Examples with XXServiceDef org.apache.ranger.entity.XXServiceDef used on opensource projects

Example 46 with XXServiceDef

use of org.apache.ranger.entity.XXServiceDef in project ranger by apache.

the class ServiceDBStore method updatePolicy.

@Override
public RangerPolicy updatePolicy(RangerPolicy policy) throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> ServiceDBStore.updatePolicy(" + policy + ")");
    }
    XXPolicy xxExisting = daoMgr.getXXPolicy().getById(policy.getId());
    RangerPolicy existing = policyService.getPopulatedViewObject(xxExisting);
    if (existing == null) {
        throw new Exception("no policy exists with ID=" + policy.getId());
    }
    RangerService service = getServiceByName(policy.getService());
    if (service == null) {
        throw new Exception("service does not exist - name=" + policy.getService());
    }
    XXServiceDef xServiceDef = daoMgr.getXXServiceDef().findByName(service.getType());
    if (xServiceDef == null) {
        throw new Exception("service-def does not exist - name=" + service.getType());
    }
    if (!StringUtils.equalsIgnoreCase(existing.getService(), policy.getService())) {
        throw new Exception("policy id=" + policy.getId() + " already exists in service " + existing.getService() + ". It can not be moved to service " + policy.getService());
    }
    boolean renamed = !StringUtils.equalsIgnoreCase(policy.getName(), existing.getName());
    if (renamed) {
        XXPolicy newNamePolicy = daoMgr.getXXPolicy().findByNameAndServiceId(policy.getName(), service.getId());
        if (newNamePolicy != null) {
            throw new Exception("another policy already exists with name '" + policy.getName() + "'. ID=" + newNamePolicy.getId());
        }
    }
    Map<String, RangerPolicyResource> newResources = policy.getResources();
    List<RangerPolicyItem> policyItems = policy.getPolicyItems();
    List<RangerPolicyItem> denyPolicyItems = policy.getDenyPolicyItems();
    List<RangerPolicyItem> allowExceptions = policy.getAllowExceptions();
    List<RangerPolicyItem> denyExceptions = policy.getDenyExceptions();
    List<RangerDataMaskPolicyItem> dataMaskPolicyItems = policy.getDataMaskPolicyItems();
    List<RangerRowFilterPolicyItem> rowFilterItems = policy.getRowFilterPolicyItems();
    List<String> policyLabels = policy.getPolicyLabels();
    policy.setCreateTime(xxExisting.getCreateTime());
    policy.setGuid(xxExisting.getGuid());
    policy.setVersion(xxExisting.getVersion());
    List<XXTrxLog> trxLogList = policyService.getTransactionLog(policy, xxExisting, RangerPolicyService.OPERATION_UPDATE_CONTEXT);
    updatePolicySignature(policy);
    boolean isTagVersionUpdateNeeded = false;
    if (EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME.equals(service.getType())) {
        isTagVersionUpdateNeeded = existing.getIsEnabled() ? !policy.getIsEnabled() : policy.getIsEnabled();
        isTagVersionUpdateNeeded = isTagVersionUpdateNeeded || !StringUtils.equals(existing.getResourceSignature(), policy.getResourceSignature());
    }
    policy = policyService.update(policy);
    XXPolicy newUpdPolicy = daoMgr.getXXPolicy().getById(policy.getId());
    deleteExistingPolicyResources(policy);
    deleteExistingPolicyItems(policy);
    deleteExistingPolicyLabel(policy);
    createNewResourcesForPolicy(policy, newUpdPolicy, newResources);
    createNewPolicyItemsForPolicy(policy, newUpdPolicy, policyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ALLOW);
    createNewPolicyItemsForPolicy(policy, newUpdPolicy, denyPolicyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DENY);
    createNewPolicyItemsForPolicy(policy, newUpdPolicy, allowExceptions, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ALLOW_EXCEPTIONS);
    createNewPolicyItemsForPolicy(policy, newUpdPolicy, denyExceptions, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DENY_EXCEPTIONS);
    createNewDataMaskPolicyItemsForPolicy(policy, newUpdPolicy, dataMaskPolicyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DATAMASK);
    createNewRowFilterPolicyItemsForPolicy(policy, newUpdPolicy, rowFilterItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ROWFILTER);
    createNewLabelsForPolicy(newUpdPolicy, policyLabels);
    handlePolicyUpdate(service, isTagVersionUpdateNeeded);
    RangerPolicy updPolicy = policyService.getPopulatedViewObject(newUpdPolicy);
    dataHistService.createObjectDataHistory(updPolicy, RangerDataHistService.ACTION_UPDATE);
    bizUtil.createTrxLog(trxLogList);
    return updPolicy;
}

Example 47 with XXServiceDef

use of org.apache.ranger.entity.XXServiceDef in project ranger by apache.

the class ServiceDBStore method createPolicy.

@Override
public RangerPolicy createPolicy(RangerPolicy policy) throws Exception {
    RangerService service = getServiceByName(policy.getService());
    if (service == null) {
        throw new Exception("service does not exist - name=" + policy.getService());
    }
    XXServiceDef xServiceDef = daoMgr.getXXServiceDef().findByName(service.getType());
    if (xServiceDef == null) {
        throw new Exception("service-def does not exist - name=" + service.getType());
    }
    XXPolicy existing = daoMgr.getXXPolicy().findByNameAndServiceId(policy.getName(), service.getId());
    if (existing != null) {
        throw new Exception("policy already exists: ServiceName=" + policy.getService() + "; PolicyName=" + policy.getName() + ". ID=" + existing.getId());
    }
    Map<String, RangerPolicyResource> resources = policy.getResources();
    List<RangerPolicyItem> policyItems = policy.getPolicyItems();
    List<RangerPolicyItem> denyPolicyItems = policy.getDenyPolicyItems();
    List<RangerPolicyItem> allowExceptions = policy.getAllowExceptions();
    List<RangerPolicyItem> denyExceptions = policy.getDenyExceptions();
    List<RangerDataMaskPolicyItem> dataMaskItems = policy.getDataMaskPolicyItems();
    List<RangerRowFilterPolicyItem> rowFilterItems = policy.getRowFilterPolicyItems();
    List<String> policyLabels = policy.getPolicyLabels();
    policy.setVersion(Long.valueOf(1));
    updatePolicySignature(policy);
    if (populateExistingBaseFields) {
        assignedIdPolicyService.setPopulateExistingBaseFields(true);
        daoMgr.getXXPolicy().setIdentityInsert(true);
        policy = assignedIdPolicyService.create(policy);
        daoMgr.getXXPolicy().setIdentityInsert(false);
        daoMgr.getXXPolicy().updateSequence();
        assignedIdPolicyService.setPopulateExistingBaseFields(false);
    } else {
        policy = policyService.create(policy);
    }
    XXPolicy xCreatedPolicy = daoMgr.getXXPolicy().getById(policy.getId());
    createNewResourcesForPolicy(policy, xCreatedPolicy, resources);
    createNewPolicyItemsForPolicy(policy, xCreatedPolicy, policyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ALLOW);
    createNewPolicyItemsForPolicy(policy, xCreatedPolicy, denyPolicyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DENY);
    createNewPolicyItemsForPolicy(policy, xCreatedPolicy, allowExceptions, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ALLOW_EXCEPTIONS);
    createNewPolicyItemsForPolicy(policy, xCreatedPolicy, denyExceptions, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DENY_EXCEPTIONS);
    createNewDataMaskPolicyItemsForPolicy(policy, xCreatedPolicy, dataMaskItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DATAMASK);
    createNewRowFilterPolicyItemsForPolicy(policy, xCreatedPolicy, rowFilterItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ROWFILTER);
    createNewLabelsForPolicy(xCreatedPolicy, policyLabels);
    handlePolicyUpdate(service, true);
    RangerPolicy createdPolicy = policyService.getPopulatedViewObject(xCreatedPolicy);
    dataHistService.createObjectDataHistory(createdPolicy, RangerDataHistService.ACTION_CREATE);
    List<XXTrxLog> trxLogList = policyService.getTransactionLog(createdPolicy, RangerPolicyService.OPERATION_CREATE_CONTEXT);
    bizUtil.createTrxLog(trxLogList);
    return createdPolicy;
}

Example 48 with XXServiceDef

use of org.apache.ranger.entity.XXServiceDef in project ranger by apache.

the class ServiceDBStore method writeBookForPolicyItems.

private void writeBookForPolicyItems(RangerPolicy policy, RangerPolicyItem policyItem, RangerDataMaskPolicyItem dataMaskPolicyItem, RangerRowFilterPolicyItem rowFilterPolicyItem, Row row, String policyConditionType) {
    if (LOG.isDebugEnabled()) {
        // To avoid PMD violation
        LOG.debug("policyConditionType:[" + policyConditionType + "]");
    }
    List<String> groups = new ArrayList<String>();
    List<String> users = new ArrayList<String>();
    String groupNames = "";
    String policyConditionTypeValue = "";
    String userNames = "";
    String policyLabelNames = "";
    String accessType = "";
    String policyStatus = "";
    String policyType = "";
    Boolean delegateAdmin = false;
    String isRecursive = "";
    String isExcludes = "";
    String serviceName = "";
    String description = "";
    Boolean isAuditEnabled = true;
    isAuditEnabled = policy.getIsAuditEnabled();
    String isExcludesValue = "";
    Cell cell = row.createCell(0);
    cell.setCellValue(policy.getId());
    List<RangerPolicyItemAccess> accesses = new ArrayList<RangerPolicyItemAccess>();
    List<RangerPolicyItemCondition> conditionsList = new ArrayList<RangerPolicyItemCondition>();
    String conditionKeyValue = "";
    List<String> policyLabels = new ArrayList<String>();
    String resValue = "";
    String resourceKeyVal = "";
    String isRecursiveValue = "";
    String resKey = "";
    StringBuffer sb = new StringBuffer();
    StringBuffer sbIsRecursive = new StringBuffer();
    StringBuffer sbIsExcludes = new StringBuffer();
    Map<String, RangerPolicyResource> resources = policy.getResources();
    RangerPolicyItemDataMaskInfo dataMaskInfo = new RangerPolicyItemDataMaskInfo();
    RangerPolicyItemRowFilterInfo filterInfo = new RangerPolicyItemRowFilterInfo();
    cell = row.createCell(1);
    cell.setCellValue(policy.getName());
    cell = row.createCell(2);
    if (resources != null) {
        for (Entry<String, RangerPolicyResource> resource : resources.entrySet()) {
            resKey = resource.getKey();
            RangerPolicyResource policyResource = resource.getValue();
            List<String> resvalueList = policyResource.getValues();
            isExcludes = policyResource.getIsExcludes().toString();
            isRecursive = policyResource.getIsRecursive().toString();
            resValue = resvalueList.toString();
            sb = sb.append(resourceKeyVal).append("; ").append(resKey).append("=").append(resValue);
            sbIsExcludes = sbIsExcludes.append(resourceKeyVal).append("; ").append(resKey).append("=[").append(isExcludes).append("]");
            sbIsRecursive = sbIsRecursive.append(resourceKeyVal).append("; ").append(resKey).append("=[").append(isRecursive).append("]");
        }
        isExcludesValue = sbIsExcludes.toString();
        isExcludesValue = isExcludesValue.substring(1);
        isRecursiveValue = sbIsRecursive.toString();
        isRecursiveValue = isRecursiveValue.substring(1);
        resourceKeyVal = sb.toString();
        resourceKeyVal = resourceKeyVal.substring(1);
        cell.setCellValue(resourceKeyVal);
        if (policyItem != null && dataMaskPolicyItem == null && rowFilterPolicyItem == null) {
            groups = policyItem.getGroups();
            users = policyItem.getUsers();
            accesses = policyItem.getAccesses();
            delegateAdmin = policyItem.getDelegateAdmin();
            conditionsList = policyItem.getConditions();
        } else if (dataMaskPolicyItem != null && policyItem == null && rowFilterPolicyItem == null) {
            groups = dataMaskPolicyItem.getGroups();
            users = dataMaskPolicyItem.getUsers();
            accesses = dataMaskPolicyItem.getAccesses();
            delegateAdmin = dataMaskPolicyItem.getDelegateAdmin();
            conditionsList = dataMaskPolicyItem.getConditions();
            dataMaskInfo = dataMaskPolicyItem.getDataMaskInfo();
            String dataMaskType = dataMaskInfo.getDataMaskType();
            String conditionExpr = dataMaskInfo.getConditionExpr();
            String valueExpr = dataMaskInfo.getValueExpr();
            String maskingInfo = "dataMasktype=[" + dataMaskType + "]";
            if (conditionExpr != null && !conditionExpr.isEmpty() && valueExpr != null && !valueExpr.isEmpty()) {
                maskingInfo = maskingInfo + "; conditionExpr=[" + conditionExpr + "]";
            }
            cell = row.createCell(17);
            cell.setCellValue(maskingInfo);
        } else if (rowFilterPolicyItem != null && policyItem == null && dataMaskPolicyItem == null) {
            groups = rowFilterPolicyItem.getGroups();
            users = rowFilterPolicyItem.getUsers();
            accesses = rowFilterPolicyItem.getAccesses();
            delegateAdmin = rowFilterPolicyItem.getDelegateAdmin();
            conditionsList = rowFilterPolicyItem.getConditions();
            filterInfo = rowFilterPolicyItem.getRowFilterInfo();
            String filterExpr = filterInfo.getFilterExpr();
            cell = row.createCell(18);
            cell.setCellValue(filterExpr);
        }
        if (CollectionUtils.isNotEmpty(accesses)) {
            for (RangerPolicyItemAccess access : accesses) {
                accessType = accessType + access.getType();
                accessType = accessType + " ,";
            }
            accessType = accessType.substring(0, accessType.lastIndexOf(","));
        }
        if (CollectionUtils.isNotEmpty(groups)) {
            groupNames = groupNames + groups.toString();
            StringTokenizer groupToken = new StringTokenizer(groupNames, "[]");
            groupNames = groupToken.nextToken().toString();
        }
        if (CollectionUtils.isNotEmpty(users)) {
            userNames = userNames + users.toString();
            StringTokenizer userToken = new StringTokenizer(userNames, "[]");
            userNames = userToken.nextToken().toString();
        }
        String conditionValue = "";
        for (RangerPolicyItemCondition conditions : conditionsList) {
            String conditionType = conditions.getType();
            List<String> conditionList = conditions.getValues();
            conditionValue = conditionList.toString();
            conditionKeyValue = conditionType + "=" + conditionValue;
        }
        cell = row.createCell(3);
        cell.setCellValue(groupNames);
        cell = row.createCell(4);
        cell.setCellValue(userNames);
        cell = row.createCell(5);
        cell.setCellValue(accessType.trim());
        cell = row.createCell(6);
        XXService xxservice = daoMgr.getXXService().findByName(policy.getService());
        String ServiceType = "";
        if (xxservice != null) {
            Long ServiceId = xxservice.getType();
            XXServiceDef xxservDef = daoMgr.getXXServiceDef().getById(ServiceId);
            if (xxservDef != null) {
                ServiceType = xxservDef.getName();
            }
        }
        if (policyConditionType != null) {
            policyConditionTypeValue = policyConditionType;
        }
        if (policyConditionType == null && ServiceType.equalsIgnoreCase("tag")) {
            policyConditionTypeValue = POLICY_ALLOW_INCLUDE;
        } else if (policyConditionType == null) {
            policyConditionTypeValue = "";
        }
        cell.setCellValue(ServiceType);
        cell = row.createCell(7);
    }
    if (policy.getIsEnabled()) {
        policyStatus = "Enabled";
    } else {
        policyStatus = "Disabled";
    }
    policyLabels = policy.getPolicyLabels();
    if (CollectionUtils.isNotEmpty(policyLabels)) {
        policyLabelNames = policyLabelNames + policyLabels.toString();
        StringTokenizer policyLabelToken = new StringTokenizer(policyLabelNames, "[]");
        policyLabelNames = policyLabelToken.nextToken().toString();
    }
    cell.setCellValue(policyStatus);
    cell = row.createCell(8);
    int policyTypeInt = policy.getPolicyType();
    switch(policyTypeInt) {
        case RangerPolicy.POLICY_TYPE_ACCESS:
            policyType = POLICY_TYPE_ACCESS;
            break;
        case RangerPolicy.POLICY_TYPE_DATAMASK:
            policyType = POLICY_TYPE_DATAMASK;
            break;
        case RangerPolicy.POLICY_TYPE_ROWFILTER:
            policyType = POLICY_TYPE_ROWFILTER;
            break;
    }
    cell.setCellValue(policyType);
    cell = row.createCell(9);
    cell.setCellValue(delegateAdmin.toString().toUpperCase());
    cell = row.createCell(10);
    cell.setCellValue(isRecursiveValue);
    cell = row.createCell(11);
    cell.setCellValue(isExcludesValue);
    cell = row.createCell(12);
    serviceName = policy.getService();
    cell.setCellValue(serviceName);
    cell = row.createCell(13);
    description = policy.getDescription();
    cell.setCellValue(description);
    cell = row.createCell(14);
    cell.setCellValue(isAuditEnabled.toString().toUpperCase());
    cell = row.createCell(15);
    cell.setCellValue(conditionKeyValue.trim());
    cell = row.createCell(16);
    cell.setCellValue(policyConditionTypeValue);
    cell = row.createCell(19);
    cell.setCellValue(policyLabelNames);
}

Example 49 with XXServiceDef

use of org.apache.ranger.entity.XXServiceDef in project ranger by apache.

the class PatchMigration_J10002 method mapXResourceToPolicy.

private RangerPolicy mapXResourceToPolicy(RangerPolicy policy, XXResource xRes, RangerService service) {
    String serviceName = service.getName();
    String serviceType = service.getType();
    String name = xRes.getPolicyName();
    String description = xRes.getDescription();
    Boolean isAuditEnabled = true;
    Boolean isEnabled = true;
    Map<String, RangerPolicyResource> resources = new HashMap<String, RangerPolicyResource>();
    List<RangerPolicyItem> policyItems = new ArrayList<RangerPolicyItem>();
    XXServiceDef svcDef = daoMgr.getXXServiceDef().findByName(serviceType);
    if (svcDef == null) {
        logger.error(serviceType + ": service-def not found. Skipping policy '" + name + "'");
        return null;
    }
    List<XXAuditMap> auditMapList = daoMgr.getXXAuditMap().findByResourceId(xRes.getId());
    if (stringUtil.isEmpty(auditMapList)) {
        isAuditEnabled = false;
    }
    if (xRes.getResourceStatus() == AppConstants.STATUS_DISABLED) {
        isEnabled = false;
    }
    Boolean isPathRecursive = xRes.getIsRecursive() == RangerCommonEnums.BOOL_TRUE;
    Boolean isTableExcludes = xRes.getTableType() == RangerCommonEnums.POLICY_EXCLUSION;
    Boolean isColumnExcludes = xRes.getColumnType() == RangerCommonEnums.POLICY_EXCLUSION;
    if (StringUtils.equalsIgnoreCase(serviceType, "hdfs")) {
        toRangerResourceList(xRes.getName(), "path", Boolean.FALSE, isPathRecursive, resources);
    } else if (StringUtils.equalsIgnoreCase(serviceType, "hbase")) {
        toRangerResourceList(xRes.getTables(), "table", isTableExcludes, Boolean.FALSE, resources);
        toRangerResourceList(xRes.getColumnFamilies(), "column-family", Boolean.FALSE, Boolean.FALSE, resources);
        toRangerResourceList(xRes.getColumns(), "column", isColumnExcludes, Boolean.FALSE, resources);
    } else if (StringUtils.equalsIgnoreCase(serviceType, "hive")) {
        toRangerResourceList(xRes.getDatabases(), "database", Boolean.FALSE, Boolean.FALSE, resources);
        toRangerResourceList(xRes.getTables(), "table", isTableExcludes, Boolean.FALSE, resources);
        toRangerResourceList(xRes.getColumns(), "column", isColumnExcludes, Boolean.FALSE, resources);
        toRangerResourceList(xRes.getUdfs(), "udf", Boolean.FALSE, Boolean.FALSE, resources);
    } else if (StringUtils.equalsIgnoreCase(serviceType, "knox")) {
        toRangerResourceList(xRes.getTopologies(), "topology", Boolean.FALSE, Boolean.FALSE, resources);
        toRangerResourceList(xRes.getServices(), "service", Boolean.FALSE, Boolean.FALSE, resources);
    } else if (StringUtils.equalsIgnoreCase(serviceType, "storm")) {
        toRangerResourceList(xRes.getTopologies(), "topology", Boolean.FALSE, Boolean.FALSE, resources);
    }
    policyItems = getPolicyItemListForRes(xRes, svcDef);
    policy.setService(serviceName);
    policy.setName(name);
    policy.setDescription(description);
    policy.setIsAuditEnabled(isAuditEnabled);
    policy.setIsEnabled(isEnabled);
    policy.setResources(resources);
    policy.setPolicyItems(policyItems);
    policy.setCreateTime(xRes.getCreateTime());
    policy.setUpdateTime(xRes.getUpdateTime());
    XXPortalUser createdByUser = daoMgr.getXXPortalUser().getById(xRes.getAddedByUserId());
    XXPortalUser updByUser = daoMgr.getXXPortalUser().getById(xRes.getUpdatedByUserId());
    if (createdByUser != null) {
        policy.setCreatedBy(createdByUser.getLoginId());
    }
    if (updByUser != null) {
        policy.setUpdatedBy(updByUser.getLoginId());
    }
    policy.setId(xRes.getId());
    return policy;
}

Example 50 with XXServiceDef

use of org.apache.ranger.entity.XXServiceDef in project ranger by apache.

the class ServiceREST method secureRevokeAccess.

@POST
@Path("/secure/services/revoke/{serviceName}")
@Produces({ "application/json", "application/xml" })
public RESTResponse secureRevokeAccess(@PathParam("serviceName") String serviceName, GrantRevokeRequest revokeRequest, @Context HttpServletRequest request) throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> ServiceREST.secureRevokeAccess(" + serviceName + ", " + revokeRequest + ")");
    }
    RESTResponse ret = new RESTResponse();
    RangerPerfTracer perf = null;
    if (revokeRequest != null) {
        if (serviceUtil.isValidService(serviceName, request)) {
            try {
                if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
                    perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.secureRevokeAccess(serviceName=" + serviceName + ")");
                }
                validateGrantRevokeRequest(revokeRequest);
                String userName = revokeRequest.getGrantor();
                Set<String> userGroups = CollectionUtils.isNotEmpty(revokeRequest.getGrantorGroups()) ? revokeRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
                RangerAccessResource resource = new RangerAccessResourceImpl(StringUtil.toStringObjectMap(revokeRequest.getResource()));
                boolean isAdmin = hasAdminAccess(serviceName, userName, userGroups, resource);
                boolean isAllowed = false;
                boolean isKeyAdmin = bizUtil.isKeyAdmin();
                bizUtil.blockAuditorRoleUser();
                XXService xService = daoManager.getXXService().findByName(serviceName);
                XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
                RangerService rangerService = svcStore.getServiceByName(serviceName);
                if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
                    if (isKeyAdmin) {
                        isAllowed = true;
                    } else {
                        isAllowed = bizUtil.isUserAllowedForGrantRevoke(rangerService, Allowed_User_List_For_Grant_Revoke, userName);
                    }
                } else {
                    if (isAdmin) {
                        isAllowed = true;
                    } else {
                        isAllowed = bizUtil.isUserAllowedForGrantRevoke(rangerService, Allowed_User_List_For_Grant_Revoke, userName);
                    }
                }
                if (isAllowed) {
                    RangerPolicy policy = getExactMatchPolicyForResource(serviceName, resource, userName);
                    if (policy != null) {
                        boolean policyUpdated = false;
                        policyUpdated = ServiceRESTUtil.processRevokeRequest(policy, revokeRequest);
                        if (policyUpdated) {
                            svcStore.updatePolicy(policy);
                        } else {
                            LOG.error("processSecureRevokeRequest processing failed");
                            throw new Exception("processSecureRevokeRequest processing failed");
                        }
                    }
                } else {
                    LOG.error("secureRevokeAccess(" + serviceName + ", " + revokeRequest + ") failed as User doesn't have permission to revoke Policy");
                    throw restErrorUtil.createGrantRevokeRESTException("User doesn't have necessary permission to revoke access");
                }
            } catch (WebApplicationException excp) {
                throw excp;
            } catch (Throwable excp) {
                LOG.error("secureRevokeAccess(" + serviceName + ", " + revokeRequest + ") failed", excp);
                throw restErrorUtil.createRESTException(excp.getMessage());
            } finally {
                RangerPerfTracer.log(perf);
            }
            ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
        }
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== ServiceREST.secureRevokeAccess(" + serviceName + ", " + revokeRequest + "): " + ret);
    }
    return ret;
}