You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by GitBox <gi...@apache.org> on 2022/05/12 23:22:14 UTC
[GitHub] [ozone] aswinshakil opened a new pull request, #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
aswinshakil opened a new pull request, #3408:
URL: https://github.com/apache/ozone/pull/3408
## What changes were proposed in this pull request?
- Add implementation of `MultiTenantAccessController` using the [Ranger client](https://github.com/apache/ranger/tree/master/intg/src/main/java) instead of HTTP REST calls.
- Remove the `MultiTenantAccessController` REST implementation for now. If the Ranger client turns out not to be ready yet we can finish the REST implementation and continue using it.
- Add an `InMemoryMultiTenantAccessController` for testing that simulates Ranger by storing state in memory.
- Add/modify operations in `MultiTenantAccessController` to support only our current needs from Ranger.
## What is the link to the Apache JIRA
HDDS-5836
## How was this patch tested?
- [x] Test of interface and builders added using the in memory controller.
- [x] Running the tests in a live secure cluster using the Ranger client controller.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877149379
##########
hadoop-ozone/dist/src/main/license/jar-report.txt:
##########
@@ -25,33 +29,43 @@ share/ozone/lib/commons-configuration2.jar
share/ozone/lib/commons-daemon.jar
share/ozone/lib/commons-digester.jar
share/ozone/lib/commons-io.jar
+share/ozone/lib/commons-lang.jar
share/ozone/lib/commons-lang3.jar
share/ozone/lib/commons-logging.jar
share/ozone/lib/commons-math3.jar
share/ozone/lib/commons-net.jar
share/ozone/lib/commons-pool2.jar
share/ozone/lib/commons-text.jar
share/ozone/lib/commons-validator.jar
+share/ozone/lib/compiler.jar
share/ozone/lib/derby.jar
share/ozone/lib/disruptor.jar
share/ozone/lib/dnsjava.jar
+share/ozone/lib/elasticsearch-cli.jar
+share/ozone/lib/elasticsearch-core.jar
+share/ozone/lib/elasticsearch-geo.jar
+share/ozone/lib/elasticsearch-rest-client.jar
+share/ozone/lib/elasticsearch-rest-high-level-client.jar
+share/ozone/lib/elasticsearch-secure-sm.jar
+share/ozone/lib/elasticsearch-x-content.jar
+share/ozone/lib/elasticsearch.jar
share/ozone/lib/error_prone_annotations.jar
share/ozone/lib/failureaccess.jar
-share/ozone/lib/FastInfoset.jar
+share/ozone/lib/gethostname4j.jar
share/ozone/lib/grpc-api.jar
share/ozone/lib/grpc-context.jar
share/ozone/lib/grpc-core.jar
share/ozone/lib/grpc-netty.jar
-share/ozone/lib/grpc-protobuf.jar
share/ozone/lib/grpc-protobuf-lite.jar
+share/ozone/lib/grpc-protobuf.jar
share/ozone/lib/grpc-stub.jar
share/ozone/lib/gson.jar
share/ozone/lib/guava-jre.jar
share/ozone/lib/guice-assistedinject.jar
share/ozone/lib/guice-bridge.jar
-share/ozone/lib/guice.jar
share/ozone/lib/guice-multibindings.jar
share/ozone/lib/guice-servlet.jar
+share/ozone/lib/guice.jar
Review Comment:
nit: can we avoid re-ordering the lines that indicates the same jar and keep only the lines added (or removed if any)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877173372
##########
hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/multitenant/InMemoryMultiTenantAccessController.java:
##########
@@ -0,0 +1,154 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.ozone.om.multitenant;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * In Memory version of MultiTenantAccessController.
+ */
+public class InMemoryMultiTenantAccessController
+ implements MultiTenantAccessController {
+
+ private final Map<String, Policy> policies;
+ private final Map<String, Role> roles;
Review Comment:
nit
```suggestion
private final Map<String, Policy> policies;
private final Map<String, Role> roles;
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877151799
##########
hadoop-ozone/ozone-manager/pom.xml:
##########
@@ -144,6 +144,24 @@ https://maven.apache.org/xsd/maven-4.0.0.xsd">
<version>0.9.11</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.ranger</groupId>
+ <artifactId>ranger-intg</artifactId>
+ <version>3.0.0-SNAPSHOT</version>
Review Comment:
IIRC the feature we need will also be released in Ranger 2.3.0. If there is a 2.3.0-SNAPSHOT jar, can we use that (and try it) instead?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] errose28 commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
errose28 commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877298803
##########
hadoop-ozone/ozone-manager/pom.xml:
##########
@@ -144,6 +144,24 @@ https://maven.apache.org/xsd/maven-4.0.0.xsd">
<version>0.9.11</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.ranger</groupId>
+ <artifactId>ranger-intg</artifactId>
+ <version>3.0.0-SNAPSHOT</version>
Review Comment:
I see that version on Ranger's ranger-2.3 release branch but it looks like it is not being published
```
[ERROR] Failed to execute goal on project ozone-manager: Could not resolve dependencies for project org.apache.ozone:ozone-manager:jar:1.3.0-SNAPSHOT: Could not find artifact org.apache.ranger:ranger-intg:jar:2.3.0-SNAPSHOT in apache.snapshots.https (https://repository.apache.org/content/repositories/snapshots) -> [Help 1]
```
FYI the Ranger 2.3.0 release is being tracked in this Jira: https://issues.apache.org/jira/browse/RANGER-3710
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877405791
##########
hadoop-ozone/ozone-manager/pom.xml:
##########
@@ -144,6 +144,24 @@ https://maven.apache.org/xsd/maven-4.0.0.xsd">
<version>0.9.11</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.ranger</groupId>
+ <artifactId>ranger-intg</artifactId>
+ <version>3.0.0-SNAPSHOT</version>
Review Comment:
Sounds good to me. We can keep 3.0.0-SNAPSHOT for now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877169862
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/multitenant/RangerClientMultiTenantAccessController.java:
##########
@@ -0,0 +1,314 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.ozone.om.multitenant;
+
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_RANGER_HTTPS_ADDRESS_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_RANGER_SERVICE;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.ozone.OmUtils;
+import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
+import org.apache.hadoop.security.SecurityUtil;
+import org.apache.http.auth.BasicUserPrincipal;
+import org.apache.ranger.RangerServiceException;
+import org.apache.ranger.plugin.model.RangerPolicy;
+import org.apache.ranger.plugin.model.RangerRole;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import org.apache.ranger.RangerClient;
+
+/**
+ * Implementation of {@link MultiTenantAccessController} using the
+ * {@link RangerClient} to communicate with Ranger.
+ */
+public class RangerClientMultiTenantAccessController implements
+ MultiTenantAccessController {
+
+ private static final Logger LOG = LoggerFactory
+ .getLogger(RangerClientMultiTenantAccessController.class);
+
+ private final RangerClient client;
+ private final String rangerServiceName;
+ private final Map<IAccessAuthorizer.ACLType, String> aclToString;
+ private final Map<String, IAccessAuthorizer.ACLType> stringToAcl;
+ private final String omPrincipal;
+
+ public RangerClientMultiTenantAccessController(OzoneConfiguration conf)
+ throws IOException {
+ aclToString = MultiTenantAccessController.getRangerAclStrings();
+ stringToAcl = new HashMap<>();
+ aclToString.forEach((type, string) -> stringToAcl.put(string, type));
+
+ // TODO: Double check configuration set up after HDDS-6612 is merged.
+ String rangerHttpsAddress = conf.get(OZONE_RANGER_HTTPS_ADDRESS_KEY);
+ rangerServiceName = conf.get(OZONE_RANGER_SERVICE);
+ String configuredOmPrincipal = conf.get(OZONE_OM_KERBEROS_PRINCIPAL_KEY);
+ // Replace _HOST pattern with host name in the Kerberos principal. Ranger
+ // client currently does not do this automatically.
+ omPrincipal = SecurityUtil.getServerPrincipal(
+ configuredOmPrincipal, OmUtils.getOmAddress(conf).getHostName());
+ String keytabPath = conf.get(OZONE_OM_KERBEROS_KEYTAB_FILE_KEY);
+
+ client = new RangerClient(rangerHttpsAddress,
+ "kerberos", omPrincipal, keytabPath, rangerServiceName, "ozone");
Review Comment:
nit
```suggestion
client = new RangerClient(rangerHttpsAddress, KERBEROS.name().toLowerCase(),
omPrincipal, keytabPath, rangerServiceName, OzoneConsts.OZONE);
```
(don't forget the imports)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] errose28 commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
errose28 commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877285747
##########
hadoop-ozone/dist/src/main/license/jar-report.txt:
##########
@@ -25,33 +29,43 @@ share/ozone/lib/commons-configuration2.jar
share/ozone/lib/commons-daemon.jar
share/ozone/lib/commons-digester.jar
share/ozone/lib/commons-io.jar
+share/ozone/lib/commons-lang.jar
share/ozone/lib/commons-lang3.jar
share/ozone/lib/commons-logging.jar
share/ozone/lib/commons-math3.jar
share/ozone/lib/commons-net.jar
share/ozone/lib/commons-pool2.jar
share/ozone/lib/commons-text.jar
share/ozone/lib/commons-validator.jar
+share/ozone/lib/compiler.jar
share/ozone/lib/derby.jar
share/ozone/lib/disruptor.jar
share/ozone/lib/dnsjava.jar
+share/ozone/lib/elasticsearch-cli.jar
+share/ozone/lib/elasticsearch-core.jar
+share/ozone/lib/elasticsearch-geo.jar
+share/ozone/lib/elasticsearch-rest-client.jar
+share/ozone/lib/elasticsearch-rest-high-level-client.jar
+share/ozone/lib/elasticsearch-secure-sm.jar
+share/ozone/lib/elasticsearch-x-content.jar
+share/ozone/lib/elasticsearch.jar
share/ozone/lib/error_prone_annotations.jar
share/ozone/lib/failureaccess.jar
-share/ozone/lib/FastInfoset.jar
+share/ozone/lib/gethostname4j.jar
share/ozone/lib/grpc-api.jar
share/ozone/lib/grpc-context.jar
share/ozone/lib/grpc-core.jar
share/ozone/lib/grpc-netty.jar
-share/ozone/lib/grpc-protobuf.jar
share/ozone/lib/grpc-protobuf-lite.jar
+share/ozone/lib/grpc-protobuf.jar
share/ozone/lib/grpc-stub.jar
share/ozone/lib/gson.jar
share/ozone/lib/guava-jre.jar
share/ozone/lib/guice-assistedinject.jar
share/ozone/lib/guice-bridge.jar
-share/ozone/lib/guice.jar
share/ozone/lib/guice-multibindings.jar
share/ozone/lib/guice-servlet.jar
+share/ozone/lib/guice.jar
Review Comment:
This file is updated automatically by running `update-jar-report.sh`. I believe the order changes due to system specific implementations of `sort`, which determines things like whether of not `share/ozone/lib/guice.jar` comes before or after `share/ozone/lib/guice-multibindings.jar`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl commented on pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl commented on PR #3408:
URL: https://github.com/apache/ozone/pull/3408#issuecomment-1133191968
Thanks @errose28 and @aswinshakil for working on this!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877156791
##########
hadoop-ozone/ozone-manager/pom.xml:
##########
@@ -144,6 +144,24 @@ https://maven.apache.org/xsd/maven-4.0.0.xsd">
<version>0.9.11</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.ranger</groupId>
+ <artifactId>ranger-intg</artifactId>
+ <version>3.0.0-SNAPSHOT</version>
+ <scope>compile</scope>
+ <!-- Workaround to prevent slf4j binding conflicts until ranger-intg is
+ fixed to not introduce this to the classpath -->
+ <exclusions>
+ <exclusion>
+ <groupId>ch.qos.logback</groupId>
+ <artifactId>logback-classic</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>com.sun.jersey</groupId>
+ <artifactId>jersey-bundle</artifactId>
+ </exclusion>
+ </exclusions>
Review Comment:
Are `elasticsearch` and `lucene` required, which seems to be introduced as transitive dependencies? If not we could exclude them as well?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl commented on a diff in pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl commented on code in PR #3408:
URL: https://github.com/apache/ozone/pull/3408#discussion_r877165112
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/multitenant/RangerClientMultiTenantAccessController.java:
##########
@@ -0,0 +1,314 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.ozone.om.multitenant;
+
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_KEYTAB_FILE_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_OM_KERBEROS_PRINCIPAL_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_RANGER_HTTPS_ADDRESS_KEY;
+import static org.apache.hadoop.ozone.om.OMConfigKeys.OZONE_RANGER_SERVICE;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.ozone.OmUtils;
+import org.apache.hadoop.ozone.security.acl.IAccessAuthorizer;
+import org.apache.hadoop.security.SecurityUtil;
+import org.apache.http.auth.BasicUserPrincipal;
+import org.apache.ranger.RangerServiceException;
+import org.apache.ranger.plugin.model.RangerPolicy;
+import org.apache.ranger.plugin.model.RangerRole;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import org.apache.ranger.RangerClient;
+
+/**
+ * Implementation of {@link MultiTenantAccessController} using the
+ * {@link RangerClient} to communicate with Ranger.
+ */
+public class RangerClientMultiTenantAccessController implements
+ MultiTenantAccessController {
+
+ private static final Logger LOG = LoggerFactory
+ .getLogger(RangerClientMultiTenantAccessController.class);
+
+ private final RangerClient client;
+ private final String rangerServiceName;
+ private final Map<IAccessAuthorizer.ACLType, String> aclToString;
+ private final Map<String, IAccessAuthorizer.ACLType> stringToAcl;
+ private final String omPrincipal;
+
+ public RangerClientMultiTenantAccessController(OzoneConfiguration conf)
+ throws IOException {
+ aclToString = MultiTenantAccessController.getRangerAclStrings();
+ stringToAcl = new HashMap<>();
+ aclToString.forEach((type, string) -> stringToAcl.put(string, type));
+
+ // TODO: Double check configuration set up after HDDS-6612 is merged.
Review Comment:
Now that HDDS-6612 is merged. Would you merge the feature branch into this PR and then revisit this comment?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] errose28 commented on pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
errose28 commented on PR #3408:
URL: https://github.com/apache/ozone/pull/3408#issuecomment-1126591553
Converting to draft while we debug some Recon dependency errors and update Jar report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] smengcl merged pull request #3408: HDDS-5836. [Multi-Tenant] Use Ranger java client.
Posted by GitBox <gi...@apache.org>.
smengcl merged PR #3408:
URL: https://github.com/apache/ozone/pull/3408
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org