You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by Abhay Kulkarni <ak...@hortonworks.com> on 2019/04/08 18:46:16 UTC
Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/
-----------------------------------------------------------
Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
Bugs: RANGER-2400
https://issues.apache.org/jira/browse/RANGER-2400
Repository: ranger
Description
-------
Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
Diffs
-----
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 2eaffccac
security-admin/db/mysql/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql 5ca1e3667
security-admin/db/oracle/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql 51f4999f7
security-admin/db/postgres/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql 5f64a2dba
security-admin/db/sqlanywhere/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql fc21cec3e
security-admin/db/sqlserver/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 574166c3d
security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java 0af7a1da2
security-admin/src/main/resources/META-INF/jpa_named_queries.xml 7e702c144
Diff: https://reviews.apache.org/r/70426/diff/1/
Testing
-------
Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
Thanks,
Abhay Kulkarni
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/#review214715
-----------------------------------------------------------
Fix it, then Ship it!
security-admin/src/main/java/org/apache/ranger/service/RangerPolicyServiceBase.java
Line 168 (original), 169 (patched)
<https://reviews.apache.org/r/70426/#comment300934>
zone == null is an error condition, which should result in following exception - from #114 above:
throw restErrorUtil.createRESTException("Invalid zoneName for policyName: " + vObj.getName()
+ "Zone Not Found : " + vObj.getZoneName(), MessageEnums.INVALID_INPUT_DATA);
security-admin/src/main/java/org/apache/ranger/service/RangerPolicyServiceBase.java
Line 174 (original), 175 (patched)
<https://reviews.apache.org/r/70426/#comment300935>
line #173 returns null, #175 returns StringUtis.EMPTY. Is this intentional?
- Madhan Neethiraj
On April 17, 2019, 4:24 a.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70426/
> -----------------------------------------------------------
>
> (Updated April 17, 2019, 4:24 a.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2400
> https://issues.apache.org/jira/browse/RANGER-2400
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/model/RangerSecurityZone.java c3e96bf60
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
> agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
> agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
> security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 707c3119a
> security-admin/db/mysql/patches/037-create-security-zone-schema.sql a50ec0e34
> security-admin/db/mysql/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql e7d89898f
> security-admin/db/oracle/patches/037-create-security-zone-schema.sql 354c74dd4
> security-admin/db/oracle/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql a1998fc3e
> security-admin/db/postgres/patches/037-create-security-zone-schema.sql 434231dd6
> security-admin/db/postgres/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql 207c5a3a5
> security-admin/db/sqlanywhere/patches/037-create-security-zone-schema.sql 893d453e6
> security-admin/db/sqlanywhere/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql 36aefcff6
> security-admin/db/sqlserver/patches/037-create-security-zone-schema.sql a610b70b1
> security-admin/db/sqlserver/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/src/main/java/org/apache/ranger/biz/SecurityZoneDBStore.java 5499ea7c0
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 1d341c56f
> security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
> security-admin/src/main/java/org/apache/ranger/entity/XXSecurityZone.java eccff5feb
> security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java 3c1b1d2ee
> security-admin/src/main/java/org/apache/ranger/service/RangerPolicyServiceBase.java c18759a5d
> security-admin/src/main/resources/META-INF/jpa_named_queries.xml 18dc5fe48
> security-admin/src/test/java/org/apache/ranger/biz/TestSecurityZoneDBStore.java ecd120eef
> security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java 88a563b6d
>
>
> Diff: https://reviews.apache.org/r/70426/diff/5/
>
>
> Testing
> -------
>
> Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/
-----------------------------------------------------------
(Updated April 17, 2019, 4:28 p.m.)
Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
Changes
-------
Addressed review comments
Bugs: RANGER-2400
https://issues.apache.org/jira/browse/RANGER-2400
Repository: ranger
Description
-------
Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/plugin/model/RangerSecurityZone.java c3e96bf60
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 707c3119a
security-admin/db/mysql/patches/037-create-security-zone-schema.sql a50ec0e34
security-admin/db/mysql/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql e7d89898f
security-admin/db/oracle/patches/037-create-security-zone-schema.sql 354c74dd4
security-admin/db/oracle/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql a1998fc3e
security-admin/db/postgres/patches/037-create-security-zone-schema.sql 434231dd6
security-admin/db/postgres/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql 207c5a3a5
security-admin/db/sqlanywhere/patches/037-create-security-zone-schema.sql 893d453e6
security-admin/db/sqlanywhere/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql 36aefcff6
security-admin/db/sqlserver/patches/037-create-security-zone-schema.sql a610b70b1
security-admin/db/sqlserver/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/src/main/java/org/apache/ranger/biz/SecurityZoneDBStore.java 5499ea7c0
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 1d341c56f
security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
security-admin/src/main/java/org/apache/ranger/entity/XXSecurityZone.java eccff5feb
security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java 3c1b1d2ee
security-admin/src/main/java/org/apache/ranger/service/RangerPolicyServiceBase.java c18759a5d
security-admin/src/main/resources/META-INF/jpa_named_queries.xml 18dc5fe48
security-admin/src/test/java/org/apache/ranger/biz/TestSecurityZoneDBStore.java ecd120eef
security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java 88a563b6d
security-admin/src/test/java/org/apache/ranger/service/TestRangerPolicyServiceBase.java c32422ef4
Diff: https://reviews.apache.org/r/70426/diff/6/
Changes: https://reviews.apache.org/r/70426/diff/5-6/
Testing
-------
Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
Thanks,
Abhay Kulkarni
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/
-----------------------------------------------------------
(Updated April 17, 2019, 4:24 a.m.)
Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
Changes
-------
Addressed review comments
Bugs: RANGER-2400
https://issues.apache.org/jira/browse/RANGER-2400
Repository: ranger
Description
-------
Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/plugin/model/RangerSecurityZone.java c3e96bf60
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 707c3119a
security-admin/db/mysql/patches/037-create-security-zone-schema.sql a50ec0e34
security-admin/db/mysql/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql e7d89898f
security-admin/db/oracle/patches/037-create-security-zone-schema.sql 354c74dd4
security-admin/db/oracle/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql a1998fc3e
security-admin/db/postgres/patches/037-create-security-zone-schema.sql 434231dd6
security-admin/db/postgres/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql 207c5a3a5
security-admin/db/sqlanywhere/patches/037-create-security-zone-schema.sql 893d453e6
security-admin/db/sqlanywhere/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql 36aefcff6
security-admin/db/sqlserver/patches/037-create-security-zone-schema.sql a610b70b1
security-admin/db/sqlserver/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/src/main/java/org/apache/ranger/biz/SecurityZoneDBStore.java 5499ea7c0
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 1d341c56f
security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
security-admin/src/main/java/org/apache/ranger/entity/XXSecurityZone.java eccff5feb
security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java 3c1b1d2ee
security-admin/src/main/java/org/apache/ranger/service/RangerPolicyServiceBase.java c18759a5d
security-admin/src/main/resources/META-INF/jpa_named_queries.xml 18dc5fe48
security-admin/src/test/java/org/apache/ranger/biz/TestSecurityZoneDBStore.java ecd120eef
security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java 88a563b6d
Diff: https://reviews.apache.org/r/70426/diff/5/
Changes: https://reviews.apache.org/r/70426/diff/4-5/
Testing
-------
Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
Thanks,
Abhay Kulkarni
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/#review214712
-----------------------------------------------------------
Fix it, then Ship it!
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
Line 1849 (original), 1850 (patched)
<https://reviews.apache.org/r/70426/#comment300932>
zoneId should be initialized to RangerSecurityZone.RANGER_UNZONED_SECURITY_ZONE_ID, to avoid NULL being sent down to DB query from line #1860.
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
Lines 4343 (patched)
<https://reviews.apache.org/r/70426/#comment300933>
Consider removing this commented code block.
- Madhan Neethiraj
On April 16, 2019, 5:26 p.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70426/
> -----------------------------------------------------------
>
> (Updated April 16, 2019, 5:26 p.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2400
> https://issues.apache.org/jira/browse/RANGER-2400
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/model/RangerSecurityZone.java 547e2d204
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
> agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
> agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
> security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 0a529b412
> security-admin/db/mysql/patches/037-create-security-zone-schema.sql aff9786c0
> security-admin/db/mysql/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql 9be7e8db9
> security-admin/db/oracle/patches/037-create-security-zone-schema.sql aae31dc11
> security-admin/db/oracle/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql ec39c3242
> security-admin/db/postgres/patches/037-create-security-zone-schema.sql 4a94d26d3
> security-admin/db/postgres/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql abfe12058
> security-admin/db/sqlanywhere/patches/037-create-security-zone-schema.sql 5b7daded2
> security-admin/db/sqlanywhere/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql 1e8dff9f9
> security-admin/db/sqlserver/patches/037-create-security-zone-schema.sql e621b43df
> security-admin/db/sqlserver/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/src/main/java/org/apache/ranger/biz/SecurityZoneDBStore.java 5499ea7c0
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 1d341c56f
> security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
> security-admin/src/main/java/org/apache/ranger/entity/XXSecurityZone.java eccff5feb
> security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java ec69d6e3a
> security-admin/src/main/resources/META-INF/jpa_named_queries.xml 7e702c144
> security-admin/src/test/java/org/apache/ranger/biz/TestSecurityZoneDBStore.java ecd120eef
> security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java 88a563b6d
>
>
> Diff: https://reviews.apache.org/r/70426/diff/4/
>
>
> Testing
> -------
>
> Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/
-----------------------------------------------------------
(Updated April 16, 2019, 5:26 p.m.)
Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
Changes
-------
As sqlanywhere database does not allow any null-valued column in a composite unique key, the patch is updated to have a hard-coded security zone representing "unzoned" zone created at Ranger admin initialization time. The only purpose for having this zone is to ensure that the zone_id field in x_policy table is never null.
Bugs: RANGER-2400
https://issues.apache.org/jira/browse/RANGER-2400
Repository: ranger
Description
-------
Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/plugin/model/RangerSecurityZone.java 547e2d204
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 0a529b412
security-admin/db/mysql/patches/037-create-security-zone-schema.sql aff9786c0
security-admin/db/mysql/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql 9be7e8db9
security-admin/db/oracle/patches/037-create-security-zone-schema.sql aae31dc11
security-admin/db/oracle/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql ec39c3242
security-admin/db/postgres/patches/037-create-security-zone-schema.sql 4a94d26d3
security-admin/db/postgres/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql abfe12058
security-admin/db/sqlanywhere/patches/037-create-security-zone-schema.sql 5b7daded2
security-admin/db/sqlanywhere/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql 1e8dff9f9
security-admin/db/sqlserver/patches/037-create-security-zone-schema.sql e621b43df
security-admin/db/sqlserver/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/src/main/java/org/apache/ranger/biz/SecurityZoneDBStore.java 5499ea7c0
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 1d341c56f
security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
security-admin/src/main/java/org/apache/ranger/entity/XXSecurityZone.java eccff5feb
security-admin/src/main/java/org/apache/ranger/rest/SecurityZoneREST.java ec69d6e3a
security-admin/src/main/resources/META-INF/jpa_named_queries.xml 7e702c144
security-admin/src/test/java/org/apache/ranger/biz/TestSecurityZoneDBStore.java ecd120eef
security-admin/src/test/java/org/apache/ranger/rest/TestSecurityZoneREST.java 88a563b6d
Diff: https://reviews.apache.org/r/70426/diff/4/
Changes: https://reviews.apache.org/r/70426/diff/3-4/
Testing
-------
Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
Thanks,
Abhay Kulkarni
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/
-----------------------------------------------------------
(Updated April 10, 2019, 3:58 p.m.)
Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
Changes
-------
Cleaned up SQL scripts
Bugs: RANGER-2400
https://issues.apache.org/jira/browse/RANGER-2400
Repository: ranger
Description
-------
Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 2eaffccac
security-admin/db/mysql/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql 5ca1e3667
security-admin/db/oracle/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql 51f4999f7
security-admin/db/postgres/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql 5f64a2dba
security-admin/db/sqlanywhere/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql fc21cec3e
security-admin/db/sqlserver/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 574166c3d
security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java 0af7a1da2
security-admin/src/main/resources/META-INF/jpa_named_queries.xml 7e702c144
Diff: https://reviews.apache.org/r/70426/diff/3/
Changes: https://reviews.apache.org/r/70426/diff/2-3/
Testing
-------
Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
Thanks,
Abhay Kulkarni
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/#review214479
-----------------------------------------------------------
Ship it!
Ship It!
- Madhan Neethiraj
On April 8, 2019, 10:48 p.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70426/
> -----------------------------------------------------------
>
> (Updated April 8, 2019, 10:48 p.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2400
> https://issues.apache.org/jira/browse/RANGER-2400
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
> agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
> agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
> security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 2eaffccac
> security-admin/db/mysql/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql 5ca1e3667
> security-admin/db/oracle/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql 51f4999f7
> security-admin/db/postgres/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql 5f64a2dba
> security-admin/db/sqlanywhere/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql fc21cec3e
> security-admin/db/sqlserver/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 574166c3d
> security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
> security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java 0af7a1da2
> security-admin/src/main/resources/META-INF/jpa_named_queries.xml 7e702c144
>
>
> Diff: https://reviews.apache.org/r/70426/diff/2/
>
>
> Testing
> -------
>
> Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
>
>
> Thanks,
>
> Abhay Kulkarni
>
>
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Abhay Kulkarni <ak...@hortonworks.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/
-----------------------------------------------------------
(Updated April 8, 2019, 10:48 p.m.)
Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
Changes
-------
Addressed review comments
Bugs: RANGER-2400
https://issues.apache.org/jira/browse/RANGER-2400
Repository: ranger
Description
-------
Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
Diffs (updated)
-----
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 2eaffccac
security-admin/db/mysql/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql 5ca1e3667
security-admin/db/oracle/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql 51f4999f7
security-admin/db/postgres/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql 5f64a2dba
security-admin/db/sqlanywhere/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql fc21cec3e
security-admin/db/sqlserver/patches/040-modify-unique-constraint-on-policy-table.sql PRE-CREATION
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 574166c3d
security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java 0af7a1da2
security-admin/src/main/resources/META-INF/jpa_named_queries.xml 7e702c144
Diff: https://reviews.apache.org/r/70426/diff/2/
Changes: https://reviews.apache.org/r/70426/diff/1-2/
Testing
-------
Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
Thanks,
Abhay Kulkarni
Re: Review Request 70426: RANGER-2400: policy name needs to be unique
within security zone and service
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70426/#review214472
-----------------------------------------------------------
security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
Lines 1854 (patched)
<https://reviews.apache.org/r/70426/#comment300675>
"service-def does not exist" ==> "zone does not exist"
security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java
Lines 58 (patched)
<https://reviews.apache.org/r/70426/#comment300676>
It is a valid condition to have multiple policies for a given combination of serviceId and policyName; consider this:
serviceId=1, policyName="test-policy", zoneId=
serviceId=1, policyName="test-policy", zoneId=1
serviceId=1, policyName="test-policy", zoneId=2
Consider adding a named-query which looks only for unzoned policy:
<named-query name="XXPolicy.findUnzonedByNameAndServiceId">
<query>select obj from XXPolicy obj where obj.name = :polName and obj.service = :serviceId and obj.zoneId is null order by obj.id</query>
</named-query>
- Madhan Neethiraj
On April 8, 2019, 6:46 p.m., Abhay Kulkarni wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/70426/
> -----------------------------------------------------------
>
> (Updated April 8, 2019, 6:46 p.m.)
>
>
> Review request for ranger, Madhan Neethiraj, Mehul Parikh, Nikhil P, Pradeep Agrawal, Ramesh Mani, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-2400
> https://issues.apache.org/jira/browse/RANGER-2400
>
>
> Repository: ranger
>
>
> Description
> -------
>
> Ranger enforces uniqueness of policy name within a service. However, with introduction of security zones, policy name needs to be unique within a security zone and a service. This will obviate the need for inventing unique policy names if the policy is associated with the same service but different security zones, as well as present security zone as a namespace in Ranger admin as it does for making authorization decisions.
>
>
> Diffs
> -----
>
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerPolicyValidator.java 710e75d57
> agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerValidator.java fa50ab2d6
> agents-common/src/main/java/org/apache/ranger/plugin/store/ServiceStore.java 9e37cd550
> agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerPolicyValidator.java 8cdb9c3a6
> security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 2eaffccac
> security-admin/db/mysql/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql 5ca1e3667
> security-admin/db/oracle/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql 51f4999f7
> security-admin/db/postgres/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql 5f64a2dba
> security-admin/db/sqlanywhere/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql fc21cec3e
> security-admin/db/sqlserver/patches/041-modify-unique-constraint-on-policy-table.sql PRE-CREATION
> security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 574166c3d
> security-admin/src/main/java/org/apache/ranger/db/XXPolicyDao.java 2a870efaa
> security-admin/src/main/java/org/apache/ranger/patch/PatchMigration_J10002.java 0af7a1da2
> security-admin/src/main/resources/META-INF/jpa_named_queries.xml 7e702c144
>
>
> Diff: https://reviews.apache.org/r/70426/diff/1/
>
>
> Testing
> -------
>
> Created security zone and ensured that the default policies created within zone have same names as corresponding default policies in unzoned zone. Ensured that within same zone (including unzoned zone), two policies with same name cannot be created.
>
>
> Thanks,
>
> Abhay Kulkarni
>
>