Examples with RangerRowFilterPolicyItem org.apache.ranger.plugin.model.RangerPolicy.RangerRowFilterPolicyItem used on opensource projects

Example 6 with RangerRowFilterPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerRowFilterPolicyItem in project ranger by apache.

the class RangerPolicyValidator method isValidAccessTypeDef.

boolean isValidAccessTypeDef(RangerPolicy policy, final List<ValidationFailureDetails> failures, Action action, boolean isAdmin, final RangerServiceDef serviceDef) {
    boolean valid = true;
    if (LOG.isDebugEnabled()) {
        LOG.debug(String.format("==> RangerPolicyValidator.isValidAccessTypeDef(%s, %s, %s,%s,%s)", policy, failures, action, isAdmin, serviceDef));
    }
    int policyType = policy.getPolicyType() == null ? RangerPolicy.POLICY_TYPE_ACCESS : policy.getPolicyType();
    // row filter policy
    if (policyType == RangerPolicy.POLICY_TYPE_ROWFILTER) {
        List<String> rowFilterAccessTypeDefNames = new ArrayList<String>();
        if (serviceDef != null && serviceDef.getRowFilterDef() != null) {
            if (!CollectionUtils.isEmpty(serviceDef.getRowFilterDef().getAccessTypes())) {
                for (RangerAccessTypeDef rangerAccessTypeDef : serviceDef.getRowFilterDef().getAccessTypes()) {
                    rowFilterAccessTypeDefNames.add(rangerAccessTypeDef.getName().toLowerCase());
                }
            }
        }
        if (!CollectionUtils.isEmpty(policy.getRowFilterPolicyItems())) {
            for (RangerRowFilterPolicyItem rangerRowFilterPolicyItem : policy.getRowFilterPolicyItems()) {
                if (!CollectionUtils.isEmpty(rangerRowFilterPolicyItem.getAccesses())) {
                    for (RangerPolicyItemAccess rangerPolicyItemAccess : rangerRowFilterPolicyItem.getAccesses()) {
                        if (!rowFilterAccessTypeDefNames.contains(rangerPolicyItemAccess.getType().toLowerCase())) {
                            ValidationErrorCode error = ValidationErrorCode.POLICY_VALIDATION_ERR_POLICY_ITEM_ACCESS_TYPE_INVALID;
                            failures.add(new ValidationFailureDetailsBuilder().field("row filter policy item access type").isSemanticallyIncorrect().becauseOf(error.getMessage(rangerPolicyItemAccess.getType(), rowFilterAccessTypeDefNames)).errorCode(error.getErrorCode()).build());
                            valid = false;
                        }
                    }
                }
            }
        }
    }
    // data mask policy
    if (policyType == RangerPolicy.POLICY_TYPE_DATAMASK) {
        List<String> dataMaskAccessTypeDefNames = new ArrayList<String>();
        if (serviceDef != null && serviceDef.getDataMaskDef() != null) {
            if (!CollectionUtils.isEmpty(serviceDef.getDataMaskDef().getAccessTypes())) {
                for (RangerAccessTypeDef rangerAccessTypeDef : serviceDef.getDataMaskDef().getAccessTypes()) {
                    dataMaskAccessTypeDefNames.add(rangerAccessTypeDef.getName().toLowerCase());
                }
            }
        }
        if (!CollectionUtils.isEmpty(policy.getDataMaskPolicyItems())) {
            for (RangerDataMaskPolicyItem rangerDataMaskPolicyItem : policy.getDataMaskPolicyItems()) {
                if (!CollectionUtils.isEmpty(rangerDataMaskPolicyItem.getAccesses())) {
                    for (RangerPolicyItemAccess rangerPolicyItemAccess : rangerDataMaskPolicyItem.getAccesses()) {
                        if (!dataMaskAccessTypeDefNames.contains(rangerPolicyItemAccess.getType().toLowerCase())) {
                            ValidationErrorCode error = ValidationErrorCode.POLICY_VALIDATION_ERR_POLICY_ITEM_ACCESS_TYPE_INVALID;
                            failures.add(new ValidationFailureDetailsBuilder().field("data masking policy item access type").isSemanticallyIncorrect().becauseOf(error.getMessage(rangerPolicyItemAccess.getType(), dataMaskAccessTypeDefNames)).errorCode(error.getErrorCode()).build());
                            valid = false;
                        }
                    }
                }
            }
        }
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug(String.format("<== RangerPolicyValidator.isValidAccessTypeDef(%s, %s, %s,%s,%s)", policy, failures, action, isAdmin, serviceDef));
    }
    return valid;
}

Example 7 with RangerRowFilterPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerRowFilterPolicyItem in project ranger by apache.

the class RangerPolicyService method compareTwoRowFilterPolicyItemList.

private boolean compareTwoRowFilterPolicyItemList(String value, String oldValue) {
    if (value == null && oldValue == null) {
        return true;
    }
    if (value == "" && oldValue == "") {
        return true;
    }
    if (stringUtil.isEmpty(value) || stringUtil.isEmpty(oldValue)) {
        return false;
    }
    ObjectMapper mapper = new ObjectMapper();
    try {
        List<RangerRowFilterPolicyItem> obj = mapper.readValue(value, new TypeReference<List<RangerRowFilterPolicyItem>>() {
        });
        List<RangerRowFilterPolicyItem> oldObj = mapper.readValue(oldValue, new TypeReference<List<RangerRowFilterPolicyItem>>() {
        });
        int oldListSize = oldObj.size();
        int listSize = obj.size();
        if (oldListSize != listSize) {
            return false;
        }
        for (RangerRowFilterPolicyItem polItem : obj) {
            if (!oldObj.contains(polItem)) {
                return false;
            }
        }
        return true;
    } catch (JsonParseException e) {
        throw restErrorUtil.createRESTException("Invalid input data: " + e.getMessage(), MessageEnums.INVALID_INPUT_DATA);
    } catch (JsonMappingException e) {
        throw restErrorUtil.createRESTException("Invalid input data: " + e.getMessage(), MessageEnums.INVALID_INPUT_DATA);
    } catch (IOException e) {
        throw restErrorUtil.createRESTException("Invalid input data: " + e.getMessage(), MessageEnums.INVALID_INPUT_DATA);
    }
}

Example 8 with RangerRowFilterPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerRowFilterPolicyItem in project ranger by apache.

the class ServiceDBStore method writeExcel.

private void writeExcel(List<RangerPolicy> policies, String excelFileName, HttpServletResponse response) throws IOException {
    Workbook workbook = null;
    OutputStream outStream = null;
    try {
        workbook = new HSSFWorkbook();
        Sheet sheet = workbook.createSheet();
        createHeaderRow(sheet);
        int rowCount = 0;
        if (!CollectionUtils.isEmpty(policies)) {
            for (RangerPolicy policy : policies) {
                List<RangerPolicyItem> policyItems = policy.getPolicyItems();
                List<RangerRowFilterPolicyItem> rowFilterPolicyItems = policy.getRowFilterPolicyItems();
                List<RangerDataMaskPolicyItem> dataMaskPolicyItems = policy.getDataMaskPolicyItems();
                List<RangerPolicyItem> allowExceptions = policy.getAllowExceptions();
                List<RangerPolicyItem> denyExceptions = policy.getDenyExceptions();
                List<RangerPolicyItem> denyPolicyItems = policy.getDenyPolicyItems();
                XXService xxservice = daoMgr.getXXService().findByName(policy.getService());
                String serviceType = "";
                if (xxservice != null) {
                    Long ServiceId = xxservice.getType();
                    XXServiceDef xxservDef = daoMgr.getXXServiceDef().getById(ServiceId);
                    if (xxservDef != null) {
                        serviceType = xxservDef.getName();
                    }
                }
                if (CollectionUtils.isNotEmpty(policyItems)) {
                    for (RangerPolicyItem policyItem : policyItems) {
                        Row row = sheet.createRow(++rowCount);
                        writeBookForPolicyItems(policy, policyItem, null, null, row, POLICY_ALLOW_INCLUDE);
                    }
                } else if (CollectionUtils.isNotEmpty(dataMaskPolicyItems)) {
                    for (RangerDataMaskPolicyItem dataMaskPolicyItem : dataMaskPolicyItems) {
                        Row row = sheet.createRow(++rowCount);
                        writeBookForPolicyItems(policy, null, dataMaskPolicyItem, null, row, null);
                    }
                } else if (CollectionUtils.isNotEmpty(rowFilterPolicyItems)) {
                    for (RangerRowFilterPolicyItem rowFilterPolicyItem : rowFilterPolicyItems) {
                        Row row = sheet.createRow(++rowCount);
                        writeBookForPolicyItems(policy, null, null, rowFilterPolicyItem, row, null);
                    }
                } else if (serviceType.equalsIgnoreCase(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME)) {
                    if (CollectionUtils.isEmpty(policyItems)) {
                        Row row = sheet.createRow(++rowCount);
                        RangerPolicyItem policyItem = new RangerPolicyItem();
                        writeBookForPolicyItems(policy, policyItem, null, null, row, POLICY_ALLOW_INCLUDE);
                    }
                } else if (CollectionUtils.isEmpty(policyItems)) {
                    Row row = sheet.createRow(++rowCount);
                    RangerPolicyItem policyItem = new RangerPolicyItem();
                    writeBookForPolicyItems(policy, policyItem, null, null, row, POLICY_ALLOW_INCLUDE);
                }
                if (CollectionUtils.isNotEmpty(allowExceptions)) {
                    for (RangerPolicyItem policyItem : allowExceptions) {
                        Row row = sheet.createRow(++rowCount);
                        writeBookForPolicyItems(policy, policyItem, null, null, row, POLICY_ALLOW_EXCLUDE);
                    }
                }
                if (CollectionUtils.isNotEmpty(denyExceptions)) {
                    for (RangerPolicyItem policyItem : denyExceptions) {
                        Row row = sheet.createRow(++rowCount);
                        writeBookForPolicyItems(policy, policyItem, null, null, row, POLICY_DENY_EXCLUDE);
                    }
                }
                if (CollectionUtils.isNotEmpty(denyPolicyItems)) {
                    for (RangerPolicyItem policyItem : denyPolicyItems) {
                        Row row = sheet.createRow(++rowCount);
                        writeBookForPolicyItems(policy, policyItem, null, null, row, POLICY_DENY_INCLUDE);
                    }
                }
            }
        }
        ByteArrayOutputStream outByteStream = new ByteArrayOutputStream();
        workbook.write(outByteStream);
        byte[] outArray = outByteStream.toByteArray();
        response.setContentType("application/ms-excel");
        response.setContentLength(outArray.length);
        response.setHeader("Expires:", "0");
        response.setHeader("Content-Disposition", "attachment; filename=" + excelFileName);
        response.setStatus(HttpServletResponse.SC_OK);
        outStream = response.getOutputStream();
        outStream.write(outArray);
        outStream.flush();
    } catch (IOException ex) {
        LOG.error("Failed to create report file " + excelFileName, ex);
    } catch (Exception ex) {
        LOG.error("Error while generating report file " + excelFileName, ex);
    } finally {
        if (outStream != null) {
            outStream.close();
        }
        if (workbook != null) {
            workbook.close();
        }
    }
}

Example 9 with RangerRowFilterPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerRowFilterPolicyItem in project ranger by apache.

the class ServiceDBStore method updatePolicy.

@Override
public RangerPolicy updatePolicy(RangerPolicy policy) throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> ServiceDBStore.updatePolicy(" + policy + ")");
    }
    XXPolicy xxExisting = daoMgr.getXXPolicy().getById(policy.getId());
    RangerPolicy existing = policyService.getPopulatedViewObject(xxExisting);
    if (existing == null) {
        throw new Exception("no policy exists with ID=" + policy.getId());
    }
    RangerService service = getServiceByName(policy.getService());
    if (service == null) {
        throw new Exception("service does not exist - name=" + policy.getService());
    }
    XXServiceDef xServiceDef = daoMgr.getXXServiceDef().findByName(service.getType());
    if (xServiceDef == null) {
        throw new Exception("service-def does not exist - name=" + service.getType());
    }
    if (!StringUtils.equalsIgnoreCase(existing.getService(), policy.getService())) {
        throw new Exception("policy id=" + policy.getId() + " already exists in service " + existing.getService() + ". It can not be moved to service " + policy.getService());
    }
    boolean renamed = !StringUtils.equalsIgnoreCase(policy.getName(), existing.getName());
    if (renamed) {
        XXPolicy newNamePolicy = daoMgr.getXXPolicy().findByNameAndServiceId(policy.getName(), service.getId());
        if (newNamePolicy != null) {
            throw new Exception("another policy already exists with name '" + policy.getName() + "'. ID=" + newNamePolicy.getId());
        }
    }
    Map<String, RangerPolicyResource> newResources = policy.getResources();
    List<RangerPolicyItem> policyItems = policy.getPolicyItems();
    List<RangerPolicyItem> denyPolicyItems = policy.getDenyPolicyItems();
    List<RangerPolicyItem> allowExceptions = policy.getAllowExceptions();
    List<RangerPolicyItem> denyExceptions = policy.getDenyExceptions();
    List<RangerDataMaskPolicyItem> dataMaskPolicyItems = policy.getDataMaskPolicyItems();
    List<RangerRowFilterPolicyItem> rowFilterItems = policy.getRowFilterPolicyItems();
    List<String> policyLabels = policy.getPolicyLabels();
    policy.setCreateTime(xxExisting.getCreateTime());
    policy.setGuid(xxExisting.getGuid());
    policy.setVersion(xxExisting.getVersion());
    List<XXTrxLog> trxLogList = policyService.getTransactionLog(policy, xxExisting, RangerPolicyService.OPERATION_UPDATE_CONTEXT);
    updatePolicySignature(policy);
    boolean isTagVersionUpdateNeeded = false;
    if (EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME.equals(service.getType())) {
        isTagVersionUpdateNeeded = existing.getIsEnabled() ? !policy.getIsEnabled() : policy.getIsEnabled();
        isTagVersionUpdateNeeded = isTagVersionUpdateNeeded || !StringUtils.equals(existing.getResourceSignature(), policy.getResourceSignature());
    }
    policy = policyService.update(policy);
    XXPolicy newUpdPolicy = daoMgr.getXXPolicy().getById(policy.getId());
    deleteExistingPolicyResources(policy);
    deleteExistingPolicyItems(policy);
    deleteExistingPolicyLabel(policy);
    createNewResourcesForPolicy(policy, newUpdPolicy, newResources);
    createNewPolicyItemsForPolicy(policy, newUpdPolicy, policyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ALLOW);
    createNewPolicyItemsForPolicy(policy, newUpdPolicy, denyPolicyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DENY);
    createNewPolicyItemsForPolicy(policy, newUpdPolicy, allowExceptions, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ALLOW_EXCEPTIONS);
    createNewPolicyItemsForPolicy(policy, newUpdPolicy, denyExceptions, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DENY_EXCEPTIONS);
    createNewDataMaskPolicyItemsForPolicy(policy, newUpdPolicy, dataMaskPolicyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DATAMASK);
    createNewRowFilterPolicyItemsForPolicy(policy, newUpdPolicy, rowFilterItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ROWFILTER);
    createNewLabelsForPolicy(newUpdPolicy, policyLabels);
    handlePolicyUpdate(service, isTagVersionUpdateNeeded);
    RangerPolicy updPolicy = policyService.getPopulatedViewObject(newUpdPolicy);
    dataHistService.createObjectDataHistory(updPolicy, RangerDataHistService.ACTION_UPDATE);
    bizUtil.createTrxLog(trxLogList);
    return updPolicy;
}

Example 10 with RangerRowFilterPolicyItem

use of org.apache.ranger.plugin.model.RangerPolicy.RangerRowFilterPolicyItem in project ranger by apache.

the class ServiceDBStore method createPolicy.

@Override
public RangerPolicy createPolicy(RangerPolicy policy) throws Exception {
    RangerService service = getServiceByName(policy.getService());
    if (service == null) {
        throw new Exception("service does not exist - name=" + policy.getService());
    }
    XXServiceDef xServiceDef = daoMgr.getXXServiceDef().findByName(service.getType());
    if (xServiceDef == null) {
        throw new Exception("service-def does not exist - name=" + service.getType());
    }
    XXPolicy existing = daoMgr.getXXPolicy().findByNameAndServiceId(policy.getName(), service.getId());
    if (existing != null) {
        throw new Exception("policy already exists: ServiceName=" + policy.getService() + "; PolicyName=" + policy.getName() + ". ID=" + existing.getId());
    }
    Map<String, RangerPolicyResource> resources = policy.getResources();
    List<RangerPolicyItem> policyItems = policy.getPolicyItems();
    List<RangerPolicyItem> denyPolicyItems = policy.getDenyPolicyItems();
    List<RangerPolicyItem> allowExceptions = policy.getAllowExceptions();
    List<RangerPolicyItem> denyExceptions = policy.getDenyExceptions();
    List<RangerDataMaskPolicyItem> dataMaskItems = policy.getDataMaskPolicyItems();
    List<RangerRowFilterPolicyItem> rowFilterItems = policy.getRowFilterPolicyItems();
    List<String> policyLabels = policy.getPolicyLabels();
    policy.setVersion(Long.valueOf(1));
    updatePolicySignature(policy);
    if (populateExistingBaseFields) {
        assignedIdPolicyService.setPopulateExistingBaseFields(true);
        daoMgr.getXXPolicy().setIdentityInsert(true);
        policy = assignedIdPolicyService.create(policy);
        daoMgr.getXXPolicy().setIdentityInsert(false);
        daoMgr.getXXPolicy().updateSequence();
        assignedIdPolicyService.setPopulateExistingBaseFields(false);
    } else {
        policy = policyService.create(policy);
    }
    XXPolicy xCreatedPolicy = daoMgr.getXXPolicy().getById(policy.getId());
    createNewResourcesForPolicy(policy, xCreatedPolicy, resources);
    createNewPolicyItemsForPolicy(policy, xCreatedPolicy, policyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ALLOW);
    createNewPolicyItemsForPolicy(policy, xCreatedPolicy, denyPolicyItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DENY);
    createNewPolicyItemsForPolicy(policy, xCreatedPolicy, allowExceptions, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ALLOW_EXCEPTIONS);
    createNewPolicyItemsForPolicy(policy, xCreatedPolicy, denyExceptions, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DENY_EXCEPTIONS);
    createNewDataMaskPolicyItemsForPolicy(policy, xCreatedPolicy, dataMaskItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_DATAMASK);
    createNewRowFilterPolicyItemsForPolicy(policy, xCreatedPolicy, rowFilterItems, xServiceDef, RangerPolicyItemEvaluator.POLICY_ITEM_TYPE_ROWFILTER);
    createNewLabelsForPolicy(xCreatedPolicy, policyLabels);
    handlePolicyUpdate(service, true);
    RangerPolicy createdPolicy = policyService.getPopulatedViewObject(xCreatedPolicy);
    dataHistService.createObjectDataHistory(createdPolicy, RangerDataHistService.ACTION_CREATE);
    List<XXTrxLog> trxLogList = policyService.getTransactionLog(createdPolicy, RangerPolicyService.OPERATION_CREATE_CONTEXT);
    bizUtil.createTrxLog(trxLogList);
    return createdPolicy;
}