You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Nikhil P <np...@gmail.com> on 2019/10/15 11:29:31 UTC
Review Request 71614: RANGER-2617 : Provide descriptive error message
when role delete not allowed
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71614/
-----------------------------------------------------------
Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
Bugs: RANGER-2617
https://issues.apache.org/jira/browse/RANGER-2617
Repository: ranger
Description
-------
Scenario:
Create a role r1
Create a ranger policy for role r1
Try to delete role
Role delete is not allowed as a policy exists with the specified role.
Response: XXRole can't be deleted
Expected:
Descriptive message with details on why the operation is not allowed
Diffs
-----
security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java 9151a7209
Diff: https://reviews.apache.org/r/71614/diff/1/
Testing
-------
Tested on local VM if descriptive response is given If role delete is not allowed.
Thanks,
Nikhil P
Re: Review Request 71614: RANGER-2617 : Provide descriptive error
message when role delete not allowed
Posted by Velmurugan Periasamy <vp...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71614/#review218218
-----------------------------------------------------------
Ship it!
Ship It!
- Velmurugan Periasamy
On Oct. 15, 2019, 1:46 p.m., Nikhil P wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71614/
> -----------------------------------------------------------
>
> (Updated Oct. 15, 2019, 1:46 p.m.)
>
>
> Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2617
> https://issues.apache.org/jira/browse/RANGER-2617
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Scenario:
> Create a role r1
> Create a ranger policy for role r1
> Try to delete role
> Role delete is not allowed as a policy exists with the specified role.
>
> Response: XXRole can't be deleted
>
> Expected:
> Descriptive message with details on why the operation is not allowed
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java dfc5be89d
>
>
> Diff: https://reviews.apache.org/r/71614/diff/2/
>
>
> Testing
> -------
>
> Tested on local VM if descriptive response is given If role delete is not allowed.
>
>
> Thanks,
>
> Nikhil P
>
>
Re: Review Request 71614: RANGER-2617 : Provide descriptive error
message when role delete not allowed
Posted by Nikhil P <np...@gmail.com>.
> On Oct. 15, 2019, 9:59 p.m., Madhan Neethiraj wrote:
> > security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java
> > Lines 159 (patched)
> > <https://reviews.apache.org/r/71614/diff/2/?file=2169119#file2169119line159>
> >
> > In addition to looking for references in policies, shouldn't references from other roles be checked as well?
yes, it should be checked.
- Nikhil
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71614/#review218219
-----------------------------------------------------------
On Oct. 16, 2019, 2:56 p.m., Nikhil P wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71614/
> -----------------------------------------------------------
>
> (Updated Oct. 16, 2019, 2:56 p.m.)
>
>
> Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2617
> https://issues.apache.org/jira/browse/RANGER-2617
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Scenario:
> Create a role r1
> Create a ranger policy for role r1
> Try to delete role
> Role delete is not allowed as a policy exists with the specified role.
>
> Response: XXRole can't be deleted
>
> Expected:
> Descriptive message with details on why the operation is not allowed
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java dfc5be89d
>
>
> Diff: https://reviews.apache.org/r/71614/diff/3/
>
>
> Testing
> -------
>
> Tested on local VM if descriptive response is given If role delete is not allowed.
>
>
> Thanks,
>
> Nikhil P
>
>
Re: Review Request 71614: RANGER-2617 : Provide descriptive error
message when role delete not allowed
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71614/#review218219
-----------------------------------------------------------
security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java
Lines 157 (patched)
<https://reviews.apache.org/r/71614/#comment305811>
"it is already present in policy" => "it is referenced in one or more policies"
security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java
Lines 159 (patched)
<https://reviews.apache.org/r/71614/#comment305812>
In addition to looking for references in policies, shouldn't references from other roles be checked as well?
- Madhan Neethiraj
On Oct. 15, 2019, 1:46 p.m., Nikhil P wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71614/
> -----------------------------------------------------------
>
> (Updated Oct. 15, 2019, 1:46 p.m.)
>
>
> Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2617
> https://issues.apache.org/jira/browse/RANGER-2617
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Scenario:
> Create a role r1
> Create a ranger policy for role r1
> Try to delete role
> Role delete is not allowed as a policy exists with the specified role.
>
> Response: XXRole can't be deleted
>
> Expected:
> Descriptive message with details on why the operation is not allowed
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java dfc5be89d
>
>
> Diff: https://reviews.apache.org/r/71614/diff/2/
>
>
> Testing
> -------
>
> Tested on local VM if descriptive response is given If role delete is not allowed.
>
>
> Thanks,
>
> Nikhil P
>
>
Re: Review Request 71614: RANGER-2617 : Provide descriptive error
message when role delete not allowed
Posted by Nikhil P <np...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71614/
-----------------------------------------------------------
(Updated Oct. 17, 2019, 4:19 p.m.)
Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
Changes
-------
resolved review comments.
added rolename in descriptive message.
Bugs: RANGER-2617
https://issues.apache.org/jira/browse/RANGER-2617
Repository: ranger
Description
-------
Scenario:
Create a role r1
Create a ranger policy for role r1
Try to delete role
Role delete is not allowed as a policy exists with the specified role.
Response: XXRole can't be deleted
Expected:
Descriptive message with details on why the operation is not allowed
Diffs (updated)
-----
security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java 5d432f8d8
security-admin/src/main/java/org/apache/ranger/db/XXPolicyRefRoleDao.java b92f8066f
security-admin/src/main/java/org/apache/ranger/db/XXRoleRefRoleDao.java 419481079
security-admin/src/main/resources/META-INF/jpa_named_queries.xml 7e2139916
Diff: https://reviews.apache.org/r/71614/diff/4/
Changes: https://reviews.apache.org/r/71614/diff/3-4/
Testing
-------
Tested on local VM if descriptive response is given If role delete is not allowed.
Thanks,
Nikhil P
Re: Review Request 71614: RANGER-2617 : Provide descriptive error
message when role delete not allowed
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71614/#review218229
-----------------------------------------------------------
Fix it, then Ship it!
security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java
Lines 194 (patched)
<https://reviews.apache.org/r/71614/#comment305825>
Only the count is needed here; consider avoiding retrieval of entire XXPolicyRefRole objects here. Add a query that will return number of references, and check for "refCount > 1" here - like:
Long roleRefCount = daoMgr.getXXPolicyRefRole().findRoleRefCount(roleName);
return roleRefCount < 1;
Same for line #200.
- Madhan Neethiraj
On Oct. 16, 2019, 9:26 a.m., Nikhil P wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71614/
> -----------------------------------------------------------
>
> (Updated Oct. 16, 2019, 9:26 a.m.)
>
>
> Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2617
> https://issues.apache.org/jira/browse/RANGER-2617
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Scenario:
> Create a role r1
> Create a ranger policy for role r1
> Try to delete role
> Role delete is not allowed as a policy exists with the specified role.
>
> Response: XXRole can't be deleted
>
> Expected:
> Descriptive message with details on why the operation is not allowed
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java dfc5be89d
>
>
> Diff: https://reviews.apache.org/r/71614/diff/3/
>
>
> Testing
> -------
>
> Tested on local VM if descriptive response is given If role delete is not allowed.
>
>
> Thanks,
>
> Nikhil P
>
>
Re: Review Request 71614: RANGER-2617 : Provide descriptive error
message when role delete not allowed
Posted by Nikhil P <np...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71614/
-----------------------------------------------------------
(Updated Oct. 16, 2019, 2:56 p.m.)
Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
Bugs: RANGER-2617
https://issues.apache.org/jira/browse/RANGER-2617
Repository: ranger
Description
-------
Scenario:
Create a role r1
Create a ranger policy for role r1
Try to delete role
Role delete is not allowed as a policy exists with the specified role.
Response: XXRole can't be deleted
Expected:
Descriptive message with details on why the operation is not allowed
Diffs (updated)
-----
security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java dfc5be89d
Diff: https://reviews.apache.org/r/71614/diff/3/
Changes: https://reviews.apache.org/r/71614/diff/2-3/
Testing
-------
Tested on local VM if descriptive response is given If role delete is not allowed.
Thanks,
Nikhil P
Re: Review Request 71614: RANGER-2617 : Provide descriptive error
message when role delete not allowed
Posted by Nikhil P <np...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71614/
-----------------------------------------------------------
(Updated Oct. 15, 2019, 7:16 p.m.)
Review request for ranger, Gautam Borad, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
Bugs: RANGER-2617
https://issues.apache.org/jira/browse/RANGER-2617
Repository: ranger
Description
-------
Scenario:
Create a role r1
Create a ranger policy for role r1
Try to delete role
Role delete is not allowed as a policy exists with the specified role.
Response: XXRole can't be deleted
Expected:
Descriptive message with details on why the operation is not allowed
Diffs (updated)
-----
security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java dfc5be89d
Diff: https://reviews.apache.org/r/71614/diff/2/
Changes: https://reviews.apache.org/r/71614/diff/1-2/
Testing
-------
Tested on local VM if descriptive response is given If role delete is not allowed.
Thanks,
Nikhil P