You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Abhay Kulkarni <ak...@hortonworks.com> on 2017/01/25 08:32:52 UTC
Review Request 55915: Update Ranger plugin handling of
service-not-found error
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55915/
-----------------------------------------------------------
Review request for ranger and Madhan Neethiraj.
Bugs: RANGER-1329
https://issues.apache.org/jira/browse/RANGER-1329
Repository: ranger
Description
-------
If the service is deleted or renamed in Ranger Admin, the plugins should run with no policy to determine authorization of resource-accesses.
Diffs
-----
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminClient.java 6755e15
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java 646004a
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerAdminTagRetriever.java 9c336bf
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerFileBasedTagRetriever.java 248aafa
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java 43d501a
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagRetriever.java a5eeeaa
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java c34aa19
agents-common/src/main/java/org/apache/ranger/plugin/util/PolicyRefresher.java 91c24c6
agents-common/src/main/java/org/apache/ranger/plugin/util/RangerServiceNotFoundException.java PRE-CREATION
knox-agent/src/main/java/org/apache/ranger/admin/client/RangerAdminJersey2RESTClient.java 1c649de
ranger-plugin-classloader/src/main/java/org/apache/ranger/plugin/classloader/RangerPluginClassLoaderUtil.java 156fec9
security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 7e50fd5
security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 5fbc259
security-admin/src/main/java/org/apache/ranger/common/RESTErrorUtil.java c98487f
security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 84675fc
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java b6018fb
security-admin/src/main/java/org/apache/ranger/rest/TagREST.java feb6a54
security-admin/src/main/resources/META-INF/jpa_named_queries.xml c8c3d2f
security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java fafd4e0
security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java 9608544
Diff: https://reviews.apache.org/r/55915/diff/
Testing
-------
Tested with localVM.
1. Deleted/renamed service in Ranger Admin, and ensured that the policycache is moved to a different name, and plugin is reinitialized with no policies. This behavior is controlled by a configuration variable 'ranger.disable.policycache.when.service.not.found'.
2. Disabled service in Ranger Admin, and ensured that the policycache is not modified/moved, and policy-engine continues to use existing policies.
Thanks,
Abhay Kulkarni
Re: Review Request 55915: Update Ranger plugin handling of
service-not-found error
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
> On Jan. 26, 2017, 8:21 p.m., Madhan Neethiraj wrote:
> > agents-common/src/main/java/org/apache/ranger/plugin/util/RangerServiceNotFoundException.java, line 27
> > <https://reviews.apache.org/r/55915/diff/1/?file=1614146#file1614146line27>
> >
> > Consider isolating the details of message validation to this class, with the following method:
> >
> > public static boolean isServiceNotFoundError(String seviceName, String exceptionMessage) {
> > }
message validation details are buried in another method which throws RangerServiceNotFoundException if message validation succeeds
- Abhay
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55915/#review163161
-----------------------------------------------------------
On Jan. 25, 2017, 8:32 a.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/55915/
> -----------------------------------------------------------
>
> (Updated Jan. 25, 2017, 8:32 a.m.)
>
>
> Review request for ranger and Madhan Neethiraj.
>
>
> Bugs: RANGER-1329
> https://issues.apache.org/jira/browse/RANGER-1329
>
>
> Repository: ranger
>
>
> Description
> -------
>
> If the service is deleted or renamed in Ranger Admin, the plugins should run with no policy to determine authorization of resource-accesses.
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminClient.java 6755e15
> agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java 646004a
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerAdminTagRetriever.java 9c336bf
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerFileBasedTagRetriever.java 248aafa
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java 43d501a
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagRetriever.java a5eeeaa
> agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java c34aa19
> agents-common/src/main/java/org/apache/ranger/plugin/util/PolicyRefresher.java 91c24c6
> agents-common/src/main/java/org/apache/ranger/plugin/util/RangerServiceNotFoundException.java PRE-CREATION
> knox-agent/src/main/java/org/apache/ranger/admin/client/RangerAdminJersey2RESTClient.java 1c649de
> ranger-plugin-classloader/src/main/java/org/apache/ranger/plugin/classloader/RangerPluginClassLoaderUtil.java 156fec9
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 7e50fd5
> security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 5fbc259
> security-admin/src/main/java/org/apache/ranger/common/RESTErrorUtil.java c98487f
> security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 84675fc
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java b6018fb
> security-admin/src/main/java/org/apache/ranger/rest/TagREST.java feb6a54
> security-admin/src/main/resources/META-INF/jpa_named_queries.xml c8c3d2f
> security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java fafd4e0
> security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java 9608544
>
> Diff: https://reviews.apache.org/r/55915/diff/
>
>
> Testing
> -------
>
> Tested with localVM.
> 1. Deleted/renamed service in Ranger Admin, and ensured that the policycache is moved to a different name, and plugin is reinitialized with no policies. This behavior is controlled by a configuration variable 'ranger.disable.policycache.when.service.not.found'.
> 2. Disabled service in Ranger Admin, and ensured that the policycache is not modified/moved, and policy-engine continues to use existing policies.
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 55915: Update Ranger plugin handling of
service-not-found error
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55915/#review163161
-----------------------------------------------------------
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminClient.java (line 31)
<https://reviews.apache.org/r/55915/#comment234591>
Properties used by plugins are prefixed with "ranger.plugin.<serviceType>.". It will be good to name this one as well similarly.
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java (line 55)
<https://reviews.apache.org/r/55915/#comment234592>
To avoid potential confusion, consider renaming "disableCache" ==> "disableCacheIfSerivceNotFound"
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java (line 149)
<https://reviews.apache.org/r/55915/#comment234596>
it will be cleaner to check for 'disableCache' in the caller (RangerPolicyRefresher). Consider only checking for exception message and throw RangerServiceNotFoundException from here.
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java (line 336)
<https://reviews.apache.org/r/55915/#comment234595>
it will be cleaner to check for 'disableCache' in the caller (RangerTagEnricher). Consider only checking for exception message and throw RangerServiceNotFoundException from here.
agents-common/src/main/java/org/apache/ranger/plugin/util/RangerServiceNotFoundException.java (line 27)
<https://reviews.apache.org/r/55915/#comment234597>
Consider isolating the details of message validation to this class, with the following method:
public static boolean isServiceNotFoundError(String seviceName, String exceptionMessage) {
}
- Madhan Neethiraj
On Jan. 25, 2017, 8:32 a.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/55915/
> -----------------------------------------------------------
>
> (Updated Jan. 25, 2017, 8:32 a.m.)
>
>
> Review request for ranger and Madhan Neethiraj.
>
>
> Bugs: RANGER-1329
> https://issues.apache.org/jira/browse/RANGER-1329
>
>
> Repository: ranger
>
>
> Description
> -------
>
> If the service is deleted or renamed in Ranger Admin, the plugins should run with no policy to determine authorization of resource-accesses.
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminClient.java 6755e15
> agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java 646004a
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerAdminTagRetriever.java 9c336bf
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerFileBasedTagRetriever.java 248aafa
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java 43d501a
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagRetriever.java a5eeeaa
> agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java c34aa19
> agents-common/src/main/java/org/apache/ranger/plugin/util/PolicyRefresher.java 91c24c6
> agents-common/src/main/java/org/apache/ranger/plugin/util/RangerServiceNotFoundException.java PRE-CREATION
> knox-agent/src/main/java/org/apache/ranger/admin/client/RangerAdminJersey2RESTClient.java 1c649de
> ranger-plugin-classloader/src/main/java/org/apache/ranger/plugin/classloader/RangerPluginClassLoaderUtil.java 156fec9
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 7e50fd5
> security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 5fbc259
> security-admin/src/main/java/org/apache/ranger/common/RESTErrorUtil.java c98487f
> security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 84675fc
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java b6018fb
> security-admin/src/main/java/org/apache/ranger/rest/TagREST.java feb6a54
> security-admin/src/main/resources/META-INF/jpa_named_queries.xml c8c3d2f
> security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java fafd4e0
> security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java 9608544
>
> Diff: https://reviews.apache.org/r/55915/diff/
>
>
> Testing
> -------
>
> Tested with localVM.
> 1. Deleted/renamed service in Ranger Admin, and ensured that the policycache is moved to a different name, and plugin is reinitialized with no policies. This behavior is controlled by a configuration variable 'ranger.disable.policycache.when.service.not.found'.
> 2. Disabled service in Ranger Admin, and ensured that the policycache is not modified/moved, and policy-engine continues to use existing policies.
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 55915: Update Ranger plugin handling of
service-not-found error
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55915/#review163377
-----------------------------------------------------------
Fix it, then Ship it!
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java (line 145)
<https://reviews.apache.org/r/55915/#comment234801>
StringUtils.isNotBlank() may not be useful here.
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java (line 639)
<https://reviews.apache.org/r/55915/#comment234803>
disableCacheIfServiceNotFound() ==> disableCache()
agents-common/src/main/java/org/apache/ranger/plugin/util/PolicyRefresher.java (line 229)
<https://reviews.apache.org/r/55915/#comment234805>
disableCacheIfServiceNotFound() ==> disableCache()
- Madhan Neethiraj
On Jan. 27, 2017, 10:49 p.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/55915/
> -----------------------------------------------------------
>
> (Updated Jan. 27, 2017, 10:49 p.m.)
>
>
> Review request for ranger and Madhan Neethiraj.
>
>
> Bugs: RANGER-1329
> https://issues.apache.org/jira/browse/RANGER-1329
>
>
> Repository: ranger
>
>
> Description
> -------
>
> If the service is deleted or renamed in Ranger Admin, the plugins should run with no policy to determine authorization of resource-accesses.
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminClient.java 6755e15
> agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java 646004a
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerAdminTagRetriever.java 9c336bf
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerFileBasedTagRetriever.java 248aafa
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java 43d501a
> agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagRetriever.java a5eeeaa
> agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java c34aa19
> agents-common/src/main/java/org/apache/ranger/plugin/util/PolicyRefresher.java 91c24c6
> agents-common/src/main/java/org/apache/ranger/plugin/util/RangerServiceNotFoundException.java PRE-CREATION
> knox-agent/src/main/java/org/apache/ranger/admin/client/RangerAdminJersey2RESTClient.java 1c649de
> ranger-plugin-classloader/src/main/java/org/apache/ranger/plugin/classloader/RangerPluginClassLoaderUtil.java 156fec9
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 7e50fd5
> security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 5fbc259
> security-admin/src/main/java/org/apache/ranger/common/RESTErrorUtil.java c98487f
> security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 84675fc
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 81c10e8
> security-admin/src/main/java/org/apache/ranger/rest/TagREST.java feb6a54
> security-admin/src/main/resources/META-INF/jpa_named_queries.xml c8c3d2f
> security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java fafd4e0
> security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java 9608544
>
> Diff: https://reviews.apache.org/r/55915/diff/
>
>
> Testing
> -------
>
> Tested with localVM.
> 1. Deleted/renamed service in Ranger Admin, and ensured that the policycache is moved to a different name, and plugin is reinitialized with no policies. This behavior is controlled by a configuration variable 'ranger.disable.policycache.when.service.not.found'.
> 2. Disabled service in Ranger Admin, and ensured that the policycache is not modified/moved, and policy-engine continues to use existing policies.
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 55915: Update Ranger plugin handling of
service-not-found error
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/55915/
-----------------------------------------------------------
(Updated Jan. 27, 2017, 10:49 p.m.)
Review request for ranger and Madhan Neethiraj.
Changes
-------
Addressed review comments
Bugs: RANGER-1329
https://issues.apache.org/jira/browse/RANGER-1329
Repository: ranger
Description
-------
If the service is deleted or renamed in Ranger Admin, the plugins should run with no policy to determine authorization of resource-accesses.
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminClient.java 6755e15
agents-common/src/main/java/org/apache/ranger/admin/client/RangerAdminRESTClient.java 646004a
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerAdminTagRetriever.java 9c336bf
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerFileBasedTagRetriever.java 248aafa
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagEnricher.java 43d501a
agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/RangerTagRetriever.java a5eeeaa
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java c34aa19
agents-common/src/main/java/org/apache/ranger/plugin/util/PolicyRefresher.java 91c24c6
agents-common/src/main/java/org/apache/ranger/plugin/util/RangerServiceNotFoundException.java PRE-CREATION
knox-agent/src/main/java/org/apache/ranger/admin/client/RangerAdminJersey2RESTClient.java 1c649de
ranger-plugin-classloader/src/main/java/org/apache/ranger/plugin/classloader/RangerPluginClassLoaderUtil.java 156fec9
security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 7e50fd5
security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 5fbc259
security-admin/src/main/java/org/apache/ranger/common/RESTErrorUtil.java c98487f
security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 84675fc
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 81c10e8
security-admin/src/main/java/org/apache/ranger/rest/TagREST.java feb6a54
security-admin/src/main/resources/META-INF/jpa_named_queries.xml c8c3d2f
security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java fafd4e0
security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java 9608544
Diff: https://reviews.apache.org/r/55915/diff/
Testing
-------
Tested with localVM.
1. Deleted/renamed service in Ranger Admin, and ensured that the policycache is moved to a different name, and plugin is reinitialized with no policies. This behavior is controlled by a configuration variable 'ranger.disable.policycache.when.service.not.found'.
2. Disabled service in Ranger Admin, and ensured that the policycache is not modified/moved, and policy-engine continues to use existing policies.
Thanks,
Abhay Kulkarni