You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2015/06/14 02:56:50 UTC
[1/6] incubator-ranger git commit: RANGER-549: fix updateService()
using Public API fails
Repository: incubator-ranger
Updated Branches:
refs/heads/tag-policy ea3bcb38e -> 96e450a43
RANGER-549: fix updateService() using Public API fails
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/12ab54a0
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/12ab54a0
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/12ab54a0
Branch: refs/heads/tag-policy
Commit: 12ab54a0eb2a35c5bb9428c83dd003ce82732bab
Parents: c5f61c8
Author: Madhan Neethiraj <ma...@apache.org>
Authored: Fri Jun 12 01:12:28 2015 -0700
Committer: Madhan Neethiraj <ma...@apache.org>
Committed: Fri Jun 12 01:12:28 2015 -0700
----------------------------------------------------------------------
.../ranger/plugin/model/validation/RangerServiceValidator.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/12ab54a0/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java
----------------------------------------------------------------------
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java
index 659249e..615e385 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java
@@ -150,7 +150,7 @@ public class RangerServiceValidator extends RangerValidator {
.becauseOf("service with the name[" + name + "] already exists")
.build());
valid = false;
- } else if (otherService != null && otherService.getId() !=null && otherService.getId() != id) {
+ } else if (otherService != null && otherService.getId() !=null && !otherService.getId().equals(id)) {
failures.add(new ValidationFailureDetailsBuilder()
.field("id/name")
.isSemanticallyIncorrect()
[5/6] incubator-ranger git commit: RANGER-553 Default policy creation
during service creation should handle service defs with multiple hierarchies,
e.g. hive, properly
Posted by ma...@apache.org.
RANGER-553 Default policy creation during service creation should handle service defs with multiple hierarchies, e.g. hive, properly
Signed-off-by: Madhan Neethiraj <ma...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/d85beb4e
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/d85beb4e
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/d85beb4e
Branch: refs/heads/tag-policy
Commit: d85beb4e4ca214e57b748e1ec55ab6929cf06494
Parents: a1706e8
Author: Alok Lal <al...@hortonworks.com>
Authored: Fri Jun 12 19:09:13 2015 -0700
Committer: Madhan Neethiraj <ma...@apache.org>
Committed: Sat Jun 13 09:55:29 2015 -0700
----------------------------------------------------------------------
.../org/apache/ranger/biz/ServiceDBStore.java | 69 +++++++++++---------
1 file changed, 38 insertions(+), 31 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/d85beb4e/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
index d57f0be..ff04d3f 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
@@ -100,6 +100,7 @@ import org.apache.ranger.plugin.model.RangerServiceDef.RangerEnumElementDef;
import org.apache.ranger.plugin.model.RangerServiceDef.RangerPolicyConditionDef;
import org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef;
import org.apache.ranger.plugin.model.RangerServiceDef.RangerServiceConfigDef;
+import org.apache.ranger.plugin.model.validation.RangerServiceDefHelper;
import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil;
import org.apache.ranger.plugin.store.ServicePredicateUtil;
import org.apache.ranger.plugin.store.ServiceStore;
@@ -1065,7 +1066,7 @@ public class ServiceDBStore implements ServiceStore {
bizUtil.createTrxLog(trxLogList);
if (createDefaultPolicy) {
- createDefaultPolicy(xCreatedService, vXUser);
+ createDefaultPolicies(xCreatedService, vXUser);
}
return createdService;
@@ -1669,9 +1670,20 @@ public class ServiceDBStore implements ServiceStore {
return ret;
}
- private void createDefaultPolicy(XXService createdService, VXUser vXUser) throws Exception {
+ private void createDefaultPolicies(XXService createdService, VXUser vXUser) throws Exception {
+ // we need to create one policy for each resource hierarchy
+ RangerServiceDef serviceDef = getServiceDef(createdService.getType());
+ RangerServiceDefHelper serviceDefHelper = new RangerServiceDefHelper(serviceDef);
+ int i = 1;
+ for (List<RangerResourceDef> aHierarchy : serviceDefHelper.getResourceHierarchies()) {
+ createDefaultPolicy(createdService, vXUser, aHierarchy, i);
+ i++;
+ }
+ }
+
+ private void createDefaultPolicy(XXService createdService, VXUser vXUser, List<RangerResourceDef> resourceHierarchy, int num) throws Exception {
RangerPolicy policy = new RangerPolicy();
- String policyName=createdService.getName()+"-"+1+"-"+DateUtil.dateToString(DateUtil.getUTCDate(),"yyyyMMddHHmmss");
+ String policyName=createdService.getName()+"-"+num+"-"+DateUtil.dateToString(DateUtil.getUTCDate(),"yyyyMMddHHmmss");
policy.setIsEnabled(true);
policy.setVersion(1L);
@@ -1680,34 +1692,7 @@ public class ServiceDBStore implements ServiceStore {
policy.setDescription("Default Policy for Service: " + createdService.getName());
policy.setIsAuditEnabled(true);
- Map<String, RangerPolicyResource> resources = new HashMap<String, RangerPolicyResource>();
- List<XXResourceDef> resDefList = daoMgr.getXXResourceDef().findByServiceDefId(createdService.getType());
-
- for(XXResourceDef resDef : resDefList) {
- // for hive, 2 policies should be created: 1) database/table/column 2) database/udf
- // until we support multiple default policies creation - one for each resource hierarchy,
- // lets just skip udf in the resoure list
- if("udf".equalsIgnoreCase(resDef.getName())) {
- continue;
- }
-
- RangerPolicyResource polRes = new RangerPolicyResource();
- polRes.setIsExcludes(false);
- polRes.setIsRecursive(false);
-
- String value = "*";
- if("path".equalsIgnoreCase(resDef.getName())) {
- value = "/*";
- }
-
- if(resDef.getRecursivesupported()) {
- polRes.setIsRecursive(Boolean.TRUE);
- }
-
- polRes.setValue(value);
- resources.put(resDef.getName(), polRes);
- }
- policy.setResources(resources);
+ policy.setResources(createDefaultPolicyResource(resourceHierarchy));
if (vXUser != null) {
List<RangerPolicyItem> policyItems = new ArrayList<RangerPolicyItem>();
@@ -1742,6 +1727,28 @@ public class ServiceDBStore implements ServiceStore {
policy = createPolicy(policy);
}
+ Map<String, RangerPolicyResource> createDefaultPolicyResource(List<RangerResourceDef> resourceHierarchy) throws Exception {
+ Map<String, RangerPolicyResource> resourceMap = new HashMap<>();
+
+ for (RangerResourceDef resourceDef : resourceHierarchy) {
+ RangerPolicyResource polRes = new RangerPolicyResource();
+ polRes.setIsExcludes(false);
+ polRes.setIsRecursive(false);
+
+ String value = "*";
+ if("path".equalsIgnoreCase(resourceDef.getName())) {
+ value = "/*";
+ }
+
+ if(resourceDef.getRecursiveSupported()) {
+ polRes.setIsRecursive(Boolean.TRUE);
+ }
+
+ polRes.setValue(value);
+ resourceMap.put(resourceDef.getName(), polRes);
+ }
+ return resourceMap;
+ }
private Map<String, String> validateRequiredConfigParams(RangerService service, Map<String, String> configs) {
if(LOG.isDebugEnabled()) {
[4/6] incubator-ranger git commit: RANGER-549 updating the tests so
it would have failed without the fix that was checked in prior
Posted by ma...@apache.org.
RANGER-549 updating the tests so it would have failed without the fix that was checked in prior
Signed-off-by: Madhan Neethiraj <ma...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/a1706e83
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/a1706e83
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/a1706e83
Branch: refs/heads/tag-policy
Commit: a1706e83da238f23b036fdb95265bc68298ff9a8
Parents: bef9c7a
Author: Alok Lal <al...@hortonworks.com>
Authored: Fri Jun 12 12:40:04 2015 -0700
Committer: Madhan Neethiraj <ma...@apache.org>
Committed: Sat Jun 13 09:38:16 2015 -0700
----------------------------------------------------------------------
.../ranger/plugin/model/validation/TestRangerServiceValidator.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/a1706e83/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceValidator.java
----------------------------------------------------------------------
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceValidator.java b/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceValidator.java
index 6c20f0d..4b0fdbf 100644
--- a/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceValidator.java
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceValidator.java
@@ -196,7 +196,7 @@ public class TestRangerServiceValidator {
// if name is not null and it points to a service then it should match the id
when(service.getId()).thenReturn(7L);
RangerService existingService = mock(RangerService.class);
- when(existingService.getId()).thenReturn(7L);
+ when(existingService.getId()).thenReturn(new Long(7L));
when(_store.getService(7L)).thenReturn(existingService);
when(_store.getServiceByName("aName")).thenReturn(existingService);
assertTrue(_validator.isValid(service, Action.UPDATE, _failures));
[6/6] incubator-ranger git commit: Merge branch 'master' into
tag-policy
Posted by ma...@apache.org.
Merge branch 'master' into tag-policy
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/96e450a4
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/96e450a4
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/96e450a4
Branch: refs/heads/tag-policy
Commit: 96e450a43dabbf924665190c561dd6f30ec00be5
Parents: ea3bcb3 d85beb4
Author: Madhan Neethiraj <ma...@apache.org>
Authored: Sat Jun 13 17:56:39 2015 -0700
Committer: Madhan Neethiraj <ma...@apache.org>
Committed: Sat Jun 13 17:56:39 2015 -0700
----------------------------------------------------------------------
.../validation/RangerServiceValidator.java | 2 +-
.../validation/TestRangerServiceValidator.java | 2 +-
.../authorizer/RangerHiveAccessRequest.java | 2 +-
.../hive/authorizer/RangerHiveAuditHandler.java | 32 ----
.../hive/authorizer/RangerHiveAuthorizer.java | 181 +++++++------------
.../hadoop/crypto/key/RangerKeyStore.java | 13 +-
.../crypto/key/RangerKeyStoreProvider.java | 57 ++++--
.../hadoop/crypto/key/kms/server/KMS.java | 16 +-
.../apache/ranger/entity/XXRangerKeyStore.java | 2 +
.../java/org/apache/ranger/kms/dao/BaseDao.java | 16 +-
.../org/apache/ranger/kms/dao/RangerKMSDao.java | 7 +
.../META-INF/kms_jpa_named_queries.xml | 5 +
kms/src/main/resources/META-INF/persistence.xml | 7 +-
.../org/apache/ranger/biz/ServiceDBStore.java | 69 +++----
14 files changed, 201 insertions(+), 210 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/96e450a4/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java
----------------------------------------------------------------------
diff --cc agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java
index 5518e9f,615e385..7c8c552
--- a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceValidator.java
@@@ -146,17 -145,17 +146,17 @@@ public class RangerServiceValidator ext
RangerService otherService = getService(name);
if (otherService != null && action == Action.CREATE) {
failures.add(new ValidationFailureDetailsBuilder()
- .field("name")
- .isSemanticallyIncorrect()
- .becauseOf("service with the name[" + name + "] already exists")
- .build());
+ .field("name")
+ .isSemanticallyIncorrect()
+ .becauseOf("service with the name[" + name + "] already exists")
+ .build());
valid = false;
- } else if (otherService != null && otherService.getId() != null && otherService.getId() != id) {
+ } else if (otherService != null && otherService.getId() !=null && !otherService.getId().equals(id)) {
failures.add(new ValidationFailureDetailsBuilder()
- .field("id/name")
- .isSemanticallyIncorrect()
- .becauseOf("id/name conflict: another service already exists with name[" + name + "], its id is [" + otherService.getId() + "]")
- .build());
+ .field("id/name")
+ .isSemanticallyIncorrect()
+ .becauseOf("id/name conflict: another service already exists with name[" + name + "], its id is [" + otherService.getId() + "]")
+ .build());
valid = false;
}
}
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/96e450a4/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
----------------------------------------------------------------------
diff --cc security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
index 7cd1f77,ff04d3f..26b1752
--- a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
@@@ -101,7 -100,10 +101,8 @@@ import org.apache.ranger.plugin.model.R
import org.apache.ranger.plugin.model.RangerServiceDef.RangerPolicyConditionDef;
import org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef;
import org.apache.ranger.plugin.model.RangerServiceDef.RangerServiceConfigDef;
+ import org.apache.ranger.plugin.model.validation.RangerServiceDefHelper;
-import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil;
-import org.apache.ranger.plugin.store.ServicePredicateUtil;
-import org.apache.ranger.plugin.store.ServiceStore;
+import org.apache.ranger.plugin.store.*;
import org.apache.ranger.plugin.util.SearchFilter;
import org.apache.ranger.plugin.util.ServicePolicies;
import org.apache.ranger.service.RangerAuditFields;
@@@ -1074,12 -1065,8 +1075,12 @@@ public class ServiceDBStore extends Abs
RangerServiceService.OPERATION_CREATE_CONTEXT);
bizUtil.createTrxLog(trxLogList);
+ if (createdService.getType().equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME)) {
+ createDefaultPolicy = false;
+ }
+
if (createDefaultPolicy) {
- createDefaultPolicy(xCreatedService, vXUser);
+ createDefaultPolicies(xCreatedService, vXUser);
}
return createdService;
[3/6] incubator-ranger git commit: RANGER-550 Hive plugin: Add
support for allowed/denied auditing for metadata commands with filtering
support from hive.
Posted by ma...@apache.org.
RANGER-550 Hive plugin: Add support for allowed/denied auditing for metadata commands with filtering support from hive.
Signed-off-by: Madhan Neethiraj <ma...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/bef9c7a4
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/bef9c7a4
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/bef9c7a4
Branch: refs/heads/tag-policy
Commit: bef9c7a4c031e4bbe9c307b0b5df65371c24b3bc
Parents: b70ec70
Author: Alok Lal <al...@hortonworks.com>
Authored: Thu Jun 11 16:45:21 2015 -0700
Committer: Madhan Neethiraj <ma...@apache.org>
Committed: Sat Jun 13 09:29:11 2015 -0700
----------------------------------------------------------------------
.../authorizer/RangerHiveAccessRequest.java | 2 +-
.../hive/authorizer/RangerHiveAuditHandler.java | 32 ----
.../hive/authorizer/RangerHiveAuthorizer.java | 181 +++++++------------
3 files changed, 71 insertions(+), 144 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/bef9c7a4/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java
----------------------------------------------------------------------
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java
index 1f7ae4d..2ae4149 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java
@@ -81,7 +81,7 @@ public class RangerHiveAccessRequest extends RangerAccessRequestImpl {
}
public RangerHiveAccessRequest(RangerHiveResource resource, String user, Set<String> groups, HiveAuthzContext context, HiveAuthzSessionContext sessionContext) {
- this(resource, user, groups, "OTHER", HiveAccessType.USE, context, sessionContext);
+ this(resource, user, groups, "METADATA OPERATION", HiveAccessType.USE, context, sessionContext);
}
public HiveAccessType getHiveAccessType() {
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/bef9c7a4/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java
----------------------------------------------------------------------
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java
index 2675a67..0f13577 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuditHandler.java
@@ -150,38 +150,6 @@ public class RangerHiveAuditHandler extends RangerDefaultAuditHandler {
}
}
- public void logAuditEventForFiltering(RangerAccessResult result, HiveOperationType hiveOpType) {
-
- if(! result.getIsAudited()) {
- return;
- }
-
- RangerHiveAccessRequest request = (RangerHiveAccessRequest)result.getAccessRequest();
- RangerHiveResource resource = (RangerHiveResource)request.getResource();
- String resourcePath = resource.getObjectType().toString();
- String accessType = getAccessTypeForMetaOperation(hiveOpType);
-
- AuthzAuditEvent auditEvent = createAuditEvent(result, accessType, resourcePath);
-
- addAuthzAuditEvent(auditEvent);
- }
-
- String getAccessTypeForMetaOperation(HiveOperationType hiveOperationType) {
- String result;
- switch (hiveOperationType) {
- case SHOWDATABASES:
- result = "SHOW DATABASES";
- break;
- case SHOWTABLES:
- result = "SHOW TABLES";
- break;
- default:
- result = "OTHER METADATA OP";
- break;
- }
- return result;
- }
-
public void logAuditEventForDfs(String userName, String dfsCommand, boolean accessGranted, int repositoryType, String repositoryName) {
AuthzAuditEvent auditEvent = new AuthzAuditEvent();
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/bef9c7a4/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
----------------------------------------------------------------------
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
index 1df1af4..9075b57 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
@@ -26,6 +26,7 @@ import java.util.List;
import java.util.Map;
import java.util.Set;
+import org.apache.commons.collections.CollectionUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -225,7 +226,18 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
List<RangerHiveAccessRequest> requests = new ArrayList<RangerHiveAccessRequest>();
- if(inputHObjs != null) {
+ if(CollectionUtils.isEmpty(inputHObjs)) {
+ // this should happen only for SHOWDATABASES
+ if (hiveOpType == HiveOperationType.SHOWDATABASES) {
+ RangerHiveResource resource = new RangerHiveResource(HiveObjectType.DATABASE, null);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, hiveOpType.name(), HiveAccessType.USE, context, sessionContext);
+ requests.add(request);
+ } else {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("RangerHiveAuthorizer.checkPrivileges: Unexpected operation type[" + hiveOpType + "] received with empty input objects list!");
+ }
+ }
+ } else {
for(HivePrivilegeObject hiveObj : inputHObjs) {
RangerHiveResource resource = getHiveResource(hiveOpType, hiveObj);
@@ -283,76 +295,54 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
}
}
- if (isMetaDataOperation(hiveOpType)) {
- RangerHiveResource resource = getHiveResource(hiveOpType);
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, context, sessionContext);
- RangerAccessResult result = hivePlugin.isAccessAllowed(request);
- if (result == null) {
- LOG.error("Internal error: null RangerAccessResult object received back from isAccessAllowed()!");
- throw new HiveAccessControlException(String.format("Permission denied: user [%s] does not have [%s] privilege",
- user, hiveOpType));
- } else if (!result.getIsAllowed()) {
- String path = resource.getAsString();
- throw new HiveAccessControlException(String.format("Permission denied: user [%s] does not have [%s] privilege on [%s]",
- user, hiveOpType.name(), path));
- } else {
- if (LOG.isDebugEnabled()) {
- LOG.debug(String.format("[%s] allowed on resource[%s]: request[%s], result[%s]", hiveOpType, resource, request, result));
+ for(RangerHiveAccessRequest request : requests) {
+ RangerHiveResource resource = (RangerHiveResource)request.getResource();
+ RangerAccessResult result = null;
+
+ if(resource.getObjectType() == HiveObjectType.COLUMN && StringUtils.contains(resource.getColumn(), COLUMN_SEP)) {
+ List<RangerAccessRequest> colRequests = new ArrayList<RangerAccessRequest>();
+
+ String[] columns = StringUtils.split(resource.getColumn(), COLUMN_SEP);
+
+ // in case of multiple columns, original request is not sent to the plugin; hence service-def will not be set
+ resource.setServiceDef(hivePlugin.getServiceDef());
+
+ for(String column : columns) {
+ if (column != null) {
+ column = column.trim();
+ }
+ if(StringUtils.isBlank(column)) {
+ continue;
+ }
+
+ RangerHiveResource colResource = new RangerHiveResource(HiveObjectType.COLUMN, resource.getDatabase(), resource.getTable(), column);
+
+ RangerHiveAccessRequest colRequest = request.copy();
+ colRequest.setResource(colResource);
+
+ colRequests.add(colRequest);
}
- if (result.getIsAudited()) {
- auditHandler.logAuditEventForFiltering(result, hiveOpType);
+
+ Collection<RangerAccessResult> colResults = hivePlugin.isAccessAllowed(colRequests, auditHandler);
+
+ if(colResults != null) {
+ for(RangerAccessResult colResult : colResults) {
+ result = colResult;
+
+ if(!result.getIsAllowed()) {
+ break;
+ }
+ }
}
+ } else {
+ result = hivePlugin.isAccessAllowed(request, auditHandler);
}
- } else {
- for(RangerHiveAccessRequest request : requests) {
- RangerHiveResource resource = (RangerHiveResource)request.getResource();
- RangerAccessResult result = null;
-
- if(resource.getObjectType() == HiveObjectType.COLUMN && StringUtils.contains(resource.getColumn(), COLUMN_SEP)) {
- List<RangerAccessRequest> colRequests = new ArrayList<RangerAccessRequest>();
-
- String[] columns = StringUtils.split(resource.getColumn(), COLUMN_SEP);
- // in case of multiple columns, original request is not sent to the plugin; hence service-def will not be set
- resource.setServiceDef(hivePlugin.getServiceDef());
-
- for(String column : columns) {
- if (column != null) {
- column = column.trim();
- }
- if(StringUtils.isBlank(column)) {
- continue;
- }
-
- RangerHiveResource colResource = new RangerHiveResource(HiveObjectType.COLUMN, resource.getDatabase(), resource.getTable(), column);
-
- RangerHiveAccessRequest colRequest = request.copy();
- colRequest.setResource(colResource);
-
- colRequests.add(colRequest);
- }
-
- Collection<RangerAccessResult> colResults = hivePlugin.isAccessAllowed(colRequests, auditHandler);
-
- if(colResults != null) {
- for(RangerAccessResult colResult : colResults) {
- result = colResult;
-
- if(!result.getIsAllowed()) {
- break;
- }
- }
- }
- } else {
- result = hivePlugin.isAccessAllowed(request, auditHandler);
- }
-
- if(result != null && !result.getIsAllowed()) {
- String path = resource.getAsString();
-
- throw new HiveAccessControlException(String.format("Permission denied: user [%s] does not have [%s] privilege on [%s]",
- user, request.getHiveAccessType().name(), path));
- }
+ if(result != null && !result.getIsAllowed()) {
+ String path = resource.getAsString();
+
+ throw new HiveAccessControlException(String.format("Permission denied: user [%s] does not have [%s] privilege on [%s]",
+ user, request.getHiveAccessType().name(), path));
}
}
} finally {
@@ -360,29 +350,6 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
}
}
- boolean isMetaDataOperation(HiveOperationType hiveOpType) {
- boolean result;
-
- switch (hiveOpType) {
- /*
- * Uncomment this part when hive bug is resolved.
- *
- case SHOWTABLES:
- result = true;
- break;
- *
- */
- case SHOWDATABASES: // we don't want to authorize for show databases either since any call with _any privilages runs into a problem.
- case SHOWTABLES: // currently does not work since we don't get the database name in the context to do this check correctly.
- case DESCDATABASE: // currently does not work since we don't get the database name in the context to do this check correctly.
- default:
- result = false;
- break;
- }
- return result;
- }
-
-
/**
* Check if user has privileges to do this action on these objects
* @param objs
@@ -456,38 +423,25 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
} else if (!result.getIsAllowed()) {
if (!LOG.isDebugEnabled()) {
String path = resource.getAsString();
- LOG.debug(String.format("filterListCmdObjects: Permission denied: user [%s] does not have [%s] privilege on [%s]", user, request.getHiveAccessType().name(), path));
+ LOG.debug(String.format("filterListCmdObjects: Permission denied: user [%s] does not have [%s] privilege on [%s]. resource[%s], request[%s], result[%s]",
+ user, request.getHiveAccessType().name(), path, resource, request, result));
}
} else {
if (LOG.isDebugEnabled()) {
- LOG.debug(String.format("filterListCmdObjects: resource[%s]: allowed!: request[%s], result[%s]", resource, request, result));
+ LOG.debug(String.format("filterListCmdObjects: access allowed. resource[%s], request[%s], result[%s]", resource, request, result));
}
ret.add(privilegeObject);
}
}
}
}
+
if (LOG.isDebugEnabled()) {
- LOG.debug(String.format("filterListCmdObjects: number of output objects[%d]", ret == null ? 0: ret.size()));
- LOG.debug(String.format("<== filterListCmdObjects(%s, %s): %s", objs, context, ret));
+ int count = ret == null ? 0 : ret.size();
+ LOG.debug(String.format("<== filterListCmdObjects: count[%d], ret[%s]", count, ret));
}
-
return ret;
}
-
- RangerHiveResource getHiveResource(HiveOperationType hiveOperationType) {
- RangerHiveResource hiveResource;
- switch (hiveOperationType) {
- case SHOWDATABASES:
- case SHOWTABLES:
- // any database
- hiveResource = new RangerHiveResource(HiveObjectType.DATABASE, null);
- break;
- default:
- hiveResource = null;
- }
- return hiveResource;
- }
RangerHiveResource createHiveResource(HivePrivilegeObject privilegeObject) {
RangerHiveResource resource = null;
@@ -691,6 +645,10 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
accessType = HiveAccessType.LOCK;
break;
+ /*
+ * SELECT access is done for many of these metadata operations since hive does not call back for filtering.
+ * Overtime these should move to _any/USE access (as hive adds support for filtering).
+ */
case QUERY:
case SHOW_TABLESTATUS:
case SHOW_CREATETABLE:
@@ -703,8 +661,11 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
accessType = HiveAccessType.SELECT;
break;
+ // any access done for metadata access of actions that have support from hive for filtering
+ case SHOWDATABASES:
case SWITCHDATABASE:
case DESCDATABASE:
+ case SHOWTABLES:
accessType = HiveAccessType.USE;
break;
@@ -733,10 +694,8 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
case RESET:
case SET:
case SHOWCONF:
- case SHOWDATABASES:
case SHOWFUNCTIONS:
case SHOWLOCKS:
- case SHOWTABLES:
case SHOW_COMPACTIONS:
case SHOW_GRANT:
case SHOW_ROLES:
[2/6] incubator-ranger git commit: RANGER-548: Fixes for Key Rollover
command failure
Posted by ma...@apache.org.
RANGER-548: Fixes for Key Rollover command failure
Signed-off-by: sneethiraj <sn...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/incubator-ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-ranger/commit/b70ec703
Tree: http://git-wip-us.apache.org/repos/asf/incubator-ranger/tree/b70ec703
Diff: http://git-wip-us.apache.org/repos/asf/incubator-ranger/diff/b70ec703
Branch: refs/heads/tag-policy
Commit: b70ec703ad34e4c4996b7ba5a41a233d338297da
Parents: 12ab54a
Author: Velmurugan Periasamy <ve...@apache.org>
Authored: Thu Jun 11 21:59:42 2015 -0700
Committer: sneethiraj <sn...@apache.org>
Committed: Fri Jun 12 09:16:24 2015 -0700
----------------------------------------------------------------------
.../hadoop/crypto/key/RangerKeyStore.java | 13 ++---
.../crypto/key/RangerKeyStoreProvider.java | 57 +++++++++++++-------
.../hadoop/crypto/key/kms/server/KMS.java | 16 +++++-
.../apache/ranger/entity/XXRangerKeyStore.java | 2 +
.../java/org/apache/ranger/kms/dao/BaseDao.java | 16 ++++--
.../org/apache/ranger/kms/dao/RangerKMSDao.java | 7 +++
.../META-INF/kms_jpa_named_queries.xml | 5 ++
kms/src/main/resources/META-INF/persistence.xml | 7 ++-
8 files changed, 90 insertions(+), 33 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/b70ec703/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java
----------------------------------------------------------------------
diff --git a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java
index f38f8b0..dc8efde 100644
--- a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java
+++ b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStore.java
@@ -82,14 +82,12 @@ public class RangerKeyStore extends KeyStoreSpi {
int version;
}
- private final Hashtable<String, Object> keyEntries ;
+ private Hashtable<String, Object> keyEntries = new Hashtable<String, Object>();
RangerKeyStore() {
- keyEntries = new Hashtable<String, Object>();
}
RangerKeyStore(DaoManager daoManager) {
- keyEntries = new Hashtable<String, Object>();
this.daoManager = daoManager;
}
@@ -117,7 +115,7 @@ public class RangerKeyStore extends KeyStoreSpi {
o = constructor.newInstance(password);
Method m = c.getDeclaredMethod("unseal", SealedObject.class);
m.setAccessible(true);
- key = (Key) m.invoke(o, ((SecretKeyEntry)entry).sealedKey);
+ key = (Key) m.invoke(o, ((SecretKeyEntry)entry).sealedKey);
} catch (ClassNotFoundException | NoSuchMethodException | SecurityException | InstantiationException | IllegalAccessException | IllegalArgumentException | InvocationTargetException e) {
logger.error(e.getMessage());
}
@@ -313,6 +311,7 @@ public class RangerKeyStore extends KeyStoreSpi {
{
synchronized(keyEntries) {
List<XXRangerKeyStore> rangerKeyDetails = dbOperationLoad();
+
DataInputStream dis;
MessageDigest md = null;
@@ -372,7 +371,6 @@ public class RangerKeyStore extends KeyStoreSpi {
entry.description = rangerKey.getDescription();
entry.version = rangerKey.getVersion();
entry.attributes = rangerKey.getAttributes();
-
//read the sealed key
try {
ois = new ObjectInputStream(dis);
@@ -380,7 +378,7 @@ public class RangerKeyStore extends KeyStoreSpi {
} catch (ClassNotFoundException cnfe) {
throw new IOException(cnfe.getMessage());
}
-
+
//Add the entry to the list
keyEntries.put(alias, entry);
}finally {
@@ -398,7 +396,7 @@ public class RangerKeyStore extends KeyStoreSpi {
try{
if(daoManager != null){
RangerKMSDao rangerKMSDao = new RangerKMSDao(daoManager);
- return rangerKMSDao.getAll();
+ return rangerKMSDao.getAllKeys();
}
}catch(Exception e){
e.printStackTrace();
@@ -531,7 +529,6 @@ public class RangerKeyStore extends KeyStoreSpi {
entry.version = (alias.split("@").length == 2)?(Integer.parseInt(alias.split("@")[1])):0;
entry.description = k.getFormat()+" - "+ks.getType();
keyEntries.put(alias, entry);
- System.out.println("+ adding key alias [" + alias + "]") ;
}
} catch (Throwable t) {
logger.error("Unable to load keystore file ", t);
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/b70ec703/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java
----------------------------------------------------------------------
diff --git a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java
index ee48c7c..23547a7 100755
--- a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java
+++ b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerKeyStoreProvider.java
@@ -37,6 +37,7 @@ import java.util.List;
import java.util.Map;
import javax.crypto.spec.SecretKeySpec;
+
import org.apache.hadoop.classification.InterfaceAudience;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.crypto.key.KeyProvider;
@@ -46,6 +47,7 @@ import org.apache.hadoop.fs.Path;
import org.apache.ranger.credentialapi.CredentialReader;
import org.apache.ranger.kms.dao.DaoManager;
import org.apache.log4j.Logger;
+
import java.util.concurrent.locks.Lock;
import java.util.concurrent.locks.ReadWriteLock;
import java.util.concurrent.locks.ReentrantReadWriteLock;
@@ -93,7 +95,7 @@ public class RangerKeyStoreProvider extends KeyProvider{
// Master Key does not exists
throw new IOException("Ranger MasterKey does not exists");
}
- reloadKeys() ;
+ reloadKeys();
ReadWriteLock lock = new ReentrantReadWriteLock(true);
readLock = lock.readLock();
}
@@ -133,13 +135,13 @@ public class RangerKeyStoreProvider extends KeyProvider{
}
private void loadKeys(char[] masterKey) throws NoSuchAlgorithmException, CertificateException, IOException {
- dbStore.engineLoad(null, masterKey);
+ dbStore.engineLoad(null, masterKey);
}
@Override
public KeyVersion createKey(String name, byte[] material, Options options)
throws IOException {
- reloadKeys() ;
+ reloadKeys() ;
if (dbStore.engineContainsAlias(name) || cache.containsKey(name)) {
throw new IOException("Key " + name + " already exists");
}
@@ -158,7 +160,7 @@ public class RangerKeyStoreProvider extends KeyProvider{
try {
ObjectMapper om = new ObjectMapper();
String attribute = om.writeValueAsString(attributes);
- dbStore.addKeyEntry(versionName, new SecretKeySpec(material, cipher), masterKey, cipher, bitLength, description, version, attribute);
+ dbStore.addKeyEntry(versionName, new SecretKeySpec(material, cipher), masterKey, cipher, bitLength, description, version, attribute);
} catch (KeyStoreException e) {
throw new IOException("Can't store key " + versionName,e);
}
@@ -168,7 +170,8 @@ public class RangerKeyStoreProvider extends KeyProvider{
@Override
public void deleteKey(String name) throws IOException {
- Metadata meta = getMetadata(name);
+ reloadKeys();
+ Metadata meta = getMetadata(name);
if (meta == null) {
throw new IOException("Key " + name + " does not exist");
}
@@ -190,7 +193,7 @@ public class RangerKeyStoreProvider extends KeyProvider{
throw new IOException("Problem removing " + name + " from " + this, e);
}
cache.remove(name);
- changed = true;
+ changed = true;
}
@Override
@@ -212,15 +215,18 @@ public class RangerKeyStoreProvider extends KeyProvider{
}
try {
dbStore.engineStore(null, masterKey);
+ reloadKeys();
} catch (NoSuchAlgorithmException e) {
throw new IOException("No such algorithm storing key", e);
} catch (CertificateException e) {
throw new IOException("Certificate exception storing key", e);
- }
+ }
changed = false;
}catch (IOException ioe) {
+ cache.clear();
+ reloadKeys();
throw ioe;
- }
+ }
}
@Override
@@ -230,14 +236,20 @@ public class RangerKeyStoreProvider extends KeyProvider{
SecretKeySpec key = null;
try {
if (!dbStore.engineContainsAlias(versionName)) {
- return null;
- }
+ dbStore.engineLoad(null, masterKey);
+ if (!dbStore.engineContainsAlias(versionName)) {
+ return null;
+ }
+ }
key = (SecretKeySpec) dbStore.engineGetKey(versionName, masterKey);
} catch (NoSuchAlgorithmException e) {
throw new IOException("Can't get algorithm for key " + key, e);
} catch (UnrecoverableKeyException e) {
throw new IOException("Can't recover key " + key, e);
}
+ catch (CertificateException e) {
+ throw new IOException("Certificate exception storing key", e);
+ }
if (key == null) {
return null;
} else {
@@ -285,15 +297,18 @@ public class RangerKeyStoreProvider extends KeyProvider{
@Override
public Metadata getMetadata(String name) throws IOException {
- try {
+ try {
readLock.lock();
- reloadKeys() ;
- if (cache.containsKey(name)) {
- return cache.get(name);
+ if (cache.containsKey(name)) {
+ Metadata meta = cache.get(name);
+ return meta;
}
try {
if (!dbStore.engineContainsAlias(name)) {
- return null;
+ dbStore.engineLoad(null, masterKey);
+ if (!dbStore.engineContainsAlias(name)) {
+ return null;
+ }
}
Key key = dbStore.engineGetKey(name, masterKey);
if(key != null){
@@ -307,13 +322,18 @@ public class RangerKeyStoreProvider extends KeyProvider{
throw new IOException("Can't recover key for " + name, e);
}
return null;
- } finally {
+ }
+ catch(Exception e){
+ throw new IOException("Please try again ", e);
+ }
+ finally {
readLock.unlock();
}
}
@Override
public KeyVersion rollNewVersion(String name, byte[] material)throws IOException {
+ reloadKeys();
Metadata meta = getMetadata(name);
if (meta == null) {
throw new IOException("Key " + name + " not found");
@@ -345,12 +365,13 @@ public class RangerKeyStoreProvider extends KeyProvider{
private void reloadKeys() throws IOException {
try {
- loadKeys(masterKey);
+ cache.clear();
+ loadKeys(masterKey);
} catch (NoSuchAlgorithmException e) {
throw new IOException("Can't load Keys");
}catch(CertificateException e){
throw new IOException("Can't load Keys");
- }
+ }
}
/**
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/b70ec703/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMS.java
----------------------------------------------------------------------
diff --git a/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMS.java b/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMS.java
index 404b710..ae6d8f8 100644
--- a/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMS.java
+++ b/kms/src/main/java/org/apache/hadoop/crypto/key/kms/server/KMS.java
@@ -52,6 +52,8 @@ import java.util.ArrayList;
import java.util.LinkedList;
import java.util.List;
import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
/**
* Class providing the REST bindings, via Jersey, for the KMS.
@@ -67,6 +69,8 @@ public class KMS {
GENERATE_EEK, DECRYPT_EEK
}
+ private static final String KEY_NAME_VALIDATION = "[a-z,A-Z,0-9](?!.*--)(?!.*__)(?!.*-_)(?!.*_-)[\\w\\-\\_]*";
+
private KeyProviderCryptoExtension provider;
private KMSAudit kmsAudit;
@@ -105,7 +109,8 @@ public class KMS {
KMSWebApp.getAdminCallsMeter().mark();
UserGroupInformation user = HttpUserGroupInformation.get();
final String name = (String) jsonKey.get(KMSRESTConstants.NAME_FIELD);
- KMSClientProvider.checkNotEmpty(name, KMSRESTConstants.NAME_FIELD);
+ KMSClientProvider.checkNotEmpty(name, KMSRESTConstants.NAME_FIELD);
+ validateKeyName(name);
assertAccess(Type.CREATE, user, KMSOp.CREATE_KEY, name, request.getRemoteAddr());
String cipher = (String) jsonKey.get(KMSRESTConstants.CIPHER_FIELD);
final String material = (String) jsonKey.get(KMSRESTConstants.MATERIAL_FIELD);
@@ -158,6 +163,15 @@ public class KMS {
header("Location", keyURL).entity(json).build();
}
+ private void validateKeyName(String name) {
+ Pattern pattern = Pattern.compile(KEY_NAME_VALIDATION);
+ Matcher matcher = pattern.matcher(name);
+ if(!matcher.matches()){
+ throw new IllegalArgumentException("Key Name : " + name +
+ ", should start with alpha/numeric letters and can have special characters - (hypen) or _ (underscore)");
+ }
+ }
+
@DELETE
@Path(KMSRESTConstants.KEY_RESOURCE + "/{name:.*}")
public Response deleteKey(@PathParam("name") final String name, @Context HttpServletRequest request)
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/b70ec703/kms/src/main/java/org/apache/ranger/entity/XXRangerKeyStore.java
----------------------------------------------------------------------
diff --git a/kms/src/main/java/org/apache/ranger/entity/XXRangerKeyStore.java b/kms/src/main/java/org/apache/ranger/entity/XXRangerKeyStore.java
index 9bc53c2..8defdf6 100755
--- a/kms/src/main/java/org/apache/ranger/entity/XXRangerKeyStore.java
+++ b/kms/src/main/java/org/apache/ranger/entity/XXRangerKeyStore.java
@@ -17,6 +17,7 @@
package org.apache.ranger.entity;
+import javax.persistence.Cacheable;
import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
@@ -28,6 +29,7 @@ import javax.persistence.Table;
import javax.xml.bind.annotation.XmlRootElement;
@Entity
+@Cacheable(false)
@Table(name="ranger_keystore")
@XmlRootElement
public class XXRangerKeyStore extends XXDBBase implements java.io.Serializable {
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/b70ec703/kms/src/main/java/org/apache/ranger/kms/dao/BaseDao.java
----------------------------------------------------------------------
diff --git a/kms/src/main/java/org/apache/ranger/kms/dao/BaseDao.java b/kms/src/main/java/org/apache/ranger/kms/dao/BaseDao.java
index f835bcc..dbaedd0 100644
--- a/kms/src/main/java/org/apache/ranger/kms/dao/BaseDao.java
+++ b/kms/src/main/java/org/apache/ranger/kms/dao/BaseDao.java
@@ -177,9 +177,8 @@ public abstract class BaseDao<T> {
TypedQuery<T> qry = getEntityManager().createQuery(
"SELECT t FROM " + tClass.getSimpleName() + " t", tClass);
-
+ qry.setHint("eclipselink.refresh", "true");
ret = qry.getResultList();
-
return ret;
}
@@ -189,9 +188,8 @@ public abstract class BaseDao<T> {
TypedQuery<Long> qry = getEntityManager().createQuery(
"SELECT count(t) FROM " + tClass.getSimpleName() + " t",
Long.class);
-
+ qry.setHint("eclipselink.refresh", "true");
ret = qry.getSingleResult();
-
return ret;
}
@@ -258,4 +256,14 @@ public abstract class BaseDao<T> {
}
return 0;
}
+
+ public List<T> getAllKeys(String namedQuery) {
+ try {
+ return getEntityManager()
+ .createNamedQuery(namedQuery, tClass).setHint("eclipselink.refresh", "true").getResultList();
+ } catch (NoResultException e) {
+ e.printStackTrace();
+ }
+ return null;
+ }
}
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/b70ec703/kms/src/main/java/org/apache/ranger/kms/dao/RangerKMSDao.java
----------------------------------------------------------------------
diff --git a/kms/src/main/java/org/apache/ranger/kms/dao/RangerKMSDao.java b/kms/src/main/java/org/apache/ranger/kms/dao/RangerKMSDao.java
index 2f750aa..cb64310 100644
--- a/kms/src/main/java/org/apache/ranger/kms/dao/RangerKMSDao.java
+++ b/kms/src/main/java/org/apache/ranger/kms/dao/RangerKMSDao.java
@@ -17,6 +17,8 @@
package org.apache.ranger.kms.dao;
+import java.util.List;
+
import org.apache.ranger.entity.XXRangerKeyStore;
public class RangerKMSDao extends BaseDao<XXRangerKeyStore> {
@@ -32,4 +34,9 @@ public class RangerKMSDao extends BaseDao<XXRangerKeyStore> {
public int deleteByAlias(String alias){
return super.deleteByAlias("XXRangerKeyStore.deleteByAlias", alias);
}
+
+ public List<XXRangerKeyStore> getAllKeys(){
+ List<XXRangerKeyStore> xxr = super.getAllKeys("XXRangerKeyStore.getAllKeys");
+ return xxr;
+ }
}
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/b70ec703/kms/src/main/resources/META-INF/kms_jpa_named_queries.xml
----------------------------------------------------------------------
diff --git a/kms/src/main/resources/META-INF/kms_jpa_named_queries.xml b/kms/src/main/resources/META-INF/kms_jpa_named_queries.xml
index 8fd3128..94d5fa6 100644
--- a/kms/src/main/resources/META-INF/kms_jpa_named_queries.xml
+++ b/kms/src/main/resources/META-INF/kms_jpa_named_queries.xml
@@ -23,6 +23,11 @@
WHERE obj.alias=:alias
</query>
</named-query>
+
+ <named-query name="XXRangerKeyStore.getAllKeys">
+ <query>SELECT Obj FROM XXRangerKeyStore obj
+ </query>
+ </named-query>
<named-query name="XXRangerKeyStore.deleteByAlias">
<query>DELETE FROM XXRangerKeyStore obj
http://git-wip-us.apache.org/repos/asf/incubator-ranger/blob/b70ec703/kms/src/main/resources/META-INF/persistence.xml
----------------------------------------------------------------------
diff --git a/kms/src/main/resources/META-INF/persistence.xml b/kms/src/main/resources/META-INF/persistence.xml
index 31c0bc4..57445b5 100644
--- a/kms/src/main/resources/META-INF/persistence.xml
+++ b/kms/src/main/resources/META-INF/persistence.xml
@@ -20,9 +20,12 @@
<mapping-file>META-INF/kms_jpa_named_queries.xml</mapping-file>
<class>org.apache.ranger.entity.XXRangerMasterKey</class>
<class>org.apache.ranger.entity.XXRangerKeyStore</class>
-
+ <shared-cache-mode>NONE</shared-cache-mode>
+
<properties>
- <property name="eclipselink.logging.level" value="SEVERE"/>
+ <property name="eclipselink.logging.level" value="WARNING"/>
+ <property name="eclipselink.cache.shared.default" value="false"/>
+ <property name="eclipselink.query-results-cache" value="false"/>
</properties>
</persistence-unit>
</persistence>