You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by ab...@apache.org on 2018/10/13 00:08:40 UTC
ranger git commit: RANGER-2207: Allow resources to appear in column
mask policies without being visible in access policies
Repository: ranger
Updated Branches:
refs/heads/master f039a3e2d -> 6fc9a823d
RANGER-2207: Allow resources to appear in column mask policies without being visible in access policies
Project: http://git-wip-us.apache.org/repos/asf/ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/ranger/commit/6fc9a823
Tree: http://git-wip-us.apache.org/repos/asf/ranger/tree/6fc9a823
Diff: http://git-wip-us.apache.org/repos/asf/ranger/diff/6fc9a823
Branch: refs/heads/master
Commit: 6fc9a823dbeeb55a8ef767e0da8b5c7be2495ac0
Parents: f039a3e
Author: Abhay Kulkarni <ak...@hortonworks.com>
Authored: Fri Oct 12 16:45:44 2018 -0700
Committer: Abhay Kulkarni <ak...@hortonworks.com>
Committed: Fri Oct 12 16:45:44 2018 -0700
----------------------------------------------------------------------
.../plugin/errors/ValidationErrorCode.java | 1 +
.../validation/RangerServiceDefHelper.java | 12 ++++++++
.../validation/RangerServiceDefValidator.java | 32 ++++++++++++++++++++
.../plugin/service/RangerBaseService.java | 2 +-
.../ranger/plugin/util/ServiceDefUtil.java | 8 +++--
.../TestRangerServiceDefValidator.java | 24 +++++++++++++++
.../ranger/services/hdfs/RangerServiceHdfs.java | 2 +-
.../scripts/models/BackboneFormDataType.js | 13 +++++---
.../src/main/webapp/scripts/utils/XAUtils.js | 16 ++++++++++
9 files changed, 100 insertions(+), 10 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java
----------------------------------------------------------------------
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java b/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java
index 3cd7876..9b9ccd1 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/errors/ValidationErrorCode.java
@@ -63,6 +63,7 @@ public enum ValidationErrorCode {
SERVICE_DEF_VALIDATION_ERR_ENUM_DEF_NULL_ENUM_ELEMENT(2020, "An enum element in enum element collection of enum [{0}] is null"),
SERVICE_DEF_VALIDATION_ERR_INVALID_SERVICE_RESOURCE_LEVELS(2021, "Resource-def levels are not in increasing order in an hierarchy"),
SERVICE_DEF_VALIDATION_ERR_NOT_LOWERCASE_NAME(2022, "{0}:[{1}] Invalid resource name. Resource name should consist of only lowercase, hyphen or underscore characters"),
+ SERVICE_DEF_VALIDATION_ERR_INVALID_MANADORY_VALUE_FOR_SERVICE_RESOURCE(2023, "{0} cannot be mandatory because {1}(parent) is not mandatory"),
// POLICY VALIDATION
POLICY_VALIDATION_ERR_UNSUPPORTED_ACTION(3001, "Internal error: method signature isValid(Long) is only supported for DELETE"),
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java
----------------------------------------------------------------------
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java
index 6cb55c2..6df5d8d 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java
@@ -183,6 +183,18 @@ public class RangerServiceDefHelper {
return _delegate.getResourceHierarchies(policyType);
}
+ public Set<List<RangerResourceDef>> filterHierarchies_containsOnlyMandatoryResources(Integer policyType) {
+ Set<List<RangerResourceDef>> hierarchies = getResourceHierarchies(policyType);
+ Set<List<RangerResourceDef>> result = new HashSet<List<RangerResourceDef>>(hierarchies.size());
+ for (List<RangerResourceDef> aHierarchy : hierarchies) {
+ Set<String> mandatoryResources = getMandatoryResourceNames(aHierarchy);
+ if (aHierarchy.size() == mandatoryResources.size()) {
+ result.add(aHierarchy);
+ }
+ }
+ return result;
+ }
+
public Set<List<RangerResourceDef>> getResourceHierarchies(Integer policyType, Collection<String> keys) {
Set<List<RangerResourceDef>> ret = new HashSet<List<RangerResourceDef>>();
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java
----------------------------------------------------------------------
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java
index 45821e8..6a1b3e1 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefValidator.java
@@ -599,6 +599,38 @@ public class RangerServiceDefValidator extends RangerValidator {
}
}
}
+ // If a resource is not mandatory, then it cannot be non-leaf in any hierarchy (RANGER-2207)
+ List<RangerResourceDef> resources = serviceDef.getResources();
+ List<String> resourceNames = new ArrayList<>(resources.size());
+ for (RangerResourceDef resourceDef : resources) {
+ resourceNames.add(resourceDef.getName());
+ }
+ for (String resourceName : resourceNames) {
+ for (int policyType : RangerPolicy.POLICY_TYPES) {
+ Set<List<RangerResourceDef>> hierarchies = defHelper.getResourceHierarchies(policyType);
+ for (List<RangerResourceDef> aHierarchy : hierarchies) {
+ boolean foundOptionalResource = false;
+ for (RangerResourceDef resourceDef : aHierarchy) {
+ if (!foundOptionalResource) {
+ if (resourceDef.getName().equalsIgnoreCase(resourceName) && !Boolean.TRUE.equals(resourceDef.getMandatory())) {
+ foundOptionalResource = true;
+ }
+ } else {
+ if (Boolean.TRUE.equals(resourceDef.getMandatory())) {
+ valid = false;
+ ValidationErrorCode error = ValidationErrorCode.SERVICE_DEF_VALIDATION_ERR_INVALID_MANADORY_VALUE_FOR_SERVICE_RESOURCE;
+ failures.add(new ValidationFailureDetailsBuilder()
+ .field(resourceDef.getName())
+ .isSemanticallyIncorrect()
+ .errorCode(error.getErrorCode())
+ .becauseOf(error.getMessage(resourceDef.getName(), resourceName))
+ .build());
+ }
+ }
+ }
+ }
+ }
+ }
if(LOG.isDebugEnabled()) {
LOG.debug(String.format("<== RangerServiceDefValidator.isValidResourceGraph(%s, %s): %s", serviceDef, failures, valid));
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBaseService.java
----------------------------------------------------------------------
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBaseService.java b/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBaseService.java
index 342b381..8d4e16f 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBaseService.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBaseService.java
@@ -125,7 +125,7 @@ public abstract class RangerBaseService {
try {
// we need to create one policy for each resource hierarchy
RangerServiceDefHelper serviceDefHelper = new RangerServiceDefHelper(serviceDef);
- for (List<RangerServiceDef.RangerResourceDef> aHierarchy : serviceDefHelper.getResourceHierarchies(RangerPolicy.POLICY_TYPE_ACCESS)) {
+ for (List<RangerServiceDef.RangerResourceDef> aHierarchy : serviceDefHelper.filterHierarchies_containsOnlyMandatoryResources(RangerPolicy.POLICY_TYPE_ACCESS)) {
RangerPolicy policy = getDefaultPolicy(aHierarchy);
if (policy != null) {
ret.add(policy);
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/agents-common/src/main/java/org/apache/ranger/plugin/util/ServiceDefUtil.java
----------------------------------------------------------------------
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/util/ServiceDefUtil.java b/agents-common/src/main/java/org/apache/ranger/plugin/util/ServiceDefUtil.java
index f8994a7..e91fbff 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/util/ServiceDefUtil.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/util/ServiceDefUtil.java
@@ -261,7 +261,10 @@ public class ServiceDefUtil {
private static RangerResourceDef mergeResourceDef(RangerResourceDef base, RangerResourceDef delta) {
RangerResourceDef ret = new RangerResourceDef(base);
- // retain base values for: itemId, name, type, level, parent, mandatory, lookupSupported
+ // retain base values for: itemId, name, type, level, parent, lookupSupported
+
+ if(Boolean.TRUE.equals(delta.getMandatory()))
+ ret.setMandatory(delta.getMandatory());
if(delta.getRecursiveSupported() != null)
ret.setRecursiveSupported(delta.getRecursiveSupported());
@@ -288,8 +291,7 @@ public class ServiceDefUtil {
if(StringUtils.isNotEmpty(delta.getValidationMessage()))
ret.setValidationMessage(delta.getValidationMessage());
- if(StringUtils.isNotEmpty(delta.getUiHint()))
- ret.setUiHint(delta.getUiHint());
+ ret.setUiHint(delta.getUiHint());
if(StringUtils.isNotEmpty(delta.getLabel()))
ret.setLabel(delta.getLabel());
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java
----------------------------------------------------------------------
diff --git a/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java b/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java
index f4e29c7..810d5bc 100644
--- a/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java
+++ b/agents-common/src/test/java/org/apache/ranger/plugin/model/validation/TestRangerServiceDefValidator.java
@@ -491,6 +491,30 @@ public class TestRangerServiceDefValidator {
_failures.clear(); assertFalse("Graph was valid!", _validator.isValidResourceGraph(_serviceDef, _failures));
assertFalse(_failures.isEmpty());
_utils.checkFailureForSemanticError(_failures, "resource graph");
+
+ data_bad = new Object[][] {
+ // { name, excludesSupported, recursiveSupported, mandatory, reg-exp, parent-level, level }
+ { "db", null, null, null, null, "" , -10 }, // -ve level is ok
+ { "table", null, null, true, null, "db", 0 }, // 0 level is ok; mandatory true here, but not at parent level?
+ { "column", null, null, null, null, "table", 10 }, // level is null!
+ { "udf", null, null, null, null, "db", 0 }, // should not conflict as it belong to a different hierarchy
+ };
+ resourceDefs = _utils.createResourceDefs(data_bad);
+ when(_serviceDef.getResources()).thenReturn(resourceDefs);
+ _failures.clear(); assertFalse(_validator.isValidResourceGraph(_serviceDef, _failures));
+ assertFalse(_failures.isEmpty());
+
+ data_good = new Object[][] {
+ // { name, excludesSupported, recursiveSupported, mandatory, reg-exp, parent-level, level }
+ { "db", null, null, true, null, "" , -10 }, // -ve level is ok
+ { "table", null, null, null, null, "db", 0 }, // 0 level is ok; mandatory true here, but not at parent level?
+ { "column", null, null, null, null, "table", 10 }, // level is null!
+ { "udf", null, null, true, null, "db", 0 }, // should not conflict as it belong to a different hierarchy
+ };
+ resourceDefs = _utils.createResourceDefs(data_good);
+ when(_serviceDef.getResources()).thenReturn(resourceDefs);
+ _failures.clear(); assertTrue(_validator.isValidResourceGraph(_serviceDef, _failures));
+ assertTrue(_failures.isEmpty());
}
@Test
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java
----------------------------------------------------------------------
diff --git a/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java b/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java
index 22ecabf..f89d14b 100644
--- a/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java
+++ b/hdfs-agent/src/main/java/org/apache/ranger/services/hdfs/RangerServiceHdfs.java
@@ -145,7 +145,7 @@ public class RangerServiceHdfs extends RangerBaseService {
try {
// we need to create one policy for keyadmin user for audit to HDFS
RangerServiceDefHelper serviceDefHelper = new RangerServiceDefHelper(serviceDef);
- for (List<RangerServiceDef.RangerResourceDef> aHierarchy : serviceDefHelper.getResourceHierarchies(RangerPolicy.POLICY_TYPE_ACCESS)) {
+ for (List<RangerServiceDef.RangerResourceDef> aHierarchy : serviceDefHelper.filterHierarchies_containsOnlyMandatoryResources(RangerPolicy.POLICY_TYPE_ACCESS)) {
RangerPolicy policy = getPolicyForKMSAudit(aHierarchy);
if (policy != null) {
ret.add(policy);
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/security-admin/src/main/webapp/scripts/models/BackboneFormDataType.js
----------------------------------------------------------------------
diff --git a/security-admin/src/main/webapp/scripts/models/BackboneFormDataType.js b/security-admin/src/main/webapp/scripts/models/BackboneFormDataType.js
index 1329eb2..22a418d 100644
--- a/security-admin/src/main/webapp/scripts/models/BackboneFormDataType.js
+++ b/security-admin/src/main/webapp/scripts/models/BackboneFormDataType.js
@@ -48,7 +48,6 @@ define(function(require) {
return configs;
}
}
- configs = _.sortBy(configs, function(m){ return m.itemId });
return configs;
};
var getValidators = function(formObj, v){
@@ -70,8 +69,13 @@ define(function(require) {
};
//Get configs for perticular policy type
- configs = getResourceConfigs(configs)
-
+ configs = getResourceConfigs(configs);
+ configs = _.sortBy(configs, function(m){ return m.itemId });
+ configs = _.filter(configs, function(m){
+ if(! _.isUndefined(m.uiHint) && ! XAUtils.hideIfNull(m, form)){
+ return m;
+ }
+ })
var samelevelFieldCreated = [];
_.each(configs, function(v, k,config) {
if (v != null) {
@@ -89,10 +93,9 @@ define(function(require) {
}
break;
}
- if($.inArray(v.parent, samelevelFieldCreated) >= 0){
+ if($.inArray(v.parent, samelevelFieldCreated) >= 0){
return;
}
-
if( isPolicyForm ){
var resourceOpts = {};
formObj.type = 'Resource';
http://git-wip-us.apache.org/repos/asf/ranger/blob/6fc9a823/security-admin/src/main/webapp/scripts/utils/XAUtils.js
----------------------------------------------------------------------
diff --git a/security-admin/src/main/webapp/scripts/utils/XAUtils.js b/security-admin/src/main/webapp/scripts/utils/XAUtils.js
index d9366a1..bb88ec3 100644
--- a/security-admin/src/main/webapp/scripts/utils/XAUtils.js
+++ b/security-admin/src/main/webapp/scripts/utils/XAUtils.js
@@ -1262,6 +1262,22 @@ define(function(require) {
}
return singleValue;
};
+ XAUtils.hideIfNull = function(obj, form){
+ //resorces hide show
+ var hideIfNull = false;
+ if(!_.isEmpty(obj.uiHint)){
+ var UIHint = JSON.parse(obj.uiHint);
+ if(!_.isUndefined(form.model.get('resources')) && !_.isEmpty(form.model.get('resources')) &&
+ _.has(form.model.get('resources'), obj.name)){
+ hideIfNull = false;
+ }else{
+ if(!_.isUndefined(UIHint.hideIfNull) && ! obj.mandatory){
+ hideIfNull = UIHint.hideIfNull;
+ }
+ }
+ }
+ return hideIfNull;
+ };
XAUtils.getBaseUrl = function (){
if(!window.location.origin){
window.location.origin = window.location.protocol + "//" + window.location.hostname + (window.location.port ? ':' + window.location.port: '');