You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by pr...@apache.org on 2018/03/15 07:31:36 UTC
[2/4] ranger git commit: RANGER-1948 : Support for Read-only Ranger
Admin users
RANGER-1948 : Support for Read-only Ranger Admin users
Signed-off-by: pradeep <pr...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/ranger/commit/b068bfe5
Tree: http://git-wip-us.apache.org/repos/asf/ranger/tree/b068bfe5
Diff: http://git-wip-us.apache.org/repos/asf/ranger/diff/b068bfe5
Branch: refs/heads/master
Commit: b068bfe56a63d70f47982f6aa60ebc5c42317b73
Parents: 0b47455
Author: fatimaawez <fa...@gmail.com>
Authored: Tue Mar 13 18:11:54 2018 +0530
Committer: pradeep <pr...@apache.org>
Committed: Thu Mar 15 11:43:44 2018 +0530
----------------------------------------------------------------------
.../scripts/rolebasedusersearchutil.py | 2 +-
.../java/org/apache/ranger/biz/AssetMgr.java | 2 +-
.../java/org/apache/ranger/biz/KmsKeyMgr.java | 6 ++
.../org/apache/ranger/biz/RangerBizUtil.java | 90 +++++++++++++---
.../org/apache/ranger/biz/ServiceDBStore.java | 34 +++---
.../java/org/apache/ranger/biz/ServiceMgr.java | 7 +-
.../java/org/apache/ranger/biz/SessionMgr.java | 16 +++
.../java/org/apache/ranger/biz/UserMgr.java | 35 +++++--
.../java/org/apache/ranger/biz/XAuditMgr.java | 7 +-
.../java/org/apache/ranger/biz/XUserMgr.java | 36 +++++++
.../apache/ranger/common/RangerConstants.java | 2 +
.../apache/ranger/common/UserSessionBase.java | 17 +++
.../patch/cliutil/RoleBasedUserSearchUtil.java | 54 +++++++---
.../java/org/apache/ranger/rest/AssetREST.java | 3 +-
.../org/apache/ranger/rest/ServiceREST.java | 104 ++++++++++++++++---
.../java/org/apache/ranger/rest/XUserREST.java | 9 ++
.../context/RangerPreAuthSecurityHandler.java | 3 +
.../apache/ranger/service/XTrxLogService.java | 12 ++-
.../conf.dist/ranger-admin-default-site.xml | 2 +-
.../java/org/apache/ranger/biz/TestUserMgr.java | 23 ++--
unixauthservice/scripts/install.properties | 1 +
21 files changed, 376 insertions(+), 89 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/scripts/rolebasedusersearchutil.py
----------------------------------------------------------------------
diff --git a/security-admin/scripts/rolebasedusersearchutil.py b/security-admin/scripts/rolebasedusersearchutil.py
index d651461..23e0839 100644
--- a/security-admin/scripts/rolebasedusersearchutil.py
+++ b/security-admin/scripts/rolebasedusersearchutil.py
@@ -36,7 +36,7 @@ os_name = os_name.upper()
msgPrompt = "Enter the below options"
msgCommand = "Usage : python rolebasedusersearchutil.py -u <userName> -p <password> -r <role>"
-msgRoleList = " <role> can be ROLE_USER/ROLE_SYS_ADMIN/ROLE_KEY_ADMIN"
+msgRoleList = " <role> can be ROLE_USER/ROLE_SYS_ADMIN/ROLE_KEY_ADMIN/ROLE_ADMIN_AUDITOR/ROLE_KEY_ADMIN_AUDITOR"
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java
index 15937c7..941691a 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java
@@ -884,7 +884,7 @@ public class AssetMgr extends AssetMgrBase {
}
public VXTrxLogList getReportLogs(SearchCriteria searchCriteria) {
- if (xaBizUtil.isAdmin() || xaBizUtil.isKeyAdmin()) {
+ if (xaBizUtil.isAdmin() || xaBizUtil.isKeyAdmin() || xaBizUtil.isAuditAdmin() || xaBizUtil.isAuditKeyAdmin()) {
if (searchCriteria == null) {
searchCriteria = new SearchCriteria();
}
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java
index 03bcb60..84cee5c 100755
--- a/security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/KmsKeyMgr.java
@@ -107,6 +107,9 @@ public class KmsKeyMgr {
@Autowired
RangerDaoManagerBase rangerDaoManagerBase;
+ @Autowired
+ RangerBizUtil rangerBizUtil;
+
@SuppressWarnings("unchecked")
public VXKmsKeyList searchKeys(HttpServletRequest request, String repoName) throws Exception{
String providers[] = null;
@@ -217,6 +220,7 @@ public class KmsKeyMgr {
public VXKmsKey rolloverKey(String provider, VXKmsKey vXKey) throws Exception{
String providers[] = null;
+ rangerBizUtil.blockAuditorRoleUser();
try {
providers = getKMSURL(provider);
} catch (Exception e) {
@@ -272,6 +276,7 @@ public class KmsKeyMgr {
public void deleteKey(String provider, String name) throws Exception{
String providers[] = null;
+ rangerBizUtil.blockAuditorRoleUser();
try {
providers = getKMSURL(provider);
} catch (Exception e) {
@@ -322,6 +327,7 @@ public class KmsKeyMgr {
public VXKmsKey createKey(String provider, VXKmsKey vXKey) throws Exception{
String providers[] = null;
+ rangerBizUtil.blockAuditorRoleUser();
try {
providers = getKMSURL(provider);
} catch (Exception e) {
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
index 224f1a0..d7e9e33 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
@@ -23,6 +23,7 @@ import java.io.File;
import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.Arrays;
+import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
@@ -30,6 +31,7 @@ import java.util.List;
import java.util.Map;
import java.util.Set;
+import javax.servlet.http.HttpServletResponse;
import org.apache.commons.io.FilenameUtils;
import org.apache.commons.io.IOCase;
import org.apache.commons.lang.StringUtils;
@@ -543,6 +545,19 @@ public class RangerBizUtil {
return false;
}
+ public boolean isAuditAdmin() {
+ UserSessionBase currentUserSession = ContextUtil
+ .getCurrentUserSession();
+ if (currentUserSession == null) {
+ logger.debug("Unable to find session.");
+ return false;
+ }
+ if (currentUserSession.isAuditUserAdmin()) {
+ return true;
+ }
+ return false;
+ }
+
/**
* return username of currently logged in user
*
@@ -1421,6 +1436,17 @@ public class RangerBizUtil {
}
return false;
}
+ public boolean isAuditKeyAdmin() {
+ UserSessionBase currentUserSession = ContextUtil.getCurrentUserSession();
+ if (currentUserSession == null) {
+ logger.debug("Unable to find session.");
+ return false;
+ }
+ if (currentUserSession.isAuditKeyAdmin()) {
+ return true;
+ }
+ return false;
+ }
/**
* @param xxDbBase
@@ -1438,10 +1464,12 @@ public class RangerBizUtil {
boolean isKeyAdmin = session.isKeyAdmin();
boolean isSysAdmin = session.isUserAdmin();
+ boolean isAuditor = session.isAuditUserAdmin();
+ boolean isAduitorKeyAdmin = session.isAuditKeyAdmin();
boolean isUser = false;
List<String> roleList = session.getUserRoleList();
- if (roleList.contains(RangerConstants.ROLE_USER)) {
+ if (roleList.contains(RangerConstants.ROLE_USER) ) {
isUser = true;
}
@@ -1454,7 +1482,9 @@ public class RangerBizUtil {
if (isKeyAdmin && EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClass)) {
return true;
- } else if ((isSysAdmin || isUser) && !EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClass)) {
+ } else if (isAduitorKeyAdmin && EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClass)) {
+ return true;
+ } else if ((isSysAdmin || isUser || isAuditor) && !EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClass)) {
return true;
}
}
@@ -1463,7 +1493,7 @@ public class RangerBizUtil {
// TODO: As of now we are allowing SYS_ADMIN to create/update/read/delete all the
// services including KMS
- if (isSysAdmin) {
+ if (isSysAdmin || isAuditor) {
return true;
}
@@ -1476,6 +1506,8 @@ public class RangerBizUtil {
if (isKeyAdmin && EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClass)) {
return true;
+ } else if (isAduitorKeyAdmin && EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClass)) {
+ return true;
} else if (isUser && !EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClass)) {
return true;
}
@@ -1520,17 +1552,31 @@ public class RangerBizUtil {
}
public boolean checkUserAccessible(VXUser vXUser) {
- if(isKeyAdmin() && vXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN)) {
- throw restErrorUtil.createRESTException("Logged in user is not allowd to create/update user",
+ boolean isAccessible = true;
+ Collection<String> roleList = userMgr.getRolesByLoginId(vXUser
+ .getName());
+ if (isKeyAdmin()) {
+ if (vXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN)
+ || vXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)
+ || roleList.contains(RangerConstants.ROLE_SYS_ADMIN)
+ || roleList.contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ isAccessible = false;
+ }
+ }
+ if (isAdmin()) {
+ if (vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN)
+ || vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)
+ || roleList.contains(RangerConstants.ROLE_KEY_ADMIN)
+ || roleList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ isAccessible = false;
+ }
+ }
+ if (!isAccessible) {
+ throw restErrorUtil.createRESTException(
+ "Logged in user is not allowd to create/update user",
MessageEnums.OPER_NO_PERMISSION);
}
-
- if(isAdmin() && vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN)) {
- throw restErrorUtil.createRESTException("Logged in user is not allowd to create/update user",
- MessageEnums.OPER_NO_PERMISSION);
- }
-
- return true;
+ return isAccessible;
}
public boolean isSSOEnabled() {
@@ -1583,4 +1629,24 @@ public class RangerBizUtil {
return false;
}
+ public void blockAuditorRoleUser() {
+ UserSessionBase session = ContextUtil.getCurrentUserSession();
+ if (session != null) {
+ if (session.isAuditKeyAdmin() || session.isAuditUserAdmin()) {
+ VXResponse vXResponse = new VXResponse();
+ vXResponse.setStatusCode(HttpServletResponse.SC_UNAUTHORIZED);
+ vXResponse.setMsgDesc("Operation"
+ + " denied. LoggedInUser="
+ + session.getXXPortalUser().getId()
+ + " ,isn't permitted to perform the action.");
+ throw restErrorUtil.generateRESTException(vXResponse);
+ }
+ } else {
+ VXResponse vXResponse = new VXResponse();
+ vXResponse.setStatusCode(HttpServletResponse.SC_UNAUTHORIZED);
+ vXResponse.setMsgDesc("Bad Credentials");
+ throw restErrorUtil.generateRESTException(vXResponse);
+ }
+ }
+
}
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
index 65c9e8b..c819ea4 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
@@ -1161,7 +1161,7 @@ public class ServiceDBStore extends AbstractServiceStore {
if (LOG.isDebugEnabled()) {
LOG.debug("==> ServiceDBStore.deleteServiceDef(" + serviceDefId + ", " + forceDelete + ")");
}
-
+ bizUtil.blockAuditorRoleUser();
UserSessionBase session = ContextUtil.getCurrentUserSession();
if (session == null) {
throw restErrorUtil.createRESTException(
@@ -3246,7 +3246,6 @@ public class ServiceDBStore extends AbstractServiceStore {
if(serviceDef == null) {
return;
}
-
boolean isTagServiceDef = StringUtils.equals(serviceDef.getName(), EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME);
XXServiceDao serviceDao = daoMgr.getXXService();
@@ -4315,21 +4314,20 @@ public class ServiceDBStore extends AbstractServiceStore {
xUserService.createXUserWithOutLogin(genericUser);
}
- public List<String> getPolicyLabels(SearchFilter searchFilter) {
- if (LOG.isDebugEnabled()) {
- LOG.debug("==> ServiceDBStore.getPolicyLabels()");
- }
- VXPolicyLabelList vxPolicyLabelList = new VXPolicyLabelList();
- List<XXPolicyLabel> xPolList = (List<XXPolicyLabel>) policyLabelsService.searchResources(searchFilter,
- policyLabelsService.searchFields, policyLabelsService.sortFields, vxPolicyLabelList);
- List<String> result = new ArrayList<String>();
- for (XXPolicyLabel xPolicyLabel : xPolList) {
- result.add(xPolicyLabel.getPolicyLabel());
- }
- if (LOG.isDebugEnabled()) {
- LOG.debug("<== ServiceDBStore.getPolicyLabels()");
- }
- return result;
+ public List<String> getPolicyLabels(SearchFilter searchFilter) {
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("==> ServiceDBStore.getPolicyLabels()");
}
-
+ VXPolicyLabelList vxPolicyLabelList = new VXPolicyLabelList();
+ List<XXPolicyLabel> xPolList = (List<XXPolicyLabel>) policyLabelsService.searchResources(searchFilter,
+ policyLabelsService.searchFields, policyLabelsService.sortFields, vxPolicyLabelList);
+ List<String> result = new ArrayList<String>();
+ for (XXPolicyLabel xPolicyLabel : xPolList) {
+ result.add(xPolicyLabel.getPolicyLabel());
+ }
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("<== ServiceDBStore.getPolicyLabels()");
+ }
+ return result;
+ }
}
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java
index a989c84..acdfd2e 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java
@@ -78,9 +78,12 @@ public class ServiceMgr {
@Autowired
TimedExecutor timedExecutor;
+ @Autowired
+ RangerBizUtil rangerBizUtil;
+
public List<String> lookupResource(String serviceName, ResourceLookupContext context, ServiceStore svcStore) throws Exception {
List<String> ret = null;
-
+ rangerBizUtil.blockAuditorRoleUser();
RangerService service = svcDBStore.getServiceByName(serviceName);
String authType = PropertiesUtil.getProperty(AUTHENTICATION_TYPE);
@@ -135,7 +138,7 @@ public class ServiceMgr {
public VXResponse validateConfig(RangerService service, ServiceStore svcStore) throws Exception {
VXResponse ret = new VXResponse();
-
+ rangerBizUtil.blockAuditorRoleUser();
String authType = PropertiesUtil.getProperty(AUTHENTICATION_TYPE);
String lookupPrincipal = SecureClientLogin.getPrincipal(PropertiesUtil.getProperty(LOOKUP_PRINCIPAL), PropertiesUtil.getProperty(HOST_NAME));
String lookupKeytab = PropertiesUtil.getProperty(LOOKUP_KEYTAB);
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
index 9eb8f1f..4a426b7 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
@@ -264,12 +264,28 @@ public class SessionMgr {
if (strRoleList.contains(RangerConstants.ROLE_SYS_ADMIN)) {
userSession.setUserAdmin(true);
userSession.setKeyAdmin(false);
+ userSession.setAuditUserAdmin(false);
+ userSession.setAuditKeyAdmin(false);
} else if (strRoleList.contains(RangerConstants.ROLE_KEY_ADMIN)) {
userSession.setKeyAdmin(true);
userSession.setUserAdmin(false);
+ userSession.setAuditUserAdmin(false);
+ userSession.setAuditKeyAdmin(false);
} else if (strRoleList.size() == 1 && RangerConstants.ROLE_USER.equals(strRoleList.get(0))) {
userSession.setKeyAdmin(false);
userSession.setUserAdmin(false);
+ userSession.setAuditUserAdmin(false);
+ userSession.setAuditKeyAdmin(false);
+ } else if (strRoleList.contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ userSession.setAuditUserAdmin(true);
+ userSession.setAuditKeyAdmin(false);
+ userSession.setKeyAdmin(false);
+ userSession.setUserAdmin(false);
+ } else if (strRoleList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ userSession.setAuditKeyAdmin(true);
+ userSession.setAuditUserAdmin(false);
+ userSession.setKeyAdmin(false);
+ userSession.setUserAdmin(false);
}
userSession.setUserRoleList(strRoleList);
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
index a110035..ad806fb 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
@@ -87,7 +87,7 @@ public class UserMgr {
SearchUtil searchUtil;
@Autowired
- RangerBizUtil msBizUtil;
+ RangerBizUtil rangerBizUtil;
@Autowired
SessionMgr sessionMgr;
@@ -130,6 +130,8 @@ public class UserMgr {
VALID_ROLE_LIST.add(RangerConstants.ROLE_SYS_ADMIN);
VALID_ROLE_LIST.add(RangerConstants.ROLE_USER);
VALID_ROLE_LIST.add(RangerConstants.ROLE_KEY_ADMIN);
+ VALID_ROLE_LIST.add(RangerConstants.ROLE_ADMIN_AUDITOR);
+ VALID_ROLE_LIST.add(RangerConstants.ROLE_KEY_ADMIN_AUDITOR);
}
public UserMgr() {
@@ -142,6 +144,7 @@ public class UserMgr {
Collection<String> userRoleList) {
XXPortalUser user = mapVXPortalUserToXXPortalUser(userProfile);
checkAdminAccess();
+ rangerBizUtil.blockAuditorRoleUser();
List<String> userRolesList = new ArrayList<String>(userRoleList);
xUserMgr.checkAccessRoles(userRolesList);
user = createUser(user, userStatus, userRoleList);
@@ -205,7 +208,7 @@ public class UserMgr {
}
checkAccess(gjUser);
-
+ rangerBizUtil.blockAuditorRoleUser();
boolean updateUser = false;
// Selectively update fields
@@ -313,7 +316,7 @@ public class UserMgr {
sessionMgr.resetUserSessionForProfiles(ContextUtil
.getCurrentUserSession());
- msBizUtil.createTrxLog(trxLogList);
+ rangerBizUtil.createTrxLog(trxLogList);
}
return gjUser;
@@ -332,6 +335,7 @@ public class UserMgr {
stringRolesList.add(userRole);
}
xUserMgr.checkAccessRoles(stringRolesList);
+ rangerBizUtil.blockAuditorRoleUser();
// Let's first delete old roles
List<XXPortalUserRole> gjUserRoles = daoManager.getXXPortalUserRole()
.findByUserId(userId);
@@ -379,18 +383,20 @@ public class UserMgr {
stringRolesList.add(vXString.getValue());
}
xUserMgr.checkAccessRoles(stringRolesList);
+ rangerBizUtil.blockAuditorRoleUser();
VXPortalUser oldUserProfile=getUserProfile(userId);
xUserMgr.updateUserRolesPermissions(oldUserProfile, stringRolesList);
}
/**
* @param pwdChange
- * @return
- */
- public VXResponse changePassword(VXPasswordChange pwdChange) {
- VXResponse ret = new VXResponse();
+ * @return
+ */
+ public VXResponse changePassword(VXPasswordChange pwdChange) {
+
+ VXResponse ret = new VXResponse();
- // First let's get the XXPortalUser for the current logged in user
+ // First let's get the XXPortalUser for the current logged in user
String currentUserLoginId = ContextUtil.getCurrentUserLoginId();
XXPortalUser gjUserCurrent = daoManager.getXXPortalUser().findByLoginId(currentUserLoginId);
checkAccessForUpdate(gjUserCurrent);
@@ -434,7 +440,7 @@ public class UserMgr {
xTrxLog.setObjectId(pwdChange.getId());
xTrxLog.setObjectName(pwdChange.getLoginId());
trxLogList.add(xTrxLog);
- msBizUtil.createTrxLog(trxLogList);
+ rangerBizUtil.createTrxLog(trxLogList);
gjUser.setPassword(encryptedNewPwd);
gjUser = daoManager.getXXPortalUser().update(gjUser);
ret.setMsgDesc("Password successfully updated");
@@ -455,6 +461,7 @@ public class UserMgr {
public VXPortalUser changeEmailAddress(XXPortalUser gjUser,
VXPasswordChange changeEmail) {
checkAccessForUpdate(gjUser);
+ rangerBizUtil.blockAuditorRoleUser();
if (StringUtils.isEmpty(changeEmail.getEmailAddress())) {
changeEmail.setEmailAddress(null);
}
@@ -502,6 +509,7 @@ public class UserMgr {
*/
public VXPortalUser deactivateUser(XXPortalUser gjUser) {
checkAdminAccess();
+ rangerBizUtil.blockAuditorRoleUser();
if (gjUser != null
&& gjUser.getStatus() != RangerConstants.ACT_STATUS_DEACTIVATED) {
logger.info("Marking user " + gjUser.getLoginId() + " as deleted");
@@ -950,6 +958,7 @@ public class UserMgr {
* if (RangerConstants.ROLE_USER.equals(gjUserRole.getUserRole())) {
* return false; }
*/
+ rangerBizUtil.blockAuditorRoleUser();
boolean publicRole = false;
for (String publicRoleStr : publicRoles) {
if (publicRoleStr.equalsIgnoreCase(gjUserRole.getUserRole())) {
@@ -969,6 +978,7 @@ public class UserMgr {
}
public XXPortalUserRole addUserRole(Long userId, String userRole) {
+ rangerBizUtil.blockAuditorRoleUser();
List<XXPortalUserRole> roleList = daoManager.getXXPortalUserRole()
.findByUserId(userId);
boolean publicRole = false;
@@ -1102,6 +1112,7 @@ public class UserMgr {
public VXPortalUser createUser(VXPortalUser userProfile) {
checkAdminAccess();
+ rangerBizUtil.blockAuditorRoleUser();
XXPortalUser xXPortalUser = this.createUser(userProfile,
RangerCommonEnums.STATUS_ENABLED);
return mapXXPortalUserVXPortalUser(xXPortalUser);
@@ -1114,6 +1125,7 @@ public class UserMgr {
}
// access control
checkAdminAccess();
+ rangerBizUtil.blockAuditorRoleUser();
logger.info("create:" + userProfile.getLoginId());
XXPortalUser xXPortalUser = null;
Collection<String> existingRoleList = null;
@@ -1175,6 +1187,7 @@ public class UserMgr {
protected VXPortalUser updateRoleForExternalUsers(
Collection<String> reqRoleList,
Collection<String> existingRoleList, VXPortalUser userProfileRes) {
+ rangerBizUtil.blockAuditorRoleUser();
UserSessionBase session = ContextUtil.getCurrentUserSession();
if (session != null && session.getXXPortalUser() != null && session.getXXPortalUser().getLoginId() != null && "rangerusersync".equals(session.getXXPortalUser().getLoginId())
&& reqRoleList != null && !reqRoleList.isEmpty()
@@ -1320,7 +1333,7 @@ public class UserMgr {
xTrxLog.setAddedByUserId(xXPortalUser.getId());
xTrxLog.setUpdatedByUserId(xXPortalUser.getId());
trxLogList.add(xTrxLog);
- msBizUtil.createTrxLog(trxLogList);
+ rangerBizUtil.createTrxLog(trxLogList);
}
}
@@ -1399,7 +1412,7 @@ public class UserMgr {
xTrxLog.setAddedByUserId(xXPortalUser.getId());
xTrxLog.setUpdatedByUserId(xXPortalUser.getId());
trxLogList.add(xTrxLog);
- msBizUtil.createTrxLog(trxLogList);
+ rangerBizUtil.createTrxLog(trxLogList);
return xXPortalUser;
}
}
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java
index c2fac0b..9eecc20 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/XAuditMgr.java
@@ -50,16 +50,19 @@ public class XAuditMgr extends XAuditMgrBase {
public VXTrxLog createXTrxLog(VXTrxLog vXTrxLog) {
checkAdminAccess();
+ rangerBizUtil.blockAuditorRoleUser();
return super.createXTrxLog(vXTrxLog);
}
public VXTrxLog updateXTrxLog(VXTrxLog vXTrxLog) {
checkAdminAccess();
+ rangerBizUtil.blockAuditorRoleUser();
return super.updateXTrxLog(vXTrxLog);
}
public void deleteXTrxLog(Long id, boolean force) {
checkAdminAccess();
+ rangerBizUtil.blockAuditorRoleUser();
super.deleteXTrxLog(id, force);
}
@@ -92,7 +95,9 @@ public class XAuditMgr extends XAuditMgrBase {
UserSessionBase session = ContextUtil.getCurrentUserSession();
if (session != null) {
if (!session.isUserAdmin()) {
- throw restErrorUtil.create403RESTException("Operation" + " denied. LoggedInUser=" + (session != null ? session.getXXPortalUser().getId() : "Not Logged In")
+ throw restErrorUtil.create403RESTException("Operation"
+ + " denied. LoggedInUser="
+ + session.getXXPortalUser().getId()
+ " ,isn't permitted to perform the action.");
}
} else {
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
index 487fefa..2fc9a9b 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
@@ -38,6 +38,7 @@ import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerPolicy.RangerDataMaskPolicyItem;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem;
import org.apache.ranger.plugin.model.RangerPolicy.RangerRowFilterPolicyItem;
+import org.apache.ranger.security.context.RangerAPIMapping;
import org.apache.ranger.service.*;
import org.apache.ranger.view.*;
import org.apache.log4j.Logger;
@@ -161,6 +162,7 @@ public class XUserMgr extends XUserMgrBase {
public VXUser createXUser(VXUser vXUser) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
validatePassword(vXUser);
String userName = vXUser.getName();
if (userName == null || "null".equalsIgnoreCase(userName)
@@ -255,6 +257,17 @@ public class XUserMgr extends XUserMgrBase {
createOrUpdateUserPermisson(vXPortalUser, moduleNameId.get(RangerConstants.MODULE_KEY_MANAGER), isCreate);
createOrUpdateUserPermisson(vXPortalUser, moduleNameId.get(RangerConstants.MODULE_REPORTS), isCreate);
createOrUpdateUserPermisson(vXPortalUser, moduleNameId.get(RangerConstants.MODULE_RESOURCE_BASED_POLICIES), isCreate);
+ } else if (role.equals(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerConstants.MODULE_KEY_MANAGER),isCreate);
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerConstants.MODULE_REPORTS),isCreate);
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerConstants.MODULE_RESOURCE_BASED_POLICIES),isCreate);
+ } else if (role.equals(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerConstants.MODULE_REPORTS),isCreate);
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerConstants.MODULE_RESOURCE_BASED_POLICIES),isCreate);
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerConstants.MODULE_AUDIT),isCreate);
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerConstants.MODULE_USER_GROUPS),isCreate);
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerConstants.MODULE_TAG_BASED_POLICIES),isCreate);
+ createOrUpdateUserPermisson(vXPortalUser,moduleNameId.get(RangerAPIMapping.TAB_PERMISSIONS),isCreate);
}
}
@@ -328,6 +341,7 @@ public class XUserMgr extends XUserMgrBase {
+ "username.", MessageEnums.INVALID_INPUT_DATA);
}
checkAccess(vXUser.getName());
+ xaBizUtil.blockAuditorRoleUser();
VXPortalUser oldUserProfile = userMgr.getUserProfileByLoginId(vXUser
.getName());
VXPortalUser vXPortalUser = new VXPortalUser();
@@ -509,6 +523,7 @@ public class XUserMgr extends XUserMgrBase {
public VXUserGroupInfo createXUserGroupFromMap(VXUserGroupInfo vXUserGroupInfo) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
VXUserGroupInfo vxUGInfo = new VXUserGroupInfo();
VXUser vXUser = vXUserGroupInfo.getXuserInfo();
VXPortalUser vXPortalUser = userMgr.getUserProfileByLoginId(vXUser
@@ -546,6 +561,7 @@ public class XUserMgr extends XUserMgrBase {
public VXGroupUserInfo createXGroupUserFromMap(
VXGroupUserInfo vXGroupUserInfo) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
VXGroupUserInfo vxGUInfo = new VXGroupUserInfo();
VXGroup vXGroup = vXGroupUserInfo.getXgroupInfo();
@@ -645,12 +661,14 @@ public class XUserMgr extends XUserMgrBase {
public VXUser createXUserWithOutLogin(VXUser vXUser) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
validatePassword(vXUser);
return xUserService.createXUserWithOutLogin(vXUser);
}
public VXGroup createXGroup(VXGroup vXGroup) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
if (vXGroup.getDescription() == null) {
vXGroup.setDescription(vXGroup.getName());
}
@@ -664,11 +682,13 @@ public class XUserMgr extends XUserMgrBase {
public VXGroup createXGroupWithoutLogin(VXGroup vXGroup) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
return xGroupService.createXGroupWithOutLogin(vXGroup);
}
public VXGroupUser createXGroupUser(VXGroupUser vXGroupUser) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
vXGroupUser = xGroupUserService
.createXGroupUserWithOutLogin(vXGroupUser);
return vXGroupUser;
@@ -724,6 +744,7 @@ public class XUserMgr extends XUserMgrBase {
public void deleteXGroupAndXUser(String groupName, String userName) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
VXGroup vxGroup = xGroupService.getGroupByGroupName(groupName);
VXUser vxUser = xUserService.getXUserByUserName(userName);
SearchCriteria searchCriteria = new SearchCriteria();
@@ -834,6 +855,7 @@ public class XUserMgr extends XUserMgrBase {
@Override
public VXGroup updateXGroup(VXGroup vXGroup) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
XXGroup xGroup = daoManager.getXXGroup().getById(vXGroup.getId());
List<XXTrxLog> trxLogList = xGroupService.getTransactionLog(vXGroup,
xGroup, "update");
@@ -859,30 +881,36 @@ public class XUserMgr extends XUserMgrBase {
public VXGroupUser updateXGroupUser(VXGroupUser vXGroupUser) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
return super.updateXGroupUser(vXGroupUser);
}
public void deleteXGroupUser(Long id, boolean force) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
super.deleteXGroupUser(id, force);
}
public VXGroupGroup createXGroupGroup(VXGroupGroup vXGroupGroup){
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
return super.createXGroupGroup(vXGroupGroup);
}
public VXGroupGroup updateXGroupGroup(VXGroupGroup vXGroupGroup) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
return super.updateXGroupGroup(vXGroupGroup);
}
public void deleteXGroupGroup(Long id, boolean force) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
super.deleteXGroupGroup(id, force);
}
public void deleteXPermMap(Long id, boolean force) {
+ xaBizUtil.blockAuditorRoleUser();
if (force) {
XXPermMap xPermMap = daoManager.getXXPermMap().getById(id);
if (xPermMap != null) {
@@ -905,6 +933,7 @@ public class XUserMgr extends XUserMgrBase {
}
public void deleteXAuditMap(Long id, boolean force) {
+ xaBizUtil.blockAuditorRoleUser();
if (force) {
XXAuditMap xAuditMap = daoManager.getXXAuditMap().getById(id);
if (xAuditMap != null) {
@@ -928,6 +957,7 @@ public class XUserMgr extends XUserMgrBase {
public void modifyUserVisibility(HashMap<Long, Integer> visibilityMap) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
Set<Map.Entry<Long, Integer>> entries = visibilityMap.entrySet();
for (Map.Entry<Long, Integer> entry : entries) {
XXUser xUser = daoManager.getXXUser().getById(entry.getKey());
@@ -939,6 +969,7 @@ public class XUserMgr extends XUserMgrBase {
public void modifyGroupsVisibility(HashMap<Long, Integer> groupVisibilityMap) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
Set<Map.Entry<Long, Integer>> entries = groupVisibilityMap.entrySet();
for (Map.Entry<Long, Integer> entry : entries) {
XXGroup xGroup = daoManager.getXXGroup().getById(entry.getKey());
@@ -1366,6 +1397,7 @@ public class XUserMgr extends XUserMgrBase {
}
public VXStringList setUserRolesByExternalID(Long userId, List<VXString> vStringRolesList) {
+ xaBizUtil.blockAuditorRoleUser();
List<String> roleListNewProfile = new ArrayList<String>();
if(vStringRolesList!=null){
for (VXString vXString : vStringRolesList) {
@@ -1391,6 +1423,7 @@ public class XUserMgr extends XUserMgrBase {
}
public VXStringList setUserRolesByName(String userName, List<VXString> vStringRolesList) {
+ xaBizUtil.blockAuditorRoleUser();
List<String> roleListNewProfile = new ArrayList<String>();
if(vStringRolesList!=null){
for (VXString vXString : vStringRolesList) {
@@ -1758,6 +1791,7 @@ public class XUserMgr extends XUserMgrBase {
public void deleteXGroup(Long id, boolean force) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
XXGroupDao xXGroupDao = daoManager.getXXGroup();
XXGroup xXGroup = xXGroupDao.getById(id);
VXGroup vXGroup = xGroupService.populateViewBean(xXGroup);
@@ -1926,6 +1960,7 @@ public class XUserMgr extends XUserMgrBase {
public synchronized void deleteXUser(Long id, boolean force) {
checkAdminAccess();
+ xaBizUtil.blockAuditorRoleUser();
XXUserDao xXUserDao = daoManager.getXXUser();
XXUser xXUser = xXUserDao.getById(id);
VXUser vXUser = xUserService.populateViewBean(xXUser);
@@ -2154,6 +2189,7 @@ public class XUserMgr extends XUserMgrBase {
logger.error("User Name: "+userName);
throw restErrorUtil.createRESTException("Please provide a valid username.",MessageEnums.INVALID_INPUT_DATA);
}
+
VXUser vXUser = null;
VXPortalUser vXPortalUser=null;
XXUser xxUser = daoManager.getXXUser().findByUserName(userName);
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java b/security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java
index e31e9d7..35b9d0a 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/RangerConstants.java
@@ -36,6 +36,8 @@ public class RangerConstants extends RangerCommonEnums {
public final static String ROLE_ANON = "ROLE_ANON";
public final static String ROLE_OTHER = "ROLE_OTHER";
public final static String GROUP_PUBLIC = "public";
+ public final static String ROLE_ADMIN_AUDITOR = "ROLE_ADMIN_AUDITOR";
+ public final static String ROLE_KEY_ADMIN_AUDITOR = "ROLE_KEY_ADMIN_AUDITOR";
// Action constants
public final static String ACTION_EDIT = "edit";
public final static String ACTION_CHANGE = "change";
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java b/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
index bcf9080..6decee3 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
@@ -34,6 +34,8 @@ public class UserSessionBase implements Serializable {
XXPortalUser xXPortalUser;
XXAuthSession xXAuthSession;
private boolean userAdmin;
+ private boolean userAuditAdmin = false;
+ private boolean auditKeyAdmin = false;
private boolean keyAdmin = false;
private int authProvider = RangerConstants.USER_APP;
private List<String> userRoleList = new ArrayList<String>();
@@ -67,6 +69,14 @@ public class UserSessionBase implements Serializable {
return userAdmin;
}
+ public boolean isAuditUserAdmin() {
+ return userAuditAdmin;
+ }
+
+ public void setAuditUserAdmin(boolean userAuditAdmin) {
+ this.userAuditAdmin = userAuditAdmin;
+ }
+
public void setUserAdmin(boolean userAdmin) {
this.userAdmin = userAdmin;
}
@@ -114,6 +124,13 @@ public class UserSessionBase implements Serializable {
this.keyAdmin = keyAdmin;
}
+ public boolean isAuditKeyAdmin() {
+ return auditKeyAdmin;
+ }
+
+ public void setAuditKeyAdmin(boolean auditKeyAdmin) {
+ this.auditKeyAdmin = auditKeyAdmin;
+ }
/**
* @return the rangerUserPermission
*/
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java b/security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java
index d3a28f7..7df0640 100644
--- a/security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/patch/cliutil/RoleBasedUserSearchUtil.java
@@ -44,8 +44,7 @@ import org.springframework.stereotype.Component;
@Component
public class RoleBasedUserSearchUtil extends BaseLoader {
- private static final Logger logger = Logger
- .getLogger(RoleBasedUserSearchUtil.class);
+ private static final Logger logger = Logger.getLogger(RoleBasedUserSearchUtil.class);
@Autowired
XUserService xUserService;
@@ -77,7 +76,9 @@ public class RoleBasedUserSearchUtil extends BaseLoader {
roles.add(RangerConstants.ROLE_USER);
roles.add(RangerConstants.ROLE_SYS_ADMIN);
roles.add(RangerConstants.ROLE_KEY_ADMIN);
- if (!StringUtils.isBlank(userRole)) {
+ roles.add(RangerConstants.ROLE_ADMIN_AUDITOR);
+ roles.add(RangerConstants.ROLE_KEY_ADMIN_AUDITOR);
+ if (!StringUtils.isBlank(userRole)) {
userRole = userRole.toUpperCase();
if (!roles.contains(userRole)) {
System.out.println("Invalid UserRole. Exiting!!!");
@@ -134,7 +135,9 @@ public class RoleBasedUserSearchUtil extends BaseLoader {
try {
if (!CollectionUtils.isEmpty(userRoleList) && userRoleList != null) {
Map<String, String> roleSysAdminMap = new HashMap<String, String>();
+ Map<String, String> roleAdminAuditorMap = new HashMap<String, String>();
Map<String, String> roleKeyAdminMap = new HashMap<String, String>();
+ Map<String, String> roleKeyAdminAuditorMap = new HashMap<String, String>();
Map<String, String> roleUserMap = new HashMap<String, String>();
for (String userRole : userRoleList) {
List<XXPortalUser> listXXPortalUser = daoMgr.getXXPortalUser().findByRole(userRole);
@@ -143,10 +146,18 @@ public class RoleBasedUserSearchUtil extends BaseLoader {
for (XXPortalUser xXPortalUser : listXXPortalUser) {
roleSysAdminMap.put(xXPortalUser.getLoginId(),userRole);
}
+ } else if (userRole.equalsIgnoreCase(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ for (XXPortalUser xXPortalUser : listXXPortalUser) {
+ roleAdminAuditorMap.put(xXPortalUser.getLoginId(),userRole);
+ }
} else if (userRole.equalsIgnoreCase(RangerConstants.ROLE_KEY_ADMIN)) {
for (XXPortalUser xXPortalUser : listXXPortalUser) {
roleKeyAdminMap.put(xXPortalUser.getLoginId(),userRole);
}
+ } else if (userRole.equalsIgnoreCase(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ for (XXPortalUser xXPortalUser : listXXPortalUser) {
+ roleKeyAdminAuditorMap.put(xXPortalUser.getLoginId(),userRole);
+ }
} else if (userRole.equalsIgnoreCase(RangerConstants.ROLE_USER)) {
for (XXPortalUser xXPortalUser : listXXPortalUser) {
roleUserMap.put(xXPortalUser.getLoginId(),userRole);
@@ -154,7 +165,7 @@ public class RoleBasedUserSearchUtil extends BaseLoader {
}
}
}
- if (MapUtils.isEmpty( roleSysAdminMap) && MapUtils.isEmpty(roleKeyAdminMap) && MapUtils.isEmpty(roleUserMap)) {
+ if (MapUtils.isEmpty(roleSysAdminMap) && MapUtils.isEmpty(roleKeyAdminMap) && MapUtils.isEmpty(roleUserMap) && MapUtils.isEmpty(roleAdminAuditorMap) && MapUtils.isEmpty(roleKeyAdminAuditorMap)) {
System.out.println("users with given user role are not there");
logger.error("users with given user role are not there");
System.exit(1);
@@ -174,6 +185,16 @@ public class RoleBasedUserSearchUtil extends BaseLoader {
System.out.println(entry.getValue() + " : " + entry.getKey());
}
}
+ if (!MapUtils.isEmpty(roleAdminAuditorMap)) {
+ for(Entry<String, String> entry : roleAdminAuditorMap.entrySet()){
+ System.out.println(entry.getValue() + " : " + entry.getKey());
+ }
+ }
+ if (!MapUtils.isEmpty(roleKeyAdminAuditorMap)) {
+ for(Entry<String, String> entry : roleKeyAdminAuditorMap.entrySet()){
+ System.out.println(entry.getValue() + " : " + entry.getKey());
+ }
+ }
if (userRoleList.contains(RangerConstants.ROLE_SYS_ADMIN)) {
System.out.println("ROLE_SYS_ADMIN Total Count : " + roleSysAdminMap.size());
}
@@ -183,7 +204,14 @@ public class RoleBasedUserSearchUtil extends BaseLoader {
if (userRoleList.contains(RangerConstants.ROLE_USER)) {
System.out.println("ROLE_USER Total Count : " + roleUserMap.size());
}
- int total = roleSysAdminMap.size() + roleKeyAdminMap.size() + roleUserMap.size();
+ if (userRoleList.contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ System.out.println("ROLE_ADMIN_AUDITOR Total Count : " + roleAdminAuditorMap.size());
+ }
+ if (userRoleList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ System.out.println("ROLE_KEY_ADMIN_AUDITOR Total Count : " + roleKeyAdminAuditorMap.size());
+ }
+
+ int total = roleSysAdminMap.size() + roleKeyAdminMap.size() + roleUserMap.size() + roleAdminAuditorMap.size() + roleKeyAdminAuditorMap.size();
System.out.println("Total Count : " + total);
}
}
@@ -218,23 +246,25 @@ public class RoleBasedUserSearchUtil extends BaseLoader {
} else {
isUserAuthorized = true;
}
- } else if (existingRole.get(0).equalsIgnoreCase(RangerConstants.ROLE_SYS_ADMIN)) {
+ } else if (existingRole.get(0).equalsIgnoreCase(RangerConstants.ROLE_SYS_ADMIN) || existingRole.get(0).equalsIgnoreCase(RangerConstants.ROLE_ADMIN_AUDITOR)) {
if (checkRole) {
- userRoleList.add(RangerConstants.ROLE_SYS_ADMIN);
+ userRoleList.add(RangerConstants.ROLE_SYS_ADMIN);
+ userRoleList.add(RangerConstants.ROLE_ADMIN_AUDITOR);
userRoleList.add(RangerConstants.ROLE_USER);
getUsersBasedOnRole(userRoleList);
- } else if (existingRole.get(0).equalsIgnoreCase(userRole) || userRole.equalsIgnoreCase(RangerConstants.ROLE_USER)) {
+ } else if (existingRole.get(0).equalsIgnoreCase(userRole) || userRole.equalsIgnoreCase(RangerConstants.ROLE_USER) || userRole.equalsIgnoreCase(RangerConstants.ROLE_ADMIN_AUDITOR) || userRole.equalsIgnoreCase(RangerConstants.ROLE_SYS_ADMIN)) {
userRoleList.add(userRole);
getUsersBasedOnRole(userRoleList);
- } else {
+ }else {
isUserAuthorized = true;
}
- } else if (existingRole.get(0).equalsIgnoreCase(RangerConstants.ROLE_KEY_ADMIN) || userRole.equalsIgnoreCase(RangerConstants.ROLE_USER)) {
+ } else if (existingRole.get(0).equalsIgnoreCase(RangerConstants.ROLE_KEY_ADMIN) || existingRole.get(0).equalsIgnoreCase(RangerConstants.ROLE_KEY_ADMIN_AUDITOR) || userRole.equalsIgnoreCase(RangerConstants.ROLE_USER)) {
if (checkRole) {
- userRoleList.add(RangerConstants.ROLE_KEY_ADMIN);
+ userRoleList.add(RangerConstants.ROLE_KEY_ADMIN);
+ userRoleList.add(RangerConstants.ROLE_KEY_ADMIN_AUDITOR);
userRoleList.add(RangerConstants.ROLE_USER);
getUsersBasedOnRole(userRoleList);
- } else if (existingRole.get(0).equalsIgnoreCase(userRole) || userRole.equalsIgnoreCase(RangerConstants.ROLE_USER)) {
+ } else if (existingRole.get(0).equalsIgnoreCase(userRole) || userRole.equalsIgnoreCase(RangerConstants.ROLE_USER) || userRole.equalsIgnoreCase(RangerConstants.ROLE_KEY_ADMIN) || userRole.equalsIgnoreCase(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
userRoleList.add(userRole);
getUsersBasedOnRole(userRoleList);
} else {
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java b/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
index 9f7cd26..b7e045d 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
@@ -650,8 +650,9 @@ public class AssetREST {
searchUtil.extractString(request, searchCriteria, "cluster", "Cluster Name", StringUtil.VALIDATION_TEXT);
boolean isKeyAdmin = msBizUtil.isKeyAdmin();
+ boolean isAuditKeyAdmin = msBizUtil.isAuditKeyAdmin();
XXServiceDef xxServiceDef = daoManager.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME);
- if(isKeyAdmin && xxServiceDef != null){
+ if(isKeyAdmin && xxServiceDef != null || isAuditKeyAdmin && xxServiceDef != null){
searchCriteria.getParamList().put("repoType", xxServiceDef.getId());
}
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
index 229863e..dad8a97 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
@@ -246,7 +246,7 @@ public class ServiceREST {
bizUtil.hasAdminPermissions("Service-Def");
bizUtil.hasKMSPermissions("Service-Def", serviceDef.getImplClass());
-
+ bizUtil.blockAuditorRoleUser();
ret = svcStore.createServiceDef(serviceDef);
} catch(WebApplicationException excp) {
throw excp;
@@ -286,7 +286,7 @@ public class ServiceREST {
bizUtil.hasAdminPermissions("Service-Def");
bizUtil.hasKMSPermissions("Service-Def", serviceDef.getImplClass());
-
+ bizUtil.blockAuditorRoleUser();
ret = svcStore.updateServiceDef(serviceDef);
} catch(WebApplicationException excp) {
throw excp;
@@ -655,6 +655,7 @@ public class ServiceREST {
MessageEnums.OPER_NO_PERMISSION);
}
}
+ bizUtil.blockAuditorRoleUser();
ret = svcStore.createService(service);
} catch(WebApplicationException excp) {
throw excp;
@@ -700,7 +701,7 @@ public class ServiceREST {
XXServiceDef xxServiceDef = daoManager.getXXServiceDef().findByName(service.getType());
bizUtil.hasKMSPermissions("Service", xxServiceDef.getImplclassname());
-
+ bizUtil.blockAuditorRoleUser();
Map<String, Object> options = getOptions(request);
ret = svcStore.updateService(service, options);
@@ -765,7 +766,7 @@ public class ServiceREST {
}
XXServiceDef xxServiceDef = daoManager.getXXServiceDef().getById(service.getType());
bizUtil.hasKMSPermissions("Service", xxServiceDef.getImplclassname());
-
+ bizUtil.blockAuditorRoleUser();
tagStore.deleteAllTagObjectsForService(service.getName());
svcStore.deleteService(id);
@@ -1069,7 +1070,7 @@ public class ServiceREST {
RangerAccessResource resource = new RangerAccessResourceImpl(StringUtil.toStringObjectMap(grantRequest.getResource()));
boolean isAdmin = hasAdminAccess(serviceName, userName, userGroups, resource);
-
+ bizUtil.blockAuditorRoleUser();
if(!isAdmin) {
throw restErrorUtil.createGrantRevokeRESTException( "User doesn't have necessary permission to grant access");
}
@@ -1184,7 +1185,7 @@ public class ServiceREST {
isAllowed = bizUtil.isUserAllowedForGrantRevoke(rangerService, Allowed_User_List_For_Grant_Revoke, userName);
}
}
-
+ bizUtil.blockAuditorRoleUser();
if (isAllowed) {
RangerPolicy policy = getExactMatchPolicyForResource(serviceName, resource, userName);
@@ -1281,7 +1282,7 @@ public class ServiceREST {
RangerAccessResource resource = new RangerAccessResourceImpl(StringUtil.toStringObjectMap(revokeRequest.getResource()));
boolean isAdmin = hasAdminAccess(serviceName, userName, userGroups, resource);
-
+ bizUtil.blockAuditorRoleUser();
if(!isAdmin) {
throw restErrorUtil.createGrantRevokeRESTException("User doesn't have necessary permission to revoke access");
}
@@ -1362,7 +1363,7 @@ public class ServiceREST {
isAllowed = bizUtil.isUserAllowedForGrantRevoke(rangerService, Allowed_User_List_For_Grant_Revoke, userName);
}
}
-
+ bizUtil.blockAuditorRoleUser();
if (isAllowed) {
RangerPolicy policy = getExactMatchPolicyForResource(serviceName, resource, userName);
@@ -1477,7 +1478,7 @@ public class ServiceREST {
validator.validate(policy, Action.CREATE, bizUtil.isAdmin());
ensureAdminAccess(policy);
-
+ bizUtil.blockAuditorRoleUser();
ret = svcStore.createPolicy(policy);
}
} catch(WebApplicationException excp) {
@@ -1565,7 +1566,7 @@ public class ServiceREST {
validator.validate(policy, Action.UPDATE, bizUtil.isAdmin());
ensureAdminAccess(policy);
-
+ bizUtil.blockAuditorRoleUser();
ret = svcStore.updatePolicy(policy);
} catch(WebApplicationException excp) {
throw excp;
@@ -1604,7 +1605,7 @@ public class ServiceREST {
RangerPolicy policy = svcStore.getPolicy(id);
ensureAdminAccess(policy);
-
+ bizUtil.blockAuditorRoleUser();
svcStore.deletePolicy(id);
} catch(WebApplicationException excp) {
throw excp;
@@ -1639,7 +1640,7 @@ public class ServiceREST {
ret = svcStore.getPolicy(id);
if(ret != null) {
- ensureAdminAccess(ret);
+ ensureAdminAndAuditAccess(ret);
}
} catch(WebApplicationException excp) {
throw excp;
@@ -1772,6 +1773,12 @@ public class ServiceREST {
policyLists = getAllFilteredPolicyList(filter, request, policyLists);
if (CollectionUtils.isNotEmpty(policyLists)){
+ for (RangerPolicy rangerPolicy : policyLists) {
+ if (rangerPolicy != null) {
+ ensureAdminAndAuditAccess(rangerPolicy);
+ }
+ }
+ bizUtil.blockAuditorRoleUser();
svcStore.getPoliciesInExcel(policyLists, response);
}else{
response.setStatus(HttpServletResponse.SC_NO_CONTENT);
@@ -1819,6 +1826,12 @@ public class ServiceREST {
policyLists = getAllFilteredPolicyList(filter, request, policyLists);
if (CollectionUtils.isNotEmpty(policyLists)){
+ for (RangerPolicy rangerPolicy : policyLists) {
+ if (rangerPolicy != null) {
+ ensureAdminAndAuditAccess(rangerPolicy);
+ }
+ }
+ bizUtil.blockAuditorRoleUser();
svcStore.getPoliciesInCSV(policyLists, response);
}else{
response.setStatus(HttpServletResponse.SC_NO_CONTENT);
@@ -1855,6 +1868,7 @@ public class ServiceREST {
if (LOG.isDebugEnabled()) {
LOG.debug("==> ServiceREST.getPoliciesInJson()");
}
+
RangerPerfTracer perf = null;
SearchFilter filter = searchUtil.getSearchFilter(request,policyService.sortFields);
@@ -1870,12 +1884,19 @@ public class ServiceREST {
policyLists = getAllFilteredPolicyList(filter, request, policyLists);
if (CollectionUtils.isNotEmpty(policyLists)) {
+ for (RangerPolicy rangerPolicy : policyLists) {
+ if (rangerPolicy != null) {
+ ensureAdminAndAuditAccess(rangerPolicy);
+ }
+ }
+ bizUtil.blockAuditorRoleUser();
svcStore.getPoliciesInJson(policyLists, response);
} else {
checkPoliciesExists = true;
response.setStatus(HttpServletResponse.SC_NO_CONTENT);
LOG.error("There is no Policy to Export!!");
}
+
if(!checkPoliciesExists){
RangerExportPolicyList rangerExportPolicyList = new RangerExportPolicyList();
svcStore.putMetaDataInfo(rangerExportPolicyList);
@@ -2300,6 +2321,7 @@ public class ServiceREST {
try {
validator.validate(rangerPolicy.getId(), Action.DELETE);
ensureAdminAccess(rangerPolicy);
+ bizUtil.blockAuditorRoleUser();
svcStore.deletePolicy(rangerPolicy);
totalDeletedPilicies = totalDeletedPilicies + 1;
if (LOG.isDebugEnabled()) {
@@ -2848,7 +2870,7 @@ public class ServiceREST {
try {
policy = svcStore.getPolicyFromEventTime(eventTimeStr, policyId);
if(policy != null) {
- ensureAdminAccess(policy);
+ ensureAdminAndAuditAccess(policy);
}
} catch(WebApplicationException excp) {
throw excp;
@@ -2986,6 +3008,8 @@ public class ServiceREST {
boolean isAdmin = bizUtil.isAdmin();
boolean isKeyAdmin = bizUtil.isKeyAdmin();
String userName = bizUtil.getCurrentUserLoginId();
+ boolean isAuditAdmin = bizUtil.isAuditAdmin();
+ boolean isAuditKeyAdmin = bizUtil.isAuditKeyAdmin();
Set<String> userGroups = null;
Map<String, List<RangerPolicy>> servicePoliciesMap = new HashMap<String, List<RangerPolicy>>();
@@ -3009,7 +3033,7 @@ public class ServiceREST {
List<RangerPolicy> listToFilter = entry.getValue();
if (CollectionUtils.isNotEmpty(listToFilter)) {
- if (isAdmin || isKeyAdmin) {
+ if (isAdmin || isKeyAdmin || isAuditAdmin || isAuditKeyAdmin) {
XXService xService = daoManager.getXXService().findByName(serviceName);
Long serviceDefId = xService.getType();
boolean isKmsService = serviceDefId.equals(EmbeddedServiceDefsUtil.instance().getKmsServiceDefId());
@@ -3018,6 +3042,14 @@ public class ServiceREST {
if (!isKmsService) {
ret.addAll(listToFilter);
}
+ } else if (isAuditAdmin) {
+ if (!isKmsService) {
+ ret.addAll(listToFilter);
+ }
+ } else if (isAuditKeyAdmin) {
+ if (isKmsService) {
+ ret.addAll(listToFilter);
+ }
} else { // isKeyAdmin
if (isKmsService) {
ret.addAll(listToFilter);
@@ -3342,4 +3374,46 @@ public class ServiceREST {
}
return ret;
}
-}
+
+ void ensureAdminAndAuditAccess(RangerPolicy policy) {
+ boolean isAdmin = bizUtil.isAdmin();
+ boolean isKeyAdmin = bizUtil.isKeyAdmin();
+ String userName = bizUtil.getCurrentUserLoginId();
+ boolean isAuditAdmin = bizUtil.isAuditAdmin();
+ boolean isAuditKeyAdmin = bizUtil.isAuditKeyAdmin();
+ if (!isAdmin && !isKeyAdmin && !isAuditAdmin && !isAuditKeyAdmin) {
+ boolean isAllowed = false;
+
+ RangerPolicyEngine policyEngine = getDelegatedAdminPolicyEngine(policy
+ .getService());
+
+ if (policyEngine != null) {
+ Set<String> userGroups = userMgr.getGroupsForUser(userName);
+
+ isAllowed = hasAdminAccess(policy, userName, userGroups);
+ }
+
+ if (!isAllowed) {
+ throw restErrorUtil.createRESTException(HttpServletResponse.SC_UNAUTHORIZED,"User '"
+ + userName+ "' does not have delegated-admin privilege on given resources",true);
+ }
+ } else {
+
+ XXService xService = daoManager.getXXService().findByName(policy.getService());
+ XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
+
+ if (isAdmin || isAuditAdmin) {
+ if (EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(xServiceDef.getImplclassname())) {
+ throw restErrorUtil.createRESTException(
+ "KMS Policies/Services/Service-Defs are not accessible for user '"
+ + userName + "'.",MessageEnums.OPER_NO_PERMISSION);
+ }
+ } else if (isKeyAdmin || isAuditKeyAdmin) {
+ if (!EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(xServiceDef.getImplclassname())) {
+ throw restErrorUtil.createRESTException("Only KMS Policies/Services/Service-Defs are accessible for user '"
+ + userName + "'.",MessageEnums.OPER_NO_PERMISSION);
+ }
+ }
+ }
+ }
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
index c81a6f3..c206acb 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
@@ -281,6 +281,7 @@ public class XUserREST {
@Path("/users")
@Produces({ "application/xml", "application/json" })
public VXUser updateXUser(VXUser vXUser) {
+ bizUtil.checkUserAccessible(vXUser);
return xUserMgr.updateXUser(vXUser);
}
@@ -790,6 +791,7 @@ public class XUserREST {
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_X_MODULE_DEF_PERMISSION + "\")")
public VXModuleDef createXModuleDefPermission(VXModuleDef vXModuleDef) {
xUserMgr.checkAdminAccess();
+ bizUtil.blockAuditorRoleUser();
return xUserMgr.createXModuleDefPermission(vXModuleDef);
}
@@ -807,6 +809,7 @@ public class XUserREST {
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_X_MODULE_DEF_PERMISSION + "\")")
public VXModuleDef updateXModuleDefPermission(VXModuleDef vXModuleDef) {
xUserMgr.checkAdminAccess();
+ bizUtil.blockAuditorRoleUser();
return xUserMgr.updateXModuleDefPermission(vXModuleDef);
}
@@ -817,6 +820,7 @@ public class XUserREST {
@Context HttpServletRequest request) {
boolean force = true;
xUserMgr.checkAdminAccess();
+ bizUtil.blockAuditorRoleUser();
xUserMgr.deleteXModuleDefPermission(id, force);
}
@@ -859,6 +863,7 @@ public class XUserREST {
public VXUserPermission createXUserPermission(
VXUserPermission vXUserPermission) {
xUserMgr.checkAdminAccess();
+ bizUtil.blockAuditorRoleUser();
return xUserMgr.createXUserPermission(vXUserPermission);
}
@@ -877,6 +882,7 @@ public class XUserREST {
public VXUserPermission updateXUserPermission(
VXUserPermission vXUserPermission) {
xUserMgr.checkAdminAccess();
+ bizUtil.blockAuditorRoleUser();
return xUserMgr.updateXUserPermission(vXUserPermission);
}
@@ -924,6 +930,7 @@ public class XUserREST {
public VXGroupPermission createXGroupPermission(
VXGroupPermission vXGroupPermission) {
xUserMgr.checkAdminAccess();
+ bizUtil.blockAuditorRoleUser();
return xUserMgr.createXGroupPermission(vXGroupPermission);
}
@@ -942,6 +949,7 @@ public class XUserREST {
public VXGroupPermission updateXGroupPermission(
VXGroupPermission vXGroupPermission) {
xUserMgr.checkAdminAccess();
+ bizUtil.blockAuditorRoleUser();
return xUserMgr.updateXGroupPermission(vXGroupPermission);
}
@@ -952,6 +960,7 @@ public class XUserREST {
@Context HttpServletRequest request) {
boolean force = true;
xUserMgr.checkAdminAccess();
+ bizUtil.blockAuditorRoleUser();
xUserMgr.deleteXGroupPermission(id, force);
}
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java b/security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java
index 6951cbd..673902d 100644
--- a/security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java
+++ b/security-admin/src/main/java/org/apache/ranger/security/context/RangerPreAuthSecurityHandler.java
@@ -74,6 +74,9 @@ public class RangerPreAuthSecurityHandler {
if (CollectionUtils.isEmpty(associatedTabs)) {
return true;
}
+ if(associatedTabs.contains(RangerAPIMapping.TAB_PERMISSIONS) && userSession.isAuditUserAdmin()){
+ return true;
+ }
return isAPIAccessible(associatedTabs);
}
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java
----------------------------------------------------------------------
diff --git a/security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java b/security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java
index 4227d85..e940df2 100644
--- a/security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java
+++ b/security-admin/src/main/java/org/apache/ranger/service/XTrxLogService.java
@@ -111,6 +111,9 @@ public class XTrxLogService extends XTrxLogServiceBase<XXTrxLog, VXTrxLog> {
if (session != null && session.isKeyAdmin()) {
resultList = em.createQuery(selectCQ).setFirstResult(minRowSize).setMaxResults(maxRowSize).getResultList();
}
+ if (session != null && session.isAuditKeyAdmin()) {
+ resultList = em.createQuery(selectCQ).setFirstResult(minRowSize).setMaxResults(maxRowSize).getResultList();
+ }
List<VXTrxLog> trxLogList = new ArrayList<VXTrxLog>();
for (VXXTrxLog xTrxLog : resultList) {
@@ -127,7 +130,7 @@ public class XTrxLogService extends XTrxLogServiceBase<XXTrxLog, VXTrxLog> {
}
List<VXTrxLog> keyAdminTrxLogList = new ArrayList<VXTrxLog>();
- if (session != null && session.isKeyAdmin() && xxServiceDef != null) {
+ if (session != null && xxServiceDef != null && (session.isKeyAdmin()|| session.isAuditKeyAdmin())) {
List<VXTrxLog> vXTrxLogs = new ArrayList<VXTrxLog>();
for (VXTrxLog xTrxLog : trxLogList) {
int parentObjectClassType = xTrxLog.getParentObjectClassType();
@@ -157,7 +160,7 @@ public class XTrxLogService extends XTrxLogServiceBase<XXTrxLog, VXTrxLog> {
List<XXPortalUserRole> xxPortalUserRole = daoManager.getXXPortalUserRole()
.findByUserId(xxPortalUser.getId());
if (xxPortalUserRole != null
- && xxPortalUserRole.get(0).getUserRole().equalsIgnoreCase("ROLE_KEY_ADMIN")) {
+ && (xxPortalUserRole.get(0).getUserRole().equalsIgnoreCase("ROLE_KEY_ADMIN") || xxPortalUserRole.get(0).getUserRole().equalsIgnoreCase("ROLE_KEY_ADMIN_AUDITOR"))) {
vXTrxLogs.add(xTrxLog);
}
}
@@ -176,7 +179,7 @@ public class XTrxLogService extends XTrxLogServiceBase<XXTrxLog, VXTrxLog> {
VXTrxLogList vxTrxLogList = new VXTrxLogList();
vxTrxLogList.setStartIndex(startIndex);
vxTrxLogList.setPageSize(pageSize);
- if (session != null && session.isKeyAdmin()) {
+ if (session != null && (session.isKeyAdmin() || session.isAuditKeyAdmin()) ) {
vxTrxLogList.setVXTrxLogs(keyAdminTrxLogList);
} else {
vxTrxLogList.setVXTrxLogs(trxLogList);
@@ -205,6 +208,9 @@ public class XTrxLogService extends XTrxLogServiceBase<XXTrxLog, VXTrxLog> {
if (session != null && session.isKeyAdmin()) {
count = keyadminCount;
}
+ if (session != null && session.isAuditKeyAdmin()) {
+ count = keyadminCount;
+ }
return count;
}
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml
----------------------------------------------------------------------
diff --git a/security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml b/security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml
index 87da9a0..686f720 100644
--- a/security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml
+++ b/security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml
@@ -80,7 +80,7 @@
<!-- #Role list -->
<property>
<name>ranger.users.roles.list</name>
- <value>ROLE_SYS_ADMIN, ROLE_USER, ROLE_OTHER, ROLE_ANON, ROLE_KEY_ADMIN</value>
+ <value>ROLE_SYS_ADMIN, ROLE_USER, ROLE_OTHER, ROLE_ANON, ROLE_KEY_ADMIN, ROLE_ADMIN_AUDITOR, ROLE_KEY_ADMIN_AUDITOR</value>
</property>
<!-- #Mail listing -->
<property>
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
----------------------------------------------------------------------
diff --git a/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java b/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
index 4a8d88f..307f435 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
@@ -94,7 +94,7 @@ public class TestUserMgr {
SearchUtil searchUtil;
@Mock
- RangerBizUtil msBizUtil;
+ RangerBizUtil rangerBizUtil;
@Mock
XUserPermissionService xUserPermissionService;
@@ -188,7 +188,7 @@ public class TestUserMgr {
.thenReturn(user);
Mockito.when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
Mockito.when(roleDao.findByUserId(userId)).thenReturn(list);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
XXPortalUser dbxxPortalUser = userMgr.createUser(userProfile, 1,
userRoleList);
Assert.assertNotNull(dbxxPortalUser);
@@ -241,7 +241,7 @@ public class TestUserMgr {
.thenReturn(user);
Mockito.when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
Mockito.when(roleDao.findByUserId(userId)).thenReturn(list);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
XXPortalUser dbxxPortalUser = userMgr.createUser(userProfile, 1);
userId = dbxxPortalUser.getId();
@@ -288,7 +288,6 @@ public class TestUserMgr {
Mockito.when(daoManager.getXXPortalUser()).thenReturn(userDao);
Mockito.when(
stringUtil.validatePassword(Mockito.anyString(), Mockito.any(String[].class))).thenReturn(true);
-
VXResponse dbVXResponse = userMgr.changePassword(pwdChange);
Assert.assertNotNull(dbVXResponse);
Assert.assertEquals(userProfile.getStatus(),
@@ -449,7 +448,7 @@ public class TestUserMgr {
Mockito.when(xUserPermissionService.populateViewBean(xUserPermissionObj)).thenReturn(userPermission);
Mockito.when(daoManager.getXXModuleDef()).thenReturn(xModuleDefDao);
Mockito.when(xModuleDefDao.findByModuleId(Mockito.anyLong())).thenReturn(xModuleDef);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
VXPortalUser dbVXPortalUser = userMgr.changeEmailAddress(user,
changeEmail);
Assert.assertNotNull(dbVXPortalUser);
@@ -550,7 +549,7 @@ public class TestUserMgr {
Mockito.when(xUserPermissionService.populateViewBean(xUserPermissionObj)).thenReturn(userPermission);
Mockito.when(daoManager.getXXModuleDef()).thenReturn(xModuleDefDao);
Mockito.when(xModuleDefDao.findByModuleId(Mockito.anyLong())).thenReturn(xModuleDef);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
VXPortalUser dbVXPortalUser = userMgr.changeEmailAddress(userKeyAdmin,changeEmail);
Assert.assertNotNull(dbVXPortalUser);
Assert.assertEquals(userId, dbVXPortalUser.getId());
@@ -648,7 +647,7 @@ public class TestUserMgr {
Mockito.when(xUserPermissionService.populateViewBean(xUserPermissionObj)).thenReturn(userPermission);
Mockito.when(daoManager.getXXModuleDef()).thenReturn(xModuleDefDao);
Mockito.when(xModuleDefDao.findByModuleId(Mockito.anyLong())).thenReturn(xModuleDef);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
VXPortalUser dbVXPortalUser = userMgr.changeEmailAddress(user,changeEmail);
Assert.assertNotNull(dbVXPortalUser);
Assert.assertEquals(userId, dbVXPortalUser.getId());
@@ -710,6 +709,7 @@ public class TestUserMgr {
Mockito.when(daoManager.getXXGroupPermission()).thenReturn(
xGroupPermissionDao);
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
VXPortalUser dbVXPortalUser = userMgr.createUser(userProfile);
Assert.assertNotNull(dbVXPortalUser);
Assert.assertEquals(user.getId(), dbVXPortalUser.getId());
@@ -745,6 +745,7 @@ public class TestUserMgr {
Mockito.when(userDao.findByLoginId(Mockito.anyString())).thenReturn(
user);
Mockito.when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
VXPortalUser dbVXPortalUser = userMgr
.createDefaultAccountUser(userProfile);
Assert.assertNotNull(dbVXPortalUser);
@@ -799,7 +800,7 @@ public class TestUserMgr {
MessageEnums.INVALID_INPUT_DATA)).thenThrow(
new WebApplicationException());
thrown.expect(WebApplicationException.class);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
XXPortalUser dbXXPortalUser = userMgr.updateUserWithPass(userProfile);
Assert.assertNotNull(dbXXPortalUser);
Assert.assertEquals(userId, dbXXPortalUser.getId());
@@ -908,7 +909,7 @@ public class TestUserMgr {
Mockito.when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
Mockito.when(roleDao.findByUserId(userId)).thenReturn(list);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
boolean deleteValue = userMgr.deleteUserRole(userId, userRole);
Assert.assertTrue(deleteValue);
}
@@ -1002,7 +1003,7 @@ public class TestUserMgr {
Mockito.when(
xUserPermissionService.populateViewBean(xUserPermissionObj))
.thenReturn(vXUserPermission);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
VXPortalUser dbVXPortalUser = userMgr.deactivateUser(user);
Assert.assertNotNull(dbVXPortalUser);
Assert.assertEquals(user.getId(), dbVXPortalUser.getId());
@@ -1218,7 +1219,7 @@ public class TestUserMgr {
Mockito.when(daoManager.getXXModuleDef()).thenReturn(xModuleDefDao);
Mockito.when(xModuleDefDao.findByModuleId(Mockito.anyLong()))
.thenReturn(xModuleDef);
-
+ Mockito.doNothing().when(rangerBizUtil).blockAuditorRoleUser();
userMgr.checkAccess(userId);
userMgr.setUserRoles(userId, vStringRolesList);
http://git-wip-us.apache.org/repos/asf/ranger/blob/b068bfe5/unixauthservice/scripts/install.properties
----------------------------------------------------------------------
diff --git a/unixauthservice/scripts/install.properties b/unixauthservice/scripts/install.properties
index be8723c..d4c6513 100644
--- a/unixauthservice/scripts/install.properties
+++ b/unixauthservice/scripts/install.properties
@@ -86,6 +86,7 @@ USERS_GROUPS_ASSIGNMENT_LIST_DELIMITER = :
USERNAME_GROUPNAME_ASSIGNMENT_LIST_DELIMITER = ,
# with above mentioned delimiters a sample value would be ROLE_SYS_ADMIN:u:userName1,userName2&ROLE_SYS_ADMIN:g:groupName1,groupName2&ROLE_KEY_ADMIN:u:userName&ROLE_KEY_ADMIN:g:groupName&ROLE_USER:u:userName3,userName4&ROLE_USER:g:groupName3
+#&ROLE_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:u:userName&ROLE_KEY_ADMIN_AUDITOR:g:groupName&ROLE_ADMIN_AUDITOR:g:groupName
GROUP_BASED_ROLE_ASSIGNMENT_RULES =
# URL of source ldap