You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Fatima Khan <fa...@gmail.com> on 2018/03/06 07:08:12 UTC
Review Request 65914: Ranger 1948 : Support for Read-only Ranger
Admin users
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/
-----------------------------------------------------------
Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
Bugs: Ranger-1948
https://issues.apache.org/jira/browse/Ranger-1948
Repository: ranger
Description
-------
This Jira is to cater to need of Auditor roles in Ranger Admin.
We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
* Auditor (Readonly privileges from current Admin role user )
* KMS Auditor (Readonly privileges from current Keydmin role user )
Diffs
-----
security-admin/scripts/rolebasedusersearchutil.py d651461
security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java 840bb38
security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 8341a73
security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java b713d12
security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 0e99be1
security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java cb7ca52
security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java 9c19bb0
security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java 9a9604f
security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
unixauthservice/scripts/install.properties 88bce69
Diff: https://reviews.apache.org/r/65914/diff/1/
Testing
-------
Tested scenario's:
1.Tested admin user is able to create User role user.
2.Tested admin user is able to create Auditor role user.
3.Tested admin user is not able to create kms auditor role user.
4.Tested keyadmin user is able to create kms auditor.
5.Tested auditor is able to only view policies, users, services and audits.
6.Tested kms auditor is able to only view policies, users, services, audits and keys.
7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
8.Auditor role users are not allowed to import/export policies
9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
Thanks,
Fatima Khan
Re: Review Request 65914: Ranger 1948 : Support for Read-only Ranger
Admin users
Posted by Velmurugan Periasamy <vp...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/#review198728
-----------------------------------------------------------
security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java
Lines 127 (patched)
<https://reviews.apache.org/r/65914/#comment278952>
Handle condition if session is null
security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java
Lines 731 (patched)
<https://reviews.apache.org/r/65914/#comment278953>
Handle condition if session is null
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
Lines 1558 (patched)
<https://reviews.apache.org/r/65914/#comment278954>
Both conditions are setting isAccessible to false. Can this be simplified?
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
Lines 1565 (patched)
<https://reviews.apache.org/r/65914/#comment278955>
Both conditions are setting isAccessible to false. Can this be simplified?
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
Line 670 (original), 671 (patched)
<https://reviews.apache.org/r/65914/#comment278951>
Why is this call repeated? See line 669.
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
Lines 4097 (patched)
<https://reviews.apache.org/r/65914/#comment278956>
Handle condition if session is null
security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java
Lines 1331 (patched)
<https://reviews.apache.org/r/65914/#comment278957>
Handle condition if session is null.
security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
Lines 1355 (patched)
<https://reviews.apache.org/r/65914/#comment278958>
Handle condition if session is null
security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java
Lines 128 (patched)
<https://reviews.apache.org/r/65914/#comment278960>
Handle condition if session is null
security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
Lines 2291 (patched)
<https://reviews.apache.org/r/65914/#comment278961>
Handle condition if session is null
security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java
Lines 580 (patched)
<https://reviews.apache.org/r/65914/#comment278965>
Handle condition if session is null
- Velmurugan Periasamy
On March 6, 2018, 7:08 a.m., Fatima Khan wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/65914/
> -----------------------------------------------------------
>
> (Updated March 6, 2018, 7:08 a.m.)
>
>
> Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
>
>
> Bugs: Ranger-1948
> https://issues.apache.org/jira/browse/Ranger-1948
>
>
> Repository: ranger
>
>
> Description
> -------
>
> This Jira is to cater to need of Auditor roles in Ranger Admin.
>
> We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
> * Auditor (Readonly privileges from current Admin role user )
> * KMS Auditor (Readonly privileges from current Keydmin role user )
>
>
> Diffs
> -----
>
> security-admin/scripts/rolebasedusersearchutil.py d651461
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java 840bb38
> security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
> security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
> security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
> security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 8341a73
> security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
> security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
> security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java b713d12
> security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
> security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 0e99be1
> security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
> security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
> security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java cb7ca52
> security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java 9c19bb0
> security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java 9a9604f
> security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
> security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
> security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
> unixauthservice/scripts/install.properties 88bce69
>
>
> Diff: https://reviews.apache.org/r/65914/diff/1/
>
>
> Testing
> -------
>
> Tested scenario's:
> 1.Tested admin user is able to create User role user.
> 2.Tested admin user is able to create Auditor role user.
> 3.Tested admin user is not able to create kms auditor role user.
> 4.Tested keyadmin user is able to create kms auditor.
> 5.Tested auditor is able to only view policies, users, services and audits.
> 6.Tested kms auditor is able to only view policies, users, services, audits and keys.
> 7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
> 8.Auditor role users are not allowed to import/export policies
> 9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
>
>
> Thanks,
>
> Fatima Khan
>
>
Re: Review Request 65914: Ranger 1948 : Support for Read-only Ranger
Admin users
Posted by Pradeep Agrawal <pr...@freestoneinfotech.com>.
> On March 7, 2018, 10:43 a.m., Zsombor Gegesy wrote:
> > security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java
> > Lines 580 (patched)
> > <https://reviews.apache.org/r/65914/diff/2/?file=1972206#file1972206line580>
> >
> > The same blockAuditorRoleUser method is copied everywhere.
> >
> > Please move this method to a separate service, and write a unit test for it. As it is called everywhere it is important to work as expected
@Fatima : I think you can copy that method in RangerBizUtil.java file. see if that can fit there and works fine.
- Pradeep
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/#review198779
-----------------------------------------------------------
On March 7, 2018, 9:03 a.m., Fatima Khan wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/65914/
> -----------------------------------------------------------
>
> (Updated March 7, 2018, 9:03 a.m.)
>
>
> Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
>
>
> Bugs: Ranger-1948
> https://issues.apache.org/jira/browse/Ranger-1948
>
>
> Repository: ranger
>
>
> Description
> -------
>
> This Jira is to cater to need of Auditor roles in Ranger Admin.
>
> We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
> * Auditor (Readonly privileges from current Admin role user )
> * KMS Auditor (Readonly privileges from current Keydmin role user )
>
>
> Diffs
> -----
>
> security-admin/scripts/rolebasedusersearchutil.py d651461
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java 840bb38
> security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
> security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
> security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
> security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 8341a73
> security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
> security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
> security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
> security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
> security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 0e99be1
> security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
> security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
> security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java cb7ca52
> security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java 9c19bb0
> security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
> security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
> security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
> security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
> unixauthservice/scripts/install.properties 88bce69
>
>
> Diff: https://reviews.apache.org/r/65914/diff/2/
>
>
> Testing
> -------
>
> Tested scenario's:
> 1.Tested admin user is able to create User role user.
> 2.Tested admin user is able to create Auditor role user.
> 3.Tested admin user is not able to create kms auditor role user.
> 4.Tested keyadmin user is able to create kms auditor.
> 5.Tested auditor is able to only view policies, users, services and audits.
> 6.Tested kms auditor is able to only view policies, users, services, audits and keys.
> 7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
> 8.Auditor role users are not allowed to import/export policies
> 9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
>
>
> Thanks,
>
> Fatima Khan
>
>
Re: Review Request 65914: Ranger 1948 : Support for Read-only Ranger
Admin users
Posted by Zsombor Gegesy <zs...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/#review198779
-----------------------------------------------------------
security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java
Lines 133 (patched)
<https://reviews.apache.org/r/65914/#comment279017>
session is not null here
security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java
Lines 738 (patched)
<https://reviews.apache.org/r/65914/#comment279018>
session is not null here
security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java
Lines 580 (patched)
<https://reviews.apache.org/r/65914/#comment279019>
The same blockAuditorRoleUser method is copied everywhere.
Please move this method to a separate service, and write a unit test for it. As it is called everywhere it is important to work as expected
- Zsombor Gegesy
On March 7, 2018, 9:03 a.m., Fatima Khan wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/65914/
> -----------------------------------------------------------
>
> (Updated March 7, 2018, 9:03 a.m.)
>
>
> Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
>
>
> Bugs: Ranger-1948
> https://issues.apache.org/jira/browse/Ranger-1948
>
>
> Repository: ranger
>
>
> Description
> -------
>
> This Jira is to cater to need of Auditor roles in Ranger Admin.
>
> We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
> * Auditor (Readonly privileges from current Admin role user )
> * KMS Auditor (Readonly privileges from current Keydmin role user )
>
>
> Diffs
> -----
>
> security-admin/scripts/rolebasedusersearchutil.py d651461
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java 840bb38
> security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
> security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
> security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
> security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 8341a73
> security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
> security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
> security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
> security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
> security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 0e99be1
> security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
> security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
> security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java cb7ca52
> security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java 9c19bb0
> security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
> security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
> security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
> security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
> unixauthservice/scripts/install.properties 88bce69
>
>
> Diff: https://reviews.apache.org/r/65914/diff/2/
>
>
> Testing
> -------
>
> Tested scenario's:
> 1.Tested admin user is able to create User role user.
> 2.Tested admin user is able to create Auditor role user.
> 3.Tested admin user is not able to create kms auditor role user.
> 4.Tested keyadmin user is able to create kms auditor.
> 5.Tested auditor is able to only view policies, users, services and audits.
> 6.Tested kms auditor is able to only view policies, users, services, audits and keys.
> 7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
> 8.Auditor role users are not allowed to import/export policies
> 9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
>
>
> Thanks,
>
> Fatima Khan
>
>
Re: Review Request 65914: RANGER 1948 : Support for Read-only Ranger
Admin users
Posted by Pradeep Agrawal <pr...@freestoneinfotech.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/#review199247
-----------------------------------------------------------
Ship it!
Ship It!
- Pradeep Agrawal
On March 13, 2018, 1:43 p.m., Fatima Khan wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/65914/
> -----------------------------------------------------------
>
> (Updated March 13, 2018, 1:43 p.m.)
>
>
> Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
>
>
> Bugs: RANGER-1948
> https://issues.apache.org/jira/browse/RANGER-1948
>
>
> Repository: ranger
>
>
> Description
> -------
>
> This Jira is to cater to need of Auditor roles in Ranger Admin.
>
> We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
> * Auditor (Readonly privileges from current Admin role user )
> * KMS Auditor (Readonly privileges from current Keydmin role user )
>
>
> Diffs
> -----
>
> security-admin/scripts/rolebasedusersearchutil.py d651461
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
> security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
> security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
> security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
> security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
> security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
> security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
> security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
> security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
> security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
> security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 229863e
> security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
> security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
> security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
> security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
> security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 4a8d88f
> unixauthservice/scripts/install.properties be8723c
>
>
> Diff: https://reviews.apache.org/r/65914/diff/5/
>
>
> Testing
> -------
>
> Tested scenario's:
> 1.Tested admin user is able to create User role user.
> 2.Tested admin user is able to create Auditor role user.
> 3.Tested admin user is not able to create kms auditor role user.
> 4.Tested keyadmin user is able to create kms auditor.
> 5.Tested auditor is able to only view policies, users, services and audits.
> 6.Tested kms auditor is able to only view policies, users, services, audits and keys.
> 7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
> 8.Auditor role users are not allowed to import/export policies
> 9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
>
>
> Thanks,
>
> Fatima Khan
>
>
Re: Review Request 65914: RANGER 1948 : Support for Read-only Ranger
Admin users
Posted by Velmurugan Periasamy <vp...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/#review199238
-----------------------------------------------------------
Ship it!
Ship It!
- Velmurugan Periasamy
On March 13, 2018, 1:43 p.m., Fatima Khan wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/65914/
> -----------------------------------------------------------
>
> (Updated March 13, 2018, 1:43 p.m.)
>
>
> Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
>
>
> Bugs: RANGER-1948
> https://issues.apache.org/jira/browse/RANGER-1948
>
>
> Repository: ranger
>
>
> Description
> -------
>
> This Jira is to cater to need of Auditor roles in Ranger Admin.
>
> We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
> * Auditor (Readonly privileges from current Admin role user )
> * KMS Auditor (Readonly privileges from current Keydmin role user )
>
>
> Diffs
> -----
>
> security-admin/scripts/rolebasedusersearchutil.py d651461
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
> security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
> security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
> security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
> security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
> security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
> security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
> security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
> security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
> security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
> security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 229863e
> security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
> security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
> security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
> security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
> security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 4a8d88f
> unixauthservice/scripts/install.properties be8723c
>
>
> Diff: https://reviews.apache.org/r/65914/diff/5/
>
>
> Testing
> -------
>
> Tested scenario's:
> 1.Tested admin user is able to create User role user.
> 2.Tested admin user is able to create Auditor role user.
> 3.Tested admin user is not able to create kms auditor role user.
> 4.Tested keyadmin user is able to create kms auditor.
> 5.Tested auditor is able to only view policies, users, services and audits.
> 6.Tested kms auditor is able to only view policies, users, services, audits and keys.
> 7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
> 8.Auditor role users are not allowed to import/export policies
> 9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
>
>
> Thanks,
>
> Fatima Khan
>
>
Re: Review Request 65914: RANGER 1948 : Support for Read-only Ranger
Admin users
Posted by Fatima Khan <fa...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/
-----------------------------------------------------------
(Updated March 13, 2018, 1:43 p.m.)
Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
Summary (updated)
-----------------
RANGER 1948 : Support for Read-only Ranger Admin users
Bugs: RANGER-1948
https://issues.apache.org/jira/browse/RANGER-1948
Repository: ranger
Description
-------
This Jira is to cater to need of Auditor roles in Ranger Admin.
We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
* Auditor (Readonly privileges from current Admin role user )
* KMS Auditor (Readonly privileges from current Keydmin role user )
Diffs (updated)
-----
security-admin/scripts/rolebasedusersearchutil.py d651461
security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 229863e
security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 4a8d88f
unixauthservice/scripts/install.properties be8723c
Diff: https://reviews.apache.org/r/65914/diff/5/
Changes: https://reviews.apache.org/r/65914/diff/4-5/
Testing
-------
Tested scenario's:
1.Tested admin user is able to create User role user.
2.Tested admin user is able to create Auditor role user.
3.Tested admin user is not able to create kms auditor role user.
4.Tested keyadmin user is able to create kms auditor.
5.Tested auditor is able to only view policies, users, services and audits.
6.Tested kms auditor is able to only view policies, users, services, audits and keys.
7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
8.Auditor role users are not allowed to import/export policies
9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
Thanks,
Fatima Khan
Re: Review Request 65914: Ranger 1948 : Support for Read-only Ranger
Admin users
Posted by Fatima Khan <fa...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/
-----------------------------------------------------------
(Updated March 12, 2018, 1:33 p.m.)
Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
Bugs: Ranger-1948
https://issues.apache.org/jira/browse/Ranger-1948
Repository: ranger
Description
-------
This Jira is to cater to need of Auditor roles in Ranger Admin.
We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
* Auditor (Readonly privileges from current Admin role user )
* KMS Auditor (Readonly privileges from current Keydmin role user )
Diffs (updated)
-----
security-admin/scripts/rolebasedusersearchutil.py d651461
security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 229863e
security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 4a8d88f
unixauthservice/scripts/install.properties be8723c
Diff: https://reviews.apache.org/r/65914/diff/4/
Changes: https://reviews.apache.org/r/65914/diff/3-4/
Testing
-------
Tested scenario's:
1.Tested admin user is able to create User role user.
2.Tested admin user is able to create Auditor role user.
3.Tested admin user is not able to create kms auditor role user.
4.Tested keyadmin user is able to create kms auditor.
5.Tested auditor is able to only view policies, users, services and audits.
6.Tested kms auditor is able to only view policies, users, services, audits and keys.
7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
8.Auditor role users are not allowed to import/export policies
9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
Thanks,
Fatima Khan
Re: Review Request 65914: Ranger 1948 : Support for Read-only Ranger
Admin users
Posted by Velmurugan Periasamy <vp...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/#review198882
-----------------------------------------------------------
security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
Lines 150 (patched)
<https://reviews.apache.org/r/65914/#comment279123>
This patch fails existing unit tests. Need to be fixed.
```
-------------------------------------------------------------------------------
Test set: org.apache.ranger.biz.TestUserMgr
-------------------------------------------------------------------------------
Tests run: 23, Failures: 1, Errors: 15, Skipped: 0, Time elapsed: 0.443 sec <<< FAILURE! - in org.apache.ranger.biz.TestUserMgr
test11CreateUser(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.029 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.createUser(UserMgr.java:150)
at org.apache.ranger.biz.TestUserMgr.test11CreateUser(TestUserMgr.java:192)
test12CreateUser(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.001 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.createUser(UserMgr.java:183)
at org.apache.ranger.biz.TestUserMgr.test12CreateUser(TestUserMgr.java:245)
test13ChangePasswordAsAdmin(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.003 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.changePassword(UserMgr.java:407)
at org.apache.ranger.biz.TestUserMgr.test13ChangePasswordAsAdmin(TestUserMgr.java:292)
test14ChangePasswordAsKeyAdmin(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.001 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.changePassword(UserMgr.java:407)
at org.apache.ranger.biz.TestUserMgr.test14ChangePasswordAsKeyAdmin(TestUserMgr.java:325)
test15ChangePasswordAsUser(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.001 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.changePassword(UserMgr.java:407)
at org.apache.ranger.biz.TestUserMgr.test15ChangePasswordAsUser(TestUserMgr.java:355)
test16ChangeEmailAddressAsAdmin(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.067 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.changeEmailAddress(UserMgr.java:468)
at org.apache.ranger.biz.TestUserMgr.test16ChangeEmailAddressAsAdmin(TestUserMgr.java:453)
test17ChangeEmailAddressAsKeyAdmin(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.001 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.changeEmailAddress(UserMgr.java:468)
at org.apache.ranger.biz.TestUserMgr.test17ChangeEmailAddressAsKeyAdmin(TestUserMgr.java:554)
test18ChangeEmailAddressAsUser(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.001 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.changeEmailAddress(UserMgr.java:468)
at org.apache.ranger.biz.TestUserMgr.test18ChangeEmailAddressAsUser(TestUserMgr.java:652)
test19updateRoles(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.updateRoles(UserMgr.java:343)
at org.apache.ranger.biz.TestUserMgr.test19updateRoles(TestUserMgr.java:1247)
test20UpdateUserWithPass(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.updatePasswordInSHA256(UserMgr.java:1306)
at org.apache.ranger.biz.TestUserMgr.test20UpdateUserWithPass(TestUserMgr.java:1271)
test21CreateUser(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.001 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.createUser(UserMgr.java:1119)
at org.apache.ranger.biz.TestUserMgr.test21CreateUser(TestUserMgr.java:713)
test22CreateDefaultAccountUser(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.001 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.createDefaultAccountUser(UserMgr.java:1132)
at org.apache.ranger.biz.TestUserMgr.test22CreateDefaultAccountUser(TestUserMgr.java:749)
test24UpdateUserWithPass(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.033 sec <<< FAILURE!
java.lang.AssertionError:
Expected: an instance of javax.ws.rs.WebApplicationException
but: <java.lang.NullPointerException> is a java.lang.NullPointerException
Stacktrace was: java.lang.NullPointerException
at org.apache.ranger.biz.UserMgr.updateUserWithPass(UserMgr.java:1271)
at org.apache.ranger.biz.TestUserMgr.test24UpdateUserWithPass(TestUserMgr.java:803)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.rules.ExpectedException$ExpectedExceptionStatement.evaluate(ExpectedException.java:239)
at org.junit.rules.RunRules.evaluate(RunRules.java:20)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
at org.mockito.internal.runners.DefaultInternalRunner$1.run(DefaultInternalRunner.java:68)
at org.mockito.internal.runners.DefaultInternalRunner.run(DefaultInternalRunner.java:74)
at org.mockito.internal.runners.StrictRunner.run(StrictRunner.java:39)
at org.mockito.junit.MockitoJUnitRunner.run(MockitoJUnitRunner.java:161)
at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:283)
at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:173)
at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:153)
at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:128)
at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:203)
at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:155)
at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103)
at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
at org.junit.Assert.assertThat(Assert.java:956)
at org.junit.Assert.assertThat(Assert.java:923)
at org.junit.rules.ExpectedException.handleException(ExpectedException.java:252)
at org.junit.rules.ExpectedException.access$000(ExpectedException.java:106)
at org.junit.rules.ExpectedException$ExpectedExceptionStatement.evaluate(ExpectedException.java:241)
at org.junit.rules.RunRules.evaluate(RunRules.java:20)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
at org.mockito.internal.runners.DefaultInternalRunner$1.run(DefaultInternalRunner.java:68)
at org.mockito.internal.runners.DefaultInternalRunner.run(DefaultInternalRunner.java:74)
at org.mockito.internal.runners.StrictRunner.run(StrictRunner.java:39)
at org.mockito.junit.MockitoJUnitRunner.run(MockitoJUnitRunner.java:161)
at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:283)
at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:173)
at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:153)
at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:128)
at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:203)
at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:155)
at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103)
test28DeleteUserRole(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.001 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.deleteUserRole(UserMgr.java:965)
at org.apache.ranger.biz.UserMgr.deleteUserRole(UserMgr.java:954)
at org.apache.ranger.biz.TestUserMgr.test28DeleteUserRole(TestUserMgr.java:912)
test29DeactivateUser(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.036 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.deactivateUser(UserMgr.java:516)
at org.apache.ranger.biz.TestUserMgr.test29DeactivateUser(TestUserMgr.java:1006)
test33setUserRoles(org.apache.ranger.biz.TestUserMgr) Time elapsed: 0.004 sec <<< ERROR!
java.lang.NullPointerException: null
at org.apache.ranger.biz.UserMgr.setUserRoles(UserMgr.java:391)
at org.apache.ranger.biz.TestUserMgr.test33setUserRoles(TestUserMgr.java:1223)
```
- Velmurugan Periasamy
On March 8, 2018, 11:31 a.m., Fatima Khan wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/65914/
> -----------------------------------------------------------
>
> (Updated March 8, 2018, 11:31 a.m.)
>
>
> Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
>
>
> Bugs: Ranger-1948
> https://issues.apache.org/jira/browse/Ranger-1948
>
>
> Repository: ranger
>
>
> Description
> -------
>
> This Jira is to cater to need of Auditor roles in Ranger Admin.
>
> We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
> * Auditor (Readonly privileges from current Admin role user )
> * KMS Auditor (Readonly privileges from current Keydmin role user )
>
>
> Diffs
> -----
>
> security-admin/scripts/rolebasedusersearchutil.py d651461
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
> security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java 840bb38
> security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
> security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
> security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
> security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 8341a73
> security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
> security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
> security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
> security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
> security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 0e99be1
> security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
> security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
> security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
> security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java cb7ca52
> security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java 9c19bb0
> security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
> security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
> security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
> security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
> unixauthservice/scripts/install.properties be8723c
>
>
> Diff: https://reviews.apache.org/r/65914/diff/3/
>
>
> Testing
> -------
>
> Tested scenario's:
> 1.Tested admin user is able to create User role user.
> 2.Tested admin user is able to create Auditor role user.
> 3.Tested admin user is not able to create kms auditor role user.
> 4.Tested keyadmin user is able to create kms auditor.
> 5.Tested auditor is able to only view policies, users, services and audits.
> 6.Tested kms auditor is able to only view policies, users, services, audits and keys.
> 7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
> 8.Auditor role users are not allowed to import/export policies
> 9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
>
>
> Thanks,
>
> Fatima Khan
>
>
Re: Review Request 65914: Ranger 1948 : Support for Read-only Ranger
Admin users
Posted by Fatima Khan <fa...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/
-----------------------------------------------------------
(Updated March 8, 2018, 11:31 a.m.)
Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
Bugs: Ranger-1948
https://issues.apache.org/jira/browse/Ranger-1948
Repository: ranger
Description
-------
This Jira is to cater to need of Auditor roles in Ranger Admin.
We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
* Auditor (Readonly privileges from current Admin role user )
* KMS Auditor (Readonly privileges from current Keydmin role user )
Diffs (updated)
-----
security-admin/scripts/rolebasedusersearchutil.py d651461
security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java 840bb38
security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 8341a73
security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 0e99be1
security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java cb7ca52
security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java 9c19bb0
security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
unixauthservice/scripts/install.properties be8723c
Diff: https://reviews.apache.org/r/65914/diff/3/
Changes: https://reviews.apache.org/r/65914/diff/2-3/
Testing
-------
Tested scenario's:
1.Tested admin user is able to create User role user.
2.Tested admin user is able to create Auditor role user.
3.Tested admin user is not able to create kms auditor role user.
4.Tested keyadmin user is able to create kms auditor.
5.Tested auditor is able to only view policies, users, services and audits.
6.Tested kms auditor is able to only view policies, users, services, audits and keys.
7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
8.Auditor role users are not allowed to import/export policies
9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
Thanks,
Fatima Khan
Re: Review Request 65914: Ranger 1948 : Support for Read-only Ranger
Admin users
Posted by Fatima Khan <fa...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/65914/
-----------------------------------------------------------
(Updated March 7, 2018, 9:03 a.m.)
Review request for ranger, Don Bosco Durai, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, and Sailaja Polavarapu.
Bugs: Ranger-1948
https://issues.apache.org/jira/browse/Ranger-1948
Repository: ranger
Description
-------
This Jira is to cater to need of Auditor roles in Ranger Admin.
We can introduce Auditor Roles for both the Administrator Roles in Ranger Admin.
* Auditor (Readonly privileges from current Admin role user )
* KMS Auditor (Readonly privileges from current Keydmin role user )
Diffs (updated)
-----
security-admin/scripts/rolebasedusersearchutil.py d651461
security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java 15937c7
security-admin/src/main/java/org/apache/ranger/biz/AssetMgrBase.java 840bb38
security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java 03bcb60
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 224f1a0
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java ecde444
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java a989c84
security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java 9eb8f1f
security-admin/src/main/java/org/apache/ranger/biz/TagDBStore.java 8341a73
security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java a110035
security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java c2fac0b
security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java 487fefa
security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java e31e9d7
security-admin/src/main/java/org/apache/ranger/common/ServiceUtil.java 0e99be1
security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java bcf9080
security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java d3a28f7
security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java 9f7cd26
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java cb7ca52
security-admin/src/main/java/org/apache/ranger/rest/ServiceTagsProcessor.java 9c19bb0
security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java c81a6f3
security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java 6951cbd
security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java 4227d85
security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml 87da9a0
unixauthservice/scripts/install.properties 88bce69
Diff: https://reviews.apache.org/r/65914/diff/2/
Changes: https://reviews.apache.org/r/65914/diff/1-2/
Testing
-------
Tested scenario's:
1.Tested admin user is able to create User role user.
2.Tested admin user is able to create Auditor role user.
3.Tested admin user is not able to create kms auditor role user.
4.Tested keyadmin user is able to create kms auditor.
5.Tested auditor is able to only view policies, users, services and audits.
6.Tested kms auditor is able to only view policies, users, services, audits and keys.
7.Tested auditor is able to see permission tab but kms auditor should not see permission tab.
8.Auditor role users are not allowed to import/export policies
9.Verified syncing of users from auditor role :: if we add them in properties install.properties of usersync during initial start of usersync.Property value in install.properties will be GROUP_BASED_ROLE_ASSIGNMENT_RULES= &ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
Thanks,
Fatima Khan