You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by di...@apache.org on 2026/08/05 10:17:17 UTC
(ranger) branch master updated: RANGER-5724: Grant API returns 200 OK for null payload (#1123)
This is an automated email from the ASF dual-hosted git repository.
dineshkumar-yadav pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 59bf21d96 RANGER-5724: Grant API returns 200 OK for null payload (#1123)
59bf21d96 is described below
commit 59bf21d969d6bd75b1ad3c382bc87fdfac5759d3
Author: Sanket-Shelar <12...@users.noreply.github.com>
AuthorDate: Wed Aug 5 15:47:11 2026 +0530
RANGER-5724: Grant API returns 200 OK for null payload (#1123)
---
.../java/org/apache/ranger/rest/ServiceREST.java | 308 +++++++++++----------
.../org/apache/ranger/rest/TestServiceREST.java | 28 ++
2 files changed, 184 insertions(+), 152 deletions(-)
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
index ea76f5415..e75f1018c 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
@@ -1149,114 +1149,116 @@ public List<String> lookupResource(@PathParam("serviceName") String serviceName,
public RESTResponse grantAccess(@PathParam("serviceName") String serviceName, GrantRevokeRequest grantRequest, @Context HttpServletRequest request) throws Exception {
LOG.debug("==> ServiceREST.grantAccess({}, {})", serviceName, grantRequest);
+ if (grantRequest == null) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Grant request object is null or missing body in grant access api", false);
+ }
+
RESTResponse ret = new RESTResponse();
RangerPerfTracer perf = null;
- if (grantRequest != null) {
- if (serviceUtil.isValidateHttpsAuthentication(serviceName, request)) {
- try {
- bizUtil.failUnauthenticatedIfNotAllowed();
-
- if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.grantAccess(serviceName=" + serviceName + ")");
- }
+ if (serviceUtil.isValidateHttpsAuthentication(serviceName, request)) {
+ try {
+ bizUtil.failUnauthenticatedIfNotAllowed();
- // This is an open API - dont care about who calls it. Caller is treated as privileged user
- boolean hasAdminPrivilege = true;
- String loggedInUser = null;
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.grantAccess(serviceName=" + serviceName + ")");
+ }
- validateGrantRevokeRequest(grantRequest, hasAdminPrivilege, loggedInUser);
+ // This is an open API - dont care about who calls it. Caller is treated as privileged user
+ boolean hasAdminPrivilege = true;
+ String loggedInUser = null;
- String userName = grantRequest.getGrantor();
- Set<String> userGroups = CollectionUtils.isNotEmpty(grantRequest.getGrantorGroups()) ? grantRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
- String ownerUser = grantRequest.getOwnerUser();
- RangerAccessResource resource = new RangerAccessResourceImpl(getAccessResourceObjectMap(grantRequest.getResource()), ownerUser);
- Set<String> accessTypes = grantRequest.getAccessTypes();
- VXUser vxUser = xUserService.getXUserByUserName(userName);
+ validateGrantRevokeRequest(grantRequest, hasAdminPrivilege, loggedInUser);
- if (vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) || vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
- VXResponse vXResponse = new VXResponse();
+ String userName = grantRequest.getGrantor();
+ Set<String> userGroups = CollectionUtils.isNotEmpty(grantRequest.getGrantorGroups()) ? grantRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
+ String ownerUser = grantRequest.getOwnerUser();
+ RangerAccessResource resource = new RangerAccessResourceImpl(getAccessResourceObjectMap(grantRequest.getResource()), ownerUser);
+ Set<String> accessTypes = grantRequest.getAccessTypes();
+ VXUser vxUser = xUserService.getXUserByUserName(userName);
- vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
- vXResponse.setMsgDesc("Operation denied. LoggedInUser=" + vxUser.getId() + " is not permitted to perform the action.");
+ if (vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) || vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ VXResponse vXResponse = new VXResponse();
- throw restErrorUtil.generateRESTException(vXResponse);
- }
+ vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
+ vXResponse.setMsgDesc("Operation denied. LoggedInUser=" + vxUser.getId() + " is not permitted to perform the action.");
- RangerService rangerService = svcStore.getServiceByName(serviceName);
- String zoneName = getRangerAdminZoneName(serviceName, grantRequest);
- boolean isAdmin = bizUtil.isUserRangerAdmin(userName) || bizUtil.isUserServiceAdmin(rangerService, userName) || hasAdminAccess(serviceName, zoneName, userName, userGroups, resource, accessTypes);
+ throw restErrorUtil.generateRESTException(vXResponse);
+ }
- if (!isAdmin) {
- throw restErrorUtil.createGrantRevokeRESTException("User doesn't have necessary permission to grant access");
- }
+ RangerService rangerService = svcStore.getServiceByName(serviceName);
+ String zoneName = getRangerAdminZoneName(serviceName, grantRequest);
+ boolean isAdmin = bizUtil.isUserRangerAdmin(userName) || bizUtil.isUserServiceAdmin(rangerService, userName) || hasAdminAccess(serviceName, zoneName, userName, userGroups, resource, accessTypes);
- RangerPolicy policy = getExactMatchPolicyForResource(serviceName, resource, zoneName, userName);
+ if (!isAdmin) {
+ throw restErrorUtil.createGrantRevokeRESTException("User doesn't have necessary permission to grant access");
+ }
- if (policy != null) {
- boolean policyUpdated = ServiceRESTUtil.processGrantRequest(policy, grantRequest);
+ RangerPolicy policy = getExactMatchPolicyForResource(serviceName, resource, zoneName, userName);
- if (policyUpdated) {
- policy.setZoneName(zoneName);
+ if (policy != null) {
+ boolean policyUpdated = ServiceRESTUtil.processGrantRequest(policy, grantRequest);
- ensureAdminAccess(policy, userName);
+ if (policyUpdated) {
+ policy.setZoneName(zoneName);
- svcStore.updatePolicy(policy);
- } else {
- LOG.error("processGrantRequest processing failed");
+ ensureAdminAccess(policy, userName);
- throw new Exception("processGrantRequest processing failed");
- }
+ svcStore.updatePolicy(policy);
} else {
- policy = new RangerPolicy();
+ LOG.error("processGrantRequest processing failed");
- policy.setService(serviceName);
- policy.setName("grant-" + System.currentTimeMillis()); // TODO: better policy name
- policy.setDescription("created by grant");
- policy.setIsAuditEnabled(grantRequest.getEnableAudit());
- policy.setCreatedBy(userName);
+ throw new Exception("processGrantRequest processing failed");
+ }
+ } else {
+ policy = new RangerPolicy();
- Map<String, RangerPolicyResource> policyResources = new HashMap<>();
- Set<String> resourceNames = resource.getKeys();
+ policy.setService(serviceName);
+ policy.setName("grant-" + System.currentTimeMillis()); // TODO: better policy name
+ policy.setDescription("created by grant");
+ policy.setIsAuditEnabled(grantRequest.getEnableAudit());
+ policy.setCreatedBy(userName);
- if (!CollectionUtils.isEmpty(resourceNames)) {
- for (String resourceName : resourceNames) {
- policyResources.put(resourceName, getPolicyResource(resource.getValue(resourceName), grantRequest));
- }
- }
+ Map<String, RangerPolicyResource> policyResources = new HashMap<>();
+ Set<String> resourceNames = resource.getKeys();
- policy.setResources(policyResources);
+ if (!CollectionUtils.isEmpty(resourceNames)) {
+ for (String resourceName : resourceNames) {
+ policyResources.put(resourceName, getPolicyResource(resource.getValue(resourceName), grantRequest));
+ }
+ }
- RangerPolicyItem policyItem = new RangerPolicyItem();
+ policy.setResources(policyResources);
- policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
- policyItem.addUsers(grantRequest.getUsers());
- policyItem.addGroups(grantRequest.getGroups());
- policyItem.addRoles(grantRequest.getRoles());
+ RangerPolicyItem policyItem = new RangerPolicyItem();
- for (String accessType : grantRequest.getAccessTypes()) {
- policyItem.addAccess(new RangerPolicyItemAccess(accessType, Boolean.TRUE));
- }
+ policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
+ policyItem.addUsers(grantRequest.getUsers());
+ policyItem.addGroups(grantRequest.getGroups());
+ policyItem.addRoles(grantRequest.getRoles());
- policy.addPolicyItem(policyItem);
- policy.setZoneName(zoneName);
+ for (String accessType : grantRequest.getAccessTypes()) {
+ policyItem.addAccess(new RangerPolicyItemAccess(accessType, Boolean.TRUE));
+ }
- ensureAdminAccess(policy, userName);
+ policy.addPolicyItem(policyItem);
+ policy.setZoneName(zoneName);
- svcStore.createPolicy(policy);
- }
- } catch (WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("grantAccess({}, {}) failed", serviceName, grantRequest, excp);
+ ensureAdminAccess(policy, userName);
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
+ svcStore.createPolicy(policy);
}
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("grantAccess({}, {}) failed", serviceName, grantRequest, excp);
- ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
+ throw restErrorUtil.createRESTException(excp.getMessage());
+ } finally {
+ RangerPerfTracer.log(perf);
}
+
+ ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
}
LOG.debug("<== ServiceREST.grantAccess({}, {}) :{}", serviceName, grantRequest, ret);
@@ -1271,114 +1273,116 @@ public RESTResponse grantAccess(@PathParam("serviceName") String serviceName, Gr
public RESTResponse secureGrantAccess(@PathParam("serviceName") String serviceName, GrantRevokeRequest grantRequest, @Context HttpServletRequest request) throws Exception {
LOG.debug("==> ServiceREST.secureGrantAccess({}, {})", serviceName, grantRequest);
+ if (grantRequest == null) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Grant request object is null or missing body in grant access api", false);
+ }
+
RESTResponse ret = new RESTResponse();
RangerPerfTracer perf = null;
bizUtil.blockAuditorRoleUser();
- if (grantRequest != null) {
- if (serviceUtil.isValidService(serviceName, request)) {
- try {
- if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.scureGrantAccess(serviceName=" + serviceName + ")");
- }
+ if (serviceUtil.isValidService(serviceName, request)) {
+ try {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.scureGrantAccess(serviceName=" + serviceName + ")");
+ }
- XXService xService = daoManager.getXXService().findByName(serviceName);
- XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
- RangerService rangerService = svcStore.getServiceByName(serviceName);
- String loggedInUser = bizUtil.getCurrentUserLoginId();
- boolean hasAdminPrivilege = bizUtil.isAdmin() || bizUtil.isUserServiceAdmin(rangerService, loggedInUser) || bizUtil.isUserAllowedForGrantRevoke(rangerService, loggedInUser);
+ XXService xService = daoManager.getXXService().findByName(serviceName);
+ XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
+ RangerService rangerService = svcStore.getServiceByName(serviceName);
+ String loggedInUser = bizUtil.getCurrentUserLoginId();
+ boolean hasAdminPrivilege = bizUtil.isAdmin() || bizUtil.isUserServiceAdmin(rangerService, loggedInUser) || bizUtil.isUserAllowedForGrantRevoke(rangerService, loggedInUser);
- validateGrantRevokeRequest(grantRequest, hasAdminPrivilege, loggedInUser);
+ validateGrantRevokeRequest(grantRequest, hasAdminPrivilege, loggedInUser);
- String userName = grantRequest.getGrantor();
- Set<String> userGroups = grantRequest.getGrantorGroups();
- String ownerUser = grantRequest.getOwnerUser();
- RangerAccessResource resource = new RangerAccessResourceImpl(getAccessResourceObjectMap(grantRequest.getResource()), ownerUser);
- Set<String> accessTypes = grantRequest.getAccessTypes();
- String zoneName = getRangerAdminZoneName(serviceName, grantRequest);
- boolean isAllowed = false;
+ String userName = grantRequest.getGrantor();
+ Set<String> userGroups = grantRequest.getGrantorGroups();
+ String ownerUser = grantRequest.getOwnerUser();
+ RangerAccessResource resource = new RangerAccessResourceImpl(getAccessResourceObjectMap(grantRequest.getResource()), ownerUser);
+ Set<String> accessTypes = grantRequest.getAccessTypes();
+ String zoneName = getRangerAdminZoneName(serviceName, grantRequest);
+ boolean isAllowed = false;
- if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
- if (bizUtil.isKeyAdmin() || bizUtil.isUserAllowedForGrantRevoke(rangerService, loggedInUser)) {
- isAllowed = true;
- }
- } else {
- isAllowed = bizUtil.isUserRangerAdmin(userName) || bizUtil.isUserServiceAdmin(rangerService, userName) || hasAdminAccess(serviceName, zoneName, userName, userGroups, resource, accessTypes);
+ if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
+ if (bizUtil.isKeyAdmin() || bizUtil.isUserAllowedForGrantRevoke(rangerService, loggedInUser)) {
+ isAllowed = true;
}
+ } else {
+ isAllowed = bizUtil.isUserRangerAdmin(userName) || bizUtil.isUserServiceAdmin(rangerService, userName) || hasAdminAccess(serviceName, zoneName, userName, userGroups, resource, accessTypes);
+ }
- if (isAllowed) {
- RangerPolicy policy = getExactMatchPolicyForResource(serviceName, resource, zoneName, userName);
-
- if (policy != null) {
- boolean policyUpdated = ServiceRESTUtil.processGrantRequest(policy, grantRequest);
+ if (isAllowed) {
+ RangerPolicy policy = getExactMatchPolicyForResource(serviceName, resource, zoneName, userName);
- if (policyUpdated) {
- policy.setZoneName(zoneName);
+ if (policy != null) {
+ boolean policyUpdated = ServiceRESTUtil.processGrantRequest(policy, grantRequest);
- ensureAdminAccess(policy, userName);
+ if (policyUpdated) {
+ policy.setZoneName(zoneName);
- svcStore.updatePolicy(policy);
- } else {
- LOG.error("processSecureGrantRequest processing failed");
+ ensureAdminAccess(policy, userName);
- throw new Exception("processSecureGrantRequest processing failed");
- }
+ svcStore.updatePolicy(policy);
} else {
- policy = new RangerPolicy();
+ LOG.error("processSecureGrantRequest processing failed");
- policy.setService(serviceName);
- policy.setName("grant-" + System.currentTimeMillis()); // TODO: better policy name
- policy.setDescription("created by grant");
- policy.setIsAuditEnabled(grantRequest.getEnableAudit());
- policy.setCreatedBy(userName);
+ throw new Exception("processSecureGrantRequest processing failed");
+ }
+ } else {
+ policy = new RangerPolicy();
- Map<String, RangerPolicyResource> policyResources = new HashMap<>();
- Set<String> resourceNames = resource.getKeys();
+ policy.setService(serviceName);
+ policy.setName("grant-" + System.currentTimeMillis()); // TODO: better policy name
+ policy.setDescription("created by grant");
+ policy.setIsAuditEnabled(grantRequest.getEnableAudit());
+ policy.setCreatedBy(userName);
- if (!CollectionUtils.isEmpty(resourceNames)) {
- for (String resourceName : resourceNames) {
- policyResources.put(resourceName, getPolicyResource(resource.getValue(resourceName), grantRequest));
- }
- }
+ Map<String, RangerPolicyResource> policyResources = new HashMap<>();
+ Set<String> resourceNames = resource.getKeys();
- policy.setResources(policyResources);
+ if (!CollectionUtils.isEmpty(resourceNames)) {
+ for (String resourceName : resourceNames) {
+ policyResources.put(resourceName, getPolicyResource(resource.getValue(resourceName), grantRequest));
+ }
+ }
- RangerPolicyItem policyItem = new RangerPolicyItem();
+ policy.setResources(policyResources);
- policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
- policyItem.addUsers(grantRequest.getUsers());
- policyItem.addGroups(grantRequest.getGroups());
- policyItem.addRoles(grantRequest.getRoles());
+ RangerPolicyItem policyItem = new RangerPolicyItem();
- for (String accessType : grantRequest.getAccessTypes()) {
- policyItem.addAccess(new RangerPolicyItemAccess(accessType, Boolean.TRUE));
- }
+ policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
+ policyItem.addUsers(grantRequest.getUsers());
+ policyItem.addGroups(grantRequest.getGroups());
+ policyItem.addRoles(grantRequest.getRoles());
- policy.addPolicyItem(policyItem);
- policy.setZoneName(zoneName);
+ for (String accessType : grantRequest.getAccessTypes()) {
+ policyItem.addAccess(new RangerPolicyItemAccess(accessType, Boolean.TRUE));
+ }
- ensureAdminAccess(policy, userName);
+ policy.addPolicyItem(policyItem);
+ policy.setZoneName(zoneName);
- svcStore.createPolicy(policy);
- }
- } else {
- LOG.error("secureGrantAccess({}, {}) failed as User doesn't have permission to grant Policy", serviceName, grantRequest);
+ ensureAdminAccess(policy, userName);
- throw restErrorUtil.createGrantRevokeRESTException("User doesn't have necessary permission to grant access");
+ svcStore.createPolicy(policy);
}
- } catch (WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("secureGrantAccess({}, {}) failed", serviceName, grantRequest, excp);
+ } else {
+ LOG.error("secureGrantAccess({}, {}) failed as User doesn't have permission to grant Policy", serviceName, grantRequest);
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
+ throw restErrorUtil.createGrantRevokeRESTException("User doesn't have necessary permission to grant access");
}
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("secureGrantAccess({}, {}) failed", serviceName, grantRequest, excp);
- ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
+ throw restErrorUtil.createRESTException(excp.getMessage());
+ } finally {
+ RangerPerfTracer.log(perf);
}
+
+ ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
}
LOG.debug("<== ServiceREST.secureGrantAccess({}, {}) :{}", serviceName, grantRequest, ret);
diff --git a/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java b/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
index 125940347..4f26b13f3 100644
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
@@ -3914,6 +3914,34 @@ void test156GrantBlockedWhenUnauthenticatedAndFlagFalse() throws Exception {
Assertions.assertThrows(WebApplicationException.class, () -> serviceREST.grantAccess("HDFS_1", grantRequest, request));
}
+ @Test
+ void test157GrantAccessRejectsNullRequest() {
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+
+ Mockito.when(restErrorUtil.createRESTException(Mockito.eq(HttpServletResponse.SC_BAD_REQUEST), Mockito.anyString(), Mockito.eq(false)))
+ .thenReturn(new WebApplicationException());
+
+ Assertions.assertThrows(WebApplicationException.class, () -> serviceREST.grantAccess("cm_hive", null, request));
+
+ Mockito.verify(restErrorUtil).createRESTException(HttpServletResponse.SC_BAD_REQUEST,
+ "Grant request object is null or missing body in grant access api", false);
+ Mockito.verifyNoInteractions(serviceUtil);
+ }
+
+ @Test
+ void test158SecureGrantAccessRejectsNullRequest() {
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+
+ Mockito.when(restErrorUtil.createRESTException(Mockito.eq(HttpServletResponse.SC_BAD_REQUEST), Mockito.anyString(), Mockito.eq(false)))
+ .thenReturn(new WebApplicationException());
+
+ Assertions.assertThrows(WebApplicationException.class, () -> serviceREST.secureGrantAccess("cm_hive", null, request));
+
+ Mockito.verify(restErrorUtil).createRESTException(HttpServletResponse.SC_BAD_REQUEST,
+ "Grant request object is null or missing body in grant access api", false);
+ Mockito.verifyNoInteractions(bizUtil);
+ }
+
RangerPolicy rangerPolicy() {
List<RangerPolicyItemAccess> accesses = new ArrayList<>();
List<String> users = new ArrayList<>();