You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Dhaval Shah <dh...@gmail.com> on 2019/09/18 13:54:44 UTC
Review Request 71504: RANGER-2571 Need to add Knox proxy configuration
support in Ranger plugins
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71504/
-----------------------------------------------------------
Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
Bugs: RANGER-2571
https://issues.apache.org/jira/browse/RANGER-2571
Repository: ranger
Description
-------
Need to add support for below property in the ranger-<plugin>-security.xml
ranger.plugin.<serviceType>.use.x-forwarded-for.ipaddress=true
ranger.plugin.<serviceType>.trusted.proxy.ipaddress which should be set to IP addresses of Knox hosts .
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java 870ec96
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java 5729eb2
hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java 7b2882c
plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java b49fb8a
Diff: https://reviews.apache.org/r/71504/diff/1/
Testing (updated)
-------
Tested for Hive, atlas
Thanks,
Dhaval Shah
Re: Review Request 71504: RANGER-2571 Need to add Knox proxy
configuration support in Ranger plugins
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71504/#review217814
-----------------------------------------------------------
hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java
Lines 829 (patched)
<https://reviews.apache.org/r/71504/#comment305205>
lines #829 and #830 are effectively no-op, as they read and set the value from/in base class. Please review and remove.
plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java
Lines 311 (patched)
<https://reviews.apache.org/r/71504/#comment305206>
Where is 'accessRequest' defined?
- Madhan Neethiraj
On Sept. 18, 2019, 1:54 p.m., Dhaval Shah wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71504/
> -----------------------------------------------------------
>
> (Updated Sept. 18, 2019, 1:54 p.m.)
>
>
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2571
> https://issues.apache.org/jira/browse/RANGER-2571
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Need to add support for below property in the ranger-<plugin>-security.xml
>
> ranger.plugin.<serviceType>.use.x-forwarded-for.ipaddress=true
> ranger.plugin.<serviceType>.trusted.proxy.ipaddress which should be set to IP addresses of Knox hosts .
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java 870ec96
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java 5729eb2
> hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java 7b2882c
> plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java b49fb8a
>
>
> Diff: https://reviews.apache.org/r/71504/diff/1/
>
>
> Testing
> -------
>
> Tested for Hive, atlas
>
>
> Thanks,
>
> Dhaval Shah
>
>
Re: Review Request 71504: RANGER-2571 Need to add Knox proxy
configuration support in Ranger plugins
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71504/#review217863
-----------------------------------------------------------
Ship it!
Ship It!
- Madhan Neethiraj
On Sept. 19, 2019, 6:14 p.m., Dhaval Shah wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71504/
> -----------------------------------------------------------
>
> (Updated Sept. 19, 2019, 6:14 p.m.)
>
>
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2571
> https://issues.apache.org/jira/browse/RANGER-2571
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Need to add support for below property in the ranger-<plugin>-security.xml
>
> ranger.plugin.<serviceType>.use.x-forwarded-for.ipaddress=true
> ranger.plugin.<serviceType>.trusted.proxy.ipaddress which should be set to IP addresses of Knox hosts .
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java 870ec96
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java 5729eb2
> hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java 7b2882c
> plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java b49fb8a
>
>
> Diff: https://reviews.apache.org/r/71504/diff/2/
>
>
> Testing
> -------
>
> Tested for Hive, atlas
>
>
> Thanks,
>
> Dhaval Shah
>
>
Re: Review Request 71504: RANGER-2571 Need to add Knox proxy
configuration support in Ranger plugins
Posted by Dhaval Shah <dh...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71504/
-----------------------------------------------------------
(Updated Sept. 19, 2019, 6:14 p.m.)
Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
Bugs: RANGER-2571
https://issues.apache.org/jira/browse/RANGER-2571
Repository: ranger
Description
-------
Need to add support for below property in the ranger-<plugin>-security.xml
ranger.plugin.<serviceType>.use.x-forwarded-for.ipaddress=true
ranger.plugin.<serviceType>.trusted.proxy.ipaddress which should be set to IP addresses of Knox hosts .
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java 870ec96
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java 5729eb2
hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java 7b2882c
plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java b49fb8a
Diff: https://reviews.apache.org/r/71504/diff/2/
Changes: https://reviews.apache.org/r/71504/diff/1-2/
Testing
-------
Tested for Hive, atlas
Thanks,
Dhaval Shah
Re: Review Request 71504: RANGER-2571 Need to add Knox proxy
configuration support in Ranger plugins
Posted by Velmurugan Periasamy <vp...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71504/#review217853
-----------------------------------------------------------
plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java
Lines 312 (patched)
<https://reviews.apache.org/r/71504/#comment305249>
Please review. This does not compile.
- Velmurugan Periasamy
On Sept. 18, 2019, 1:54 p.m., Dhaval Shah wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71504/
> -----------------------------------------------------------
>
> (Updated Sept. 18, 2019, 1:54 p.m.)
>
>
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2571
> https://issues.apache.org/jira/browse/RANGER-2571
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Need to add support for below property in the ranger-<plugin>-security.xml
>
> ranger.plugin.<serviceType>.use.x-forwarded-for.ipaddress=true
> ranger.plugin.<serviceType>.trusted.proxy.ipaddress which should be set to IP addresses of Knox hosts .
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java 870ec96
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java 5729eb2
> hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java 7b2882c
> plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java b49fb8a
>
>
> Diff: https://reviews.apache.org/r/71504/diff/1/
>
>
> Testing
> -------
>
> Tested for Hive, atlas
>
>
> Thanks,
>
> Dhaval Shah
>
>
Re: Review Request 71504: RANGER-2571 Need to add Knox proxy
configuration support in Ranger plugins
Posted by Madhan Neethiraj <ma...@apache.org>.
> On Sept. 18, 2019, 3:33 p.m., Abhay Kulkarni wrote:
> > agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java
> > Lines 145 (patched)
> > <https://reviews.apache.org/r/71504/diff/1/?file=2165625#file2165625line145>
> >
> > GrantRevokeRequest is generated by the plugin itself and sent to Ranger admin. Does it make sense for these attributes to have any values other than the plugins IP address? Please review.
the plugins should send the ip-address & forwarded-ip addresses to Ranger Admin, in GrantRevokeRequest - so that appropriate IP address will be used in policy-conditions (when necessary) when Ranger Admin evaluates the policies.
- Madhan
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71504/#review217818
-----------------------------------------------------------
On Sept. 18, 2019, 1:54 p.m., Dhaval Shah wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71504/
> -----------------------------------------------------------
>
> (Updated Sept. 18, 2019, 1:54 p.m.)
>
>
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2571
> https://issues.apache.org/jira/browse/RANGER-2571
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Need to add support for below property in the ranger-<plugin>-security.xml
>
> ranger.plugin.<serviceType>.use.x-forwarded-for.ipaddress=true
> ranger.plugin.<serviceType>.trusted.proxy.ipaddress which should be set to IP addresses of Knox hosts .
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java 870ec96
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java 5729eb2
> hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java 7b2882c
> plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java b49fb8a
>
>
> Diff: https://reviews.apache.org/r/71504/diff/1/
>
>
> Testing
> -------
>
> Tested for Hive, atlas
>
>
> Thanks,
>
> Dhaval Shah
>
>
Re: Review Request 71504: RANGER-2571 Need to add Knox proxy
configuration support in Ranger plugins
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71504/#review217818
-----------------------------------------------------------
agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java
Lines 145 (patched)
<https://reviews.apache.org/r/71504/#comment305209>
GrantRevokeRequest is generated by the plugin itself and sent to Ranger admin. Does it make sense for these attributes to have any values other than the plugins IP address? Please review.
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
Lines 1498 (patched)
<https://reviews.apache.org/r/71504/#comment305210>
GrantRevokeRequest is a data structure for providing Ranger admin necessary information to create ranger policy corresponding to Grant or Revoke SQL commands. How will these attributes useful to ranger-admin? Please review.
hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
Line 1603 (original), 1605 (patched)
<https://reviews.apache.org/r/71504/#comment305211>
Same as the comment above.
- Abhay Kulkarni
On Sept. 18, 2019, 1:54 p.m., Dhaval Shah wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71504/
> -----------------------------------------------------------
>
> (Updated Sept. 18, 2019, 1:54 p.m.)
>
>
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2571
> https://issues.apache.org/jira/browse/RANGER-2571
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Need to add support for below property in the ranger-<plugin>-security.xml
>
> ranger.plugin.<serviceType>.use.x-forwarded-for.ipaddress=true
> ranger.plugin.<serviceType>.trusted.proxy.ipaddress which should be set to IP addresses of Knox hosts .
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/util/GrantRevokeRequest.java 870ec96
> hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java 5729eb2
> hdfs-agent/src/main/java/org/apache/ranger/authorization/hadoop/RangerHdfsAuthorizer.java 7b2882c
> plugin-yarn/src/main/java/org/apache/ranger/authorization/yarn/authorizer/RangerYarnAuthorizer.java b49fb8a
>
>
> Diff: https://reviews.apache.org/r/71504/diff/1/
>
>
> Testing
> -------
>
> Tested for Hive, atlas
>
>
> Thanks,
>
> Dhaval Shah
>
>