You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@ranger.apache.org by Kishor Gollapalliwar <ki...@gmail.com> on 2021/10/29 13:59:14 UTC

Review Request 73673: RANGER-3502: Make GET zones API accessible to authorized users only

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73673/
-----------------------------------------------------------

Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mahesh Bandal, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, Vishal Suvagia, and Velmurugan Periasamy.

Bugs: RANGER-3502
https://issues.apache.org/jira/browse/RANGER-3502

Repository: ranger

Description
-------

Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.

Steps to reproduce:

Diffs
-----

security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java fcf843370
security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java d6384a694

Diff: https://reviews.apache.org/r/73673/diff/1/

Testing
-------

1. mvn clean compile package install verify
2. Verified UI login with admin user
3. Verified curl (GET zones API) with admin user
4. Verified UI login with non-admin user having access to zone module
5. Verified curl (GET zones API) with non-admin user having access to zone module
6. Verified UI login with non-admin user having NO access to zone module
7. Verified curl (GET zones API) with non-admin user having NO access to zone module
8. Created /Updated deleted services
9. Created /Updated deleted policies
10. Created /Updated deleted zones & associated attached them to services

Thanks,

Kishor Gollapalliwar

Re: Review Request 73673: RANGER-3502: Make GET zone APIs accessible to authorized users only

Posted by Kishor Gollapalliwar <ki...@gmail.com>.


> On Nov. 2, 2021, 2:33 p.m., Madhan Neethiraj wrote:
> > security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java
> > Lines 290 (patched)
> > <https://reviews.apache.org/r/73673/diff/2/?file=2255079#file2255079line291>
> >
> >     Ranger admin UI for policies shows list of security zones in a dropdown list. Does the UI use this (getAllZones()) API to retrieve list of security zones? If yes, users not having MODULE_SECURITY_ZONE permission will not be able to get this list populated, and they will not be able to manage policies in security zone. Please review this usecase.
> 
> Kishor Gollapalliwar wrote:
>     The API (getAllZones()) is used on Dashboard, Reports & Access Audits pages. It seems implementation of these pages/ functionalities is based on assumption, zones & related info will be available/ visible to all regardless if they are authorized or not. This patch will break these functionalities. Please suggest if currennt implementation of these pages/ functionalities (Dashboard, Reports & Access Audits pages) is correct.

Update patch to handle review comments


- Kishor


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73673/#review223705
-----------------------------------------------------------


On Nov. 18, 2021, 4:18 p.m., Kishor Gollapalliwar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73673/
> -----------------------------------------------------------
> 
> (Updated Nov. 18, 2021, 4:18 p.m.)
> 
> 
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mahesh Bandal, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, Vishal Suvagia, and Velmurugan Periasamy.
> 
> 
> Bugs: RANGER-3502
>     https://issues.apache.org/jira/browse/RANGER-3502
> 
> 
> Repository: ranger
> 
> 
> Description
> -------
> 
> Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.
> 
> Steps to reproduce:
> 
> Create a internal user name, test_user1
> Remove the permission on Security Zone module for a user
> Login as test_user1 user to Ranger Admin, user should not be able to see Security Zone tab
> Access the API using following curls
> 1. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones"
> 2. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/{ID}"
> 3. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/name/{ZONE_NAME}"
> 
> 
> Diffs
> -----
> 
>   security-admin/src/main/java/org/apache/ranger/biz/SecurityZoneDBStore.java 12ad7e676 
>   security-admin/src/main/java/org/apache/ranger/db/XXSecurityZoneDao.java 46ff16f37 
>   security-admin/src/main/java/org/apache/ranger/db/XXSecurityZoneRefServiceDao.java f5c1a882f 
>   security-admin/src/main/java/org/apache/ranger/db/XXSecurityZoneRefTagServiceDao.java c30dba1ce 
>   security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java fcf843370 
>   security-admin/src/main/java/org/apache/ranger/view/RangerMinimal.java PRE-CREATION 
>   security-admin/src/main/java/org/apache/ranger/view/RangerSecurityZoneMinimalList.java PRE-CREATION 
>   security-admin/src/main/java/org/apache/ranger/view/RangerServiceMinimalList.java PRE-CREATION 
>   security-admin/src/main/resources/META-INF/jpa_named_queries.xml 85cadbbd5 
>   security-admin/src/main/webapp/scripts/controllers/Controller.js 74f2af513 
>   security-admin/src/main/webapp/scripts/views/UploadServicePolicy.js f7d3b7316 
>   security-admin/src/main/webapp/scripts/views/policymanager/ServiceLayout.js 11d471137 
>   security-admin/src/main/webapp/scripts/views/policymanager/ServiceLayoutSidebar.js 67a577c20 
>   security-admin/src/main/webapp/scripts/views/reports/AuditLayout.js 2acf35f3d 
>   security-admin/src/main/webapp/scripts/views/reports/UserAccessLayout.js e6ec81f27 
>   security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java d6384a694 
> 
> 
> Diff: https://reviews.apache.org/r/73673/diff/3/
> 
> 
> Testing
> -------
> 
> 1. mvn clean compile package install verify
> 2. Verified UI login with admin user
> 3. Verified curl (GET zones API) with admin user
> 4. Verified UI login with non-admin user having access to zone module 
> 5. Verified curl (GET zones API) with non-admin user having access to zone module
> 6. Verified UI login with non-admin user having NO access to zone module 
> 7. Verified curl (GET zones API) with non-admin user having NO access to zone module
> 8. Created /Updated deleted services
> 9. Created /Updated deleted policies
> 10. Created /Updated deleted zones & associated attached them to services
> 11. Verified behaviour on dashboard, report, access audit import & export functionalities
> 
> 
> Thanks,
> 
> Kishor Gollapalliwar
> 
>

Re: Review Request 73673: RANGER-3502: Make GET zone APIs accessible to authorized users only

Posted by Kishor Gollapalliwar <ki...@gmail.com>.


> On Nov. 2, 2021, 2:33 p.m., Madhan Neethiraj wrote:
> > security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java
> > Lines 290 (patched)
> > <https://reviews.apache.org/r/73673/diff/2/?file=2255079#file2255079line291>
> >
> >     Ranger admin UI for policies shows list of security zones in a dropdown list. Does the UI use this (getAllZones()) API to retrieve list of security zones? If yes, users not having MODULE_SECURITY_ZONE permission will not be able to get this list populated, and they will not be able to manage policies in security zone. Please review this usecase.

The API (getAllZones()) is used on Dashboard, Reports & Access Audits pages. It seems implementation of these pages/ functionalities is based on assumption, zones & related info will be available/ visible to all regardless if they are authorized or not. This patch will break these functionalities. Please suggest if currennt implementation of these pages/ functionalities (Dashboard, Reports & Access Audits pages) is correct.


- Kishor


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73673/#review223705
-----------------------------------------------------------


On Nov. 2, 2021, 2:09 p.m., Kishor Gollapalliwar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73673/
> -----------------------------------------------------------
> 
> (Updated Nov. 2, 2021, 2:09 p.m.)
> 
> 
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mahesh Bandal, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, Vishal Suvagia, and Velmurugan Periasamy.
> 
> 
> Bugs: RANGER-3502
>     https://issues.apache.org/jira/browse/RANGER-3502
> 
> 
> Repository: ranger
> 
> 
> Description
> -------
> 
> Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.
> 
> Steps to reproduce:
> 
> Create a internal user name, test_user1
> Remove the permission on Security Zone module for a user
> Login as test_user1 user to Ranger Admin, user should not be able to see Security Zone tab
> Access the API using following curls
> 1. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones"
> 2. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/{ID}"
> 3. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/name/{ZONE_NAME}"
> 
> 
> Diffs
> -----
> 
>   security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java fcf843370 
>   security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java d6384a694 
> 
> 
> Diff: https://reviews.apache.org/r/73673/diff/2/
> 
> 
> Testing
> -------
> 
> 1. mvn clean compile package install verify
> 2. Verified UI login with admin user
> 3. Verified curl (GET zones API) with admin user
> 4. Verified UI login with non-admin user having access to zone module 
> 5. Verified curl (GET zones API) with non-admin user having access to zone module
> 6. Verified UI login with non-admin user having NO access to zone module 
> 7. Verified curl (GET zones API) with non-admin user having NO access to zone module
> 8. Created /Updated deleted services
> 9. Created /Updated deleted policies
> 10. Created /Updated deleted zones & associated attached them to services
> 
> 
> Thanks,
> 
> Kishor Gollapalliwar
> 
>

Re: Review Request 73673: RANGER-3502: Make GET zone APIs accessible to authorized users only

Posted by Madhan Neethiraj <ma...@apache.org>.

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73673/#review223705
-----------------------------------------------------------




security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java
Lines 290 (patched)
<https://reviews.apache.org/r/73673/#comment312813>

    Ranger admin UI for policies shows list of security zones in a dropdown list. Does the UI use this (getAllZones()) API to retrieve list of security zones? If yes, users not having MODULE_SECURITY_ZONE permission will not be able to get this list populated, and they will not be able to manage policies in security zone. Please review this usecase.


- Madhan Neethiraj


On Nov. 2, 2021, 2:09 p.m., Kishor Gollapalliwar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73673/
> -----------------------------------------------------------
> 
> (Updated Nov. 2, 2021, 2:09 p.m.)
> 
> 
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mahesh Bandal, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, Vishal Suvagia, and Velmurugan Periasamy.
> 
> 
> Bugs: RANGER-3502
>     https://issues.apache.org/jira/browse/RANGER-3502
> 
> 
> Repository: ranger
> 
> 
> Description
> -------
> 
> Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.
> 
> Steps to reproduce:
> 
> Create a internal user name, test_user1
> Remove the permission on Security Zone module for a user
> Login as test_user1 user to Ranger Admin, user should not be able to see Security Zone tab
> Access the API using following curls
> 1. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones"
> 2. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/{ID}"
> 3. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/name/{ZONE_NAME}"
> 
> 
> Diffs
> -----
> 
>   security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java fcf843370 
>   security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java d6384a694 
> 
> 
> Diff: https://reviews.apache.org/r/73673/diff/2/
> 
> 
> Testing
> -------
> 
> 1. mvn clean compile package install verify
> 2. Verified UI login with admin user
> 3. Verified curl (GET zones API) with admin user
> 4. Verified UI login with non-admin user having access to zone module 
> 5. Verified curl (GET zones API) with non-admin user having access to zone module
> 6. Verified UI login with non-admin user having NO access to zone module 
> 7. Verified curl (GET zones API) with non-admin user having NO access to zone module
> 8. Created /Updated deleted services
> 9. Created /Updated deleted policies
> 10. Created /Updated deleted zones & associated attached them to services
> 
> 
> Thanks,
> 
> Kishor Gollapalliwar
> 
>

Re: Review Request 73673: RANGER-3502: Make GET zone APIs accessible to authorized users only

Posted by Kishor Gollapalliwar <ki...@gmail.com>.

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73673/
-----------------------------------------------------------

(Updated Nov. 18, 2021, 4:18 p.m.)


Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mahesh Bandal, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, Vishal Suvagia, and Velmurugan Periasamy.


Bugs: RANGER-3502
    https://issues.apache.org/jira/browse/RANGER-3502


Repository: ranger


Description
-------

Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.

Steps to reproduce:

Create a internal user name, test_user1
Remove the permission on Security Zone module for a user
Login as test_user1 user to Ranger Admin, user should not be able to see Security Zone tab
Access the API using following curls
1. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones"
2. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/{ID}"
3. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/name/{ZONE_NAME}"


Diffs (updated)
-----

  security-admin/src/main/java/org/apache/ranger/biz/SecurityZoneDBStore.java 12ad7e676 
  security-admin/src/main/java/org/apache/ranger/db/XXSecurityZoneDao.java 46ff16f37 
  security-admin/src/main/java/org/apache/ranger/db/XXSecurityZoneRefServiceDao.java f5c1a882f 
  security-admin/src/main/java/org/apache/ranger/db/XXSecurityZoneRefTagServiceDao.java c30dba1ce 
  security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java fcf843370 
  security-admin/src/main/java/org/apache/ranger/view/RangerMinimal.java PRE-CREATION 
  security-admin/src/main/java/org/apache/ranger/view/RangerSecurityZoneMinimalList.java PRE-CREATION 
  security-admin/src/main/java/org/apache/ranger/view/RangerServiceMinimalList.java PRE-CREATION 
  security-admin/src/main/resources/META-INF/jpa_named_queries.xml 85cadbbd5 
  security-admin/src/main/webapp/scripts/controllers/Controller.js 74f2af513 
  security-admin/src/main/webapp/scripts/views/UploadServicePolicy.js f7d3b7316 
  security-admin/src/main/webapp/scripts/views/policymanager/ServiceLayout.js 11d471137 
  security-admin/src/main/webapp/scripts/views/policymanager/ServiceLayoutSidebar.js 67a577c20 
  security-admin/src/main/webapp/scripts/views/reports/AuditLayout.js 2acf35f3d 
  security-admin/src/main/webapp/scripts/views/reports/UserAccessLayout.js e6ec81f27 
  security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java d6384a694 


Diff: https://reviews.apache.org/r/73673/diff/3/

Changes: https://reviews.apache.org/r/73673/diff/2-3/


Testing (updated)
-------

1. mvn clean compile package install verify
2. Verified UI login with admin user
3. Verified curl (GET zones API) with admin user
4. Verified UI login with non-admin user having access to zone module 
5. Verified curl (GET zones API) with non-admin user having access to zone module
6. Verified UI login with non-admin user having NO access to zone module 
7. Verified curl (GET zones API) with non-admin user having NO access to zone module
8. Created /Updated deleted services
9. Created /Updated deleted policies
10. Created /Updated deleted zones & associated attached them to services
11. Verified behaviour on dashboard, report, access audit import & export functionalities


Thanks,

Kishor Gollapalliwar

Re: Review Request 73673: RANGER-3502: Make GET zone APIs accessible to authorized users only

Posted by Kishor Gollapalliwar <ki...@gmail.com>.

(Updated Nov. 2, 2021, 2:09 p.m.)

Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mahesh Bandal, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, Vishal Suvagia, and Velmurugan Periasamy.

Summary (updated)
-----------------

RANGER-3502: Make GET zone APIs accessible to authorized users only

Bugs: RANGER-3502
https://issues.apache.org/jira/browse/RANGER-3502

Repository: ranger

Description (updated)
-------

Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.

Steps to reproduce:

Create a internal user name, test_user1
Remove the permission on Security Zone module for a user
Login as test_user1 user to Ranger Admin, user should not be able to see Security Zone tab
Access the API using following curls
1. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones"
2. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/{ID}"
3. curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/name/{ZONE_NAME}"

Diffs
-----

security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java fcf843370
security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java d6384a694

Diff: https://reviews.apache.org/r/73673/diff/2/

Testing
-------

Thanks,

Kishor Gollapalliwar

Re: Review Request 73673: RANGER-3502: Make GET zones API accessible to authorized users only

Posted by Kishor Gollapalliwar <ki...@gmail.com>.

(Updated Nov. 2, 2021, 2:08 p.m.)

Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mahesh Bandal, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, Vishal Suvagia, and Velmurugan Periasamy.

Changes
-------

Similar access restrictions added in GetById & GetByName APIs

Bugs: RANGER-3502
https://issues.apache.org/jira/browse/RANGER-3502

Repository: ranger

Description
-------

Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.

Steps to reproduce:

Diffs (updated)
-----

security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java fcf843370
security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java d6384a694

Diff: https://reviews.apache.org/r/73673/diff/2/

Changes: https://reviews.apache.org/r/73673/diff/1-2/

Testing
-------

Thanks,

Kishor Gollapalliwar

Re: Review Request 73673: RANGER-3502: Make GET zones API accessible to authorized users only

Posted by Abhay Kulkarni <ak...@hortonworks.com>.

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73673/#review223702
-----------------------------------------------------------


Ship it!




Ship It!

- Abhay Kulkarni


On Oct. 29, 2021, 1:59 p.m., Kishor Gollapalliwar wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/73673/
> -----------------------------------------------------------
> 
> (Updated Oct. 29, 2021, 1:59 p.m.)
> 
> 
> Review request for ranger, Abhay Kulkarni, Madhan Neethiraj, Mahesh Bandal, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, Vishal Suvagia, and Velmurugan Periasamy.
> 
> 
> Bugs: RANGER-3502
>     https://issues.apache.org/jira/browse/RANGER-3502
> 
> 
> Repository: ranger
> 
> 
> Description
> -------
> 
> Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.
> 
> Steps to reproduce:
> 
> Create a internal user name, test_user1
> Remove the permission on Security Zone module for a user
> Login as test_user1 user to Ranger Admin, user should not be able to see Security Zone tab
> Access the API using curl
> curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones"
> 
> 
> Diffs
> -----
> 
>   security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java fcf843370 
>   security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java d6384a694 
> 
> 
> Diff: https://reviews.apache.org/r/73673/diff/1/
> 
> 
> Testing
> -------
> 
> 1. mvn clean compile package install verify
> 2. Verified UI login with admin user
> 3. Verified curl (GET zones API) with admin user
> 4. Verified UI login with non-admin user having access to zone module 
> 5. Verified curl (GET zones API) with non-admin user having access to zone module
> 6. Verified UI login with non-admin user having NO access to zone module 
> 7. Verified curl (GET zones API) with non-admin user having NO access to zone module
> 8. Created /Updated deleted services
> 9. Created /Updated deleted policies
> 10. Created /Updated deleted zones & associated attached them to services
> 
> 
> Thanks,
> 
> Kishor Gollapalliwar
> 
>