Examples with RangerAdminClient org.apache.ranger.admin.client.RangerAdminClient used on opensource projects

Example 1 with RangerAdminClient

use of org.apache.ranger.admin.client.RangerAdminClient in project ranger by apache.

the class RangerBasePlugin method init.

public void init() {
    cleanup();
    RangerConfiguration configuration = RangerConfiguration.getInstance();
    configuration.addResourcesForServiceType(serviceType);
    configuration.initAudit(appId);
    String propertyPrefix = "ranger.plugin." + serviceType;
    long pollingIntervalMs = configuration.getLong(propertyPrefix + ".policy.pollIntervalMs", 30 * 1000);
    String cacheDir = configuration.get(propertyPrefix + ".policy.cache.dir");
    serviceName = configuration.get(propertyPrefix + ".service.name");
    clusterName = RangerConfiguration.getInstance().get(propertyPrefix + ".ambari.cluster.name", "");
    useForwardedIPAddress = configuration.getBoolean(propertyPrefix + ".use.x-forwarded-for.ipaddress", false);
    String trustedProxyAddressString = configuration.get(propertyPrefix + ".trusted.proxy.ipaddresses");
    trustedProxyAddresses = StringUtils.split(trustedProxyAddressString, RANGER_TRUSTED_PROXY_IPADDRESSES_SEPARATOR_CHAR);
    if (trustedProxyAddresses != null) {
        for (int i = 0; i < trustedProxyAddresses.length; i++) {
            trustedProxyAddresses[i] = trustedProxyAddresses[i].trim();
        }
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug(propertyPrefix + ".use.x-forwarded-for.ipaddress:" + useForwardedIPAddress);
        LOG.debug(propertyPrefix + ".trusted.proxy.ipaddresses:[" + StringUtils.join(trustedProxyAddresses, ", ") + "]");
    }
    if (useForwardedIPAddress && StringUtils.isBlank(trustedProxyAddressString)) {
        LOG.warn("Property " + propertyPrefix + ".use.x-forwarded-for.ipaddress" + " is set to true, and Property " + propertyPrefix + ".trusted.proxy.ipaddresses" + " is not set");
        LOG.warn("Ranger plugin will trust RemoteIPAddress and treat first X-Forwarded-Address in the access-request as the clientIPAddress");
    }
    policyEngineOptions.configureForPlugin(configuration, propertyPrefix);
    LOG.info(policyEngineOptions);
    RangerAdminClient admin = createAdminClient(serviceName, appId, propertyPrefix);
    refresher = new PolicyRefresher(this, serviceType, appId, serviceName, admin, pollingIntervalMs, cacheDir);
    refresher.setDaemon(true);
    refresher.startRefresher();
    long policyReorderIntervalMs = configuration.getLong(propertyPrefix + ".policy.policyReorderInterval", 60 * 1000);
    if (policyReorderIntervalMs >= 0 && policyReorderIntervalMs < 15 * 1000) {
        policyReorderIntervalMs = 15 * 1000;
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug(propertyPrefix + ".policy.policyReorderInterval:" + policyReorderIntervalMs);
    }
    if (policyEngineOptions.disableTrieLookupPrefilter && policyReorderIntervalMs > 0) {
        policyEngineRefreshTimer = new Timer("PolicyEngineRefreshTimer", true);
        try {
            policyEngineRefreshTimer.schedule(new PolicyEngineRefresher(this), policyReorderIntervalMs, policyReorderIntervalMs);
            if (LOG.isDebugEnabled()) {
                LOG.debug("Scheduled PolicyEngineRefresher to reorder policies based on number of evaluations in and every " + policyReorderIntervalMs + " milliseconds");
            }
        } catch (IllegalStateException exception) {
            LOG.error("Error scheduling policyEngineRefresher:", exception);
            LOG.error("*** PolicyEngine will NOT be reorderd based on number of evaluations every " + policyReorderIntervalMs + " milliseconds ***");
            policyEngineRefreshTimer = null;
        }
    } else {
        LOG.info("Policies will NOT be reordered based on number of evaluations");
    }
}

Example 2 with RangerAdminClient

use of org.apache.ranger.admin.client.RangerAdminClient in project ranger by apache.

the class RangerBasePlugin method revokeAccess.

public void revokeAccess(GrantRevokeRequest request, RangerAccessResultProcessor resultProcessor) throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerBasePlugin.revokeAccess(" + request + ")");
    }
    PolicyRefresher refresher = this.refresher;
    RangerAdminClient admin = refresher == null ? null : refresher.getRangerAdminClient();
    boolean isSuccess = false;
    try {
        if (admin == null) {
            throw new Exception("ranger-admin client is null");
        }
        admin.revokeAccess(request);
        isSuccess = true;
    } finally {
        auditGrantRevoke(request, "revoke", isSuccess, resultProcessor);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerBasePlugin.revokeAccess(" + request + ")");
    }
}

Example 3 with RangerAdminClient

use of org.apache.ranger.admin.client.RangerAdminClient in project ranger by apache.

the class RangerBasePlugin method grantAccess.

public void grantAccess(GrantRevokeRequest request, RangerAccessResultProcessor resultProcessor) throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerBasePlugin.grantAccess(" + request + ")");
    }
    PolicyRefresher refresher = this.refresher;
    RangerAdminClient admin = refresher == null ? null : refresher.getRangerAdminClient();
    boolean isSuccess = false;
    try {
        if (admin == null) {
            throw new Exception("ranger-admin client is null");
        }
        admin.grantAccess(request);
        isSuccess = true;
    } finally {
        auditGrantRevoke(request, "grant", isSuccess, resultProcessor);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerBasePlugin.grantAccess(" + request + ")");
    }
}

Example 4 with RangerAdminClient

use of org.apache.ranger.admin.client.RangerAdminClient in project ranger by apache.

the class RangerBasePlugin method createAdminClient.

public static RangerAdminClient createAdminClient(String rangerServiceName, String applicationId, String propertyPrefix) {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerBasePlugin.createAdminClient(" + rangerServiceName + ", " + applicationId + ", " + propertyPrefix + ")");
    }
    RangerAdminClient ret = null;
    String propertyName = propertyPrefix + ".policy.source.impl";
    String policySourceImpl = RangerConfiguration.getInstance().get(propertyName);
    if (StringUtils.isEmpty(policySourceImpl)) {
        if (LOG.isDebugEnabled()) {
            LOG.debug(String.format("Value for property[%s] was null or empty. Unexpected! Will use policy source of type[%s]", propertyName, RangerAdminRESTClient.class.getName()));
        }
    } else {
        if (LOG.isDebugEnabled()) {
            LOG.debug(String.format("Value for property[%s] was [%s].", propertyName, policySourceImpl));
        }
        try {
            @SuppressWarnings("unchecked") Class<RangerAdminClient> adminClass = (Class<RangerAdminClient>) Class.forName(policySourceImpl);
            ret = adminClass.newInstance();
        } catch (Exception excp) {
            LOG.error("failed to instantiate policy source of type '" + policySourceImpl + "'. Will use policy source of type '" + RangerAdminRESTClient.class.getName() + "'", excp);
        }
    }
    if (ret == null) {
        ret = new RangerAdminRESTClient();
    }
    ret.init(rangerServiceName, applicationId, propertyPrefix);
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerBasePlugin.createAdminClient(" + rangerServiceName + ", " + applicationId + ", " + propertyPrefix + "): policySourceImpl=" + policySourceImpl + ", client=" + ret);
    }
    return ret;
}