You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by pr...@apache.org on 2020/05/23 12:57:27 UTC
[ranger] branch master updated (45efc9a -> 813b671)
This is an automated email from the ASF dual-hosted git repository.
pradeep pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git.
from 45efc9a RANGER-2823: RangerResouceTrie.copySubTree() does not set up TrieNode's child nodes correctly
new d488d57 RANGER-2763: Hive SET Role command in Ranger hive plugin
new e78498a RANGER-2822: Best practices: Refactor embeddedserver code and remove duplicate code
new 813b671 RANGER-2831: presto-server-333 start failed due to NoClassDefFoundError
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../plugin/policyengine/RangerAccessRequest.java | 2 +
.../policyengine/RangerAccessRequestImpl.java | 23 +-
.../policyengine/RangerAccessRequestReadOnly.java | 5 +
.../policyengine/RangerTagAccessRequest.java | 1 +
.../RangerDefaultPolicyEvaluator.java | 16 +-
.../service/RangerDefaultRequestProcessor.java | 5 +-
.../RangerCustomConditionMatcherTest.java | 2 +-
.../plugin/contextenricher/TestTagEnricher.java | 2 +-
.../ranger/plugin/policyengine/TestPolicyACLs.java | 2 +-
.../plugin/policyengine/TestPolicyEngine.java | 2 +-
distro/src/main/assembly/admin-web.xml | 2 +-
distro/src/main/assembly/kms.xml | 2 +-
distro/src/main/assembly/plugin-presto.xml | 1 +
embeddedwebserver/pom.xml | 5 +
.../ranger/server/tomcat/EmbeddedServer.java | 286 +++++++--------------
.../ranger/server/tomcat/EmbeddedServerUtil.java | 96 +++++++
.../server/tomcat/SolrCollectionBootstrapper.java | 95 ++-----
.../ranger/server/tomcat/StopEmbeddedServer.java | 8 +-
.../authorization/hbase/AuthorizationSession.java | 2 +-
.../hbase/RangerAuthorizationCoprocessor.java | 2 +-
.../hive/authorizer/RangerHiveAccessRequest.java | 10 +-
.../hive/authorizer/RangerHiveAuthorizer.java | 151 +++++++++--
.../hive/authorizer/RangerHiveAuthorizerBase.java | 8 -
.../hive/authorizer/RangerHivePolicyProvider.java | 2 +-
.../atlas/authorizer/RangerAtlasAuthorizer.java | 6 +-
plugin-presto/pom.xml | 10 +
.../authorizer/RangerSystemAccessControl.java | 2 +-
pom.xml | 1 +
.../examples/sampleapp/RangerAuthorizer.java | 2 +-
ranger-presto-plugin-shim/pom.xml | 6 +
.../apache/ranger/biz/RangerPolicyAdminImpl.java | 2 +-
.../PatchForPrestoToSupportPresto333_J10038.java | 2 +
32 files changed, 427 insertions(+), 334 deletions(-)
create mode 100644 embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServerUtil.java
[ranger] 02/03: RANGER-2822: Best practices: Refactor
embeddedserver code and remove duplicate code
Posted by pr...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pradeep pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit e78498a4c1d767134b4abf4aeeeedc2d8bc69a9f
Author: pradeep <pr...@apache.org>
AuthorDate: Tue May 12 15:48:59 2020 +0530
RANGER-2822: Best practices: Refactor embeddedserver code and remove duplicate code
---
distro/src/main/assembly/admin-web.xml | 2 +-
distro/src/main/assembly/kms.xml | 2 +-
embeddedwebserver/pom.xml | 5 +
.../ranger/server/tomcat/EmbeddedServer.java | 286 +++++++--------------
.../ranger/server/tomcat/EmbeddedServerUtil.java | 96 +++++++
.../server/tomcat/SolrCollectionBootstrapper.java | 95 ++-----
.../ranger/server/tomcat/StopEmbeddedServer.java | 8 +-
7 files changed, 212 insertions(+), 282 deletions(-)
diff --git a/distro/src/main/assembly/admin-web.xml b/distro/src/main/assembly/admin-web.xml
index bae71b6..a632011 100644
--- a/distro/src/main/assembly/admin-web.xml
+++ b/distro/src/main/assembly/admin-web.xml
@@ -254,7 +254,7 @@
<include>com.kstruct:gethostname4j:jar:${kstruct.gethostname4j.version}</include>
<include>net.java.dev.jna:jna:jar:${jna.version}</include>
<include>net.java.dev.jna:jna-platform:jar:${jna-platform.version}</include>
- <include>org.apache.ranger:ranger-plugins-cred</include>
+ <include>org.apache.ranger:credentialbuilder</include>
</includes>
</binaries>
</moduleSet>
diff --git a/distro/src/main/assembly/kms.xml b/distro/src/main/assembly/kms.xml
index 7b7ea8d..c752f88 100755
--- a/distro/src/main/assembly/kms.xml
+++ b/distro/src/main/assembly/kms.xml
@@ -199,7 +199,7 @@
<include>com.kstruct:gethostname4j:jar:${kstruct.gethostname4j.version}</include>
<include>net.java.dev.jna:jna:jar:${jna.version}</include>
<include>net.java.dev.jna:jna-platform:jar:${jna-platform.version}</include>
- <include>org.apache.ranger:ranger-plugins-cred</include>
+ <include>org.apache.ranger:credentialbuilder</include>
</includes>
</binaries>
</moduleSet>
diff --git a/embeddedwebserver/pom.xml b/embeddedwebserver/pom.xml
index 8574c57..7f23965 100644
--- a/embeddedwebserver/pom.xml
+++ b/embeddedwebserver/pom.xml
@@ -83,5 +83,10 @@
<artifactId>ranger-plugins-common</artifactId>
<version>${project.version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.ranger</groupId>
+ <artifactId>credentialbuilder</artifactId>
+ <version>${project.version}</version>
+ </dependency>
</dependencies>
</project>
diff --git a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java
index 898b533..dc931c2 100644
--- a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java
+++ b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java
@@ -34,10 +34,8 @@ import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
import java.util.Date;
import java.util.Iterator;
-import java.util.Properties;
import java.util.logging.Level;
import java.util.logging.Logger;
-import java.util.List;
import org.apache.catalina.Context;
import org.apache.catalina.LifecycleException;
@@ -46,12 +44,7 @@ import org.apache.catalina.startup.Tomcat;
import org.apache.catalina.valves.AccessLogValve;
import org.apache.commons.lang.StringUtils;
import org.apache.hadoop.security.SecureClientLogin;
-import org.apache.hadoop.conf.Configuration;
-import org.apache.hadoop.security.alias.CredentialProvider;
-import org.apache.hadoop.security.alias.CredentialProviderFactory;
-import org.apache.hadoop.security.alias.JavaKeyStoreProvider;
-import org.apache.ranger.authorization.hadoop.utils.RangerCredentialProvider;
-import org.apache.ranger.plugin.util.XMLUtils;
+import org.apache.ranger.credentialapi.CredentialReader;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
@@ -61,29 +54,21 @@ import javax.net.ssl.TrustManagerFactory;
import javax.security.auth.Subject;
public class EmbeddedServer {
-
+
private static final Logger LOG = Logger.getLogger(EmbeddedServer.class
.getName());
private static final String DEFAULT_NAME_RULE = "DEFAULT";
-
- private static final String DEFAULT_CONFIG_FILENAME = "ranger-admin-default-site.xml";
- private static final String CORE_SITE_CONFIG_FILENAME = "core-site.xml";
-
private static final String DEFAULT_WEBAPPS_ROOT_FOLDER = "webapps";
-
private static String configFile = "ranger-admin-site.xml";
-
private static final String AUTH_TYPE_KERBEROS = "kerberos";
- private static final String AUTHENTICATION_TYPE = "hadoop.security.authentication";
- private static final String ADMIN_USER_PRINCIPAL = "ranger.admin.kerberos.principal";
- private static final String SOLR_BOOTSTRAP_ENABLED = "ranger.audit.solr.bootstrap.enabled";
- private static final String ADMIN_USER_KEYTAB = "ranger.admin.kerberos.keytab";
+ private static final String AUTHENTICATION_TYPE = "hadoop.security.authentication";
+ private static final String ADMIN_USER_PRINCIPAL = "ranger.admin.kerberos.principal";
+ private static final String SOLR_BOOTSTRAP_ENABLED = "ranger.audit.solr.bootstrap.enabled";
+ private static final String ADMIN_USER_KEYTAB = "ranger.admin.kerberos.keytab";
private static final String ADMIN_NAME_RULES = "hadoop.security.auth_to_local";
private static final String ADMIN_SERVER_NAME = "rangeradmin";
private static final String KMS_SERVER_NAME = "rangerkms";
-
- private Properties serverConfigProperties = new Properties();
public static final String RANGER_KEYSTORE_FILE_TYPE_DEFAULT = "jks";
public static final String RANGER_TRUSTSTORE_FILE_TYPE_DEFAULT = "jks";
public static final String RANGER_SSL_CONTEXT_ALGO_TYPE = "TLS";
@@ -93,20 +78,17 @@ public class EmbeddedServer {
public static void main(String[] args) {
new EmbeddedServer(args).start();
}
-
+
public EmbeddedServer(String[] args) {
if (args.length > 0) {
configFile = args[0];
- } else {
- XMLUtils.loadConfig(DEFAULT_CONFIG_FILENAME, serverConfigProperties);
}
- XMLUtils.loadConfig(CORE_SITE_CONFIG_FILENAME, serverConfigProperties);
- XMLUtils.loadConfig(configFile, serverConfigProperties);
+ EmbeddedServerUtil.loadRangerConfigProperties(configFile);
}
-
+
public static int DEFAULT_SHUTDOWN_PORT = 6185;
public static String DEFAULT_SHUTDOWN_COMMAND = "SHUTDOWN";
-
+
public void start() {
SSLContext sslContext = getSSLContext();
if (sslContext != null) {
@@ -115,24 +97,24 @@ public class EmbeddedServer {
final Tomcat server = new Tomcat();
String logDir = null;
- logDir = getConfig("logdir");
+ logDir = EmbeddedServerUtil.getConfig("logdir");
if (logDir == null) {
- logDir = getConfig("kms.log.dir");
+ logDir = EmbeddedServerUtil.getConfig("kms.log.dir");
}
- String servername = getConfig("servername");
- String hostName = getConfig("ranger.service.host");
- int serverPort = getIntConfig("ranger.service.http.port", 6181);
- int sslPort = getIntConfig("ranger.service.https.port", -1);
- int shutdownPort = getIntConfig("ranger.service.shutdown.port",DEFAULT_SHUTDOWN_PORT);
- String shutdownCommand = getConfig("ranger.service.shutdown.command",DEFAULT_SHUTDOWN_COMMAND);
+ String servername = EmbeddedServerUtil.getConfig("servername");
+ String hostName = EmbeddedServerUtil.getConfig("ranger.service.host");
+ int serverPort = EmbeddedServerUtil.getIntConfig("ranger.service.http.port", 6181);
+ int sslPort = EmbeddedServerUtil.getIntConfig("ranger.service.https.port", -1);
+ int shutdownPort = EmbeddedServerUtil.getIntConfig("ranger.service.shutdown.port", DEFAULT_SHUTDOWN_PORT);
+ String shutdownCommand = EmbeddedServerUtil.getConfig("ranger.service.shutdown.command", DEFAULT_SHUTDOWN_COMMAND);
server.setHostname(hostName);
server.setPort(serverPort);
server.getServer().setPort(shutdownPort);
server.getServer().setShutdown(shutdownCommand);
- boolean isHttpsEnabled = Boolean.valueOf(getConfig("ranger.service.https.attrib.ssl.enabled", "false"));
- boolean ajpEnabled = Boolean.valueOf(getConfig("ajp.enabled", "false"));
+ boolean isHttpsEnabled = Boolean.valueOf(EmbeddedServerUtil.getConfig("ranger.service.https.attrib.ssl.enabled", "false"));
+ boolean ajpEnabled = Boolean.valueOf(EmbeddedServerUtil.getConfig("ajp.enabled", "false"));
if (ajpEnabled) {
@@ -152,30 +134,30 @@ public class EmbeddedServer {
ssl.setSecure(true);
ssl.setScheme("https");
ssl.setAttribute("SSLEnabled", "true");
- ssl.setAttribute("sslProtocol", getConfig("ranger.service.https.attrib.ssl.protocol", "TLS"));
- String clientAuth=getConfig("ranger.service.https.attrib.clientAuth", "false");
+ ssl.setAttribute("sslProtocol", EmbeddedServerUtil.getConfig("ranger.service.https.attrib.ssl.protocol", "TLS"));
+ String clientAuth = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.clientAuth", "false");
if("false".equalsIgnoreCase(clientAuth)){
- clientAuth=getConfig("ranger.service.https.attrib.client.auth", "want");
+ clientAuth = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.client.auth", "want");
}
ssl.setAttribute("clientAuth",clientAuth);
- String providerPath=getConfig("ranger.credential.provider.path");
- String keyAlias= getConfig("ranger.service.https.attrib.keystore.credential.alias","keyStoreCredentialAlias");
+ String providerPath = EmbeddedServerUtil.getConfig("ranger.credential.provider.path");
+ String keyAlias = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.keystore.credential.alias", "keyStoreCredentialAlias");
String keystorePass=null;
if(providerPath!=null && keyAlias!=null){
- keystorePass=getDecryptedString(providerPath.trim(), keyAlias.trim());
- if(keystorePass==null || keystorePass.trim().isEmpty() || "none".equalsIgnoreCase(keystorePass.trim())){
- keystorePass=getConfig("ranger.service.https.attrib.keystore.pass");
+ keystorePass = CredentialReader.getDecryptedString(providerPath.trim(), keyAlias.trim());
+ if (StringUtils.isBlank(keystorePass) || "none".equalsIgnoreCase(keystorePass.trim())) {
+ keystorePass = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.keystore.pass");
}
}
- ssl.setAttribute("keyAlias", getConfig("ranger.service.https.attrib.keystore.keyalias","rangeradmin"));
+ ssl.setAttribute("keyAlias", EmbeddedServerUtil.getConfig("ranger.service.https.attrib.keystore.keyalias", "rangeradmin"));
ssl.setAttribute("keystorePass", keystorePass);
ssl.setAttribute("keystoreFile", getKeystoreFile());
-
- String defaultEnabledProtocols = "SSLv2Hello, TLSv1, TLSv1.1, TLSv1.2";
- String enabledProtocols = getConfig("ranger.service.https.attrib.ssl.enabled.protocols", defaultEnabledProtocols);
+
+ String defaultEnabledProtocols = "SSLv2Hello, TLSv1, TLSv1.1, TLSv1.2";
+ String enabledProtocols = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.ssl.enabled.protocols", defaultEnabledProtocols);
ssl.setAttribute("sslEnabledProtocols", enabledProtocols);
- String ciphers = getConfig("ranger.tomcat.ciphers");
- if (ciphers != null && ciphers.trim() != null && ciphers.trim().length() > 0) {
+ String ciphers = EmbeddedServerUtil.getConfig("ranger.tomcat.ciphers");
+ if (StringUtils.isNotBlank(ciphers)) {
ssl.setAttribute("ciphers", ciphers);
}
server.getService().addConnector(ssl);
@@ -184,37 +166,37 @@ public class EmbeddedServer {
// Making this as a default connector
//
server.setConnector(ssl);
-
+
}
updateHttpConnectorAttribConfig(server);
-
+
File logDirectory = new File(logDir);
if (!logDirectory.exists()) {
logDirectory.mkdirs();
}
-
+
AccessLogValve valve = new AccessLogValve();
valve.setRotatable(true);
valve.setAsyncSupported(true);
valve.setBuffered(false);
valve.setEnabled(true);
- valve.setFileDateFormat(getConfig("ranger.accesslog.dateformat", "yyyy-MM-dd.HH"));
+ valve.setFileDateFormat(EmbeddedServerUtil.getConfig("ranger.accesslog.dateformat", "yyyy-MM-dd.HH"));
valve.setDirectory(logDirectory.getAbsolutePath());
valve.setSuffix(".log");
String defaultAccessLogPattern = servername.equalsIgnoreCase(KMS_SERVER_NAME) ? "%h %l %u %t \"%m %U\" %s %b" : "%h %l %u %t \"%r\" %s %b";
- String logPattern = getConfig("ranger.accesslog.pattern", defaultAccessLogPattern);
- valve.setPattern(logPattern);
-
+ String logPattern = EmbeddedServerUtil.getConfig("ranger.accesslog.pattern", defaultAccessLogPattern);
+ valve.setPattern(logPattern);
+
server.getHost().getPipeline().addValve(valve);
-
+
try {
- String webapp_dir = getConfig("xa.webapp.dir");
- if (webapp_dir == null || webapp_dir.trim().isEmpty()) {
+ String webapp_dir = EmbeddedServerUtil.getConfig("xa.webapp.dir");
+ if (StringUtils.isBlank(webapp_dir)) {
// If webapp location property is not set, then let's derive
// from catalina_base
- String catalina_base = getConfig("catalina.base");
- if (catalina_base == null || catalina_base.trim().isEmpty()) {
+ String catalina_base = EmbeddedServerUtil.getConfig("catalina.base");
+ if (StringUtils.isBlank(catalina_base)) {
LOG.severe("Tomcat Server failed to start: catalina.base and/or xa.webapp.dir is not set");
System.exit(1);
}
@@ -222,9 +204,9 @@ public class EmbeddedServer {
LOG.info("Deriving webapp folder from catalina.base property. folder="
+ webapp_dir);
}
-
+
//String webContextName = getConfig("xa.webapp.contextName", "/");
- String webContextName = getConfig("ranger.contextName", "/");
+ String webContextName = EmbeddedServerUtil.getConfig("ranger.contextName", "/");
if (webContextName == null) {
webContextName = "/";
} else if (!webContextName.startsWith("/")) {
@@ -232,7 +214,7 @@ public class EmbeddedServer {
+ "] is being loaded as [ /" + webContextName + "]");
webContextName = "/" + webContextName;
}
-
+
File wad = new File(webapp_dir);
if (wad.isDirectory()) {
LOG.info("Webapp file =" + webapp_dir + ", webAppName = "
@@ -256,22 +238,22 @@ public class EmbeddedServer {
LOG.severe("Tomcat Server failed to start webapp:" + lce.toString());
lce.printStackTrace();
}
-
+
if (servername.equalsIgnoreCase(ADMIN_SERVER_NAME)) {
- String keytab = getConfig(ADMIN_USER_KEYTAB);
+ String keytab = EmbeddedServerUtil.getConfig(ADMIN_USER_KEYTAB);
String principal = null;
try {
- principal = SecureClientLogin.getPrincipal(getConfig(ADMIN_USER_PRINCIPAL), hostName);
+ principal = SecureClientLogin.getPrincipal(EmbeddedServerUtil.getConfig(ADMIN_USER_PRINCIPAL), hostName);
} catch (IOException ignored) {
LOG.warning("Failed to get ranger.admin.kerberos.principal. Reason: " + ignored.toString());
}
- String nameRules = getConfig(ADMIN_NAME_RULES);
- if (nameRules == null || nameRules.length() == 0) {
+ String nameRules = EmbeddedServerUtil.getConfig(ADMIN_NAME_RULES);
+ if (StringUtils.isBlank(nameRules)) {
LOG.info("Name is empty. Setting Name Rule as 'DEFAULT'");
nameRules = DEFAULT_NAME_RULE;
}
- if (getConfig(AUTHENTICATION_TYPE) != null
- && getConfig(AUTHENTICATION_TYPE).trim().equalsIgnoreCase(AUTH_TYPE_KERBEROS)
+ if (EmbeddedServerUtil.getConfig(AUTHENTICATION_TYPE) != null
+ && EmbeddedServerUtil.getConfig(AUTHENTICATION_TYPE).trim().equalsIgnoreCase(AUTH_TYPE_KERBEROS)
&& SecureClientLogin.isKerberosCredentialExists(principal,keytab)) {
try{
LOG.info("Provided Kerberos Credential : Principal = "
@@ -299,20 +281,18 @@ public class EmbeddedServer {
private void startServer(final Tomcat server) {
try {
-
- try {
- boolean solrBootstrapEnabled = Boolean.valueOf(getConfig(
- SOLR_BOOTSTRAP_ENABLED, "true"));
+ String servername = EmbeddedServerUtil.getConfig("servername");
+ LOG.info("Server Name : " + servername);
+ if (servername.equalsIgnoreCase(ADMIN_SERVER_NAME)) {
+ boolean solrBootstrapEnabled = Boolean.valueOf(EmbeddedServerUtil.getConfig(SOLR_BOOTSTRAP_ENABLED, "true"));
if (solrBootstrapEnabled) {
- String servername = getConfig("servername");
- LOG.info("Server Name : " + servername);
- if (servername.equalsIgnoreCase(ADMIN_SERVER_NAME)) {
+ try {
SolrCollectionBootstrapper solrSetup = new SolrCollectionBootstrapper();
solrSetup.start();
+ } catch (Exception e) {
+ LOG.severe("Error while setting solr " + e);
}
}
- } catch (Exception e) {
- LOG.severe("Error while setting solr " + e);
}
server.start();
@@ -328,47 +308,16 @@ public class EmbeddedServer {
}
private String getKeystoreFile() {
- String keystoreFile=getConfig("ranger.service.https.attrib.keystore.file");
- if (keystoreFile == null || keystoreFile.trim().isEmpty()) {
+ String keystoreFile = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.keystore.file");
+ if (StringUtils.isBlank(keystoreFile)) {
// new property not configured, lets use the old property
- keystoreFile = getConfig("ranger.https.attrib.keystore.file");
+ keystoreFile = EmbeddedServerUtil.getConfig("ranger.https.attrib.keystore.file");
}
return keystoreFile;
}
- protected String getConfig(String key) {
- String value = serverConfigProperties.getProperty(key);
- if (value == null || value.trim().isEmpty()) {
- // Value not found in properties file, let's try to get from
- // System's property
- value = System.getProperty(key);
- }
- return value;
- }
-
- protected String getConfig(String key, String defaultValue) {
- String ret = getConfig(key);
- if (ret == null) {
- ret = defaultValue;
- }
- return ret;
- }
-
- protected int getIntConfig(String key, int defaultValue) {
- int ret = defaultValue;
- String retStr = getConfig(key);
- try {
- if (retStr != null) {
- ret = Integer.parseInt(retStr);
- }
- } catch (Exception err) {
- LOG.warning(retStr + " can't be parsed to int. Reason: " + err.toString());
- }
- return ret;
- }
-
public void shutdownServer() {
- int timeWaitForShutdownInSeconds = getIntConfig(
+ int timeWaitForShutdownInSeconds = EmbeddedServerUtil.getIntConfig(
"service.waitTimeForForceShutdownInSeconds", 0);
if (timeWaitForShutdownInSeconds > 0) {
long endTime = System.currentTimeMillis()
@@ -397,88 +346,31 @@ public class EmbeddedServer {
System.exit(0);
}
- protected long getLongConfig(String key, long defaultValue) {
- long ret = defaultValue;
- String retStr = getConfig(key);
- try{
- if (retStr != null) {
- ret = Long.parseLong(retStr);
- }
- }catch(Exception err){
- LOG.warning(retStr + " can't be parsed to long. Reason: " + err.toString());
- }
- return ret;
- }
public void updateHttpConnectorAttribConfig(Tomcat server) {
- server.getConnector().setAllowTrace(Boolean.valueOf(getConfig("ranger.service.http.connector.attrib.allowTrace","false")));
- server.getConnector().setAsyncTimeout(getLongConfig("ranger.service.http.connector.attrib.asyncTimeout", 10000));
- server.getConnector().setEnableLookups(Boolean.valueOf(getConfig("ranger.service.http.connector.attrib.enableLookups","false")));
- server.getConnector().setMaxHeaderCount(getIntConfig("ranger.service.http.connector.attrib.maxHeaderCount", 100));
- server.getConnector().setMaxParameterCount(getIntConfig("ranger.service.http.connector.attrib.maxParameterCount", 10000));
- server.getConnector().setMaxPostSize(getIntConfig("ranger.service.http.connector.attrib.maxPostSize", 2097152));
- server.getConnector().setMaxSavePostSize(getIntConfig("ranger.service.http.connector.attrib.maxSavePostSize", 4096));
- server.getConnector().setParseBodyMethods(getConfig("ranger.service.http.connector.attrib.methods", "POST"));
- server.getConnector().setURIEncoding(getConfig("ranger.service.http.connector.attrib.URIEncoding", "UTF-8"));
+ server.getConnector().setAllowTrace(Boolean.valueOf(EmbeddedServerUtil.getConfig("ranger.service.http.connector.attrib.allowTrace", "false")));
+ server.getConnector().setAsyncTimeout(EmbeddedServerUtil.getLongConfig("ranger.service.http.connector.attrib.asyncTimeout", 10000L));
+ server.getConnector().setEnableLookups(Boolean.valueOf(EmbeddedServerUtil.getConfig("ranger.service.http.connector.attrib.enableLookups", "false")));
+ server.getConnector().setMaxHeaderCount(EmbeddedServerUtil.getIntConfig("ranger.service.http.connector.attrib.maxHeaderCount", 100));
+ server.getConnector().setMaxParameterCount(EmbeddedServerUtil.getIntConfig("ranger.service.http.connector.attrib.maxParameterCount", 10000));
+ server.getConnector().setMaxPostSize(EmbeddedServerUtil.getIntConfig("ranger.service.http.connector.attrib.maxPostSize", 2097152));
+ server.getConnector().setMaxSavePostSize(EmbeddedServerUtil.getIntConfig("ranger.service.http.connector.attrib.maxSavePostSize", 4096));
+ server.getConnector().setParseBodyMethods(EmbeddedServerUtil.getConfig("ranger.service.http.connector.attrib.methods", "POST"));
+ server.getConnector().setURIEncoding(EmbeddedServerUtil.getConfig("ranger.service.http.connector.attrib.URIEncoding", "UTF-8"));
server.getConnector().setXpoweredBy(false);
server.getConnector().setAttribute("server", "Apache Ranger");
- Iterator<Object> iterator = serverConfigProperties.keySet().iterator();
+ Iterator<Object> iterator = EmbeddedServerUtil.getRangerConfigProperties().keySet().iterator();
String key = null;
String property = null;
while (iterator.hasNext()){
key = iterator.next().toString();
if(key != null && key.startsWith("ranger.service.http.connector.property.")){
property = key.replace("ranger.service.http.connector.property.","");
- server.getConnector().setProperty(property,getConfig(key));
+ server.getConnector().setProperty(property, EmbeddedServerUtil.getConfig(key));
LOG.info(property + ":" + server.getConnector().getProperty(property));
}
}
}
- public String getDecryptedString(String CrendentialProviderPath,String alias) {
- String credential=null;
- try{
- if(CrendentialProviderPath==null || alias==null||CrendentialProviderPath.trim().isEmpty()||alias.trim().isEmpty()){
- return null;
- }
- char[] pass = null;
- Configuration conf = new Configuration();
- String crendentialProviderPrefixJceks=JavaKeyStoreProvider.SCHEME_NAME + "://file";
- String crendentialProviderPrefixLocalJceks="localjceks://file";
- crendentialProviderPrefixJceks=crendentialProviderPrefixJceks.toLowerCase();
- CrendentialProviderPath=CrendentialProviderPath.trim();
- alias=alias.trim();
- if(CrendentialProviderPath.toLowerCase().startsWith(crendentialProviderPrefixJceks) || CrendentialProviderPath.toLowerCase().startsWith(crendentialProviderPrefixLocalJceks)){
- conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,CrendentialProviderPath);
- }else{
- if(CrendentialProviderPath.startsWith("/")){
- conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,JavaKeyStoreProvider.SCHEME_NAME + "://file" + CrendentialProviderPath);
- }else{
- conf.set(CredentialProviderFactory.CREDENTIAL_PROVIDER_PATH,JavaKeyStoreProvider.SCHEME_NAME + "://file/" + CrendentialProviderPath);
- }
- }
- List<CredentialProvider> providers = CredentialProviderFactory.getProviders(conf);
- List<String> aliasesList;
- CredentialProvider.CredentialEntry credEntry=null;
- for(CredentialProvider provider: providers) {
- //System.out.println("Credential Provider :" + provider);
- aliasesList=provider.getAliases();
- if(aliasesList!=null && aliasesList.contains(alias.toLowerCase())){
- credEntry=null;
- credEntry= provider.getCredentialEntry(alias);
- pass = credEntry.getCredential();
- if(pass!=null && pass.length>0){
- credential=String.valueOf(pass);
- break;
- }
- }
- }
- }catch(Exception ex){
- LOG.severe("CredentialReader failed while decrypting provided string. Reason: " + ex.toString());
- credential=null;
- }
- return credential;
- }
-
private SSLContext getSSLContext() {
KeyManager[] kmList = getKeyManagers();
TrustManager[] tmList = getTrustManagers();
@@ -498,14 +390,14 @@ public class EmbeddedServer {
private KeyManager[] getKeyManagers() {
KeyManager[] kmList = null;
- String keyStoreFile = getConfig("ranger.keystore.file");
- String keyStoreAlias = getConfig("ranger.keystore.alias", "keyStoreCredentialAlias");
+ String keyStoreFile = EmbeddedServerUtil.getConfig("ranger.keystore.file");
+ String keyStoreAlias = EmbeddedServerUtil.getConfig("ranger.keystore.alias", "keyStoreCredentialAlias");
if (StringUtils.isBlank(keyStoreFile)) {
keyStoreFile = getKeystoreFile();
- keyStoreAlias = getConfig("ranger.service.https.attrib.keystore.credential.alias", "keyStoreCredentialAlias");
+ keyStoreAlias = EmbeddedServerUtil.getConfig("ranger.service.https.attrib.keystore.credential.alias", "keyStoreCredentialAlias");
}
- String credentialProviderPath = getConfig("ranger.credential.provider.path");
- String keyStoreFilepwd = getCredential(credentialProviderPath, keyStoreAlias);
+ String credentialProviderPath = EmbeddedServerUtil.getConfig("ranger.credential.provider.path");
+ String keyStoreFilepwd = CredentialReader.getDecryptedString(credentialProviderPath, keyStoreAlias);
if (StringUtils.isNotEmpty(keyStoreFile) && StringUtils.isNotEmpty(keyStoreFilepwd)) {
InputStream in = null;
@@ -557,10 +449,10 @@ public class EmbeddedServer {
private TrustManager[] getTrustManagers() {
TrustManager[] tmList = null;
- String truststoreFile = getConfig("ranger.truststore.file");
- String truststoreAlias = getConfig("ranger.truststore.alias");
- String credentialProviderPath = getConfig("ranger.credential.provider.path");
- String trustStoreFilepwd = getCredential(credentialProviderPath, truststoreAlias);
+ String truststoreFile = EmbeddedServerUtil.getConfig("ranger.truststore.file");
+ String truststoreAlias = EmbeddedServerUtil.getConfig("ranger.truststore.alias");
+ String credentialProviderPath = EmbeddedServerUtil.getConfig("ranger.credential.provider.path");
+ String trustStoreFilepwd = CredentialReader.getDecryptedString(credentialProviderPath, truststoreAlias);
if (StringUtils.isNotEmpty(truststoreFile) && StringUtils.isNotEmpty(trustStoreFilepwd)) {
InputStream in = null;
@@ -609,10 +501,6 @@ public class EmbeddedServer {
return tmList;
}
- private String getCredential(String url, String alias) {
- return RangerCredentialProvider.getInstance().getCredentialString(url, alias);
- }
-
private InputStream getFileInputStream(String fileName) throws IOException {
InputStream in = null;
if (StringUtils.isNotEmpty(fileName)) {
diff --git a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServerUtil.java b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServerUtil.java
new file mode 100644
index 0000000..bded7dd
--- /dev/null
+++ b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServerUtil.java
@@ -0,0 +1,96 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.server.tomcat;
+
+import java.util.Properties;
+import java.util.logging.Logger;
+
+import org.apache.ranger.plugin.util.XMLUtils;
+
+public class EmbeddedServerUtil {
+
+ private static final Logger LOG = Logger.getLogger(EmbeddedServerUtil.class.getName());
+ private static final String CONFIG_FILE = "ranger-admin-site.xml";
+ private static final String CORE_SITE_CONFIG_FILENAME = "core-site.xml";
+ private static final String DEFAULT_CONFIG_FILENAME = "ranger-admin-default-site.xml";
+ private static Properties rangerConfigProperties = new Properties();
+
+ private EmbeddedServerUtil() {
+ loadRangerConfigProperties(CONFIG_FILE);
+ }
+
+ public static void loadRangerConfigProperties(String configFile) {
+ if (CONFIG_FILE.equalsIgnoreCase(configFile)) {
+ XMLUtils.loadConfig(DEFAULT_CONFIG_FILENAME, rangerConfigProperties);
+ }
+ XMLUtils.loadConfig(CORE_SITE_CONFIG_FILENAME, rangerConfigProperties);
+ XMLUtils.loadConfig(configFile, rangerConfigProperties);
+ }
+
+ public static Properties getRangerConfigProperties() {
+ if (rangerConfigProperties.isEmpty()) {
+ loadRangerConfigProperties(CONFIG_FILE);
+ }
+ return rangerConfigProperties;
+ }
+
+ public static String getConfig(String key, String defaultValue) {
+ String ret = getConfig(key);
+ if (ret == null) {
+ ret = defaultValue;
+ }
+ return ret;
+ }
+
+ public static int getIntConfig(String key, int defaultValue) {
+ int ret = defaultValue;
+ String retStr = getConfig(key);
+ try {
+ if (retStr != null) {
+ ret = Integer.parseInt(retStr);
+ }
+ } catch (Exception err) {
+ LOG.severe(retStr + " can't be parsed to int. Reason: " + err.toString());
+ }
+ return ret;
+ }
+
+ public static Long getLongConfig(String key, Long defaultValue) {
+ Long ret = defaultValue;
+ String retStr = getConfig(key);
+ try {
+ if (retStr != null) {
+ ret = Long.parseLong(retStr);
+ }
+ } catch (Exception err) {
+ LOG.severe(retStr + " can't be parsed to long. Reason: " + err.toString());
+ }
+ return ret;
+ }
+
+ public static String getConfig(String key) {
+ String value = getRangerConfigProperties().getProperty(key);
+ if (value == null || value.trim().isEmpty()) {
+ value = System.getProperty(key);
+ }
+ return value;
+ }
+
+}
diff --git a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/SolrCollectionBootstrapper.java b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/SolrCollectionBootstrapper.java
index c393ff3..2e2ae6c 100644
--- a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/SolrCollectionBootstrapper.java
+++ b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/SolrCollectionBootstrapper.java
@@ -32,7 +32,6 @@ import java.util.Arrays;
import java.util.List;
import java.util.Map;
import java.util.Optional;
-import java.util.Properties;
import java.util.Set;
import java.util.logging.Logger;
import org.apache.hadoop.security.SecureClientLogin;
@@ -41,7 +40,6 @@ import org.apache.http.client.methods.HttpPost;
import org.apache.http.entity.ByteArrayEntity;
import org.apache.http.util.EntityUtils;
import org.apache.ranger.authorization.utils.StringUtil;
-import org.apache.ranger.plugin.util.XMLUtils;
import org.apache.solr.client.solrj.SolrClient;
import org.apache.solr.client.solrj.SolrServerException;
import org.apache.solr.client.solrj.impl.CloudSolrClient;
@@ -77,9 +75,6 @@ public class SolrCollectionBootstrapper extends Thread {
public static final long DEFAULT_SOLR_TIME_INTERVAL_MS = 60000L;
private static final int TRY_UNTIL_SUCCESS = -1;
public static final int DEFAULT_SOLR_BOOTSTRP_MAX_RETRY = TRY_UNTIL_SUCCESS;
- private static final String CONFIG_FILE = "ranger-admin-site.xml";
- private static final String CORE_SITE_CONFIG_FILENAME = "core-site.xml";
- private static final String DEFAULT_CONFIG_FILENAME = "ranger-admin-default-site.xml";
private static final String AUTH_TYPE_KERBEROS = "kerberos";
private static final String AUTHENTICATION_TYPE = "hadoop.security.authentication";
private static final String RANGER_SERVICE_HOSTNAME = "ranger.service.host";
@@ -109,49 +104,44 @@ public class SolrCollectionBootstrapper extends Thread {
SolrZooKeeper solrZookeeper = null;
SolrZkClient zkClient = null;
- private Properties serverConfigProperties = new Properties();
-
public SolrCollectionBootstrapper() throws IOException {
logger.info("Starting Solr Setup");
- XMLUtils.loadConfig(DEFAULT_CONFIG_FILENAME, serverConfigProperties);
- XMLUtils.loadConfig(CORE_SITE_CONFIG_FILENAME, serverConfigProperties);
- XMLUtils.loadConfig(CONFIG_FILE, serverConfigProperties);
- logger.info("AUTHENTICATION_TYPE : " + getConfig(AUTHENTICATION_TYPE));
- if (getConfig(AUTHENTICATION_TYPE) != null
- && getConfig(AUTHENTICATION_TYPE).trim().equalsIgnoreCase(
+ logger.info("AUTHENTICATION_TYPE : " + EmbeddedServerUtil.getConfig(AUTHENTICATION_TYPE));
+ if (EmbeddedServerUtil.getConfig(AUTHENTICATION_TYPE) != null
+ && EmbeddedServerUtil.getConfig(AUTHENTICATION_TYPE).trim().equalsIgnoreCase(
AUTH_TYPE_KERBEROS)) {
isKERBEROS = true;
- hostName = getConfig(RANGER_SERVICE_HOSTNAME);
+ hostName = EmbeddedServerUtil.getConfig(RANGER_SERVICE_HOSTNAME);
try {
principal = SecureClientLogin.getPrincipal(
- getConfig(ADMIN_USER_PRINCIPAL), hostName);
+ EmbeddedServerUtil.getConfig(ADMIN_USER_PRINCIPAL), hostName);
} catch (IOException ignored) {
logger.warning("Failed to get ranger.admin.kerberos.principal. Reason: "
+ ignored.toString());
}
}
- solr_collection_name = getConfig(SOLR_COLLECTION_NAME,
+ solr_collection_name = EmbeddedServerUtil.getConfig(SOLR_COLLECTION_NAME,
DEFAULT_COLLECTION_NAME);
logger.info("Solr Collection name provided is : "
+ solr_collection_name);
- solr_config_name = getConfig(SOLR_CONFIG_NAME, DEFAULT_CONFIG_NAME);
+ solr_config_name = EmbeddedServerUtil.getConfig(SOLR_CONFIG_NAME, DEFAULT_CONFIG_NAME);
logger.info("Solr Config name provided is : " + solr_config_name);
- no_of_replicas = getIntConfig(SOLR_NO_REPLICA, 1);
+ no_of_replicas = EmbeddedServerUtil.getIntConfig(SOLR_NO_REPLICA, 1);
logger.info("No. of replicas provided is : " + no_of_replicas);
- no_of_shards = getIntConfig(SOLR_NO_SHARDS, 1);
+ no_of_shards = EmbeddedServerUtil.getIntConfig(SOLR_NO_SHARDS, 1);
logger.info("No. of shards provided is : " + no_of_shards);
- max_node_per_shards = getIntConfig(SOLR_MAX_SHARD_PER_NODE, 1);
+ max_node_per_shards = EmbeddedServerUtil.getIntConfig(SOLR_MAX_SHARD_PER_NODE, 1);
logger.info("Max no of nodes per shards provided is : "
+ max_node_per_shards);
- time_interval = getLongConfig(SOLR_TIME_INTERVAL,
+ time_interval = EmbeddedServerUtil.getLongConfig(SOLR_TIME_INTERVAL,
DEFAULT_SOLR_TIME_INTERVAL_MS);
logger.info("Solr time interval provided is : " + time_interval);
-
- max_retry = getIntConfig(SOLR_BOOTSTRP_MAX_RETRY, DEFAULT_SOLR_BOOTSTRP_MAX_RETRY);
+
+ max_retry = EmbeddedServerUtil.getIntConfig(SOLR_BOOTSTRP_MAX_RETRY, DEFAULT_SOLR_BOOTSTRP_MAX_RETRY);
if (System.getProperty(PROP_JAVA_SECURITY_AUTH_LOGIN_CONFIG) == null) {
System.setProperty(PROP_JAVA_SECURITY_AUTH_LOGIN_CONFIG,
"/dev/null");
@@ -163,7 +153,7 @@ public class SolrCollectionBootstrapper extends Thread {
path_for_cloud_mode = Paths.get(solrFileDir, "contrib",
"solr_for_audit_setup", "conf");
configSetFolder = path_for_cloud_mode.toFile();
- String sslEnabledProp = getConfig(SSL_ENABLED_PARAM);
+ String sslEnabledProp = EmbeddedServerUtil.getConfig(SSL_ENABLED_PARAM);
isSSLEnabled = ("true".equalsIgnoreCase(sslEnabledProp));
}
@@ -172,9 +162,9 @@ public class SolrCollectionBootstrapper extends Thread {
String zkHosts = "";
List<String> zookeeperHosts = null;
- if (getConfig(SOLR_ZK_HOSTS) != null
- && !StringUtil.isEmpty(getConfig(SOLR_ZK_HOSTS))) {
- zkHosts = getConfig(SOLR_ZK_HOSTS).trim();
+ if (EmbeddedServerUtil.getConfig(SOLR_ZK_HOSTS) != null
+ && !StringUtil.isEmpty(EmbeddedServerUtil.getConfig(SOLR_ZK_HOSTS))) {
+ zkHosts = EmbeddedServerUtil.getConfig(SOLR_ZK_HOSTS).trim();
zookeeperHosts = new ArrayList<String>(Arrays.asList(zkHosts
.split(",")));
}
@@ -264,7 +254,7 @@ public class SolrCollectionBootstrapper extends Thread {
m = (Map) ObjectBuilder.getVal(new JSONParser(
new StringReader(response)));
} catch (JSONParser.ParseException e) {
- System.err.println("err response: " + response);
+ logger.severe("Error response: " + response);
throw new AssertionError(e);
}
} finally {
@@ -398,17 +388,6 @@ public class SolrCollectionBootstrapper extends Thread {
}
}
- private String getConfig(String key, String defaultValue) {
- String ret = getConfig(key);
- if (ret == null) {
- ret = defaultValue;
- }
- return ret;
- }
-
-
-
-
@SuppressWarnings("unchecked")
private List<String> getCollections() throws IOException, ParseException {
try {
@@ -430,44 +409,6 @@ public class SolrCollectionBootstrapper extends Thread {
}
- private int getIntConfig(String key, int defaultValue) {
- int ret = defaultValue;
- String retStr = getConfig(key);
- try {
- if (retStr != null) {
- ret = Integer.parseInt(retStr);
- }
- } catch (Exception err) {
- logger.severe(retStr + " can't be parsed to int. Reason: "
- + err.toString());
- }
- return ret;
- }
-
- private Long getLongConfig(String key, Long defaultValue) {
- Long ret = defaultValue;
- String retStr = getConfig(key);
- try {
- if (retStr != null) {
- ret = Long.parseLong(retStr);
- }
- } catch (Exception err) {
- logger.severe(retStr + " can't be parsed to long. Reason: "
- + err.toString());
- }
- return ret;
- }
-
- private String getConfig(String key) {
- String value = serverConfigProperties.getProperty(key);
- if (value == null || value.trim().isEmpty()) {
- // Value not found in properties file, let's try to get from
- // System's property
- value = System.getProperty(key);
- }
- return value;
- }
-
private File getConfigSetFolder() {
return configSetFolder;
}
diff --git a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/StopEmbeddedServer.java b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/StopEmbeddedServer.java
index 0aedd99..c020c34 100644
--- a/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/StopEmbeddedServer.java
+++ b/embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/StopEmbeddedServer.java
@@ -37,10 +37,10 @@ public class StopEmbeddedServer extends EmbeddedServer {
public void stop() {
try {
-
- int shutdownPort = getIntConfig("ranger.service.shutdown.port", DEFAULT_SHUTDOWN_PORT );
- String shutdownCommand = getConfig("ranger.service.shutdown.command", DEFAULT_SHUTDOWN_COMMAND );
-
+
+ int shutdownPort = EmbeddedServerUtil.getIntConfig("ranger.service.shutdown.port", DEFAULT_SHUTDOWN_PORT );
+ String shutdownCommand = EmbeddedServerUtil.getConfig("ranger.service.shutdown.command", DEFAULT_SHUTDOWN_COMMAND );
+
Socket sock = new Socket(SHUTDOWN_HOSTNAME,shutdownPort);
PrintWriter out = new PrintWriter(sock.getOutputStream(), true);
[ranger] 01/03: RANGER-2763: Hive SET Role command in Ranger hive
plugin
Posted by pr...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pradeep pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit d488d570d6b94a8987431d4424727c6a91d640b7
Author: pradeep <pr...@apache.org>
AuthorDate: Sun May 3 19:53:10 2020 +0530
RANGER-2763: Hive SET Role command in Ranger hive plugin
---
.../plugin/policyengine/RangerAccessRequest.java | 2 +
.../policyengine/RangerAccessRequestImpl.java | 23 +++-
.../policyengine/RangerAccessRequestReadOnly.java | 5 +
.../policyengine/RangerTagAccessRequest.java | 1 +
.../RangerDefaultPolicyEvaluator.java | 16 ++-
.../service/RangerDefaultRequestProcessor.java | 5 +-
.../RangerCustomConditionMatcherTest.java | 2 +-
.../plugin/contextenricher/TestTagEnricher.java | 2 +-
.../ranger/plugin/policyengine/TestPolicyACLs.java | 2 +-
.../plugin/policyengine/TestPolicyEngine.java | 2 +-
.../authorization/hbase/AuthorizationSession.java | 2 +-
.../hbase/RangerAuthorizationCoprocessor.java | 2 +-
.../hive/authorizer/RangerHiveAccessRequest.java | 10 +-
.../hive/authorizer/RangerHiveAuthorizer.java | 151 ++++++++++++++++++---
.../hive/authorizer/RangerHiveAuthorizerBase.java | 8 --
.../hive/authorizer/RangerHivePolicyProvider.java | 2 +-
.../atlas/authorizer/RangerAtlasAuthorizer.java | 6 +-
.../authorizer/RangerSystemAccessControl.java | 2 +-
.../examples/sampleapp/RangerAuthorizer.java | 2 +-
.../apache/ranger/biz/RangerPolicyAdminImpl.java | 2 +-
20 files changed, 195 insertions(+), 52 deletions(-)
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequest.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequest.java
index 89d585a..4a12168 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequest.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequest.java
@@ -37,6 +37,8 @@ public interface RangerAccessRequest {
Set<String> getUserGroups();
+ Set<String> getUserRoles();
+
Date getAccessTime();
String getClientIPAddress();
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequestImpl.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequestImpl.java
index 2a28f70..74a7a26 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequestImpl.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequestImpl.java
@@ -38,6 +38,7 @@ public class RangerAccessRequestImpl implements RangerAccessRequest {
private String accessType;
private String user;
private Set<String> userGroups;
+ private Set<String> userRoles;
private Date accessTime;
private String clientIPAddress;
private List<String> forwardedAddresses;
@@ -55,14 +56,15 @@ public class RangerAccessRequestImpl implements RangerAccessRequest {
private ResourceMatchingScope resourceMatchingScope = ResourceMatchingScope.SELF;
public RangerAccessRequestImpl() {
- this(null, null, null, null);
+ this(null, null, null, null, null);
}
- public RangerAccessRequestImpl(RangerAccessResource resource, String accessType, String user, Set<String> userGroups) {
+ public RangerAccessRequestImpl(RangerAccessResource resource, String accessType, String user, Set<String> userGroups, Set<String> userRoles) {
setResource(resource);
setAccessType(accessType);
setUser(user);
setUserGroups(userGroups);
+ setUserRoles(userRoles);
setForwardedAddresses(null);
// set remaining fields to default value
@@ -97,6 +99,11 @@ public class RangerAccessRequestImpl implements RangerAccessRequest {
}
@Override
+ public Set<String> getUserRoles() {
+ return userRoles;
+ }
+
+ @Override
public Date getAccessTime() {
return accessTime;
}
@@ -174,6 +181,10 @@ public class RangerAccessRequestImpl implements RangerAccessRequest {
this.userGroups = (userGroups == null) ? new HashSet<String>() : userGroups;
}
+ public void setUserRoles(Set<String> userRoles) {
+ this.userRoles = (userRoles == null) ? new HashSet<String>() : userRoles;
+ }
+
public void setAccessTime(Date accessTime) {
this.accessTime = accessTime;
}
@@ -290,6 +301,14 @@ public class RangerAccessRequestImpl implements RangerAccessRequest {
}
sb.append("} ");
+ sb.append("userRoles={");
+ if(userRoles != null) {
+ for(String role : userRoles) {
+ sb.append(role).append(" ");
+ }
+ }
+ sb.append("} ");
+
sb.append("accessTime={").append(accessTime).append("} ");
sb.append("clientIPAddress={").append(getClientIPAddress()).append("} ");
sb.append("forwardedAddresses={").append(StringUtils.join(forwardedAddresses, " ")).append("} ");
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequestReadOnly.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequestReadOnly.java
index ea42c82..4887c01 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequestReadOnly.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessRequestReadOnly.java
@@ -31,6 +31,7 @@ public class RangerAccessRequestReadOnly implements RangerAccessRequest {
// Cached here for reducing access overhead
private final RangerAccessResource resource;
private final Set<String> userGroups;
+ private final Set<String> userRoles;
private final List<String> forwardedAddresses;
private final Map<String, Object> context;
@@ -38,6 +39,7 @@ public class RangerAccessRequestReadOnly implements RangerAccessRequest {
this.source = source;
this.resource = source.getResource().getReadOnlyCopy();
this.userGroups = Collections.unmodifiableSet(source.getUserGroups());
+ this.userRoles = Collections.unmodifiableSet(source.getUserRoles());
this.context = Collections.unmodifiableMap(source.getContext());
this.forwardedAddresses = Collections.unmodifiableList(source.getForwardedAddresses());
}
@@ -61,6 +63,9 @@ public class RangerAccessRequestReadOnly implements RangerAccessRequest {
public Set<String> getUserGroups() { return userGroups; }
@Override
+ public Set<String> getUserRoles() { return userRoles; }
+
+ @Override
public Date getAccessTime() { return source.getAccessTime(); }
@Override
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerTagAccessRequest.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerTagAccessRequest.java
index ee605e8..ebe85e9 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerTagAccessRequest.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerTagAccessRequest.java
@@ -35,6 +35,7 @@ public class RangerTagAccessRequest extends RangerAccessRequestImpl {
super.setResource(new RangerTagResource(resourceTag.getType(), tagServiceDef));
super.setUser(request.getUser());
super.setUserGroups(request.getUserGroups());
+ super.setUserRoles(request.getUserRoles());
super.setAction(request.getAction());
super.setAccessType(request.getAccessType());
super.setAccessTime(request.getAccessTime());
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java b/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
index 59a0405..d75bf46 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java
@@ -608,7 +608,7 @@ public class RangerDefaultPolicyEvaluator extends RangerAbstractPolicyEvaluator
if (LOG.isDebugEnabled()) {
LOG.debug("Using ACL Summary for access evaluation. PolicyId=[" + getId() + "]");
}
- Integer accessResult = lookupPolicyACLSummary(request.getUser(), request.getUserGroups(), request.getAccessType());
+ Integer accessResult = lookupPolicyACLSummary(request.getUser(), request.getUserGroups(), request.getUserRoles(), request.getAccessType());
if (accessResult != null) {
updateAccessResult(result, matchType, accessResult.equals(RangerPolicyEvaluator.ACCESS_ALLOWED), null);
}
@@ -631,7 +631,7 @@ public class RangerDefaultPolicyEvaluator extends RangerAbstractPolicyEvaluator
}
}
- private Integer lookupPolicyACLSummary(String user, Set<String> userGroups, String accessType) {
+ private Integer lookupPolicyACLSummary(String user, Set<String> userGroups, Set<String> userRoles, String accessType) {
Integer accessResult = null;
Map<String, PolicyACLSummary.AccessResult> accesses = aclSummary.getUsersAccessInfo().get(user);
@@ -651,6 +651,16 @@ public class RangerDefaultPolicyEvaluator extends RangerAbstractPolicyEvaluator
break;
}
}
+
+ if (userRoles !=null) {
+ for (String userRole : userRoles) {
+ accesses = aclSummary.getRolesAccessInfo().get(userRole);
+ accessResult = lookupAccess(userRole, accessType, accesses);
+ if (accessResult != null) {
+ break;
+ }
+ }
+ }
}
return accessResult;
@@ -810,7 +820,7 @@ public class RangerDefaultPolicyEvaluator extends RangerAbstractPolicyEvaluator
LOG.debug("Using ACL Summary for checking if access is allowed. PolicyId=[" + getId() +"]");
}
- Integer accessResult = lookupPolicyACLSummary(user, userGroups, accessType);
+ Integer accessResult = lookupPolicyACLSummary(user, userGroups, roles, accessType);
if (accessResult != null && accessResult.equals(RangerPolicyEvaluator.ACCESS_ALLOWED)) {
ret = true;
}
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java b/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java
index c951414..2f83434 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java
@@ -63,7 +63,10 @@ public class RangerDefaultRequestProcessor implements RangerAccessRequestProcess
RangerAccessRequestUtil.setOwnerInContext(request.getContext(), owner);
}
- Set<String> roles = policyEngine.getPluginContext().getAuthContext().getRolesForUserAndGroups(request.getUser(), request.getUserGroups());
+ Set<String> roles = request.getUserRoles();
+ if (CollectionUtils.isEmpty(roles)) {
+ roles = policyEngine.getPluginContext().getAuthContext().getRolesForUserAndGroups(request.getUser(), request.getUserGroups());
+ }
if (CollectionUtils.isNotEmpty(roles)) {
RangerAccessRequestUtil.setCurrentUserRolesInContext(request.getContext(), roles);
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerCustomConditionMatcherTest.java b/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerCustomConditionMatcherTest.java
index b42353b..2c708d7 100644
--- a/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerCustomConditionMatcherTest.java
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerCustomConditionMatcherTest.java
@@ -169,7 +169,7 @@ public class RangerCustomConditionMatcherTest {
RangerAccessRequest createRequest(List<String> resourceTags) {
RangerAccessResource resource = mock(RangerAccessResource.class);
- RangerAccessRequest request = new RangerAccessRequestImpl(resource,"dummy","test", null);
+ RangerAccessRequest request = new RangerAccessRequestImpl(resource,"dummy","test", null, null);
Set<RangerTagForEval> rangerTagForEvals = new HashSet<>();
RangerPolicyResourceMatcher.MatchType matchType = RangerPolicyResourceMatcher.MatchType.NONE;
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/contextenricher/TestTagEnricher.java b/agents-common/src/test/java/org/apache/ranger/plugin/contextenricher/TestTagEnricher.java
index 4cca8ce..83b39ed 100644
--- a/agents-common/src/test/java/org/apache/ranger/plugin/contextenricher/TestTagEnricher.java
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/contextenricher/TestTagEnricher.java
@@ -102,7 +102,7 @@ public class TestTagEnricher {
List<String> resultTags = new ArrayList<>();
for (TestData test : testCase.tests) {
- RangerAccessRequestImpl request = new RangerAccessRequestImpl(test.resource, test.accessType, "testUser", null);
+ RangerAccessRequestImpl request = new RangerAccessRequestImpl(test.resource, test.accessType, "testUser", null, null);
tagEnricher.enrich(request);
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyACLs.java b/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyACLs.java
index e9954c3..e1709ad 100644
--- a/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyACLs.java
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyACLs.java
@@ -99,7 +99,7 @@ public class TestPolicyACLs {
if(oneTest == null) {
continue;
}
- RangerAccessRequestImpl request = new RangerAccessRequestImpl(oneTest.resource, RangerPolicyEngine.ANY_ACCESS, null, null);
+ RangerAccessRequestImpl request = new RangerAccessRequestImpl(oneTest.resource, RangerPolicyEngine.ANY_ACCESS, null, null, null);
RangerResourceACLs acls = policyEngine.getResourceACLs(request);
boolean userACLsMatched = true, groupACLsMatched = true, roleACLsMatched = true;
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java b/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
index c71461b..cc16655 100644
--- a/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/policyengine/TestPolicyEngine.java
@@ -567,7 +567,7 @@ public class TestPolicyEngine {
// Create a new AccessRequest
RangerAccessRequestImpl newRequest =
new RangerAccessRequestImpl(request.getResource(), request.getAccessType(),
- request.getUser(), request.getUserGroups());
+ request.getUser(), request.getUserGroups(), null);
newRequest.setClientType(request.getClientType());
newRequest.setAccessTime(request.getAccessTime());
diff --git a/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/AuthorizationSession.java b/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/AuthorizationSession.java
index 6461a24..1b13d3b 100644
--- a/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/AuthorizationSession.java
+++ b/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/AuthorizationSession.java
@@ -189,7 +189,7 @@ public class AuthorizationSession {
resource.setValue(RangerHBaseResource.KEY_COLUMN, _column);
String user = _userUtils.getUserAsString(_user);
- RangerAccessRequestImpl request = new RangerAccessRequestImpl(resource, _access, user, _groups);
+ RangerAccessRequestImpl request = new RangerAccessRequestImpl(resource, _access, user, _groups, null);
request.setAction(_operation);
request.setRequestData(_otherInformation);
request.setClientIPAddress(_remoteAddress);
diff --git a/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java b/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
index d304bec..c50a192 100644
--- a/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
+++ b/hbase-agent/src/main/java/org/apache/ranger/authorization/hbase/RangerAuthorizationCoprocessor.java
@@ -1345,7 +1345,7 @@ public class RangerAuthorizationCoprocessor implements AccessControlService.Inte
}
}
RangerAccessRequestImpl rangerAccessrequest = new RangerAccessRequestImpl(resource, null,
- _userUtils.getUserAsString(user), groups);
+ _userUtils.getUserAsString(user), groups, null);
rangerAccessrequest.setAction(operation);
rangerAccessrequest.setClientIPAddress(getRemoteAddress());
rangerAccessrequest.setResourceMatchingScope(RangerAccessRequest.ResourceMatchingScope.SELF);
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java
index 188f2b1..deb467f 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAccessRequest.java
@@ -39,6 +39,7 @@ public class RangerHiveAccessRequest extends RangerAccessRequestImpl {
public RangerHiveAccessRequest(RangerHiveResource resource,
String user,
Set<String> userGroups,
+ Set<String> userRoles,
String hiveOpTypeName,
HiveAccessType accessType,
HiveAuthzContext context,
@@ -46,6 +47,7 @@ public class RangerHiveAccessRequest extends RangerAccessRequestImpl {
this.setResource(resource);
this.setUser(user);
this.setUserGroups(userGroups);
+ this.setUserRoles(userRoles);
this.setAccessTime(new Date());
this.setAction(hiveOpTypeName);
this.setHiveAccessType(accessType);
@@ -66,15 +68,16 @@ public class RangerHiveAccessRequest extends RangerAccessRequestImpl {
public RangerHiveAccessRequest(RangerHiveResource resource,
String user,
Set<String> userGroups,
+ Set<String> userRoles,
HiveOperationType hiveOpType,
HiveAccessType accessType,
HiveAuthzContext context,
HiveAuthzSessionContext sessionContext) {
- this(resource, user, userGroups, hiveOpType.name(), accessType, context, sessionContext);
+ this(resource, user, userGroups, userRoles, hiveOpType.name(), accessType, context, sessionContext);
}
- public RangerHiveAccessRequest(RangerHiveResource resource, String user, Set<String> groups, HiveAuthzContext context, HiveAuthzSessionContext sessionContext) {
- this(resource, user, groups, "METADATA OPERATION", HiveAccessType.USE, context, sessionContext);
+ public RangerHiveAccessRequest(RangerHiveResource resource, String user, Set<String> groups, Set<String> roles, HiveAuthzContext context, HiveAuthzSessionContext sessionContext) {
+ this(resource, user, groups, roles, "METADATA OPERATION", HiveAccessType.USE, context, sessionContext);
}
public HiveAccessType getHiveAccessType() {
@@ -98,6 +101,7 @@ public class RangerHiveAccessRequest extends RangerAccessRequestImpl {
ret.setAccessType(getAccessType());
ret.setUser(getUser());
ret.setUserGroups(getUserGroups());
+ ret.setUserRoles(getUserRoles());
ret.setAccessTime(getAccessTime());
ret.setAction(getAction());
ret.setClientIPAddress(getClientIPAddress());
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
index a6f74b9..c876110 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java
@@ -28,6 +28,7 @@ import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
+import java.util.Objects;
import java.util.Set;
import org.apache.commons.collections.CollectionUtils;
@@ -100,6 +101,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
private static volatile RangerHivePlugin hivePlugin = null;
private static final String ROLE_ALL = "ALL", ROLE_DEFAULT = "DEFAULT", ROLE_NONE = "NONE";
+ private static final String ROLE_ADMIN = "admin";
private static final String CMD_CREATE_ROLE = "create role %s";
private static final String CMD_DROP_ROLE = "drop role %s";
@@ -121,6 +123,10 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
RESERVED_ROLE_NAMES = Collections.unmodifiableSet(roleNames);
}
+ private String currentUserName;
+ private Set<String> currentRoles;
+ private String adminRole;
+
public RangerHiveAuthorizer(HiveMetastoreClientFactory metastoreClientFactory,
HiveConf hiveConf,
HiveAuthenticationProvider hiveAuthenticator,
@@ -265,39 +271,136 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
@Override
public List<String> getCurrentRoleNames() throws HiveAuthzPluginException {
- if(LOG.isDebugEnabled()) {
+ if (LOG.isDebugEnabled()) {
LOG.debug("RangerHiveAuthorizer.getCurrentRoleNames()");
}
UserGroupInformation ugi = getCurrentUserGroupInfo();
- boolean result = false;
-
- if(ugi == null) {
+ boolean result = false;
+ if (ugi == null) {
throw new HiveAuthzPluginException("User information not available");
}
- List<String> ret = null;
+ List<String> ret = new ArrayList<String>();
String user = ugi.getShortUserName();
List<String> userNames = Arrays.asList(user);
-
RangerHiveAuditHandler auditHandler = new RangerHiveAuditHandler();
try {
- if(LOG.isDebugEnabled()) {
+ if (LOG.isDebugEnabled()) {
LOG.debug("<== getCurrentRoleNames() for user " + user);
}
-
- ret = hivePlugin.getUserRoles(user, auditHandler);
+ for (String role : getCurrentRoles()) {
+ ret.add(role);
+ }
result = true;
- } catch(Exception excp) {
+ } catch (Exception excp) {
throw new HiveAuthzPluginException(excp);
} finally {
- RangerAccessResult accessResult = createAuditEvent(hivePlugin, user, userNames, HiveOperationType.SHOW_ROLES, HiveAccessType.SELECT, null, result);
+ RangerAccessResult accessResult = createAuditEvent(hivePlugin, user, userNames,
+ HiveOperationType.SHOW_ROLES, HiveAccessType.SELECT, ret, result);
auditHandler.processResult(accessResult);
auditHandler.flushAudit();
}
+ return ret;
+ }
+
+ private void initUserRoles() {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug(" ==> RangerHiveAuthorizer.initUserRoles()");
+ }
+ // from SQLStdHiveAccessController.initUserRoles()
+ // to aid in testing through .q files, authenticator is passed as argument to
+ // the interface. this helps in being able to switch the user within a session.
+ // so we need to check if the user has changed
+ String newUserName = getHiveAuthenticator().getUserName();
+ if (Objects.equals(currentUserName, newUserName)) {
+ // no need to (re-)initialize the currentUserName, currentRoles fields
+ return;
+ }
+ this.currentUserName = newUserName;
+ try {
+ currentRoles = getCurrentRoleNamesFromRanger();
+ } catch (HiveAuthzPluginException e) {
+ LOG.error("Error while fetching roles from ranger for user : " + currentUserName, e);
+ }
+ LOG.info("Current user : " + currentUserName + ", Current Roles : " + currentRoles);
+ }
+
+ private Set<String> getCurrentRoles() {
+ // from SQLStdHiveAccessController.getCurrentRoles()
+ initUserRoles();
+ return currentRoles;
+ }
+
+ private Set<String> getCurrentRoleNamesFromRanger() throws HiveAuthzPluginException {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("RangerHiveAuthorizer.getCurrentRoleNamesFromRanger()");
+ }
+ UserGroupInformation ugi = getCurrentUserGroupInfo();
+ if (ugi == null) {
+ throw new HiveAuthzPluginException("User information not available");
+ }
+ Set<String> ret = new HashSet<String>();
+ String user = ugi.getShortUserName();
+
+ RangerHiveAuditHandler auditHandler = new RangerHiveAuditHandler();
+ try {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("<== getCurrentRoleNamesFromRanger() for user " + user);
+ }
+ Set<String> userRoles = new HashSet<String>(hivePlugin.getUserRoles(user, auditHandler));
+ for (String role : userRoles) {
+ if (!ROLE_ADMIN.equalsIgnoreCase(role)) {
+ ret.add(role);
+ } else {
+ this.adminRole = role;
+ }
+ }
+ } catch (Exception excp) {
+ throw new HiveAuthzPluginException(excp);
+ } finally {
+ auditHandler.flushAudit();
+ }
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("<== RangerHiveAuthorizer.getCurrentRoleNamesFromRanger() for user " + user);
+ }
return ret;
}
@Override
+ public void setCurrentRole(String roleName) throws HiveAccessControlException, HiveAuthzPluginException {
+ // from SQLStdHiveAccessController.setCurrentRole()
+ initUserRoles();
+ if (ROLE_NONE.equalsIgnoreCase(roleName)) {
+ // for set role NONE, clear all roles for current session.
+ currentRoles.clear();
+ return;
+ }
+ if (ROLE_ALL.equalsIgnoreCase(roleName)) {
+ // for set role ALL, reset roles to default roles.
+ currentRoles.clear();
+ currentRoles.addAll(getCurrentRoleNamesFromRanger());
+ return;
+ }
+ for (String role : getCurrentRoleNamesFromRanger()) {
+ // set to one of the roles user belongs to.
+ if (role.equalsIgnoreCase(roleName)) {
+ currentRoles.clear();
+ currentRoles.add(role);
+ return;
+ }
+ }
+ // set to ADMIN role, if user belongs there.
+ if (ROLE_ADMIN.equalsIgnoreCase(roleName) && null != this.adminRole) {
+ currentRoles.clear();
+ currentRoles.add(adminRole);
+ return;
+ }
+ LOG.info("Current user : " + currentUserName + ", Current Roles : " + currentRoles);
+ // If we are here it means, user is requesting a role he doesn't belong to.
+ throw new HiveAccessControlException(currentUserName + " doesn't belong to role " + roleName);
+ }
+
+ @Override
public List<String> getAllRoles()
throws HiveAuthzPluginException, HiveAccessControlException {
LOG.debug("RangerHiveAuthorizer.getAllRoles()");
@@ -673,6 +776,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
HiveAuthzSessionContext sessionContext = getHiveAuthzSessionContext();
String user = ugi.getShortUserName();
Set<String> groups = Sets.newHashSet(ugi.getGroupNames());
+ Set<String> roles = getCurrentRoles();
if(LOG.isDebugEnabled()) {
LOG.debug(toString(hiveOpType, inputHObjs, outputHObjs, context, sessionContext));
@@ -718,7 +822,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
}
if(!existsByResourceAndAccessType(requests, resource, accessType)) {
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, hiveOpType, accessType, context, sessionContext);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, hiveOpType, accessType, context, sessionContext);
requests.add(request);
}
}
@@ -726,7 +830,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
// this should happen only for SHOWDATABASES
if (hiveOpType == HiveOperationType.SHOWDATABASES) {
RangerHiveResource resource = new RangerHiveResource(HiveObjectType.DATABASE, null);
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, hiveOpType.name(), HiveAccessType.USE, context, sessionContext);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, hiveOpType.name(), HiveAccessType.USE, context, sessionContext);
requests.add(request);
} else if ( hiveOpType == HiveOperationType.REPLDUMP) {
// This happens when REPL DUMP command with null inputHObjs is sent in checkPrivileges()
@@ -742,7 +846,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
resource = new RangerHiveResource(HiveObjectType.DATABASE, dbName, null);
}
//
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, hiveOpType.name(), HiveAccessType.REPLADMIN, context, sessionContext);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, hiveOpType.name(), HiveAccessType.REPLADMIN, context, sessionContext);
requests.add(request);
} else {
if (LOG.isDebugEnabled()) {
@@ -779,7 +883,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
}
if(!existsByResourceAndAccessType(requests, resource, accessType)) {
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, hiveOpType, accessType, context, sessionContext);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, hiveOpType, accessType, context, sessionContext);
requests.add(request);
}
@@ -798,7 +902,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
} else {
resource = new RangerHiveResource(HiveObjectType.DATABASE, dbName, null);
}
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, hiveOpType.name(), HiveAccessType.REPLADMIN, context, sessionContext);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, hiveOpType.name(), HiveAccessType.REPLADMIN, context, sessionContext);
requests.add(request);
}
}
@@ -869,7 +973,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
result.setIsAllowed(false);
result.setPolicyId(rowFilterResult.getPolicyId());
- result.setReason("User does not have acces to all rows of the table");
+ result.setReason("User does not have access to all rows of the table");
} else {
// check if masking is enabled for any column in the table/view
request.setResourceMatchingScope(RangerAccessRequest.ResourceMatchingScope.SELF_OR_DESCENDANTS);
@@ -956,6 +1060,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
HiveAuthzSessionContext sessionContext = getHiveAuthzSessionContext();
String user = ugi.getShortUserName();
Set<String> groups = Sets.newHashSet(ugi.getGroupNames());
+ Set<String> roles = getCurrentRoles();
if (LOG.isDebugEnabled()) {
LOG.debug(String.format("filterListCmdObjects: user[%s], groups%s", user, groups));
}
@@ -982,7 +1087,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
if (resource == null) {
LOG.error("filterListCmdObjects: RangerHiveResource returned by createHiveResource is null");
} else {
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, context, sessionContext);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, context, sessionContext);
RangerAccessResult result = hivePlugin.isAccessAllowed(request, auditHandler);
if (result == null) {
LOG.error("filterListCmdObjects: Internal error: null RangerAccessResult object received back from isAccessAllowed()!");
@@ -1148,9 +1253,10 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
HiveAuthzSessionContext sessionContext = getHiveAuthzSessionContext();
String user = ugi.getShortUserName();
Set<String> groups = Sets.newHashSet(ugi.getGroupNames());
+ Set<String> roles = getCurrentRoles();
HiveObjectType objectType = HiveObjectType.TABLE;
RangerHiveResource resource = new RangerHiveResource(objectType, databaseName, tableOrViewName);
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, objectType.name(), HiveAccessType.SELECT, context, sessionContext);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, objectType.name(), HiveAccessType.SELECT, context, sessionContext);
RangerAccessResult result = hivePlugin.evalRowFilterPolicies(request, auditHandler);
@@ -1188,9 +1294,10 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
HiveAuthzSessionContext sessionContext = getHiveAuthzSessionContext();
String user = ugi.getShortUserName();
Set<String> groups = Sets.newHashSet(ugi.getGroupNames());
+ Set<String> roles = getCurrentRoles();
HiveObjectType objectType = HiveObjectType.COLUMN;
RangerHiveResource resource = new RangerHiveResource(objectType, databaseName, tableOrViewName, columnName);
- RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, objectType.name(), HiveAccessType.SELECT, context, sessionContext);
+ RangerHiveAccessRequest request = new RangerHiveAccessRequest(resource, user, groups, roles, objectType.name(), HiveAccessType.SELECT, context, sessionContext);
RangerAccessResult result = hivePlugin.evalDataMaskPolicies(request, auditHandler);
@@ -2464,7 +2571,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
}
RangerHiveResource hiveResource = RangerHiveAuthorizer.createHiveResource(hiveObject);
- RangerAccessRequestImpl request = new RangerAccessRequestImpl(hiveResource, RangerPolicyEngine.ANY_ACCESS, null, null);
+ RangerAccessRequestImpl request = new RangerAccessRequestImpl(hiveResource, RangerPolicyEngine.ANY_ACCESS, null, null, null);
ret = hivePlugin.getResourceACLs(request);
@@ -2620,7 +2727,7 @@ public class RangerHiveAuthorizer extends RangerHiveAuthorizerBase {
HiveAuthzContext hiveAuthzContext = builder.build();
RangerHiveResource rangerHiveResource = new RangerHiveResource(HiveObjectType.GLOBAL,"*");
- ret = new RangerHiveAccessRequest(rangerHiveResource, userOrGrantor, null, hiveOperationType, accessType, hiveAuthzContext, null);
+ ret = new RangerHiveAccessRequest(rangerHiveResource, userOrGrantor, null, null, hiveOperationType, accessType, hiveAuthzContext, null);
ret.setClusterName(hivePlugin.getClusterName());
ret.setAction(hiveOperationType.name());
ret.setClientIPAddress(getRemoteIp());
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizerBase.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizerBase.java
index c752489..e06f135 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizerBase.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizerBase.java
@@ -147,14 +147,6 @@ public abstract class RangerHiveAuthorizerBase extends AbstractHiveAuthorizer {
return VERSION.V1;
}
- @Override
- public void setCurrentRole(String roleName)
- throws HiveAccessControlException, HiveAuthzPluginException {
- LOG.debug("RangerHiveAuthorizerBase.setCurrentRole()");
-
- throwNotImplementedException("setCurrentRole");
- }
-
private void throwNotImplementedException(String method) throws HiveAuthzPluginException {
throw new HiveAuthzPluginException(method + "() not implemented in Ranger AbstractHiveAuthorizer");
}
diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHivePolicyProvider.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHivePolicyProvider.java
index ba6b459..7bdd4b3 100644
--- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHivePolicyProvider.java
+++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHivePolicyProvider.java
@@ -97,7 +97,7 @@ public class RangerHivePolicyProvider implements HivePolicyProvider {
public HiveResourceACLs getResourceACLs(RangerHiveResource hiveResource) {
HiveResourceACLs ret;
- RangerAccessRequestImpl request = new RangerAccessRequestImpl(hiveResource, RangerPolicyEngine.ANY_ACCESS, null, null);
+ RangerAccessRequestImpl request = new RangerAccessRequestImpl(hiveResource, RangerPolicyEngine.ANY_ACCESS, null, null, null);
RangerResourceACLs acls = rangerPlugin.getResourceACLs(request);
diff --git a/plugin-atlas/src/main/java/org/apache/ranger/authorization/atlas/authorizer/RangerAtlasAuthorizer.java b/plugin-atlas/src/main/java/org/apache/ranger/authorization/atlas/authorizer/RangerAtlasAuthorizer.java
index dc2ed8a..28d71de 100644
--- a/plugin-atlas/src/main/java/org/apache/ranger/authorization/atlas/authorizer/RangerAtlasAuthorizer.java
+++ b/plugin-atlas/src/main/java/org/apache/ranger/authorization/atlas/authorizer/RangerAtlasAuthorizer.java
@@ -107,7 +107,7 @@ public class RangerAtlasAuthorizer implements AtlasAuthorizer {
String action = request.getAction() != null ? request.getAction().getType() : null;
RangerAccessResourceImpl rangerResource = new RangerAccessResourceImpl(Collections.singletonMap(RESOURCE_SERVICE, "*"));
- RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(rangerResource, action, request.getUser(), request.getUserGroups());
+ RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(rangerResource, action, request.getUser(), request.getUserGroups(), null);
rangerRequest.setClientIPAddress(request.getClientIPAddress());
rangerRequest.setAccessTime(request.getAccessTime());
@@ -183,7 +183,7 @@ public class RangerAtlasAuthorizer implements AtlasAuthorizer {
rangerResource.setValue(RESOURCE_TYPE_NAME, typeName);
rangerResource.setValue(RESOURCE_TYPE_CATEGORY, typeCategory);
- RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(rangerResource, action, request.getUser(), request.getUserGroups());
+ RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(rangerResource, action, request.getUser(), request.getUserGroups(), null);
rangerRequest.setClientIPAddress(request.getClientIPAddress());
rangerRequest.setAccessTime(request.getAccessTime());
rangerRequest.setAction(action);
@@ -229,7 +229,7 @@ public class RangerAtlasAuthorizer implements AtlasAuthorizer {
RangerAccessResourceImpl rangerResource = new RangerAccessResourceImpl();
- RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(rangerResource, action, request.getUser(), request.getUserGroups());
+ RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(rangerResource, action, request.getUser(), request.getUserGroups(), null);
rangerRequest.setClientIPAddress(request.getClientIPAddress());
rangerRequest.setAccessTime(request.getAccessTime());
rangerRequest.setAction(action);
diff --git a/plugin-presto/src/main/java/org/apache/ranger/authorization/presto/authorizer/RangerSystemAccessControl.java b/plugin-presto/src/main/java/org/apache/ranger/authorization/presto/authorizer/RangerSystemAccessControl.java
index 4742847..f4fc89d 100644
--- a/plugin-presto/src/main/java/org/apache/ranger/authorization/presto/authorizer/RangerSystemAccessControl.java
+++ b/plugin-presto/src/main/java/org/apache/ranger/authorization/presto/authorizer/RangerSystemAccessControl.java
@@ -833,7 +833,7 @@ class RangerPrestoAccessRequest
String user,
Set<String> userGroups,
PrestoAccessType prestoAccessType) {
- super(resource, prestoAccessType.name().toLowerCase(ENGLISH), user, userGroups);
+ super(resource, prestoAccessType.name().toLowerCase(ENGLISH), user, userGroups, null);
setAccessTime(new Date());
}
}
diff --git a/ranger-examples/plugin-sampleapp/src/main/java/org/apache/ranger/examples/sampleapp/RangerAuthorizer.java b/ranger-examples/plugin-sampleapp/src/main/java/org/apache/ranger/examples/sampleapp/RangerAuthorizer.java
index 6b3d6ea..28db88e 100644
--- a/ranger-examples/plugin-sampleapp/src/main/java/org/apache/ranger/examples/sampleapp/RangerAuthorizer.java
+++ b/ranger-examples/plugin-sampleapp/src/main/java/org/apache/ranger/examples/sampleapp/RangerAuthorizer.java
@@ -53,7 +53,7 @@ public class RangerAuthorizer implements IAuthorizer {
RangerAccessResourceImpl resource = new RangerAccessResourceImpl();
resource.setValue("path", fileName); // "path" must be a value resource name in servicedef JSON
- RangerAccessRequest request = new RangerAccessRequestImpl(resource, accessType, user, userGroups);
+ RangerAccessRequest request = new RangerAccessRequestImpl(resource, accessType, user, userGroups, null);
RangerAccessResult result = plugin.isAccessAllowed(request);
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/RangerPolicyAdminImpl.java b/security-admin/src/main/java/org/apache/ranger/biz/RangerPolicyAdminImpl.java
index 5e93291..1c63e94 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/RangerPolicyAdminImpl.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/RangerPolicyAdminImpl.java
@@ -319,7 +319,7 @@ public class RangerPolicyAdminImpl implements RangerPolicyAdmin {
}
List<RangerPolicy> ret = new ArrayList<>();
- RangerAccessRequestImpl request = new RangerAccessRequestImpl(resource, accessType, null, null);
+ RangerAccessRequestImpl request = new RangerAccessRequestImpl(resource, accessType, null, null, null);
requestProcessor.preProcess(request);
[ranger] 03/03: RANGER-2831: presto-server-333 start failed due to
NoClassDefFoundError
Posted by pr...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pradeep pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 813b67197ae6e58c21a9e72c7f034779c3efed79
Author: pradeep <pr...@apache.org>
AuthorDate: Fri May 22 10:24:20 2020 +0530
RANGER-2831: presto-server-333 start failed due to NoClassDefFoundError
---
distro/src/main/assembly/plugin-presto.xml | 1 +
plugin-presto/pom.xml | 10 ++++++++++
pom.xml | 1 +
ranger-presto-plugin-shim/pom.xml | 6 ++++++
.../ranger/patch/PatchForPrestoToSupportPresto333_J10038.java | 2 ++
5 files changed, 20 insertions(+)
diff --git a/distro/src/main/assembly/plugin-presto.xml b/distro/src/main/assembly/plugin-presto.xml
index 507944b..a860f17 100644
--- a/distro/src/main/assembly/plugin-presto.xml
+++ b/distro/src/main/assembly/plugin-presto.xml
@@ -47,6 +47,7 @@
<include>javax.inject:javax.inject:jar:${javax-inject.version}</include>
<include>org.apache.bval:bval-jsr:jar:${presto.bval-jsr.version}</include>
<include>org.slf4j:slf4j-api:jar:${slf4j-api.version}</include>
+ <include>javax.annotation:javax.annotation-api</include>
</includes>
</binaries>
</moduleSet>
diff --git a/plugin-presto/pom.xml b/plugin-presto/pom.xml
index 61728b5..07a8cf4 100644
--- a/plugin-presto/pom.xml
+++ b/plugin-presto/pom.xml
@@ -43,6 +43,16 @@
<version>${presto.version}</version>
</dependency>
<dependency>
+ <groupId>org.apache.httpcomponents</groupId>
+ <artifactId>httpcore</artifactId>
+ <version>${httpcomponents.httpcore.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.zookeeper</groupId>
+ <artifactId>zookeeper</artifactId>
+ <version>${zookeeper.version}</version>
+ </dependency>
+ <dependency>
<groupId>org.apache.ranger</groupId>
<artifactId>ranger-plugins-common</artifactId>
<version>${project.version}</version>
diff --git a/pom.xml b/pom.xml
index 0b2e092..97677ce 100644
--- a/pom.xml
+++ b/pom.xml
@@ -137,6 +137,7 @@
<javax.persistence.version>2.1.0</javax.persistence.version>
<javax.servlet.version>3.1.0</javax.servlet.version>
<javax-inject.version>1</javax-inject.version>
+ <javax.annotation-api>1.3.2</javax.annotation-api>
<jaxb.api.version>2.3.1</jaxb.api.version>
<jericho.html.version>3.3</jericho.html.version>
<jersey-bundle.version>1.19.3</jersey-bundle.version>
diff --git a/ranger-presto-plugin-shim/pom.xml b/ranger-presto-plugin-shim/pom.xml
index 5c0f897..599ff21 100644
--- a/ranger-presto-plugin-shim/pom.xml
+++ b/ranger-presto-plugin-shim/pom.xml
@@ -137,5 +137,11 @@
<version>${protobuf-java.version}</version>
</dependency>
+ <dependency>
+ <groupId>javax.annotation</groupId>
+ <artifactId>javax.annotation-api</artifactId>
+ <version>${javax.annotation-api}</version>
+ </dependency>
+
</dependencies>
</project>
\ No newline at end of file
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/PatchForPrestoToSupportPresto333_J10038.java b/security-admin/src/main/java/org/apache/ranger/patch/PatchForPrestoToSupportPresto333_J10038.java
index f47ad13..1dd4272 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/PatchForPrestoToSupportPresto333_J10038.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/PatchForPrestoToSupportPresto333_J10038.java
@@ -34,11 +34,13 @@ import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil;
import org.apache.ranger.service.RangerPolicyService;
import org.apache.ranger.util.CLIUtil;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
+@Component
public class PatchForPrestoToSupportPresto333_J10038 extends BaseLoader {
private static final Logger logger = Logger.getLogger(PatchForPrestoToSupportPresto333_J10038.class);