You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by rm...@apache.org on 2026/05/29 18:08:21 UTC
(ranger) branch RANGER-5610-patch-fix created (now 401dbdce4)
This is an automated email from the ASF dual-hosted git repository.
rameeshm pushed a change to branch RANGER-5610-patch-fix
in repository https://gitbox.apache.org/repos/asf/ranger.git
at 401dbdce4 RANGER-5610:getResourceACLs for a principal should consider validitySchedule of principal for ACL creation
This branch includes the following new commits:
new 401dbdce4 RANGER-5610:getResourceACLs for a principal should consider validitySchedule of principal for ACL creation
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(ranger) 01/01: RANGER-5610:getResourceACLs for a principal should consider validitySchedule of principal for ACL creation
Posted by rm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rameeshm pushed a commit to branch RANGER-5610-patch-fix
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 401dbdce4a42bf1701d2cbad5f4d62c4dbe61c68
Author: Ramesh Mani <rm...@apache.org>
AuthorDate: Fri May 29 11:05:07 2026 -0700
RANGER-5610:getResourceACLs for a principal should consider validitySchedule of principal for ACL creation
Signed-off-by: Ramesh Mani <rm...@apache.org>
---
.../hive/authorizer/RangerHiveAuthorizer.java | 121 ++++++++++++++++++++
.../hive/authorizer/TestRangerHiveAuthorizer.java | 122 +++++++++++++++++++++
2 files changed, 243 insertions(+)
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
index 49738740f..42a1fb896 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
@@ -58,6 +58,7 @@
import org.apache.hadoop.thirdparty.com.google.common.collect.Sets;
import org.apache.ranger.authorization.hadoop.constants.RangerHadoopConstants;
import org.apache.ranger.authorization.utils.StringUtil;
+import org.apache.ranger.plugin.conditionevaluator.RangerValidityScheduleConditionEvaluator;
import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemAccess;
import org.apache.ranger.plugin.model.RangerRole;
@@ -2843,11 +2844,131 @@ private RangerResourceACLs getRangerResourceACLs(HivePrivilegeObject hiveObject,
ret = hivePlugin.getResourceACLs(request);
+ if (ret != null && principal != null && request != null) {
+ filterAclsByValiditySchedule(ret, principal, request);
+ }
+
LOG.debug("<== RangerHivePolicyProvider.getRangerResourceACLs:[{}], principal=[{}], Computed ACLS:[{}]", hiveObject, principal, ret);
return ret;
}
+ private void filterAclsByValiditySchedule(RangerResourceACLs acls, HivePrincipal principal, RangerAccessRequest request) {
+ if (acls == null || principal == null || request == null) {
+ return;
+ }
+
+ Map<String, Map<String, RangerResourceACLs.AccessResult>> principalACLs = null;
+ switch (principal.getType()) {
+ case USER:
+ principalACLs = acls.getUserACLs();
+ break;
+ case GROUP:
+ principalACLs = acls.getGroupACLs();
+ break;
+ case ROLE:
+ principalACLs = acls.getRoleACLs();
+ break;
+ default:
+ break;
+ }
+
+ if (principalACLs != null) {
+ Map<String, RangerResourceACLs.AccessResult> accessMap = principalACLs.get(principal.getName());
+ if (accessMap != null) {
+ List<String> keysToRemove = new ArrayList<>();
+ for (Map.Entry<String, RangerResourceACLs.AccessResult> entry : accessMap.entrySet()) {
+ RangerResourceACLs.AccessResult accessResult = entry.getValue();
+ if (accessResult != null && accessResult.getResult() == RangerPolicyEvaluator.ACCESS_CONDITIONAL) {
+ RangerPolicy policy = accessResult.getPolicy();
+ if (policy != null) {
+ boolean hasActiveItem = false;
+
+ List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<>();
+ if (CollectionUtils.isNotEmpty(policy.getPolicyItems())) {
+ policyItems.addAll(policy.getPolicyItems());
+ }
+ if (CollectionUtils.isNotEmpty(policy.getDenyPolicyItems())) {
+ policyItems.addAll(policy.getDenyPolicyItems());
+ }
+ if (CollectionUtils.isNotEmpty(policy.getAllowExceptions())) {
+ policyItems.addAll(policy.getAllowExceptions());
+ }
+ if (CollectionUtils.isNotEmpty(policy.getDenyExceptions())) {
+ policyItems.addAll(policy.getDenyExceptions());
+ }
+
+ for (RangerPolicy.RangerPolicyItem policyItem : policyItems) {
+ if (isPolicyItemApplicable(policyItem, principal, entry.getKey()) && isPolicyItemValidityActive(policyItem, request)) {
+ hasActiveItem = true;
+ break;
+ }
+ }
+ if (!hasActiveItem) {
+ keysToRemove.add(entry.getKey());
+ }
+ }
+ }
+ }
+ for (String key : keysToRemove) {
+ accessMap.remove(key);
+ }
+ if (accessMap.isEmpty()) {
+ principalACLs.remove(principal.getName());
+ }
+ }
+ }
+ }
+
+ private boolean isPolicyItemApplicable(RangerPolicy.RangerPolicyItem policyItem, HivePrincipal principal, String accessType) {
+ if (policyItem == null || principal == null || StringUtils.isBlank(accessType)) {
+ return false;
+ }
+
+ if (CollectionUtils.isEmpty(policyItem.getAccesses())) {
+ return false;
+ }
+
+ boolean hasAccessType = false;
+ for (RangerPolicy.RangerPolicyItemAccess access : policyItem.getAccesses()) {
+ if (StringUtils.equalsIgnoreCase(accessType, access.getType()) || StringUtils.equalsIgnoreCase(access.getType(), RangerPolicyEngine.ANY_ACCESS)) {
+ hasAccessType = true;
+ break;
+ }
+ }
+ if (!hasAccessType) {
+ return false;
+ }
+
+ switch (principal.getType()) {
+ case USER:
+ return CollectionUtils.isNotEmpty(policyItem.getUsers()) && (policyItem.getUsers().contains(principal.getName()) || policyItem.getUsers().contains(RangerPolicyEngine.USER_CURRENT));
+ case GROUP:
+ return CollectionUtils.isNotEmpty(policyItem.getGroups()) && (policyItem.getGroups().contains(principal.getName()) || policyItem.getGroups().contains(RangerPolicyEngine.GROUP_PUBLIC));
+ case ROLE:
+ return CollectionUtils.isNotEmpty(policyItem.getRoles()) && policyItem.getRoles().contains(principal.getName());
+ }
+ return false;
+ }
+
+ private boolean isPolicyItemValidityActive(RangerPolicy.RangerPolicyItem policyItem, RangerAccessRequest request) {
+ if (policyItem == null || request == null || CollectionUtils.isEmpty(policyItem.getConditions())) {
+ return true;
+ }
+ for (RangerPolicy.RangerPolicyItemCondition condition : policyItem.getConditions()) {
+ if (!StringUtils.equalsIgnoreCase(condition.getType(), "validitySchedule")) {
+ continue;
+ }
+ RangerValidityScheduleConditionEvaluator evaluator = new org.apache.ranger.plugin.conditionevaluator.RangerValidityScheduleConditionEvaluator();
+ evaluator.setPolicyItemCondition(condition);
+ evaluator.init();
+ if (!evaluator.isMatched(request)) {
+ return false;
+ }
+ }
+ return true;
+ }
+
private Map<String, Map<Privilege, AccessResult>> convertRangerACLsToHiveACLs(Map<String, Map<String, RangerResourceACLs.AccessResult>> rangerACLs) {
Map<String, Map<Privilege, AccessResult>> ret = new HashMap<>();
diff --git a/hive-agent/src/test/java/org/apache/ranger/authorization/hive/authorizer/TestRangerHiveAuthorizer.java b/hive-agent/src/test/java/org/apache/ranger/authorization/hive/authorizer/TestRangerHiveAuthorizer.java
index 969abc971..c419bada1 100644
--- a/hive-agent/src/test/java/org/apache/ranger/authorization/hive/authorizer/TestRangerHiveAuthorizer.java
+++ b/hive-agent/src/test/java/org/apache/ranger/authorization/hive/authorizer/TestRangerHiveAuthorizer.java
@@ -1450,6 +1450,128 @@ public void test69_getHivePrivilegeInfos_allPrincipals() throws Exception {
}
}
+ @Test
+ void test70_getRangerResourceACLs_filtersExpiredValiditySchedule() throws Exception {
+ RangerBasePlugin plugin = (RangerBasePlugin) Mockito.spy(newInstanceRangerHivePlugin("hiveCLI"));
+ RangerResourceACLs acls = new RangerResourceACLs();
+
+ RangerPolicy pUser = new RangerPolicy();
+ RangerPolicy.RangerPolicyItem item = new RangerPolicy.RangerPolicyItem();
+ item.setAccesses(Collections.singletonList(new RangerPolicy.RangerPolicyItemAccess("select", true)));
+ item.setUsers(Collections.singletonList("alice"));
+
+ RangerPolicy.RangerPolicyItemCondition condition = new RangerPolicy.RangerPolicyItemCondition();
+ condition.setType("validitySchedule");
+ condition.setValues(Collections.singletonList("{\"endTime\":\"2000/01/01 00:00:00\"}"));
+ item.setConditions(Collections.singletonList(condition));
+
+ pUser.setPolicyItems(Collections.singletonList(item));
+
+ acls.setUserAccessInfo("alice", "select", RangerPolicyEvaluator.ACCESS_CONDITIONAL, pUser);
+
+ Mockito.doReturn(acls).when(plugin).getResourceACLs(Mockito.any(RangerAccessRequestImpl.class));
+ setStaticHivePlugin(plugin);
+
+ HiveMetastoreClientFactory msFactory = Mockito.mock(HiveMetastoreClientFactory.class);
+ IMetaStoreClient ms = Mockito.mock(IMetaStoreClient.class);
+ Mockito.when(msFactory.getHiveMetastoreClient()).thenReturn(ms);
+ RangerHiveAuthorizer authorizer = new RangerHiveAuthorizer(msFactory, null, null, null);
+
+ Method m = RangerHiveAuthorizer.class.getDeclaredMethod("getRangerResourceACLs", HivePrivilegeObject.class, HivePrincipal.class);
+ m.setAccessible(true);
+
+ HivePrivilegeObject obj = new HivePrivilegeObject(HivePrivilegeObjectType.TABLE_OR_VIEW, "db1", "t1");
+ HivePrincipal principal = new HivePrincipal("alice", HivePrincipal.HivePrincipalType.USER);
+
+ Object out = m.invoke(authorizer, obj, principal);
+ assertInstanceOf(RangerResourceACLs.class, out);
+ RangerResourceACLs resultAcls = (RangerResourceACLs) out;
+
+ assertTrue(resultAcls.getUserACLs().isEmpty() || !resultAcls.getUserACLs().containsKey("alice"));
+ }
+
+ @Test
+ void test71_getRangerResourceACLs_keepsActiveValiditySchedule() throws Exception {
+ RangerBasePlugin plugin = (RangerBasePlugin) Mockito.spy(newInstanceRangerHivePlugin("hiveCLI"));
+ RangerResourceACLs acls = new RangerResourceACLs();
+
+ RangerPolicy pUser = new RangerPolicy();
+ RangerPolicy.RangerPolicyItem item = new RangerPolicy.RangerPolicyItem();
+ item.setAccesses(Collections.singletonList(new RangerPolicy.RangerPolicyItemAccess("select", true)));
+ item.setUsers(Collections.singletonList("bob"));
+
+ RangerPolicy.RangerPolicyItemCondition condition = new RangerPolicy.RangerPolicyItemCondition();
+ condition.setType("validitySchedule");
+ condition.setValues(Collections.singletonList("{\"endTime\":\"2100/01/01 00:00:00\"}"));
+ item.setConditions(Collections.singletonList(condition));
+
+ pUser.setPolicyItems(Collections.singletonList(item));
+
+ acls.setUserAccessInfo("bob", "select", RangerPolicyEvaluator.ACCESS_CONDITIONAL, pUser);
+
+ Mockito.doReturn(acls).when(plugin).getResourceACLs(Mockito.any(RangerAccessRequestImpl.class));
+ setStaticHivePlugin(plugin);
+
+ HiveMetastoreClientFactory msFactory = Mockito.mock(HiveMetastoreClientFactory.class);
+ IMetaStoreClient ms = Mockito.mock(IMetaStoreClient.class);
+ Mockito.when(msFactory.getHiveMetastoreClient()).thenReturn(ms);
+ RangerHiveAuthorizer authorizer = new RangerHiveAuthorizer(msFactory, null, null, null);
+
+ Method m = RangerHiveAuthorizer.class.getDeclaredMethod("getRangerResourceACLs", HivePrivilegeObject.class, HivePrincipal.class);
+ m.setAccessible(true);
+
+ HivePrivilegeObject obj = new HivePrivilegeObject(HivePrivilegeObjectType.TABLE_OR_VIEW, "db1", "t1");
+ HivePrincipal principal = new HivePrincipal("bob", HivePrincipal.HivePrincipalType.USER);
+
+ Object out = m.invoke(authorizer, obj, principal);
+ assertInstanceOf(RangerResourceACLs.class, out);
+ RangerResourceACLs resultAcls = (RangerResourceACLs) out;
+
+ assertFalse(resultAcls.getUserACLs().isEmpty());
+ assertTrue(resultAcls.getUserACLs().containsKey("bob"));
+ assertNotNull(resultAcls.getUserACLs().get("bob").get("select"));
+ }
+
+ @Test
+ void test72_getRangerResourceACLs_filtersExpiredValidityScheduleForGroup() throws Exception {
+ RangerBasePlugin plugin = (RangerBasePlugin) Mockito.spy(newInstanceRangerHivePlugin("hiveCLI"));
+ RangerResourceACLs acls = new RangerResourceACLs();
+
+ RangerPolicy pGroup = new RangerPolicy();
+ RangerPolicy.RangerPolicyItem item = new RangerPolicy.RangerPolicyItem();
+ item.setAccesses(Collections.singletonList(new RangerPolicy.RangerPolicyItemAccess("update", true)));
+ item.setGroups(Collections.singletonList("dev_group"));
+
+ RangerPolicy.RangerPolicyItemCondition condition = new RangerPolicy.RangerPolicyItemCondition();
+ condition.setType("validitySchedule");
+ condition.setValues(Collections.singletonList("{\"endTime\":\"2000/01/01 00:00:00\"}"));
+ item.setConditions(Collections.singletonList(condition));
+
+ pGroup.setPolicyItems(Collections.singletonList(item));
+
+ acls.setGroupAccessInfo("dev_group", "update", RangerPolicyEvaluator.ACCESS_CONDITIONAL, pGroup);
+
+ Mockito.doReturn(acls).when(plugin).getResourceACLs(Mockito.any(RangerAccessRequestImpl.class));
+ setStaticHivePlugin(plugin);
+
+ HiveMetastoreClientFactory msFactory = Mockito.mock(HiveMetastoreClientFactory.class);
+ IMetaStoreClient ms = Mockito.mock(IMetaStoreClient.class);
+ Mockito.when(msFactory.getHiveMetastoreClient()).thenReturn(ms);
+ RangerHiveAuthorizer authorizer = new RangerHiveAuthorizer(msFactory, null, null, null);
+
+ Method m = RangerHiveAuthorizer.class.getDeclaredMethod("getRangerResourceACLs", HivePrivilegeObject.class, HivePrincipal.class);
+ m.setAccessible(true);
+
+ HivePrivilegeObject obj = new HivePrivilegeObject(HivePrivilegeObjectType.TABLE_OR_VIEW, "db1", "t1");
+ HivePrincipal principal = new HivePrincipal("dev_group", HivePrincipal.HivePrincipalType.GROUP);
+
+ Object out = m.invoke(authorizer, obj, principal);
+ assertInstanceOf(RangerResourceACLs.class, out);
+ RangerResourceACLs resultAcls = (RangerResourceACLs) out;
+
+ assertTrue(resultAcls.getGroupACLs().isEmpty() || !resultAcls.getGroupACLs().containsKey("dev_group"));
+ }
+
private static RangerAccessResult allowedResult() {
RangerAccessResult res = new RangerAccessResult(RangerPolicy.POLICY_TYPE_ACCESS, "svc", null, new RangerAccessRequestImpl());
res.setIsAudited(true);