You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ma...@apache.org on 2022/05/16 18:29:01 UTC
[ranger] branch ranger-2.3 updated: RANGER-3764: conditions enhancement to support macros IS_IN_GROUP, IS_IN_ROLE, HAS_TAG, HAS_USER_ATTR, HAS_UG_ATTR, HAS_TAG_ATTR
This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch ranger-2.3
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.3 by this push:
new 4a2347e52 RANGER-3764: conditions enhancement to support macros IS_IN_GROUP, IS_IN_ROLE, HAS_TAG, HAS_USER_ATTR, HAS_UG_ATTR, HAS_TAG_ATTR
4a2347e52 is described below
commit 4a2347e5205cf69b6cfbc9885e3fed63899e8ef5
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Mon May 16 07:55:10 2022 -0700
RANGER-3764: conditions enhancement to support macros IS_IN_GROUP, IS_IN_ROLE, HAS_TAG, HAS_USER_ATTR, HAS_UG_ATTR, HAS_TAG_ATTR
(cherry picked from commit 5ea34fea442848398d2f7e23d839708da1061c8e)
---
.../policyengine/RangerRequestScriptEvaluator.java | 69 ++++++++++++++++++++++
.../ranger/plugin/util/RangerCommonConstants.java | 6 ++
.../RangerRequestScriptEvaluatorTest.java | 31 ++++++----
3 files changed, 94 insertions(+), 12 deletions(-)
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
index 4e312f88a..96be80ca1 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
@@ -709,6 +709,65 @@ public final class RangerRequestScriptEvaluator {
return toCsvQ(getTagAttr(attrName));
}
+ public boolean hasTag(String tagName) {
+ init();
+
+ return tags.containsKey(tagName);
+ }
+
+ public boolean hasUserAttr(String attrName) {
+ init();
+
+ return userAttrs.containsKey(attrName);
+ }
+
+ public boolean hasUgAttr(String attrName) {
+ init();
+
+ boolean ret = false;
+
+ for (Map<String, String> attrs : groupAttrs.values()) {
+ if (attrs.containsKey(attrName)) {
+ ret = true;
+
+ break;
+ }
+ }
+
+ return ret;
+ }
+
+ public boolean hasTagAttr(String attrName) {
+ init();
+
+ boolean ret = false;
+ Set<RangerTagForEval> tags = RangerAccessRequestUtil.getRequestTagsFromContext(accessRequest.getContext());
+
+ if (tags != null) {
+ for (RangerTagForEval tag : tags) {
+ if (tag.getAttributes().containsKey(attrName)) {
+ ret = true;
+
+ break;
+ }
+ }
+ }
+
+ return ret;
+ }
+
+ public boolean isInGroup(String groupName) {
+ init();
+
+ return userGroups.contains(groupName);
+ }
+
+ public boolean isInRole(String roleName) {
+ init();
+
+ return userRoles.contains(roleName);
+ }
+
private void init() {
if (!initDone) {
RangerUserStore userStore = RangerAccessRequestUtil.getRequestUserStoreFromContext(accessRequest.getContext());
@@ -937,9 +996,11 @@ public final class RangerRequestScriptEvaluator {
varNames.add(SCRIPT_VAR_USER);
varNames.add(SCRIPT_MACRO_USER_ATTR_NAMES_CSV);
varNames.add(SCRIPT_MACRO_USER_ATTR_NAMES_Q_CSV);
+ varNames.add(SCRIPT_MACRO_HAS_USER_ATTR);
varNames.add("userAttrNamesCsv");
varNames.add("userAttrNamesCsvQ");
+ varNames.add("hasUserAttr");
return "\\b(" + StringUtils.join(varNames, '|') + ")\\b";
}
@@ -954,11 +1015,13 @@ public final class RangerRequestScriptEvaluator {
varNames.add(SCRIPT_MACRO_GET_UG_ATTR_Q_CSV);
varNames.add(SCRIPT_MACRO_UG_ATTR_NAMES_CSV);
varNames.add(SCRIPT_MACRO_UG_ATTR_NAMES_Q_CSV);
+ varNames.add(SCRIPT_MACRO_HAS_UG_ATTR);
varNames.add("ugAttrCsv");
varNames.add("ugAttrCsvQ");
varNames.add("ugAttrNamesCsv");
varNames.add("ugAttrNamesCsvQ");
+ varNames.add("hasUgAttr");
return "\\b(" + StringUtils.join(varNames, '|') + ")\\b";
}
@@ -982,6 +1045,12 @@ public final class RangerRequestScriptEvaluator {
ret.put(SCRIPT_MACRO_UR_NAMES_Q_CSV, "ctx.urNamesCsvQ()");
ret.put(SCRIPT_MACRO_USER_ATTR_NAMES_CSV, "ctx.userAttrNamesCsv()");
ret.put(SCRIPT_MACRO_USER_ATTR_NAMES_Q_CSV, "ctx.userAttrNamesCsvQ()");
+ ret.put(SCRIPT_MACRO_HAS_TAG, "ctx.hasTag");
+ ret.put(SCRIPT_MACRO_HAS_USER_ATTR, "ctx.hasUserAttr");
+ ret.put(SCRIPT_MACRO_HAS_UG_ATTR, "ctx.hasUgAttr");
+ ret.put(SCRIPT_MACRO_HAS_TAG_ATTR, "ctx.hasTagAttr");
+ ret.put(SCRIPT_MACRO_IS_IN_GROUP, "ctx.isInGroup");
+ ret.put(SCRIPT_MACRO_IS_IN_ROLE, "ctx.isInRole");
return ret;
}
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
index c98cce0e6..a372ea019 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
@@ -115,4 +115,10 @@ public class RangerCommonConstants {
public static final String SCRIPT_MACRO_UR_NAMES_Q_CSV = "UR_NAMES_Q_CSV";
public static final String SCRIPT_MACRO_USER_ATTR_NAMES_CSV = "USER_ATTR_NAMES_CSV";
public static final String SCRIPT_MACRO_USER_ATTR_NAMES_Q_CSV = "USER_ATTR_NAMES_Q_CSV";
+ public static final String SCRIPT_MACRO_HAS_TAG = "HAS_TAG";
+ public static final String SCRIPT_MACRO_HAS_USER_ATTR = "HAS_USER_ATTR";
+ public static final String SCRIPT_MACRO_HAS_UG_ATTR = "HAS_UG_ATTR";
+ public static final String SCRIPT_MACRO_HAS_TAG_ATTR = "HAS_TAG_ATTR";
+ public static final String SCRIPT_MACRO_IS_IN_GROUP = "IS_IN_GROUP";
+ public static final String SCRIPT_MACRO_IS_IN_ROLE = "IS_IN_ROLE";
}
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java b/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java
index 7bbad7842..97b92ef78 100644
--- a/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java
@@ -76,12 +76,14 @@ public class RangerRequestScriptEvaluatorTest {
Assert.assertEquals("test: GET_TAG_ATTR_Q_CSV('attr1')", "'PCI_value','PII_value'", evaluator.evaluateScript(scriptEngine, "GET_TAG_ATTR_Q_CSV('attr1')"));
Assert.assertTrue("test: USER._name is 'test-user'", (Boolean) evaluator.evaluateScript(scriptEngine, "USER._name == 'test-user'"));
+ Assert.assertTrue("test: HAS_USER_ATTR(state)", (Boolean)evaluator.evaluateScript(scriptEngine, "HAS_USER_ATTR('state')"));
+ Assert.assertFalse("test: HAS_USER_ATTR(notExists)", (Boolean)evaluator.evaluateScript(scriptEngine, "HAS_USER_ATTR('notExists')"));
Assert.assertTrue("test: USER['state'] is 'CA'", (Boolean) evaluator.evaluateScript(scriptEngine, "USER['state'] == 'CA'"));
Assert.assertTrue("test: USER.state is 'CA'", (Boolean) evaluator.evaluateScript(scriptEngine, "USER.state == 'CA'"));
- Assert.assertTrue("test: UGNAMES has test-group1", (Boolean)evaluator.evaluateScript(scriptEngine, "UGNAMES.indexOf('test-group1') != -1"));
- Assert.assertTrue("test: UGNAMES has test-group2", (Boolean)evaluator.evaluateScript(scriptEngine, "UGNAMES.indexOf('test-group2') != -1"));
- Assert.assertTrue("test: UGNAMES doesn't have test-group3", (Boolean)evaluator.evaluateScript(scriptEngine, "UGNAMES.indexOf('test-group3') == -1"));
+ Assert.assertTrue("test: IS_IN_GROUP(test-group1)", (Boolean)evaluator.evaluateScript(scriptEngine, "IS_IN_GROUP('test-group1')"));
+ Assert.assertTrue("test: IS_IN_GROUP(test-group2)", (Boolean)evaluator.evaluateScript(scriptEngine, "IS_IN_GROUP('test-group2')"));
+ Assert.assertFalse("test: IS_IN_GROUP(notExists)", (Boolean)evaluator.evaluateScript(scriptEngine, "IS_IN_GROUP('notExists')"));
Assert.assertTrue("test: UG['test-group1'].dept is 'ENGG'", (Boolean) evaluator.evaluateScript(scriptEngine, "UG['test-group1'].dept == 'ENGG'"));
Assert.assertTrue("test: UG['test-group1'].site is 10", (Boolean) evaluator.evaluateScript(scriptEngine, "UG['test-group1'].site == 10"));
@@ -90,9 +92,9 @@ public class RangerRequestScriptEvaluatorTest {
Assert.assertTrue("test: UG['test-group3'] is null", (Boolean) evaluator.evaluateScript(scriptEngine, "UG['test-group3'] == null"));
Assert.assertTrue("test: UG['test-group1'].notExists is null", (Boolean) evaluator.evaluateScript(scriptEngine, "UG['test-group1'].notExists == null"));
- Assert.assertTrue("test: URNAMES has test-role1", (Boolean)evaluator.evaluateScript(scriptEngine, "URNAMES.indexOf('test-role1') != -1"));
- Assert.assertTrue("test: URNAMES has test-role2", (Boolean)evaluator.evaluateScript(scriptEngine, "URNAMES.indexOf('test-role2') != -1"));
- Assert.assertTrue("test: URNAMES doesn't have test-role3", (Boolean)evaluator.evaluateScript(scriptEngine, "URNAMES.indexOf('test-role3') == -1"));
+ Assert.assertTrue("test: IS_IN_ROLE(test-role1)", (Boolean)evaluator.evaluateScript(scriptEngine, "IS_IN_ROLE('test-role1')"));
+ Assert.assertTrue("test: IS_IN_ROLE(test-role2)", (Boolean)evaluator.evaluateScript(scriptEngine, "IS_IN_ROLE('test-role2')"));
+ Assert.assertFalse("test: IS_IN_ROLE(notExists)", (Boolean)evaluator.evaluateScript(scriptEngine, "IS_IN_ROLE('notExists')"));
Assert.assertTrue("test: UGA.sVal['dept'] is 'ENGG'", (Boolean)evaluator.evaluateScript(scriptEngine, "UGA.sVal['dept'] == 'ENGG'"));
Assert.assertTrue("test: UGA.sVal['site'] is 10", (Boolean) evaluator.evaluateScript(scriptEngine, "UGA.sVal['site'] == 10"));
@@ -103,6 +105,9 @@ public class RangerRequestScriptEvaluatorTest {
Assert.assertTrue("test: UGA.mVal['dept'] has 'ENGG'", (Boolean) evaluator.evaluateScript(scriptEngine, "UGA.mVal['dept'].indexOf('ENGG') != -1"));
Assert.assertTrue("test: UGA.mVal['dept'] has 'PROD'", (Boolean) evaluator.evaluateScript(scriptEngine, "UGA.mVal['dept'].indexOf('PROD') != -1"));
Assert.assertTrue("test: UGA.mVal['dept'] doesn't have 'EXEC'", (Boolean) evaluator.evaluateScript(scriptEngine, "UGA.mVal['dept'].indexOf('EXEC') == -1"));
+ Assert.assertTrue("test: HAS_UG_ATTR(dept)", (Boolean)evaluator.evaluateScript(scriptEngine, "HAS_UG_ATTR('dept')"));
+ Assert.assertTrue("test: HAS_UG_ATTR(site)", (Boolean)evaluator.evaluateScript(scriptEngine, "HAS_UG_ATTR('site')"));
+ Assert.assertFalse("test: HAS_UG_ATTR(notExists)", (Boolean)evaluator.evaluateScript(scriptEngine, "HAS_UG_ATTR('notExists')"));
Assert.assertTrue("test: REQ.accessTyp is 'select'", (Boolean) evaluator.evaluateScript(scriptEngine, "REQ.accessType == 'select'"));
Assert.assertTrue("test: REQ.action is 'query'", (Boolean) evaluator.evaluateScript(scriptEngine, "REQ.action == 'query'"));
@@ -115,14 +120,16 @@ public class RangerRequestScriptEvaluatorTest {
Assert.assertTrue("test: TAG._type is 'PII'", (Boolean) evaluator.evaluateScript(scriptEngine, "TAG._type == 'PII'"));
Assert.assertTrue("test: TAG.attr1 is 'PII_value'", (Boolean) evaluator.evaluateScript(scriptEngine, "TAG.attr1 == 'PII_value'"));
Assert.assertTrue("test: TAGS.length is 2", (Boolean) evaluator.evaluateScript(scriptEngine, "Object.keys(TAGS).length == 2"));
- Assert.assertEquals("test: TAGS has PII", evaluator.evaluateScript(scriptEngine, "TAGS.PII._type"), "PII");
- Assert.assertEquals("test: TAGS has PCI", evaluator.evaluateScript(scriptEngine, "TAGS.PCI._type"), "PCI");
- Assert.assertEquals("test: TAGS has PII.attr1=PII_value", evaluator.evaluateScript(scriptEngine, "TAGS['PII'].attr1"), "PII_value");
- Assert.assertEquals("test: TAGS has PCI.attr1=PCI_value", evaluator.evaluateScript(scriptEngine, "TAGS['PCI'].attr1"), "PCI_value");
+ Assert.assertEquals("test: TAG PII has attr1=PII_value", evaluator.evaluateScript(scriptEngine, "TAGS['PII'].attr1"), "PII_value");
+ Assert.assertEquals("test: TAG PCI has attr1=PCI_value", evaluator.evaluateScript(scriptEngine, "TAGS['PCI'].attr1"), "PCI_value");
+ Assert.assertTrue("test: TAG PII doesn't have PII.notExists", (Boolean) evaluator.evaluateScript(scriptEngine, "TAGS['PII'].notExists == undefined"));
+ Assert.assertTrue("test: HAS_TAG_ATTR(attr1)", (Boolean) evaluator.evaluateScript(scriptEngine, "HAS_TAG_ATTR('attr1')"));
+ Assert.assertFalse("test: HAS_TAG_ATTR(notExists)", (Boolean) evaluator.evaluateScript(scriptEngine, "HAS_TAG_ATTR('notExists')"));
Assert.assertTrue("test: TAGNAMES.length is 2", (Boolean) evaluator.evaluateScript(scriptEngine, "TAGNAMES.length == 2"));
- Assert.assertTrue("test: TAGNAMES has 'PII'", (Boolean)evaluator.evaluateScript(scriptEngine, "TAGNAMES.indexOf('PII') != -1"));
- Assert.assertTrue("test: TAGNAMES has 'PCI'", (Boolean)evaluator.evaluateScript(scriptEngine, "TAGNAMES.indexOf('PCI') != -1"));
+ Assert.assertTrue("test: HAS_TAG(PII)", (Boolean) evaluator.evaluateScript(scriptEngine, "HAS_TAG('PII')"));
+ Assert.assertTrue("test: HAS_TAG(PCI)", (Boolean) evaluator.evaluateScript(scriptEngine, "HAS_TAG('PCI')"));
+ Assert.assertFalse("test: HAS_TAG(notExists)", (Boolean) evaluator.evaluateScript(scriptEngine, "HAS_TAG('notExists')"));
}