Examples with RangerRole org.apache.ranger.plugin.model.RangerRole used on opensource projects

Example 1 with RangerRole

use of org.apache.ranger.plugin.model.RangerRole in project ranger by apache.

the class RangerAdminRESTClient method createRole.

@Override
public RangerRole createRole(final RangerRole request) throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerAdminRESTClient.createRole(" + request + ")");
    }
    RangerRole ret = null;
    ClientResponse response = null;
    UserGroupInformation user = MiscUtil.getUGILoginUser();
    boolean isSecureMode = user != null && UserGroupInformation.isSecurityEnabled();
    String relativeURL = RangerRESTUtils.REST_URL_SERVICE_CREATE_ROLE;
    Map<String, String> queryParams = new HashMap<String, String>();
    queryParams.put(RangerRESTUtils.SERVICE_NAME_PARAM, serviceNameUrlParam);
    if (isSecureMode) {
        PrivilegedAction<ClientResponse> action = new PrivilegedAction<ClientResponse>() {

            public ClientResponse run() {
                ClientResponse clientRes = null;
                try {
                    clientRes = restClient.post(relativeURL, queryParams, request);
                } catch (Exception e) {
                    LOG.error("Failed to get response, Error is : " + e.getMessage());
                }
                return clientRes;
            }
        };
        if (LOG.isDebugEnabled()) {
            LOG.debug("create role as user " + user);
        }
        response = user.doAs(action);
    } else {
        response = restClient.post(relativeURL, queryParams, request);
    }
    if (response != null && response.getStatus() != HttpServletResponse.SC_OK) {
        RESTResponse resp = RESTResponse.fromClientResponse(response);
        LOG.error("createRole() failed: HTTP status=" + response.getStatus() + ", message=" + resp.getMessage() + ", isSecure=" + isSecureMode + (isSecureMode ? (", user=" + user) : ""));
        if (response.getStatus() == HttpServletResponse.SC_UNAUTHORIZED) {
            throw new AccessControlException();
        }
        throw new Exception("HTTP " + response.getStatus() + " Error: " + resp.getMessage());
    } else if (response == null) {
        throw new Exception("unknown error during createRole. roleName=" + request.getName());
    } else {
        ret = response.getEntity(RangerRole.class);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerAdminRESTClient.createRole(" + request + ")");
    }
    return ret;
}

Example 2 with RangerRole

use of org.apache.ranger.plugin.model.RangerRole in project ranger by apache.

the class RangerAdminRESTClient method getRole.

@Override
public RangerRole getRole(final String execUser, final String roleName) throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerAdminRESTClient.getPrincipalsForRole(" + roleName + ")");
    }
    RangerRole ret = null;
    ClientResponse response = null;
    UserGroupInformation user = MiscUtil.getUGILoginUser();
    boolean isSecureMode = user != null && UserGroupInformation.isSecurityEnabled();
    String relativeURL = RangerRESTUtils.REST_URL_SERVICE_GET_ROLE_INFO + roleName;
    Map<String, String> queryParams = new HashMap<String, String>();
    queryParams.put(RangerRESTUtils.SERVICE_NAME_PARAM, serviceNameUrlParam);
    queryParams.put(RangerRESTUtils.REST_PARAM_EXEC_USER, execUser);
    if (isSecureMode) {
        PrivilegedAction<ClientResponse> action = new PrivilegedAction<ClientResponse>() {

            public ClientResponse run() {
                ClientResponse clientResp = null;
                try {
                    clientResp = restClient.get(relativeURL, queryParams);
                } catch (Exception e) {
                    LOG.error("Failed to get response, Error is : " + e.getMessage());
                }
                return clientResp;
            }
        };
        if (LOG.isDebugEnabled()) {
            LOG.debug("get role info as user " + user);
        }
        response = user.doAs(action);
    } else {
        response = restClient.get(relativeURL, queryParams);
    }
    if (response != null) {
        if (response.getStatus() != HttpServletResponse.SC_OK) {
            RESTResponse resp = RESTResponse.fromClientResponse(response);
            LOG.error("getPrincipalsForRole() failed: HTTP status=" + response.getStatus() + ", message=" + resp.getMessage() + ", isSecure=" + isSecureMode + (isSecureMode ? (", user=" + user) : ""));
            if (response.getStatus() == HttpServletResponse.SC_UNAUTHORIZED) {
                throw new AccessControlException();
            }
            throw new Exception("HTTP " + response.getStatus() + " Error: " + resp.getMessage());
        } else {
            ret = response.getEntity(RangerRole.class);
        }
    } else {
        throw new Exception("unknown error during getPrincipalsForRole. roleName=" + roleName);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerAdminRESTClient.getPrincipalsForRole(" + roleName + ")");
    }
    return ret;
}

Example 3 with RangerRole

use of org.apache.ranger.plugin.model.RangerRole in project ranger by apache.

the class RangerHivePlugin method createRole.

@Override
public void createRole(String roleName, HivePrincipal adminGrantor) throws HiveAuthzPluginException, HiveAccessControlException {
    if (LOG.isDebugEnabled()) {
        LOG.debug(" ==> RangerHiveAuthorizer.createRole()");
    }
    RangerHiveAuditHandler auditHandler = new RangerHiveAuditHandler(hivePlugin.getConfig());
    String currentUserName = getGrantorUsername(adminGrantor);
    List<String> roleNames = Arrays.asList(roleName);
    List<String> userNames = Arrays.asList(currentUserName);
    boolean result = false;
    if (RESERVED_ROLE_NAMES.contains(roleName.trim().toUpperCase())) {
        throw new HiveAuthzPluginException("Role name cannot be one of the reserved roles: " + RESERVED_ROLE_NAMES);
    }
    try {
        RangerRole role = new RangerRole();
        role.setName(roleName);
        role.setCreatedByUser(currentUserName);
        role.setCreatedBy(currentUserName);
        role.setUpdatedBy(currentUserName);
        // Add grantor as the member to this role with grant option.
        RangerRole.RoleMember userMember = new RangerRole.RoleMember(currentUserName, true);
        List<RangerRole.RoleMember> userMemberList = new ArrayList<>();
        userMemberList.add(userMember);
        role.setUsers(userMemberList);
        RangerRole ret = hivePlugin.createRole(role, auditHandler);
        if (LOG.isDebugEnabled()) {
            LOG.debug("<== createRole(): " + ret);
        }
        result = true;
    } catch (Exception excp) {
        throw new HiveAccessControlException(excp);
    } finally {
        RangerAccessResult accessResult = createAuditEvent(hivePlugin, currentUserName, userNames, HiveOperationType.CREATEROLE, HiveAccessType.CREATE, roleNames, result);
        auditHandler.processResult(accessResult);
        auditHandler.flushAudit();
    }
}

Example 4 with RangerRole

use of org.apache.ranger.plugin.model.RangerRole in project ranger by apache.

the class RangerHivePlugin method getRangerRoleForRoleName.

private RangerRole getRangerRoleForRoleName(String roleName) {
    RangerRole ret = null;
    RangerRoles rangerRoles = hivePlugin.getRangerRoles();
    if (rangerRoles != null) {
        Set<RangerRole> roles = rangerRoles.getRangerRoles();
        for (RangerRole role : roles) {
            if (roleName.equals(role.getName())) {
                ret = role;
                break;
            }
        }
    }
    return ret;
}

Example 5 with RangerRole

use of org.apache.ranger.plugin.model.RangerRole in project ranger by apache.

the class RangerBasePlugin method getRangerRoleForPrincipal.

public Set<RangerRole> getRangerRoleForPrincipal(String principal, String type) {
    Set<RangerRole> ret = new HashSet<>();
    Set<RangerRole> rangerRoles = null;
    Map<String, Set<String>> roleMapping = null;
    RangerRoles roles = getRangerRoles();
    if (roles != null) {
        rangerRoles = roles.getRangerRoles();
    }
    if (rangerRoles != null) {
        RangerPluginContext rangerPluginContext = policyEngine.getPluginContext();
        if (rangerPluginContext != null) {
            RangerAuthContext rangerAuthContext = rangerPluginContext.getAuthContext();
            if (rangerAuthContext != null) {
                RangerRolesUtil rangerRolesUtil = rangerAuthContext.getRangerRolesUtil();
                if (rangerRolesUtil != null) {
                    switch(type) {
                        case "USER":
                            roleMapping = rangerRolesUtil.getUserRoleMapping();
                            break;
                        case "GROUP":
                            roleMapping = rangerRolesUtil.getGroupRoleMapping();
                            break;
                        case "ROLE":
                            roleMapping = rangerRolesUtil.getRoleRoleMapping();
                            break;
                    }
                }
            }
        }
        if (roleMapping != null) {
            Set<String> principalRoles = roleMapping.get(principal);
            if (CollectionUtils.isNotEmpty(principalRoles)) {
                for (String role : principalRoles) {
                    for (RangerRole rangerRole : rangerRoles) {
                        if (rangerRole.getName().equals(role)) {
                            ret.add(rangerRole);
                        }
                    }
                }
            }
        }
    }
    return ret;
}