Examples with RangerPolicyItem org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem used on opensource projects

Example 11 with RangerPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem in project ranger by apache.

the class RangerServiceKMS method getDefaultRangerPolicies.

@Override
public List<RangerPolicy> getDefaultRangerPolicies() throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerServiceKMS.getDefaultRangerPolicies() ");
    }
    List<RangerPolicy> ret = super.getDefaultRangerPolicies();
    String adminPrincipal = getConfig().get(ADMIN_USER_PRINCIPAL);
    String adminKeytab = getConfig().get(ADMIN_USER_KEYTAB);
    String authType = getConfig().get(RANGER_AUTH_TYPE, "simple");
    String adminUser = getLookupUser(authType, adminPrincipal, adminKeytab);
    // Add default policies for HDFS, HIVE, HABSE & OM users.
    List<RangerServiceDef.RangerAccessTypeDef> hdfsAccessTypeDefs = new ArrayList<RangerServiceDef.RangerAccessTypeDef>();
    List<RangerServiceDef.RangerAccessTypeDef> omAccessTypeDefs = new ArrayList<RangerServiceDef.RangerAccessTypeDef>();
    List<RangerServiceDef.RangerAccessTypeDef> hiveAccessTypeDefs = new ArrayList<RangerServiceDef.RangerAccessTypeDef>();
    List<RangerServiceDef.RangerAccessTypeDef> hbaseAccessTypeDefs = new ArrayList<RangerServiceDef.RangerAccessTypeDef>();
    for (RangerServiceDef.RangerAccessTypeDef accessTypeDef : serviceDef.getAccessTypes()) {
        if (accessTypeDef.getName().equalsIgnoreCase(ACCESS_TYPE_GET_METADATA)) {
            hdfsAccessTypeDefs.add(accessTypeDef);
            omAccessTypeDefs.add(accessTypeDef);
            hiveAccessTypeDefs.add(accessTypeDef);
        } else if (accessTypeDef.getName().equalsIgnoreCase(ACCESS_TYPE_GENERATE_EEK)) {
            hdfsAccessTypeDefs.add(accessTypeDef);
            omAccessTypeDefs.add(accessTypeDef);
        } else if (accessTypeDef.getName().equalsIgnoreCase(ACCESS_TYPE_DECRYPT_EEK)) {
            hiveAccessTypeDefs.add(accessTypeDef);
            hbaseAccessTypeDefs.add(accessTypeDef);
        }
    }
    for (RangerPolicy defaultPolicy : ret) {
        if (defaultPolicy.getName().contains("all") && StringUtils.isNotBlank(lookUpUser)) {
            RangerPolicyItem policyItemForLookupUser = new RangerPolicyItem();
            policyItemForLookupUser.setUsers(Collections.singletonList(lookUpUser));
            policyItemForLookupUser.setAccesses(Collections.singletonList(new RangerPolicyItemAccess(ACCESS_TYPE_GET)));
            policyItemForLookupUser.setDelegateAdmin(false);
            defaultPolicy.getPolicyItems().add(policyItemForLookupUser);
        }
        List<RangerPolicy.RangerPolicyItem> policyItems = defaultPolicy.getPolicyItems();
        for (RangerPolicy.RangerPolicyItem item : policyItems) {
            List<String> users = item.getUsers();
            if (StringUtils.isNotBlank(adminUser)) {
                users.add(adminUser);
            }
            item.setUsers(users);
        }
        String hdfsUser = getConfig().get("ranger.kms.service.user.hdfs", "hdfs");
        if (hdfsUser != null && !hdfsUser.isEmpty()) {
            LOG.info("Creating default KMS policy item for " + hdfsUser);
            List<String> users = new ArrayList<String>();
            users.add(hdfsUser);
            RangerPolicy.RangerPolicyItem policyItem = createDefaultPolicyItem(hdfsAccessTypeDefs, users);
            policyItems.add(policyItem);
        }
        final String omUser = getConfig().get("ranger.kms.service.user.om", "om");
        if (StringUtils.isNotEmpty(omUser)) {
            LOG.info("Creating default KMS policy item for " + omUser);
            List<String> users = new ArrayList<String>();
            users.add(omUser);
            RangerPolicy.RangerPolicyItem policyItem = createDefaultPolicyItem(omAccessTypeDefs, users);
            policyItems.add(policyItem);
        }
        String hiveUser = getConfig().get("ranger.kms.service.user.hive", "hive");
        if (hiveUser != null && !hiveUser.isEmpty()) {
            LOG.info("Creating default KMS policy item for " + hiveUser);
            List<String> users = new ArrayList<String>();
            users.add(hiveUser);
            RangerPolicy.RangerPolicyItem policyItem = createDefaultPolicyItem(hiveAccessTypeDefs, users);
            policyItems.add(policyItem);
        }
        String hbaseUser = getConfig().get("ranger.kms.service.user.hbase", "hbase");
        if (hbaseUser != null && !hbaseUser.isEmpty()) {
            LOG.info("Creating default KMS policy item for " + hbaseUser);
            List<String> users = new ArrayList<String>();
            users.add(hbaseUser);
            RangerPolicy.RangerPolicyItem policyItem = createDefaultPolicyItem(hbaseAccessTypeDefs, users);
            policyItems.add(policyItem);
        }
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerServiceKMS.getDefaultRangerPolicies() : " + ret);
    }
    return ret;
}

Example 12 with RangerPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem in project ranger by apache.

the class PatchForMigratingOldRegimePolicyJson_J10046 method buildLists.

private void buildLists(List<? extends RangerPolicyItem> policyItems, Set<String> accesses, Set<String> conditions, Set<String> users, Set<String> groups) {
    for (RangerPolicyItem item : policyItems) {
        for (RangerPolicyItemAccess policyAccess : item.getAccesses()) {
            accesses.add(policyAccess.getType());
        }
        for (RangerPolicyItemCondition policyCondition : item.getConditions()) {
            conditions.add(policyCondition.getType());
        }
        users.addAll(item.getUsers());
        groups.addAll(item.getGroups());
    }
}

Example 13 with RangerPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem in project ranger by apache.

the class PatchForAtlasToAddEntityLabelAndBusinessMetadata_J10034 method createDefaultRangerPolicy.

private RangerPolicy createDefaultRangerPolicy(Long xServiceDefId, XXService xxService, String policyName, List<String> accessTypesLableOrBusinessMetadata, List<String> accessTypesReadEntity, List<String> resources) throws Exception {
    RangerPolicy rangerPolicy = getRangerPolicyObject(xxService.getName(), policyName);
    RangerPolicyItem rangerPolicyItemLabelOrBusinessMetadata = new RangerPolicyItem();
    List<RangerPolicyItemAccess> accessesLabelOrBusinessMetadata = getRangerPolicyItemAccessList(accessTypesLableOrBusinessMetadata, xxService, rangerPolicy.getName());
    rangerPolicyItemLabelOrBusinessMetadata.setDelegateAdmin(Boolean.TRUE);
    rangerPolicyItemLabelOrBusinessMetadata.setAccesses(accessesLabelOrBusinessMetadata);
    List<String> usersOfPolicyItem1 = getDefaultPolicyUsers(xxService);
    rangerPolicyItemLabelOrBusinessMetadata.setUsers(usersOfPolicyItem1);
    RangerPolicyItem rangerPolicyItemReadEntity = new RangerPolicyItem();
    List<RangerPolicyItemAccess> accessesReadEntity = getRangerPolicyItemAccessList(accessTypesReadEntity, xxService, rangerPolicy.getName());
    rangerPolicyItemReadEntity.setDelegateAdmin(Boolean.FALSE);
    rangerPolicyItemReadEntity.setAccesses(accessesReadEntity);
    List<String> usersOfPolicyItem2 = new ArrayList<String>();
    usersOfPolicyItem2.add("rangertagsync");
    List<String> groups = Arrays.asList(GROUP_PUBLIC);
    rangerPolicyItemReadEntity.setGroups(groups);
    rangerPolicyItemReadEntity.setUsers(usersOfPolicyItem2);
    List<RangerPolicyItem> rangerPolicyItems = new ArrayList<RangerPolicyItem>();
    rangerPolicyItems.add(rangerPolicyItemLabelOrBusinessMetadata);
    rangerPolicyItems.add(rangerPolicyItemReadEntity);
    rangerPolicy.setPolicyItems(rangerPolicyItems);
    Map<String, RangerPolicyResource> xPolResMap = getRangerPolicyResourceMap(resources, xServiceDefId, xxService.getName(), rangerPolicy.getName());
    rangerPolicy.setResources(xPolResMap);
    logger.info("Creating policy for service id : " + xxService.getId());
    RangerPolicy createdRangerPolicy = svcDBStore.createPolicy(rangerPolicy);
    if (createdRangerPolicy != null) {
        logger.info("Policy created : " + createdRangerPolicy.getName());
    }
    return createdRangerPolicy;
}

Example 14 with RangerPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem in project ranger by apache.

the class PatchAtlasForClassificationResource_J10047 method checkAndFilterNonClassificationAccessTypeFromPolicy.

private boolean checkAndFilterNonClassificationAccessTypeFromPolicy(List<RangerPolicyItem> policyItems) {
    ListIterator<RangerPolicyItem> policyItemListIterator = policyItems.listIterator();
    boolean isClassificationAccessTypeExist = false;
    while (policyItemListIterator.hasNext()) {
        RangerPolicyItem policyItem = policyItemListIterator.next();
        ListIterator<RangerPolicyItemAccess> itemAccessListIterator = policyItem.getAccesses().listIterator();
        boolean accessPresent = false;
        while (itemAccessListIterator.hasNext()) {
            RangerPolicyItemAccess access = itemAccessListIterator.next();
            if (!ATLAS_ACCESS_TYPES.contains(access.getType())) {
                itemAccessListIterator.remove();
            } else {
                accessPresent = true;
                isClassificationAccessTypeExist = true;
            }
        }
        if (!accessPresent) {
            policyItemListIterator.remove();
        }
    }
    return isClassificationAccessTypeExist;
}

Example 15 with RangerPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem in project ranger by apache.

the class PatchAtlasForClassificationResource_J10047 method createAdditionalPolicyWithClassificationForExistingEntityClassificationPolicy.

private void createAdditionalPolicyWithClassificationForExistingEntityClassificationPolicy() throws Exception {
    XXServiceDef xXServiceDefObj = daoMgr.getXXServiceDef().findByName(EMBEDDED_SERVICEDEF_ATLAS_NAME);
    if (xXServiceDefObj == null) {
        logger.debug("ServiceDef not found with name :" + EMBEDDED_SERVICEDEF_ATLAS_NAME);
        return;
    }
    Long xServiceDefId = xXServiceDefObj.getId();
    List<XXService> xxServices = daoMgr.getXXService().findByServiceDefId(xServiceDefId);
    for (XXService xxService : xxServices) {
        List<RangerPolicy> servicePolicies = svcStore.getServicePolicies(xxService.getId(), new SearchFilter());
        for (RangerPolicy policy : servicePolicies) {
            if (!isEntityResource(policy.getResources())) {
                continue;
            }
            List<RangerPolicyItem> policyItems = policy.getPolicyItems();
            List<RangerPolicyItem> denypolicyItems = policy.getDenyPolicyItems();
            boolean policyItemCheck = checkAndFilterNonClassificationAccessTypeFromPolicy(policyItems);
            boolean denyPolicyItemCheck = checkAndFilterNonClassificationAccessTypeFromPolicy(denypolicyItems);
            if (policyItemCheck || denyPolicyItemCheck) {
                policy.setName(policy.getName() + " - " + CLASSIFICATION);
                Map<String, RangerPolicyResource> xPolResMap = policy.getResources();
                RangerPolicyResource resource = xPolResMap.get(ENTITY_CLASSIFICATION);
                xPolResMap.put(CLASSIFICATION, resource);
                policy.setResources(xPolResMap);
                policy.setVersion(1L);
                policy.setGuid(null);
                policy.setId(null);
                policy.setCreateTime(new Date());
                policy.setUpdateTime(new Date());
                svcStore.createPolicy(policy);
                logger.info("New Additional policy created");
            }
        }
    }
    logger.info("<== createAdditionalPolicyWithClassificationForExistingPolicy");
}