Examples with RangerSecurityZoneService org.apache.ranger.plugin.model.RangerSecurityZone.RangerSecurityZoneService used on opensource projects

Example 6 with RangerSecurityZoneService

use of org.apache.ranger.plugin.model.RangerSecurityZone.RangerSecurityZoneService in project ranger by apache.

the class RangerSecurityZoneValidatorTest method getRangerSecurityZone.

private RangerSecurityZone getRangerSecurityZone() {
    List<String> resourceList = new ArrayList<String>();
    resourceList.add("/path/myfolder");
    HashMap<String, List<String>> resourcesMap = new HashMap<String, List<String>>();
    resourcesMap.put("hdfs", resourceList);
    List<HashMap<String, List<String>>> resources = new ArrayList<HashMap<String, List<String>>>();
    resources.add(resourcesMap);
    List<String> adminUsers = new ArrayList<String>();
    adminUsers.add("adminUser1");
    List<String> adminGrpUsers = new ArrayList<String>();
    adminGrpUsers.add("adminGrpUser1");
    List<String> aduitUsers = new ArrayList<String>();
    aduitUsers.add("aduitUser1");
    List<String> aduitGrpUsers = new ArrayList<String>();
    aduitUsers.add("aduitGrpUser1");
    RangerSecurityZoneService rangerSecurityZoneService = new RangerSecurityZoneService();
    rangerSecurityZoneService.setResources(resources);
    Map<String, RangerSecurityZone.RangerSecurityZoneService> map = new HashMap<String, RangerSecurityZone.RangerSecurityZoneService>();
    map.put("hdfsSvc", rangerSecurityZoneService);
    RangerSecurityZone rangerSecurityZone = new RangerSecurityZone();
    rangerSecurityZone.setId(1L);
    rangerSecurityZone.setAdminUsers(adminUsers);
    rangerSecurityZone.setAuditUsers(aduitUsers);
    rangerSecurityZone.setAdminUserGroups(adminGrpUsers);
    rangerSecurityZone.setAuditUserGroups(aduitGrpUsers);
    rangerSecurityZone.setName("MyZone");
    rangerSecurityZone.setServices(map);
    rangerSecurityZone.setDescription("MyZone");
    return rangerSecurityZone;
}

Example 7 with RangerSecurityZoneService

use of org.apache.ranger.plugin.model.RangerSecurityZone.RangerSecurityZoneService in project ranger by apache.

the class ServiceDBStore method disassociateZonesForService.

/**
 * Removes given service from security zones.
 * And if given service is the only service
 * associated with security zone, remove zone.
 * @param service
 * @throws Exception
 */
private void disassociateZonesForService(RangerService service) throws Exception {
    String serviceName = service.getName();
    List<String> zonesNameList = daoMgr.getXXSecurityZoneDao().findZonesByServiceName(serviceName);
    if (CollectionUtils.isNotEmpty(zonesNameList)) {
        for (String zoneName : zonesNameList) {
            RangerSecurityZone securityZone = securityZoneStore.getSecurityZoneByName(zoneName);
            Map<String, RangerSecurityZoneService> zoneServices = securityZone.getServices();
            if (zoneServices != null && !zoneServices.isEmpty()) {
                zoneServices.remove(serviceName);
                securityZone.setServices(zoneServices);
                securityZoneStore.updateSecurityZoneById(securityZone);
                if (zoneServices.isEmpty()) {
                    securityZoneStore.deleteSecurityZoneByName(zoneName);
                }
            }
        }
    }
}

Example 8 with RangerSecurityZoneService

use of org.apache.ranger.plugin.model.RangerSecurityZone.RangerSecurityZoneService in project ranger by apache.

the class RangerSecurityZoneValidator method validateWithinSecurityZone.

private boolean validateWithinSecurityZone(RangerSecurityZone securityZone, Action action, List<ValidationFailureDetails> failures) {
    if (LOG.isDebugEnabled()) {
        LOG.debug(String.format("==> RangerPolicyValidator.validateWithinSecurityZone(%s, %s, %s)", securityZone, action, failures));
    }
    boolean ret = true;
    // Validate each service for existence, not being tag-service and each resource-spec for validity
    if (MapUtils.isNotEmpty(securityZone.getServices())) {
        for (Map.Entry<String, RangerSecurityZone.RangerSecurityZoneService> serviceSpecification : securityZone.getServices().entrySet()) {
            String serviceName = serviceSpecification.getKey();
            RangerSecurityZone.RangerSecurityZoneService securityZoneService = serviceSpecification.getValue();
            ret = ret && validateSecurityZoneService(serviceName, securityZoneService, failures);
        }
    } else {
        ValidationErrorCode error = ValidationErrorCode.SECURITY_ZONE_VALIDATION_ERR_MISSING_SERVICES;
        failures.add(new ValidationFailureDetailsBuilder().becauseOf("security zone services").isMissing().field("services").errorCode(error.getErrorCode()).becauseOf(error.getMessage(securityZone.getName())).build());
        ret = false;
    }
    // both admin users and user-groups collections can't be empty
    if (CollectionUtils.isEmpty(securityZone.getAdminUsers()) && CollectionUtils.isEmpty(securityZone.getAdminUserGroups())) {
        ValidationErrorCode error = ValidationErrorCode.SECURITY_ZONE_VALIDATION_ERR_MISSING_USER_AND_GROUPS;
        failures.add(new ValidationFailureDetailsBuilder().field("security zone admin users/user-groups").isMissing().becauseOf(error.getMessage()).errorCode(error.getErrorCode()).build());
        ret = false;
    }
    // both audit users and user-groups collections can't be empty
    if (CollectionUtils.isEmpty(securityZone.getAuditUsers()) && CollectionUtils.isEmpty(securityZone.getAuditUserGroups())) {
        ValidationErrorCode error = ValidationErrorCode.SECURITY_ZONE_VALIDATION_ERR_MISSING_USER_AND_GROUPS;
        failures.add(new ValidationFailureDetailsBuilder().field("security zone audit users/user-groups").isMissing().becauseOf(error.getMessage()).errorCode(error.getErrorCode()).build());
        ret = false;
    }
    if (securityZone.getServices() != null) {
        for (Map.Entry<String, RangerSecurityZoneService> serviceResourceMapEntry : securityZone.getServices().entrySet()) {
            if (serviceResourceMapEntry.getValue().getResources() != null) {
                for (Map<String, List<String>> resource : serviceResourceMapEntry.getValue().getResources()) {
                    if (resource != null) {
                        for (Map.Entry<String, List<String>> entry : resource.entrySet()) {
                            if (CollectionUtils.isEmpty(entry.getValue())) {
                                ValidationErrorCode error = ValidationErrorCode.SECURITY_ZONE_VALIDATION_ERR_MISSING_RESOURCES;
                                failures.add(new ValidationFailureDetailsBuilder().field("security zone resources").subField("resources").isMissing().becauseOf(error.getMessage(serviceResourceMapEntry.getKey())).errorCode(error.getErrorCode()).build());
                                ret = false;
                            }
                        }
                    }
                }
            }
        }
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug(String.format("<== RangerPolicyValidator.validateWithinSecurityZone(%s, %s, %s) : %s", securityZone, action, failures, ret));
    }
    return ret;
}