You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Dineshkumar Yadav <di...@outlook.com> on 2020/07/01 07:05:16 UTC
Re: Review Request 72626: RANGER-2881 : Delegate Admin user having
role "user" able to create policy which has non-existing users/groups
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/72626/
-----------------------------------------------------------
(Updated July 1, 2020, 7:05 a.m.)
Review request for ranger, Ankita Sinha, Gautam Borad, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
Repository: ranger
Description
-------
Ranger user having role as "user" with delegate admin permission able to create policy which has non-existing users/groups/roles in the specified policy.
only admin users should be able to create policy with new users/groups/roles on the fly creation of users/groups/roles.
Diffs
-----
security-admin/src/main/java/org/apache/ranger/biz/PolicyRefUpdater.java 9ce481c63
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 4fb21a094
security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java ff8e2ba43
Diff: https://reviews.apache.org/r/72626/diff/1/
Testing
-------
Without patch steps
1. Create user with role “user”
2. Give him delegate admin role.
3. Create policy using curl request where specified policy should include non existing user/group.
4. It will be able to create the policy.
With patch same steps will give error “operation denied user/group specified in policy does not exist in ranger admin.”
Thanks,
Dineshkumar Yadav
Re: Review Request 72626: RANGER-2881 : Delegate Admin user having
role "user" able to create policy which has non-existing users/groups
Posted by Dineshkumar Yadav <di...@outlook.com>.
> On July 3, 2020, 5:32 p.m., Madhan Neethiraj wrote:
> > security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
> > Lines 1537 (patched)
> > <https://reviews.apache.org/r/72626/diff/1/?file=2235136#file2235136line1537>
> >
> > 1. consider renaming checkAdminAccess() => ensureAdminAccess(String operation)
> > 2. update calls to this method with following parameter:
> > #286: ensureAdminAccess("create user " + user);
> > #306: ensureAdminAccess("create group " + group);
> > #334: ensureAdminAccess("create role " + role);
added separate message for each individual scenario.
> On July 3, 2020, 5:32 p.m., Madhan Neethiraj wrote:
> > security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
> > Lines 1543 (patched)
> > <https://reviews.apache.org/r/72626/diff/1/?file=2235136#file2235136line1543>
> >
> > - session will not be null in #1543 - see above #1539
> > - consider the following message:
> > "user " + session.getLoginId() + " does not have permission to perform '" + operation + "'"
changed the message.
- Dineshkumar
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/72626/#review221121
-----------------------------------------------------------
On July 10, 2020, 11:22 a.m., Dineshkumar Yadav wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/72626/
> -----------------------------------------------------------
>
> (Updated July 10, 2020, 11:22 a.m.)
>
>
> Review request for ranger, Ankita Sinha, Gautam Borad, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger user having role as "user" with delegate admin permission able to create policy which has non-existing users/groups/roles in the specified policy.
> only admin users should be able to create policy with new users/groups/roles on the fly creation of users/groups/roles.
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/PolicyRefUpdater.java 6bd06f484
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 4fb21a094
> security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java ff8e2ba43
>
>
> Diff: https://reviews.apache.org/r/72626/diff/2/
>
>
> Testing
> -------
>
> Without patch steps
> 1. Create user with role “user”
> 2. Give him delegate admin role.
> 3. Create policy using curl request where specified policy should include non existing user/group.
> 4. It will be able to create the policy.
>
> With patch same steps will give error “operation denied user/group specified in policy does not exist in ranger admin.”
>
>
> Thanks,
>
> Dineshkumar Yadav
>
>
Re: Review Request 72626: RANGER-2881 : Delegate Admin user having
role "user" able to create policy which has non-existing users/groups
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/72626/#review221121
-----------------------------------------------------------
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
Lines 1537 (patched)
<https://reviews.apache.org/r/72626/#comment309909>
1. consider renaming checkAdminAccess() => ensureAdminAccess(String operation)
2. update calls to this method with following parameter:
#286: ensureAdminAccess("create user " + user);
#306: ensureAdminAccess("create group " + group);
#334: ensureAdminAccess("create role " + role);
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
Lines 1543 (patched)
<https://reviews.apache.org/r/72626/#comment309910>
- session will not be null in #1543 - see above #1539
- consider the following message:
"user " + session.getLoginId() + " does not have permission to perform '" + operation + "'"
- Madhan Neethiraj
On July 1, 2020, 7:05 a.m., Dineshkumar Yadav wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/72626/
> -----------------------------------------------------------
>
> (Updated July 1, 2020, 7:05 a.m.)
>
>
> Review request for ranger, Ankita Sinha, Gautam Borad, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger user having role as "user" with delegate admin permission able to create policy which has non-existing users/groups/roles in the specified policy.
> only admin users should be able to create policy with new users/groups/roles on the fly creation of users/groups/roles.
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/PolicyRefUpdater.java 9ce481c63
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 4fb21a094
> security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java ff8e2ba43
>
>
> Diff: https://reviews.apache.org/r/72626/diff/1/
>
>
> Testing
> -------
>
> Without patch steps
> 1. Create user with role “user”
> 2. Give him delegate admin role.
> 3. Create policy using curl request where specified policy should include non existing user/group.
> 4. It will be able to create the policy.
>
> With patch same steps will give error “operation denied user/group specified in policy does not exist in ranger admin.”
>
>
> Thanks,
>
> Dineshkumar Yadav
>
>
Re: Review Request 72626: RANGER-2881 : Delegate Admin user having
role "user" able to create policy which has non-existing users/groups
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/72626/#review221191
-----------------------------------------------------------
Ship it!
Ship It!
- Madhan Neethiraj
On July 10, 2020, 11:22 a.m., Dineshkumar Yadav wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/72626/
> -----------------------------------------------------------
>
> (Updated July 10, 2020, 11:22 a.m.)
>
>
> Review request for ranger, Ankita Sinha, Gautam Borad, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger user having role as "user" with delegate admin permission able to create policy which has non-existing users/groups/roles in the specified policy.
> only admin users should be able to create policy with new users/groups/roles on the fly creation of users/groups/roles.
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/PolicyRefUpdater.java 6bd06f484
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 4fb21a094
> security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java ff8e2ba43
>
>
> Diff: https://reviews.apache.org/r/72626/diff/2/
>
>
> Testing
> -------
>
> Without patch steps
> 1. Create user with role “user”
> 2. Give him delegate admin role.
> 3. Create policy using curl request where specified policy should include non existing user/group.
> 4. It will be able to create the policy.
>
> With patch same steps will give error “operation denied user/group specified in policy does not exist in ranger admin.”
>
>
> Thanks,
>
> Dineshkumar Yadav
>
>
Re: Review Request 72626: RANGER-2881 : Delegate Admin user having
role "user" able to create policy which has non-existing users/groups
Posted by Dineshkumar Yadav <di...@outlook.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/72626/
-----------------------------------------------------------
(Updated July 10, 2020, 11:22 a.m.)
Review request for ranger, Ankita Sinha, Gautam Borad, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
Changes
-------
change code for specific message for handling different scenario
Repository: ranger
Description
-------
Ranger user having role as "user" with delegate admin permission able to create policy which has non-existing users/groups/roles in the specified policy.
only admin users should be able to create policy with new users/groups/roles on the fly creation of users/groups/roles.
Diffs (updated)
-----
security-admin/src/main/java/org/apache/ranger/biz/PolicyRefUpdater.java 6bd06f484
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 4fb21a094
security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java ff8e2ba43
Diff: https://reviews.apache.org/r/72626/diff/2/
Changes: https://reviews.apache.org/r/72626/diff/1-2/
Testing
-------
Without patch steps
1. Create user with role “user”
2. Give him delegate admin role.
3. Create policy using curl request where specified policy should include non existing user/group.
4. It will be able to create the policy.
With patch same steps will give error “operation denied user/group specified in policy does not exist in ranger admin.”
Thanks,
Dineshkumar Yadav
Re: Review Request 72626: RANGER-2881 : Delegate Admin user having
role "user" able to create policy which has non-existing users/groups
Posted by Dineshkumar Yadav <di...@outlook.com>.
> On July 1, 2020, 1:27 p.m., Pradeep Agrawal wrote:
> > security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
> > Lines 1537 (patched)
> > <https://reviews.apache.org/r/72626/diff/1/?file=2235136#file2235136line1537>
> >
> > There are already several methods to check admin access in this class, not sure its good idea to have one more like this.
> >
> > If you are going to keep this method then please review existing call to other check admin methods and see if any of them can be replaced with this.
This method is for scenario where user is Delegate Admin having role as “user” trying create Policy with existing user/group/role.
In case if specified policy has non-existing user/group/role. It will give specific response as existing response is common.
- Dineshkumar
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/72626/#review221113
-----------------------------------------------------------
On July 1, 2020, 7:05 a.m., Dineshkumar Yadav wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/72626/
> -----------------------------------------------------------
>
> (Updated July 1, 2020, 7:05 a.m.)
>
>
> Review request for ranger, Ankita Sinha, Gautam Borad, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger user having role as "user" with delegate admin permission able to create policy which has non-existing users/groups/roles in the specified policy.
> only admin users should be able to create policy with new users/groups/roles on the fly creation of users/groups/roles.
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/PolicyRefUpdater.java 9ce481c63
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 4fb21a094
> security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java ff8e2ba43
>
>
> Diff: https://reviews.apache.org/r/72626/diff/1/
>
>
> Testing
> -------
>
> Without patch steps
> 1. Create user with role “user”
> 2. Give him delegate admin role.
> 3. Create policy using curl request where specified policy should include non existing user/group.
> 4. It will be able to create the policy.
>
> With patch same steps will give error “operation denied user/group specified in policy does not exist in ranger admin.”
>
>
> Thanks,
>
> Dineshkumar Yadav
>
>
Re: Review Request 72626: RANGER-2881 : Delegate Admin user having
role "user" able to create policy which has non-existing users/groups
Posted by Pradeep Agrawal <pr...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/72626/#review221113
-----------------------------------------------------------
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
Lines 1537 (patched)
<https://reviews.apache.org/r/72626/#comment309904>
There are already several methods to check admin access in this class, not sure its good idea to have one more like this.
If you are going to keep this method then please review existing call to other check admin methods and see if any of them can be replaced with this.
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
Lines 1543 (patched)
<https://reviews.apache.org/r/72626/#comment309903>
1) Are you missing something here => "Operation" + " denied. LoggedInUser="
2) Also do you want to print user id or user login id ?
3)
- Pradeep Agrawal
On July 1, 2020, 7:05 a.m., Dineshkumar Yadav wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/72626/
> -----------------------------------------------------------
>
> (Updated July 1, 2020, 7:05 a.m.)
>
>
> Review request for ranger, Ankita Sinha, Gautam Borad, Kishor Gollapalliwar, Abhay Kulkarni, Mehul Parikh, Pradeep Agrawal, and Velmurugan Periasamy.
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger user having role as "user" with delegate admin permission able to create policy which has non-existing users/groups/roles in the specified policy.
> only admin users should be able to create policy with new users/groups/roles on the fly creation of users/groups/roles.
>
>
> Diffs
> -----
>
> security-admin/src/main/java/org/apache/ranger/biz/PolicyRefUpdater.java 9ce481c63
> security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 4fb21a094
> security-admin/src/main/java/org/apache/ranger/biz/RoleRefUpdater.java ff8e2ba43
>
>
> Diff: https://reviews.apache.org/r/72626/diff/1/
>
>
> Testing
> -------
>
> Without patch steps
> 1. Create user with role “user”
> 2. Give him delegate admin role.
> 3. Create policy using curl request where specified policy should include non existing user/group.
> 4. It will be able to create the policy.
>
> With patch same steps will give error “operation denied user/group specified in policy does not exist in ranger admin.”
>
>
> Thanks,
>
> Dineshkumar Yadav
>
>