sortedList == null) {
- sortedList = new ArrayList<VXPermMap>();
- sortedPermMap.put(permGrp, sortedList);
- }
+ List<VXPermMap> sortedList = sortedPermMap.computeIfAbsent(permGrp, k -> new ArrayList<>());
sortedList.add(permMap);
}
}
for (Entry<String, List<VXPermMap>> entry : sortedPermMap.entrySet()) {
- List<String> userList = new ArrayList<String>();
- List<String> groupList = new ArrayList<String>();
- List<RangerPolicyItemAccess> accessList = new ArrayList<RangerPolicyItemAccess>();
- String ipAddress = null;
-
+ List<String> userList = new ArrayList<>();
+ List<String> groupList = new ArrayList<>();
+ List<RangerPolicyItemAccess> accessList = new ArrayList<>();
+ String ipAddress = null;
RangerPolicy.RangerPolicyItem policyItem = new RangerPolicy.RangerPolicyItem();
for (VXPermMap permMap : entry.getValue()) {
@@ -439,13 +467,16 @@ public class PatchMigration_J10002 extends BaseLoader {
}
String accessType = ServiceUtil.toAccessType(permMap.getPermType());
+
if (StringUtils.isBlank(accessType) || unsupportedLegacyPermTypes.contains(accessType)) {
logger.info("{}: is not a valid access-type, ignoring access-type for policy: {}", accessType, xRes.getPolicyName());
+
continue;
}
if (StringUtils.equalsIgnoreCase(accessType, "Admin")) {
policyItem.setDelegateAdmin(Boolean.TRUE);
+
if (svcDef.getId() == EmbeddedServiceDefsUtil.instance().getHBaseServiceDefId()) {
addAccessType(accessType, accessList);
}
@@ -458,11 +489,13 @@ public class PatchMigration_J10002 extends BaseLoader {
if (CollectionUtils.isEmpty(accessList)) {
logger.info("no access specified. ignoring policyItem for policy: {}", xRes.getPolicyName());
+
continue;
}
if (CollectionUtils.isEmpty(userList) && CollectionUtils.isEmpty(groupList)) {
logger.info("no user or group specified. ignoring policyItem for policy: {}", xRes.getPolicyName());
+
continue;
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchPasswordEncryption_J10001.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchPasswordEncryption_J10001.java
index 6b0669478..1d1936f8e 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchPasswordEncryption_J10001.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchPasswordEncryption_J10001.java
@@ -31,6 +31,7 @@ import java.util.List;
@Component
public class PatchPasswordEncryption_J10001 extends BaseLoader {
private static final Logger logger = LoggerFactory.getLogger(PatchPasswordEncryption_J10001.class);
+
int lineCount;
@Autowired
@@ -47,16 +48,21 @@ public class PatchPasswordEncryption_J10001 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchPasswordEncryption_J10001 loader = (PatchPasswordEncryption_J10001) CLIUtil.getBean(PatchPasswordEncryption_J10001.class);
+
//loader.init();
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -64,6 +70,7 @@ public class PatchPasswordEncryption_J10001 extends BaseLoader {
@Override
public void printStats() {
logger.info("Time taken so far:{}, moreToProcess={}", timeTakenSoFar(lineCount), isMoreToProcess());
+
print(lineCount, "Processed lines");
}
@@ -74,21 +81,27 @@ public class PatchPasswordEncryption_J10001 extends BaseLoader {
private void encryptLookupUserPassword() {
List<XXAsset> xAssetList = xaDaoManager.getXXAsset().getAll();
- String oldConfig = null;
- String newConfig = null;
+ String oldConfig;
+ String newConfig;
+
for (XXAsset xAsset : xAssetList) {
- oldConfig = null;
- newConfig = null;
oldConfig = xAsset.getConfig();
+ newConfig = null;
+
if (!stringUtil.isEmpty(oldConfig)) {
newConfig = xAssetService.getConfigWithEncryptedPassword(oldConfig, false);
+
xAsset.setConfig(newConfig);
+
xaDaoManager.getXXAsset().update(xAsset);
}
+
lineCount++;
+
logger.info("Lookup Password updated for Asset : {}", xAsset.getName());
logger.info("oldconfig : {}", oldConfig);
logger.info("newConfig : {}", newConfig);
+
print(lineCount, "Total updated assets count : ");
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchPermissionModel_J10003.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchPermissionModel_J10003.java
index 19202781e..18a6c87db 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchPermissionModel_J10003.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchPermissionModel_J10003.java
@@ -43,18 +43,24 @@ import java.util.List;
@Component
public class PatchPermissionModel_J10003 extends BaseLoader {
private static final Logger logger = LoggerFactory.getLogger(PatchPermissionModel_J10003.class);
- private static final Charset ENCODING = StandardCharsets.UTF_8;
- private static boolean grantAllUsers;
- private static String usersListFileName;
+
+ private static final Charset ENCODING = StandardCharsets.UTF_8;
+
+ private static boolean grantAllUsers;
+ private static String usersListFileName;
+
@Autowired
XUserMgr xUserMgr;
+
@Autowired
XPortalUserService xPortalUserService;
+
@Autowired
RangerDaoManager daoManager;
public static void main(String[] args) {
logger.info("main()");
+
try {
if (args != null && args.length > 0) {
if (StringUtils.equalsIgnoreCase("ALL", args[0])) {
@@ -63,16 +69,21 @@ public class PatchPermissionModel_J10003 extends BaseLoader {
usersListFileName = args[0];
}
}
+
PatchPermissionModel_J10003 loader = (PatchPermissionModel_J10003) CLIUtil.getBean(PatchPermissionModel_J10003.class);
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -89,99 +100,126 @@ public class PatchPermissionModel_J10003 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PermissionPatch.execLoad()");
+
assignPermissionToExistingUsers();
+
logger.info("<== PermissionPatch.execLoad()");
}
public void assignPermissionToExistingUsers() {
- int countUserPermissionUpdated = 0;
- Long userCount = daoManager.getXXPortalUser().getAllCount();
- List<XXPortalUser> xXPortalUsers = null;
- Long patchModeMaxLimit = Long.valueOf(500L);
+ Long userCount = daoManager.getXXPortalUser().getAllCount();
+ Long patchModeMaxLimit = 500L;
+
try {
if (userCount != null && userCount > 0) {
List<String> loginIdList = readUserNamesFromFile(usersListFileName);
+
if (!CollectionUtils.isEmpty(loginIdList)) {
- xXPortalUsers = new ArrayList<XXPortalUser>();
- XXPortalUser xXPortalUser = null;
+ List<XXPortalUser> xXPortalUsers = new ArrayList<>();
+
for (String loginId : loginIdList) {
try {
- xXPortalUser = daoManager.getXXPortalUser().findByLoginId(loginId);
+ XXPortalUser xXPortalUser = daoManager.getXXPortalUser().findByLoginId(loginId);
+
if (xXPortalUser != null) {
xXPortalUsers.add(xXPortalUser);
} else {
logger.info("User {} doesn't exist!", loginId);
}
} catch (Exception ex) {
+ // ignore
}
}
- countUserPermissionUpdated = assignPermissions(xXPortalUsers);
+
+ int countUserPermissionUpdated = assignPermissions(xXPortalUsers);
+
logger.info("Permissions assigned to {} of {}", countUserPermissionUpdated, loginIdList.size());
} else if (userCount.compareTo(patchModeMaxLimit) < 0 || grantAllUsers) {
- xXPortalUsers = daoManager.getXXPortalUser().findAllXPortalUser();
+ List<XXPortalUser> xXPortalUsers = daoManager.getXXPortalUser().findAllXPortalUser();
+
if (!CollectionUtils.isEmpty(xXPortalUsers)) {
- countUserPermissionUpdated = assignPermissions(xXPortalUsers);
+ int countUserPermissionUpdated = assignPermissions(xXPortalUsers);
+
logger.info("Permissions assigned to {} of {}", countUserPermissionUpdated, xXPortalUsers.size());
}
} else {
//if total no. of users are more than 500 then process ADMIN and KEY_ADMIN users only to avoid timeout
- xXPortalUsers = daoManager.getXXPortalUser().findByRole(RangerConstants.ROLE_SYS_ADMIN);
+ List<XXPortalUser> xXPortalUsers = daoManager.getXXPortalUser().findByRole(RangerConstants.ROLE_SYS_ADMIN);
+
if (!CollectionUtils.isEmpty(xXPortalUsers)) {
- countUserPermissionUpdated = assignPermissions(xXPortalUsers);
+ int countUserPermissionUpdated = assignPermissions(xXPortalUsers);
+
logger.info("Permissions assigned to users having role:{}. Processed:{} of total {}", RangerConstants.ROLE_SYS_ADMIN, countUserPermissionUpdated, xXPortalUsers.size());
}
+
xXPortalUsers = daoManager.getXXPortalUser().findByRole(RangerConstants.ROLE_KEY_ADMIN);
+
if (!CollectionUtils.isEmpty(xXPortalUsers)) {
- countUserPermissionUpdated = assignPermissions(xXPortalUsers);
+ int countUserPermissionUpdated = assignPermissions(xXPortalUsers);
+
logger.info("Permissions assigned to users having role:{}. Processed:{} of total {}", RangerConstants.ROLE_SYS_ADMIN, countUserPermissionUpdated, xXPortalUsers.size());
}
+
logger.info("Please execute this patch separately with argument 'ALL' to assign permission to remaining users ");
System.out.println("Please execute this patch separately with argument 'ALL' to assign module permissions to remaining users!!");
}
}
} catch (Exception ex) {
+ // ignore
}
}
private int assignPermissions(List<XXPortalUser> xXPortalUsers) {
int countUserPermissionUpdated = 0;
+
if (!CollectionUtils.isEmpty(xXPortalUsers)) {
for (XXPortalUser xPortalUser : xXPortalUsers) {
try {
if (xPortalUser != null) {
VXPortalUser vPortalUser = xPortalUserService.populateViewBean(xPortalUser);
+
if (vPortalUser != null) {
vPortalUser.setUserRoleList(daoManager.getXXPortalUserRole().findXPortalUserRolebyXPortalUserId(vPortalUser.getId()));
+
xUserMgr.assignPermissionToUser(vPortalUser, false);
+
countUserPermissionUpdated += 1;
+
logger.info("Permissions assigned/updated on base of User's Role, UserId [{}]", xPortalUser.getId());
}
}
} catch (Exception ex) {
+ // ignore
}
}
}
+
return countUserPermissionUpdated;
}
private List<String> readUserNamesFromFile(String aFileName) throws IOException {
- List<String> userNames = new ArrayList<String>();
+ List<String> userNames = new ArrayList<>();
+
if (!StringUtils.isEmpty(aFileName)) {
Path path = Paths.get(aFileName);
+
if (Files.exists(path) && Files.isRegularFile(path)) {
List<String> fileContents = Files.readAllLines(path, ENCODING);
+
if (fileContents != null && !fileContents.isEmpty()) {
for (String line : fileContents) {
if (!StringUtils.isEmpty(line) && !userNames.contains(line)) {
try {
userNames.add(line.trim());
} catch (Exception ex) {
+ // ignore
}
}
}
}
}
}
+
return userNames;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchPreSql_057_ForUpdateToUniqueGUID_J10052.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchPreSql_057_ForUpdateToUniqueGUID_J10052.java
index f4e20f334..33c72f58a 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchPreSql_057_ForUpdateToUniqueGUID_J10052.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchPreSql_057_ForUpdateToUniqueGUID_J10052.java
@@ -58,6 +58,7 @@ public class PatchPreSql_057_ForUpdateToUniqueGUID_J10052 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchPreSql_057_ForUpdateToUniqueGUID_J10052 loader = (PatchPreSql_057_ForUpdateToUniqueGUID_J10052) CLIUtil.getBean(PatchPreSql_057_ForUpdateToUniqueGUID_J10052.class);
@@ -72,6 +73,7 @@ public class PatchPreSql_057_ForUpdateToUniqueGUID_J10052 extends BaseLoader {
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -88,49 +90,58 @@ public class PatchPreSql_057_ForUpdateToUniqueGUID_J10052 extends BaseLoader {
@Override
public void execLoad() {
+ logger.info("==> updatePolicyGUIDToUniqueValue()");
+
try {
- logger.info("==> updatePolicyGUIDToUniqueValue()");
updatePolicyGUIDToUniqueValue();
} catch (Exception e) {
logger.error("Error while updatePolicyGUIDToUniqueValue()", e);
+
System.exit(1);
}
logger.info("<== updatePolicyGUIDToUniqueValue.execLoad()");
}
- private void updatePolicyGUIDToUniqueValue() throws Exception {
+ private void updatePolicyGUIDToUniqueValue() {
logger.info("==> updatePolicyGUIDToUniqueValue() ");
- List<XXSecurityZone> allXXZones = null;
- List<XXService> allXXService = null;
-
- allXXZones = daoMgr.getXXSecurityZoneDao().getAll();
- allXXService = daoMgr.getXXService().getAll();
+ List<XXSecurityZone> allXXZones = daoMgr.getXXSecurityZoneDao().getAll();
+ List<XXService> allXXService = daoMgr.getXXService().getAll();
if (CollectionUtils.isNotEmpty(allXXZones) && CollectionUtils.isNotEmpty(allXXService)) {
logger.info("Total number of zones {}, services :{}", allXXZones.size(), allXXService.size());
+
for (XXSecurityZone xSecurityZone : allXXZones) {
for (XXService xService : allXXService) {
logger.info("serching duplicate guid policies for service :{} zone:{}", xService.getName(), xSecurityZone.getName());
+
List<String> duplicateGuidList = daoMgr.getXXPolicy().findDuplicateGUIDByServiceIdAndZoneId(xService.getId(), xSecurityZone.getId());
+
if (CollectionUtils.isNotEmpty(duplicateGuidList)) {
logger.info("Total number of duplicate GUIDs:{} for service:{} and zone:{}", duplicateGuidList.size(), xService.getName(), xSecurityZone.getName());
+
for (String guid : duplicateGuidList) {
List<XXPolicy> xxPolicyList = daoMgr.getXXPolicy().findPolicyByGUIDAndServiceIdAndZoneId(guid, xService.getId(), xSecurityZone.getId());
- boolean isFirstElement = false;
+
if (CollectionUtils.isNotEmpty(xxPolicyList)) {
- isFirstElement = true;
+ boolean isFirstElement = true;
+
for (XXPolicy xxPolicy : xxPolicyList) {
if (isFirstElement) {
isFirstElement = false;
continue;
}
+
RangerPolicy policy = getPolicy(xxPolicy);
+
if (policy != null) {
guid = guidUtil.genGUID();
+
xxPolicy.setGuid(guid);
+
policy.setGuid(guid);
+
xxPolicy.setPolicyText(JsonUtils.objectToJson(policy));
daoMgr.getXXPolicy().update(xxPolicy);
@@ -155,7 +166,9 @@ public class PatchPreSql_057_ForUpdateToUniqueGUID_J10052 extends BaseLoader {
if (xPolicy != null) {
String policyText = xPolicy.getPolicyText();
+
logger.debug("Ranger Policy text:[{}]", policyText);
+
ret = JsonUtils.jsonToObject(policyText, RangerPolicy.class);
if (ret != null) {
@@ -165,7 +178,9 @@ public class PatchPreSql_057_ForUpdateToUniqueGUID_J10052 extends BaseLoader {
ret.setUpdateTime(xPolicy.getUpdateTime());
ret.setVersion(xPolicy.getVersion());
ret.setPolicyType(xPolicy.getPolicyType() == null ? RangerPolicy.POLICY_TYPE_ACCESS : xPolicy.getPolicyType());
+
XXSecurityZone xSecurityZone = daoMgr.getXXSecurityZoneDao().findByZoneId(xPolicy.getZoneId());
+
if (xSecurityZone != null) {
ret.setZoneName(xSecurityZone.getName());
}
@@ -173,6 +188,7 @@ public class PatchPreSql_057_ForUpdateToUniqueGUID_J10052 extends BaseLoader {
} else {
ret = null;
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053.java
index 496c3f67d..4ca27766e 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053.java
@@ -46,19 +46,23 @@ import java.util.Map;
@Component
public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends BaseLoader {
private static final Logger logger = LoggerFactory.getLogger(PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053.class);
- private final Boolean isPolicyEnabled = false;
+
@Autowired
RangerDaoManager daoMgr;
+
@Autowired
ServiceDBStore svcStore;
+
@Autowired
RangerFactory factory;
+
@Autowired
@Qualifier(value = "transactionManager")
PlatformTransactionManager txManager;
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 loader = (PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053) CLIUtil.getBean(PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053.class);
@@ -73,6 +77,7 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -96,31 +101,39 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
removeDuplicateResourceSignaturesPolicies();
} catch (Exception e) {
logger.error("Error while PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053()", e);
+
System.exit(1);
}
logger.info("<== PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053.execLoad()");
}
- private void updateDisabledPolicyResourceSignature() throws Exception {
+ private void updateDisabledPolicyResourceSignature() {
logger.info("==> updateDisabledPolicyResourceSignature() ");
- List<XXPolicy> xxPolicyList = daoMgr.getXXPolicy().findByPolicyStatus(isPolicyEnabled);
+ Boolean isPolicyEnabled = false;
+ List<XXPolicy> xxPolicyList = daoMgr.getXXPolicy().findByPolicyStatus(isPolicyEnabled);
logger.info("Total number of disabled policies :[{}]", xxPolicyList.size());
if (CollectionUtils.isNotEmpty(xxPolicyList)) {
for (XXPolicy xxPolicy : xxPolicyList) {
RangerPolicy policy = getPolicy(xxPolicy);
+
if (policy != null) {
policy.setResourceSignature(null);
xxPolicy.setResourceSignature(null);
+
RangerPolicyResourceSignature policySignature = factory.createPolicyResourceSignature(policy);
String signature = policySignature.getSignature();
+
policy.setResourceSignature(signature);
+
xxPolicy.setPolicyText(JsonUtils.objectToJson(policy));
xxPolicy.setResourceSignature(signature);
+
logger.debug("Ranger text after update:[{}]", xxPolicy.getPolicyText());
+
daoMgr.getXXPolicy().update(xxPolicy);
} else {
logger.info("RangerPolicy object cannot be created from xxPolicy: [{}]", xxPolicy);
@@ -131,21 +144,30 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
logger.info("<== updateDisabledPolicyResourceSignature() ");
}
- private void removeDuplicateResourceSignaturesPolicies() throws Exception {
+ private void removeDuplicateResourceSignaturesPolicies() {
logger.info("==> removeDuplicateResourceSignaturesPolicies() ");
+
Map<String, Long> duplicateEntries = daoMgr.getXXPolicy().findDuplicatePoliciesByServiceAndResourceSignature();
- if (duplicateEntries != null && duplicateEntries.size() > 0) {
+
+ if (duplicateEntries != null && !duplicateEntries.isEmpty()) {
logger.info("Total number of possible duplicate policies:{}", duplicateEntries.size());
+
for (Map.Entry<String, Long> entry : duplicateEntries.entrySet()) {
logger.info("Duplicate policy Entry - {ResourceSignature:{}, ServiceId:{}}", entry.getKey(), entry.getValue());
+
List<XXPolicy> xxPolicyList = daoMgr.getXXPolicy().findByServiceIdAndResourceSignature(entry.getValue(), entry.getKey());
+
if (CollectionUtils.isNotEmpty(xxPolicyList) && xxPolicyList.size() > 1) {
Iterator<XXPolicy> duplicatePolicies = xxPolicyList.iterator();
+
duplicatePolicies.next();
+
while (duplicatePolicies.hasNext()) {
XXPolicy xxPolicy = duplicatePolicies.next();
+
if (xxPolicy != null) {
logger.info("Attempting to Remove duplicate policy:{{}:{}}", xxPolicy.getId(), xxPolicy.getName());
+
if (cleanupRefTables(xxPolicy.getId())) {
daoMgr.getXXPolicy().remove(xxPolicy.getId());
}
@@ -156,6 +178,7 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
} else {
logger.info("no duplicate Policy found");
}
+
logger.info("<== removeDuplicateResourceSignaturesPolicies() ");
}
@@ -163,6 +186,7 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
if (policyId == null) {
return false;
}
+
daoMgr.getXXPolicyRefResource().deleteByPolicyId(policyId);
daoMgr.getXXPolicyRefRole().deleteByPolicyId(policyId);
daoMgr.getXXPolicyRefGroup().deleteByPolicyId(policyId);
@@ -170,11 +194,14 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
daoMgr.getXXPolicyRefAccessType().deleteByPolicyId(policyId);
daoMgr.getXXPolicyRefCondition().deleteByPolicyId(policyId);
daoMgr.getXXPolicyRefDataMaskType().deleteByPolicyId(policyId);
+
XXPolicyLabelMapDao policyLabelMapDao = daoMgr.getXXPolicyLabelMap();
List<XXPolicyLabelMap> xxPolicyLabelMaps = policyLabelMapDao.findByPolicyId(policyId);
+
for (XXPolicyLabelMap xxPolicyLabelMap : xxPolicyLabelMaps) {
policyLabelMapDao.remove(xxPolicyLabelMap);
}
+
return true;
}
@@ -183,7 +210,9 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
if (xPolicy != null) {
String policyText = xPolicy.getPolicyText();
+
logger.debug("Ranger Policy text:[{}]", policyText);
+
ret = JsonUtils.jsonToObject(policyText, RangerPolicy.class);
if (ret != null) {
@@ -193,7 +222,9 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
ret.setUpdateTime(xPolicy.getUpdateTime());
ret.setVersion(xPolicy.getVersion());
ret.setPolicyType(xPolicy.getPolicyType() == null ? RangerPolicy.POLICY_TYPE_ACCESS : xPolicy.getPolicyType());
+
XXSecurityZone xSecurityZone = daoMgr.getXXSecurityZoneDao().findByZoneId(xPolicy.getZoneId());
+
if (xSecurityZone != null) {
ret.setZoneName(xSecurityZone.getName());
}
@@ -201,6 +232,7 @@ public class PatchPreSql_058_ForUpdateToUniqueResoureceSignature_J10053 extends
} else {
ret = null;
}
+
return ret;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchSetAccessTypeCategory_J10061.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchSetAccessTypeCategory_J10061.java
index 72de09fa8..54a3424c1 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchSetAccessTypeCategory_J10061.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchSetAccessTypeCategory_J10061.java
@@ -108,7 +108,7 @@ public class PatchSetAccessTypeCategory_J10061 extends BaseLoader {
continue;
}
- RangerServiceDef embeddedServiceDef = null;
+ RangerServiceDef embeddedServiceDef;
try {
embeddedServiceDef = EmbeddedServiceDefsUtil.instance().getEmbeddedServiceDef(serviceDef.getName());
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchTagModulePermission_J10005.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchTagModulePermission_J10005.java
index 868a3af81..2654054a7 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchTagModulePermission_J10005.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchTagModulePermission_J10005.java
@@ -50,17 +50,22 @@ public class PatchTagModulePermission_J10005 extends BaseLoader {
public static void main(String[] args) {
logger.info("main()");
+
try {
PatchTagModulePermission_J10005 loader = (PatchTagModulePermission_J10005) CLIUtil.getBean(PatchTagModulePermission_J10005.class);
loader.init();
+
while (loader.isMoreToProcess()) {
loader.load();
}
+
logger.info("Load complete. Exiting!!!");
+
System.exit(0);
} catch (Exception e) {
logger.error("Error loading", e);
+
System.exit(1);
}
}
@@ -77,49 +82,63 @@ public class PatchTagModulePermission_J10005 extends BaseLoader {
@Override
public void execLoad() {
logger.info("==> PermissionPatch.execLoad()");
+
assignPermissionOnTagModuleToAdminUsers();
+
trimPolicyName();
+
logger.info("<== PermissionPatch.execLoad()");
}
public void assignPermissionOnTagModuleToAdminUsers() {
int countUserPermissionUpdated = 0;
XXModuleDef xModDef = daoManager.getXXModuleDef().findByModuleName(RangerConstants.MODULE_TAG_BASED_POLICIES);
+
if (xModDef == null) {
return;
}
+
List<XXPortalUser> allAdminUsers = daoManager.getXXPortalUser().findByRole(RangerConstants.ROLE_SYS_ADMIN);
+
if (!CollectionUtils.isEmpty(allAdminUsers)) {
for (XXPortalUser xPortalUser : allAdminUsers) {
VXPortalUser vPortalUser = xPortalUserService.populateViewBean(xPortalUser);
+
if (vPortalUser != null) {
vPortalUser.setUserRoleList(daoManager.getXXPortalUserRole().findXPortalUserRolebyXPortalUserId(vPortalUser.getId()));
+
xUserMgr.createOrUpdateUserPermisson(vPortalUser, xModDef.getId(), false);
+
countUserPermissionUpdated += 1;
+
logger.info("Added {} permission to user {}", xModDef.getModule(), xPortalUser.getLoginId());
}
}
}
+
logger.info("{} permissions were assigned", countUserPermissionUpdated);
}
private void trimPolicyName() {
List<XXPolicy> policies = daoManager.getXXPolicy().getAll();
+
if (!CollectionUtils.isEmpty(policies)) {
- String policyName = null;
for (XXPolicy xXPolicy : policies) {
try {
if (xXPolicy != null) {
- policyName = xXPolicy.getName();
+ String policyName = xXPolicy.getName();
+
if (!StringUtils.isEmpty(policyName)) {
if (policyName.startsWith(" ") || policyName.endsWith(" ")) {
xXPolicy.setName(StringUtils.trim(policyName));
+
daoManager.getXXPolicy().update(xXPolicy);
}
}
}
} catch (Exception ex) {
logger.info("Error during policy update:{}", xXPolicy);
+
logger.error("", ex);
}
}