(atlas) branch atlas-2.6 updated: ATLAS-5379 : Authorize lineage neighbor entities before returning headers (#731)

[ni...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch atlas-2.6
in repository https://gitbox.apache.org/repos/asf/atlas.git


The following commit(s) were added to refs/heads/atlas-2.6 by this push:
     new b3eff5aa3 ATLAS-5379 : Authorize lineage neighbor entities before returning headers (#731)
b3eff5aa3 is described below

commit b3eff5aa368f93a40aabc01e5115a9491aaed4a9
Author: Vinayak Marraiya <72...@users.noreply.github.com>
AuthorDate: Wed Sep 9 12:59:31 2026 +0530

    ATLAS-5379 : Authorize lineage neighbor entities before returning headers (#731)
    
    * ATLAS-5379: Authorize lineage neighbor entities before returning headers
    
    Apply per-entity ENTITY_READ checks when building lineage guidEntityMap.
    Skip unauthorized neighbors and omit relations when either endpoint is not readable.
    
    * ATLAS-5379: scrub unauthorized lineage neighbor headers instead of omitting them
---
 .../atlas/authorize/AtlasAuthorizationUtils.java   |  22 ++++
 .../authorize/AtlasAuthorizationUtilsTest.java     | 116 +++++++++++++++++++++
 .../atlas/discovery/EntityLineageService.java      |  20 ++++
 3 files changed, 158 insertions(+)

diff --git a/authorization/src/main/java/org/apache/atlas/authorize/AtlasAuthorizationUtils.java b/authorization/src/main/java/org/apache/atlas/authorize/AtlasAuthorizationUtils.java
index 6a254f0fa..a1c68b3a3 100644
--- a/authorization/src/main/java/org/apache/atlas/authorize/AtlasAuthorizationUtils.java
+++ b/authorization/src/main/java/org/apache/atlas/authorize/AtlasAuthorizationUtils.java
@@ -22,6 +22,8 @@ package org.apache.atlas.authorize;
 import org.apache.atlas.AtlasErrorCode;
 import org.apache.atlas.RequestContext;
 import org.apache.atlas.exception.AtlasBaseException;
+import org.apache.atlas.model.instance.AtlasEntityHeader;
+import org.apache.atlas.type.AtlasTypeRegistry;
 import org.apache.atlas.utils.AtlasPerfMetrics.MetricRecorder;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
@@ -97,6 +99,26 @@ public class AtlasAuthorizationUtils {
         }
     }
 
+    /**
+     * Scrub a single entity-header in-place when the current user is not authorized (ENTITY_READ) to read it.
+     * Mirrors the per-entity handling in {@link AtlasAuthorizer#scrubSearchResults}, but for results (e.g. lineage)
+     * that are not modeled as an {@link AtlasSearchResult}. The entity's guid and relationships are preserved by the
+     * caller (kept in the surrounding map/relations), only the header's sensitive fields are cleared.
+     */
+    public static void scrubEntityHeader(AtlasEntityHeader entityHeader, AtlasTypeRegistry typeRegistry) {
+        if (entityHeader == null) {
+            return;
+        }
+
+        if (!isAccessAllowed(new AtlasEntityAccessRequest(typeRegistry, AtlasPrivilege.ENTITY_READ, entityHeader))) {
+            try {
+                AtlasAuthorizerFactory.getAtlasAuthorizer().scrubEntityHeader(entityHeader);
+            } catch (AtlasAuthorizationException e) {
+                LOG.error("Unable to obtain AtlasAuthorizer", e);
+            }
+        }
+    }
+
     public static boolean isAccessAllowed(AtlasAdminAccessRequest request) {
         MetricRecorder metric = RequestContext.get().startMetricRecord("isAccessAllowed");
 
diff --git a/authorization/src/test/java/org/apache/atlas/authorize/AtlasAuthorizationUtilsTest.java b/authorization/src/test/java/org/apache/atlas/authorize/AtlasAuthorizationUtilsTest.java
new file mode 100644
index 000000000..1ed7bd64a
--- /dev/null
+++ b/authorization/src/test/java/org/apache/atlas/authorize/AtlasAuthorizationUtilsTest.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.atlas.authorize;
+
+import org.apache.atlas.RequestContext;
+import org.apache.atlas.model.instance.AtlasClassification;
+import org.apache.atlas.model.instance.AtlasEntityHeader;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import java.util.ArrayList;
+import java.util.Collections;
+
+import static org.testng.AssertJUnit.assertEquals;
+import static org.testng.AssertJUnit.assertNotNull;
+import static org.testng.AssertJUnit.assertTrue;
+
+/**
+ * Tests for {@link AtlasAuthorizationUtils#scrubEntityHeader(AtlasEntityHeader, org.apache.atlas.type.AtlasTypeRegistry)},
+ * the helper used by lineage to redact headers of entities the caller cannot read (ENTITY_READ).
+ */
+public class AtlasAuthorizationUtilsTest {
+    private String originalConf;
+
+    @BeforeMethod
+    public void setUp() {
+        originalConf = System.getProperty("atlas.conf");
+
+        // src/test/resources contains atlas-application.properties (SIMPLE authorizer) + policy file
+        System.setProperty("atlas.conf", "src/test/resources");
+    }
+
+    @AfterMethod
+    public void tearDown() {
+        SecurityContextHolder.clearContext();
+        RequestContext.clear();
+
+        if (originalConf != null) {
+            System.setProperty("atlas.conf", originalConf);
+        }
+    }
+
+    @Test
+    public void testScrubEntityHeaderRedactsUnauthorizedEntity() {
+        // user in an unknown group has no ENTITY_READ grant in the simple-authz policy
+        setCurrentUser("unknown-group-user", "UNKNOWN_GROUP");
+
+        AtlasEntityHeader entity = newEntityHeader();
+
+        AtlasAuthorizationUtils.scrubEntityHeader(entity, null);
+
+        // default scrub sets guid to "-1" and clears attributes/classifications
+        assertEquals("unauthorized entity guid should be scrubbed", "-1", entity.getGuid());
+        assertTrue("unauthorized entity classifications should be cleared",
+                entity.getClassifications() == null || entity.getClassifications().isEmpty());
+        assertTrue("unauthorized entity attributes should be cleared",
+                entity.getAttributes() == null || entity.getAttributes().isEmpty());
+    }
+
+    @Test
+    public void testScrubEntityHeaderKeepsAuthorizedEntity() {
+        // admin (ROLE_ADMIN) is allowed ENTITY_READ, so the header must be left untouched
+        setCurrentUser("admin", "ROLE_ADMIN");
+
+        AtlasEntityHeader entity = newEntityHeader();
+
+        AtlasAuthorizationUtils.scrubEntityHeader(entity, null);
+
+        assertEquals("authorized entity guid should be preserved", "guid-1", entity.getGuid());
+        assertNotNull("authorized entity classifications should be preserved", entity.getClassifications());
+        assertEquals("authorized entity classifications should be preserved", 1, entity.getClassifications().size());
+        assertNotNull("authorized entity attributes should be preserved", entity.getAttributes());
+        assertEquals("authorized entity attributes should be preserved",
+                "db.table@cluster", entity.getAttribute("qualifiedName"));
+    }
+
+    @Test
+    public void testScrubEntityHeaderHandlesNull() {
+        // must be a no-op (no NPE) for a null header
+        AtlasAuthorizationUtils.scrubEntityHeader(null, null);
+    }
+
+    private AtlasEntityHeader newEntityHeader() {
+        AtlasEntityHeader entity = new AtlasEntityHeader("hive_table");
+
+        entity.setGuid("guid-1");
+        entity.setAttribute("qualifiedName", "db.table@cluster");
+        entity.setClassifications(new ArrayList<>(Collections.singletonList(new AtlasClassification("PII"))));
+
+        return entity;
+    }
+
+    private void setCurrentUser(String userName, String group) {
+        SecurityContextHolder.getContext().setAuthentication(
+                new UsernamePasswordAuthenticationToken(userName, null,
+                        Collections.singletonList(new SimpleGrantedAuthority(group))));
+    }
+}
diff --git a/repository/src/main/java/org/apache/atlas/discovery/EntityLineageService.java b/repository/src/main/java/org/apache/atlas/discovery/EntityLineageService.java
index 4f169d902..fabdf9884 100644
--- a/repository/src/main/java/org/apache/atlas/discovery/EntityLineageService.java
+++ b/repository/src/main/java/org/apache/atlas/discovery/EntityLineageService.java
@@ -117,6 +117,8 @@ public class EntityLineageService implements AtlasLineageService {
             ret = getLineageInfoV2(guid, direction, depth, isDataSet);
         }
 
+        scrubLineageEntities(ret);
+
         return ret;
     }
 
@@ -137,6 +139,8 @@ public class EntityLineageService implements AtlasLineageService {
         // filtering out on-demand relations which has input & output nodes within the limit
         cleanupRelationsOnDemand(ret);
 
+        scrubLineageEntities(ret);
+
         return ret;
     }
 
@@ -679,6 +683,22 @@ public class EntityLineageService implements AtlasLineageService {
         }
     }
 
+    /**
+     * Scrub lineage entities the caller is not authorized (ENTITY_READ) to read - similar to search-result scrubbing
+     * in {@code EntityDiscoveryService.scrubSearchResults()}. The full lineage graph is gathered first; here we only
+     * redact the headers of unauthorized entities (attributes, classifications, meanings are cleared). Node guids and
+     * relations are retained so the lineage graph stays connected.
+     */
+    private void scrubLineageEntities(AtlasLineageInfo lineageInfo) {
+        if (lineageInfo == null || MapUtils.isEmpty(lineageInfo.getGuidEntityMap())) {
+            return;
+        }
+
+        for (AtlasEntityHeader entityHeader : lineageInfo.getGuidEntityMap().values()) {
+            AtlasAuthorizationUtils.scrubEntityHeader(entityHeader, atlasTypeRegistry);
+        }
+    }
+
     private AtlasLineageInfo getBothLineageInfoV1(String guid, int depth, boolean isDataSet) throws AtlasBaseException {
         AtlasLineageInfo inputLineage  = getLineageInfo(guid, INPUT, depth, isDataSet);
         AtlasLineageInfo outputLineage = getLineageInfo(guid, OUTPUT, depth, isDataSet);