Examples with RangerPolicyItemCondition org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemCondition used on opensource projects

Example 6 with RangerPolicyItemCondition

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemCondition in project ranger by apache.

the class RangerTimeOfDayMatcherTest method test_end2end_happyPath_12_oClock.

@Test
public void test_end2end_happyPath_12_oClock() {
    RangerPolicyItemCondition itemCondition = mock(RangerPolicyItemCondition.class);
    when(itemCondition.getValues()).thenReturn(Arrays.asList("12am-1am", "11am-12pm", "12pm-1pm", "11pm-12am"));
    RangerTimeOfDayMatcher matcher = new RangerTimeOfDayMatcher();
    matcher.setConditionDef(null);
    matcher.setPolicyItemCondition(itemCondition);
    matcher.init();
    Object[][] input = new Object[][] { { 0, 00, true }, { 0, 01, true }, { 1, 00, true }, { 1, 01, false }, { 10, 59, false }, { 11, 00, true }, { 11, 59, true }, { 12, 00, true }, { 12, 01, true }, { 12, 59, true }, { 13, 00, true }, { 13, 01, false }, { 22, 59, false }, { 23, 0, true }, { 23, 59, true } };
    RangerAccessRequest request = mock(RangerAccessRequest.class);
    for (Object[] data : input) {
        int hour = (int) data[0];
        int minute = (int) data[1];
        Calendar c = new GregorianCalendar(2015, Calendar.APRIL, 1, hour, minute);
        Date aDate = c.getTime();
        when(request.getAccessTime()).thenReturn(aDate);
        boolean matchExpected = (boolean) data[2];
        if (matchExpected) {
            Assert.assertTrue("" + hour, matcher.isMatched(request));
        } else {
            Assert.assertFalse("" + hour, matcher.isMatched(request));
        }
    }
}

Example 7 with RangerPolicyItemCondition

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemCondition in project ranger by apache.

the class RangerDefaultPolicyItemEvaluator method init.

public void init() {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerDefaultPolicyItemEvaluator(policyId=" + policyId + ", policyItem=" + policyItem + ", serviceType=" + getServiceType() + ", conditionsDisabled=" + getConditionsDisabledOption() + ")");
    }
    Set<String> accessPerms = new HashSet<String>();
    List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses = policyItem.getAccesses();
    for (RangerPolicy.RangerPolicyItemAccess policyItemAccess : policyItemAccesses) {
        if (policyItemAccess.getIsAllowed()) {
            accessPerms.add(policyItemAccess.getType());
        }
    }
    hasAllPerms = true;
    List<RangerServiceDef.RangerAccessTypeDef> serviceAccessTypes = serviceDef.getAccessTypes();
    for (RangerServiceDef.RangerAccessTypeDef serviceAccessType : serviceAccessTypes) {
        String serviceAccessTypeName = serviceAccessType.getName();
        if (!accessPerms.contains(serviceAccessTypeName)) {
            hasAllPerms = false;
            break;
        }
    }
    if (!getConditionsDisabledOption() && CollectionUtils.isNotEmpty(policyItem.getConditions())) {
        conditionEvaluators = new ArrayList<>();
        RangerPerfTracer perf = null;
        if (RangerPerfTracer.isPerfTraceEnabled(PERF_POLICYITEM_INIT_LOG)) {
            perf = RangerPerfTracer.getPerfTracer(PERF_POLICYITEM_INIT_LOG, "RangerPolicyItemEvaluator.init(policyId=" + policyId + ",policyItemIndex=" + getPolicyItemIndex() + ")");
        }
        for (RangerPolicyItemCondition condition : policyItem.getConditions()) {
            RangerPolicyConditionDef conditionDef = getConditionDef(condition.getType());
            if (conditionDef == null) {
                LOG.error("RangerDefaultPolicyItemEvaluator(policyId=" + policyId + "): conditionDef '" + condition.getType() + "' not found. Ignoring the condition");
                continue;
            }
            RangerConditionEvaluator conditionEvaluator = newConditionEvaluator(conditionDef.getEvaluator());
            if (conditionEvaluator != null) {
                conditionEvaluator.setServiceDef(serviceDef);
                conditionEvaluator.setConditionDef(conditionDef);
                conditionEvaluator.setPolicyItemCondition(condition);
                RangerPerfTracer perfConditionInit = null;
                if (RangerPerfTracer.isPerfTraceEnabled(PERF_POLICYCONDITION_INIT_LOG)) {
                    perfConditionInit = RangerPerfTracer.getPerfTracer(PERF_POLICYCONDITION_INIT_LOG, "RangerConditionEvaluator.init(policyId=" + policyId + ",policyItemIndex=" + getPolicyItemIndex() + ",policyConditionType=" + condition.getType() + ")");
                }
                conditionEvaluator.init();
                RangerPerfTracer.log(perfConditionInit);
                conditionEvaluators.add(conditionEvaluator);
            } else {
                LOG.error("RangerDefaultPolicyItemEvaluator(policyId=" + policyId + "): failed to instantiate condition evaluator '" + condition.getType() + "'; evaluatorClassName='" + conditionDef.getEvaluator() + "'");
            }
        }
        RangerPerfTracer.log(perf);
    }
    List<String> users = policyItem.getUsers();
    this.hasCurrentUser = CollectionUtils.isNotEmpty(users) && users.contains(RangerPolicyEngine.USER_CURRENT);
    this.hasResourceOwner = CollectionUtils.isNotEmpty(users) && users.contains(RangerPolicyEngine.RESOURCE_OWNER);
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerDefaultPolicyItemEvaluator(policyId=" + policyId + ", conditionsCount=" + getConditionEvaluators().size() + ")");
    }
}

Example 8 with RangerPolicyItemCondition

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemCondition in project ranger by apache.

the class TestServiceDBStore method rangerPolicy.

private RangerPolicy rangerPolicy() {
    List<RangerPolicyItemAccess> accesses = new ArrayList<RangerPolicyItemAccess>();
    List<String> users = new ArrayList<String>();
    List<String> groups = new ArrayList<String>();
    List<String> policyLabels = new ArrayList<String>();
    List<RangerPolicyItemCondition> conditions = new ArrayList<RangerPolicyItemCondition>();
    List<RangerPolicyItem> policyItems = new ArrayList<RangerPolicyItem>();
    RangerPolicyItem rangerPolicyItem = new RangerPolicyItem();
    rangerPolicyItem.setAccesses(accesses);
    rangerPolicyItem.setConditions(conditions);
    rangerPolicyItem.setGroups(groups);
    rangerPolicyItem.setUsers(users);
    rangerPolicyItem.setDelegateAdmin(false);
    policyItems.add(rangerPolicyItem);
    Map<String, RangerPolicyResource> policyResource = new HashMap<String, RangerPolicyResource>();
    RangerPolicyResource rangerPolicyResource = new RangerPolicyResource();
    rangerPolicyResource.setIsExcludes(true);
    rangerPolicyResource.setIsRecursive(true);
    rangerPolicyResource.setValue("1");
    rangerPolicyResource.setValues(users);
    RangerPolicy policy = new RangerPolicy();
    policy.setId(Id);
    policy.setCreateTime(new Date());
    policy.setDescription("policy");
    policy.setGuid("policyguid");
    policy.setIsEnabled(true);
    policy.setName("HDFS_1-1-20150316062453");
    policy.setUpdatedBy("Admin");
    policy.setUpdateTime(new Date());
    policy.setService("HDFS_1-1-20150316062453");
    policy.setIsAuditEnabled(true);
    policy.setPolicyItems(policyItems);
    policy.setResources(policyResource);
    policy.setPolicyLabels(policyLabels);
    return policy;
}

Example 9 with RangerPolicyItemCondition

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemCondition in project ranger by apache.

the class TestServiceDBStore method tess26createPolicy.

@Test
public void tess26createPolicy() throws Exception {
    setup();
    XXServiceDefDao xServiceDefDao = Mockito.mock(XXServiceDefDao.class);
    XXPolicy xPolicy = Mockito.mock(XXPolicy.class);
    XXPolicyDao xPolicyDao = Mockito.mock(XXPolicyDao.class);
    XXServiceDao xServiceDao = Mockito.mock(XXServiceDao.class);
    XXServiceVersionInfoDao xServiceVersionInfoDao = Mockito.mock(XXServiceVersionInfoDao.class);
    XXService xService = Mockito.mock(XXService.class);
    XXServiceVersionInfo xServiceVersionInfo = Mockito.mock(XXServiceVersionInfo.class);
    XXPolicyItemDao xPolicyItemDao = Mockito.mock(XXPolicyItemDao.class);
    XXServiceDef xServiceDef = serviceDef();
    Map<String, String> configs = new HashMap<String, String>();
    configs.put("username", "servicemgr");
    configs.put("password", "servicemgr");
    configs.put("namenode", "servicemgr");
    configs.put("hadoop.security.authorization", "No");
    configs.put("hadoop.security.authentication", "Simple");
    configs.put("hadoop.security.auth_to_local", "");
    configs.put("dfs.datanode.kerberos.principal", "");
    configs.put("dfs.namenode.kerberos.principal", "");
    configs.put("dfs.secondary.namenode.kerberos.principal", "");
    configs.put("hadoop.rpc.protection", "Privacy");
    configs.put("commonNameForCertificate", "");
    RangerService rangerService = new RangerService();
    rangerService.setId(Id);
    rangerService.setConfigs(configs);
    rangerService.setCreateTime(new Date());
    rangerService.setDescription("service policy");
    rangerService.setGuid("1427365526516_835_0");
    rangerService.setIsEnabled(true);
    rangerService.setName("HDFS_1");
    rangerService.setPolicyUpdateTime(new Date());
    rangerService.setType("1");
    rangerService.setUpdatedBy("Admin");
    String policyName = "HDFS_1-1-20150316062345";
    String name = "HDFS_1-1-20150316062453";
    List<RangerPolicyItemAccess> accessesList = new ArrayList<RangerPolicyItemAccess>();
    RangerPolicyItemAccess policyItemAccess = new RangerPolicyItemAccess();
    policyItemAccess.setIsAllowed(true);
    policyItemAccess.setType("1");
    List<String> usersList = new ArrayList<String>();
    List<String> groupsList = new ArrayList<String>();
    List<String> policyLabels = new ArrayList<String>();
    List<RangerPolicyItemCondition> conditionsList = new ArrayList<RangerPolicyItemCondition>();
    RangerPolicyItemCondition policyItemCondition = new RangerPolicyItemCondition();
    policyItemCondition.setType("1");
    policyItemCondition.setValues(usersList);
    conditionsList.add(policyItemCondition);
    List<RangerPolicyItem> policyItems = new ArrayList<RangerPolicy.RangerPolicyItem>();
    RangerPolicyItem rangerPolicyItem = new RangerPolicyItem();
    rangerPolicyItem.setDelegateAdmin(false);
    rangerPolicyItem.setAccesses(accessesList);
    rangerPolicyItem.setConditions(conditionsList);
    rangerPolicyItem.setGroups(groupsList);
    rangerPolicyItem.setUsers(usersList);
    policyItems.add(rangerPolicyItem);
    List<RangerPolicyItem> policyItemsSet = new ArrayList<RangerPolicy.RangerPolicyItem>();
    RangerPolicyItem paramPolicyItem = new RangerPolicyItem(accessesList, usersList, groupsList, conditionsList, false);
    paramPolicyItem.setDelegateAdmin(false);
    paramPolicyItem.setAccesses(accessesList);
    paramPolicyItem.setConditions(conditionsList);
    paramPolicyItem.setGroups(groupsList);
    rangerPolicyItem.setUsers(usersList);
    policyItemsSet.add(paramPolicyItem);
    XXPolicyItem xPolicyItem = new XXPolicyItem();
    xPolicyItem.setDelegateAdmin(false);
    xPolicyItem.setAddedByUserId(null);
    xPolicyItem.setCreateTime(new Date());
    xPolicyItem.setGUID(null);
    xPolicyItem.setId(Id);
    xPolicyItem.setOrder(null);
    xPolicyItem.setPolicyId(Id);
    xPolicyItem.setUpdatedByUserId(null);
    xPolicyItem.setUpdateTime(new Date());
    XXPolicy xxPolicy = new XXPolicy();
    xxPolicy.setId(Id);
    xxPolicy.setName(name);
    xxPolicy.setAddedByUserId(Id);
    xxPolicy.setCreateTime(new Date());
    xxPolicy.setDescription("test");
    xxPolicy.setIsAuditEnabled(true);
    xxPolicy.setIsEnabled(true);
    xxPolicy.setService(1L);
    xxPolicy.setUpdatedByUserId(Id);
    xxPolicy.setUpdateTime(new Date());
    List<XXServiceConfigDef> xServiceConfigDefList = new ArrayList<XXServiceConfigDef>();
    XXServiceConfigDef serviceConfigDefObj = new XXServiceConfigDef();
    serviceConfigDefObj.setId(Id);
    xServiceConfigDefList.add(serviceConfigDefObj);
    List<XXServiceConfigMap> xConfMapList = new ArrayList<XXServiceConfigMap>();
    XXServiceConfigMap xConfMap = new XXServiceConfigMap();
    xConfMap.setAddedByUserId(null);
    xConfMap.setConfigkey(name);
    xConfMap.setConfigvalue(name);
    xConfMap.setCreateTime(new Date());
    xConfMap.setServiceId(null);
    xConfMap.setId(Id);
    xConfMap.setUpdatedByUserId(null);
    xConfMap.setUpdateTime(new Date());
    xConfMapList.add(xConfMap);
    List<String> users = new ArrayList<String>();
    RangerPolicyResource rangerPolicyResource = new RangerPolicyResource();
    rangerPolicyResource.setIsExcludes(true);
    rangerPolicyResource.setIsRecursive(true);
    rangerPolicyResource.setValue("1");
    rangerPolicyResource.setValues(users);
    Map<String, RangerPolicyResource> policyResource = new HashMap<String, RangerPolicyResource>();
    policyResource.put(name, rangerPolicyResource);
    policyResource.put(policyName, rangerPolicyResource);
    RangerPolicy rangerPolicy = new RangerPolicy();
    rangerPolicy.setId(Id);
    rangerPolicy.setCreateTime(new Date());
    rangerPolicy.setDescription("policy");
    rangerPolicy.setGuid("policyguid");
    rangerPolicy.setIsEnabled(true);
    rangerPolicy.setName("HDFS_1-1-20150316062453");
    rangerPolicy.setUpdatedBy("Admin");
    rangerPolicy.setUpdateTime(new Date());
    rangerPolicy.setService("HDFS_1-1-20150316062453");
    rangerPolicy.setIsAuditEnabled(true);
    rangerPolicy.setPolicyItems(policyItems);
    rangerPolicy.setResources(policyResource);
    rangerPolicy.setPolicyLabels(policyLabels);
    XXPolicyResource xPolicyResource = new XXPolicyResource();
    xPolicyResource.setAddedByUserId(Id);
    xPolicyResource.setCreateTime(new Date());
    xPolicyResource.setId(Id);
    xPolicyResource.setIsExcludes(true);
    xPolicyResource.setIsRecursive(true);
    xPolicyResource.setPolicyId(Id);
    xPolicyResource.setResDefId(Id);
    xPolicyResource.setUpdatedByUserId(Id);
    xPolicyResource.setUpdateTime(new Date());
    List<XXPolicyConditionDef> policyConditionDefList = new ArrayList<XXPolicyConditionDef>();
    XXPolicyConditionDef policyConditionDefObj = new XXPolicyConditionDef();
    policyConditionDefObj.setAddedByUserId(Id);
    policyConditionDefObj.setCreateTime(new Date());
    policyConditionDefObj.setDefid(Id);
    policyConditionDefObj.setDescription("policy");
    policyConditionDefObj.setId(Id);
    policyConditionDefObj.setName("country");
    policyConditionDefObj.setOrder(0);
    policyConditionDefObj.setUpdatedByUserId(Id);
    policyConditionDefObj.setUpdateTime(new Date());
    policyConditionDefList.add(policyConditionDefObj);
    Mockito.when(daoManager.getXXService()).thenReturn(xServiceDao);
    Mockito.when(xServiceDao.findByName(name)).thenReturn(xService);
    Mockito.when(daoManager.getXXServiceVersionInfo()).thenReturn(xServiceVersionInfoDao);
    Mockito.when(xServiceVersionInfoDao.findByServiceId(Id)).thenReturn(xServiceVersionInfo);
    Mockito.when(xServiceVersionInfoDao.update(xServiceVersionInfo)).thenReturn(xServiceVersionInfo);
    Mockito.when(svcService.getPopulatedViewObject(xService)).thenReturn(rangerService);
    Mockito.when(daoManager.getXXServiceDef()).thenReturn(xServiceDefDao);
    Mockito.when(xServiceDefDao.findByName(rangerService.getType())).thenReturn(xServiceDef);
    Mockito.when(daoManager.getXXPolicy()).thenReturn(xPolicyDao);
    Mockito.when(policyService.create(rangerPolicy)).thenReturn(rangerPolicy);
    Mockito.when(daoManager.getXXPolicy()).thenReturn(xPolicyDao);
    Mockito.when(xPolicyDao.getById(Id)).thenReturn(xPolicy);
    Mockito.when(rangerAuditFields.populateAuditFields(Mockito.isA(XXPolicyItem.class), Mockito.isA(XXPolicy.class))).thenReturn(xPolicyItem);
    Mockito.when(daoManager.getXXPolicyItem()).thenReturn(xPolicyItemDao);
    Mockito.when(xPolicyItemDao.create(xPolicyItem)).thenReturn(xPolicyItem);
    Mockito.when(daoManager.getXXService()).thenReturn(xServiceDao);
    Mockito.when(xServiceDao.getById(Id)).thenReturn(xService);
    Mockito.when(daoManager.getXXService()).thenReturn(xServiceDao);
    Mockito.when(xServiceDao.getById(Id)).thenReturn(xService);
    RangerPolicyResourceSignature signature = Mockito.mock(RangerPolicyResourceSignature.class);
    Mockito.when(factory.createPolicyResourceSignature(rangerPolicy)).thenReturn(signature);
    XXResourceDefDao xResourceDefDao = Mockito.mock(XXResourceDefDao.class);
    XXResourceDef xResourceDef = Mockito.mock(XXResourceDef.class);
    XXPolicyResourceDao xPolicyResourceDao = Mockito.mock(XXPolicyResourceDao.class);
    XXPolicyConditionDefDao xPolicyConditionDefDao = Mockito.mock(XXPolicyConditionDefDao.class);
    Mockito.when(daoManager.getXXResourceDef()).thenReturn(xResourceDefDao);
    Mockito.when(xResourceDefDao.findByNameAndPolicyId(policyName, Id)).thenReturn(xResourceDef);
    Mockito.when(rangerAuditFields.populateAuditFields(Mockito.isA(XXPolicyResource.class), Mockito.isA(XXPolicy.class))).thenReturn(xPolicyResource);
    Mockito.when(daoManager.getXXPolicyResource()).thenReturn(xPolicyResourceDao);
    Mockito.when(xPolicyResourceDao.create(xPolicyResource)).thenReturn(xPolicyResource);
    Mockito.when(daoManager.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao);
    Mockito.when(xPolicyConditionDefDao.findByServiceDefIdAndName(Id, policyItemCondition.getType())).thenReturn(policyConditionDefObj);
    for (Entry<String, RangerPolicyResource> resource : policyResource.entrySet()) {
        Mockito.when(daoManager.getXXResourceDef()).thenReturn(xResourceDefDao);
        Mockito.when(xResourceDefDao.findByNameAndPolicyId(resource.getKey(), rangerPolicy.getId())).thenReturn(xResourceDef);
    }
    Mockito.when(daoManager.getXXPolicyConditionDef()).thenReturn(xPolicyConditionDefDao);
    Mockito.when(xPolicyConditionDefDao.findByServiceDefIdAndName(xServiceDef.getId(), policyItemCondition.getType())).thenReturn(policyConditionDefObj);
    Mockito.when(!bizUtil.hasAccess(xService, null)).thenReturn(true);
    RangerPolicy dbRangerPolicy = serviceDBStore.createPolicy(rangerPolicy);
    Assert.assertNull(dbRangerPolicy);
    Assert.assertEquals(Id, rangerPolicy.getId());
    Mockito.verify(daoManager).getXXServiceDef();
    Mockito.verify(policyService).create(rangerPolicy);
    Mockito.verify(rangerAuditFields).populateAuditFields(Mockito.isA(XXPolicyItem.class), Mockito.isA(XXPolicy.class));
    Mockito.verify(daoManager).getXXPolicyItem();
}

Example 10 with RangerPolicyItemCondition

use of org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemCondition in project ranger by apache.

the class RangerSampleSimpleMatcherTest method createMatcher.

RangerSampleSimpleMatcher createMatcher(String[] ipArray) {
    RangerSampleSimpleMatcher matcher = new RangerSampleSimpleMatcher();
    if (ipArray == null) {
        matcher.setConditionDef(null);
        matcher.setPolicyItemCondition(null);
        matcher.init();
    } else {
        RangerPolicyItemCondition condition = Mockito.mock(RangerPolicyItemCondition.class);
        List<String> addresses = Arrays.asList(ipArray);
        Mockito.when(condition.getValues()).thenReturn(addresses);
        RangerPolicyConditionDef conditionDef = Mockito.mock(RangerPolicyConditionDef.class);
        Mockito.when(conditionDef.getEvaluatorOptions()).thenReturn(_conditionOptions);
        matcher.setConditionDef(conditionDef);
        matcher.setPolicyItemCondition(condition);
        matcher.init();
    }
    return matcher;
}