You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by vi...@apache.org on 2026/09/26 13:44:07 UTC
(ranger) branch ranger-2.10 updated: RANGER-5792: Align to best practices for User rest API (#1230) (#1248)
This is an automated email from the ASF dual-hosted git repository.
vikaskr22 pushed a commit to branch ranger-2.10
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.10 by this push:
new a77d36275 RANGER-5792: Align to best practices for User rest API (#1230) (#1248)
a77d36275 is described below
commit a77d36275feff5934c81462bd5eb52c3528e2756
Author: Dineshkumar Yadav <59...@users.noreply.github.com>
AuthorDate: Sat Sep 26 19:14:01 2026 +0530
RANGER-5792: Align to best practices for User rest API (#1230) (#1248)
Co-authored-by: Vikas Kumar <ta...@gmail.com>
Co-authored-by: Madhan Neethiraj <ma...@apache.org>
Co-authored-by: Cursor <cu...@cursor.com>
---
.../java/org/apache/ranger/biz/RangerBizUtil.java | 17 +++++++++--------
.../main/java/org/apache/ranger/biz/UserMgr.java | 4 ++--
.../main/java/org/apache/ranger/biz/XUserMgr.java | 22 ++++++++++------------
.../java/org/apache/ranger/common/StringUtil.java | 9 +++++++++
4 files changed, 30 insertions(+), 22 deletions(-)
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
index d48752fba..cb096f0d3 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
@@ -1361,19 +1361,20 @@ public boolean checkUserAccessible(VXUser vXUser) {
boolean isAccessible = true;
Collection<String> roleList = userMgr.getRolesByLoginId(vXUser
.getName());
+ Collection<String> payloadRoles = vXUser.getUserRoleList();
if (isKeyAdmin()) {
- if (vXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN)
- || vXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)
- || roleList.contains(RangerConstants.ROLE_SYS_ADMIN)
- || roleList.contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ if (StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_SYS_ADMIN)
+ || StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_ADMIN_AUDITOR)
+ || StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_SYS_ADMIN)
+ || StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_ADMIN_AUDITOR)) {
isAccessible = false;
}
}
if (isAdmin()) {
- if (vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN)
- || vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)
- || roleList.contains(RangerConstants.ROLE_KEY_ADMIN)
- || roleList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ if (StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_KEY_ADMIN)
+ || StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_KEY_ADMIN_AUDITOR)
+ || StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_KEY_ADMIN)
+ || StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
isAccessible = false;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
index 35be7580d..b0254d212 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
@@ -283,10 +283,10 @@ public boolean updateRoles(Long userId, Collection<String> rolesList) {
}
List<String> stringRolesList = new ArrayList<String>();
for (String userRole : rolesList) {
- if(!VALID_ROLE_LIST.contains(userRole.toUpperCase())){
+ if (userRole == null || !VALID_ROLE_LIST.contains(userRole.trim().toUpperCase())) {
throw restErrorUtil.createRESTException("Invalid user role, please provide valid user role.",MessageEnums.INVALID_INPUT_DATA);
}
- stringRolesList.add(userRole);
+ stringRolesList.add(userRole.trim().toUpperCase());
}
xUserMgr.checkAccessRoles(stringRolesList);
rangerBizUtil.blockAuditorRoleUser();
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
index 973936239..61c781090 100755
--- a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
@@ -848,17 +848,15 @@ private boolean hasAccessToGetUserInfo(VXUser requestedVXUser) {
if (userSession != null && userSession.getLoginId() != null) {
VXUser loggedInVXUser = xUserService.getXUserByUserName(userSession.getLoginId());
if (requestedVXUser != null && CollectionUtils.isNotEmpty(requestedVXUser.getUserRoleList()) && loggedInVXUser != null && loggedInVXUser.getUserRoleList().size() == 1) {
- if (loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) {
- return requestedVXUser.getId().equals(loggedInVXUser.getId()) ? true : false;
- } else if (loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN) || loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
- if (requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN) || requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR) || requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) {
- return true;
- }
- } else if (loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) || loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
- if (loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) && "rangerusersync".equalsIgnoreCase(userSession.getLoginId())) {
- return true;
- } else if (requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) || requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) || requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) {
+ if (StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_USER)) {
+ return requestedVXUser.getId().equals(loggedInVXUser.getId());
+ } else if (StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_KEY_ADMIN) || StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ return StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_KEY_ADMIN) || StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_KEY_ADMIN_AUDITOR) || StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_USER);
+ } else if (StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_SYS_ADMIN) || StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ if (StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_SYS_ADMIN) && "rangerusersync".equalsIgnoreCase(userSession.getLoginId())) {
return true;
+ } else {
+ return StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_SYS_ADMIN) || StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_ADMIN_AUDITOR) || StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_USER);
}
}
}
@@ -1502,9 +1500,9 @@ public void checkAccessRoles(List<String> stringRolesList) {
throw restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" + (session != null ? session.getXXPortalUser().getId() : "Not Logged In") + " ,isn't permitted to perform the action.");
} else {
if (!"rangerusersync".equals(session.getXXPortalUser().getLoginId())) {// new logic for rangerusersync user
- if (session.isUserAdmin() && (stringRolesList.contains(RangerConstants.ROLE_KEY_ADMIN) || stringRolesList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR))) {
+ if (session.isUserAdmin() && (StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_KEY_ADMIN) || StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_KEY_ADMIN_AUDITOR))) {
throw restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" + (session != null ? session.getXXPortalUser().getId() : "") + " isn't permitted to perform the action.");
- } else if (session.isKeyAdmin() && (stringRolesList.contains(RangerConstants.ROLE_SYS_ADMIN) || stringRolesList.contains(RangerConstants.ROLE_ADMIN_AUDITOR))) {
+ } else if (session.isKeyAdmin() && (StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_SYS_ADMIN) || StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_ADMIN_AUDITOR))) {
throw restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" + (session != null ? session.getXXPortalUser().getId() : "") + " isn't permitted to perform the action.");
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
index 275c883c5..870e35664 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
@@ -23,6 +23,7 @@
import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
+import java.util.Collection;
import java.util.HashMap;
import java.util.List;
import java.util.regex.Matcher;
@@ -258,4 +259,12 @@ public static String getUTFEncodedString(String username) throws UnsupportedEnco
return URLEncoder.encode(username, StandardCharsets.UTF_8.toString());
}
+ public static boolean containsIgnoreCase(Collection<String> values, String str) {
+ if (values != null && str != null) {
+ return values.stream().anyMatch(str::equalsIgnoreCase);
+ }
+
+ return false;
+ }
+
}