Examples with RangerResourceDef org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef used on opensource projects

Example 31 with RangerResourceDef

use of org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef in project ranger by apache.

the class RangerDefaultPolicyResourceMatcher method isMatch.

@Override
public boolean isMatch(RangerPolicy policy, MatchScope scope, Map<String, Object> evalContext) {
    boolean ret = false;
    RangerPerfTracer perf = null;
    if (RangerPerfTracer.isPerfTraceEnabled(PERF_POLICY_RESOURCE_MATCHER_MATCH_LOG)) {
        perf = RangerPerfTracer.getPerfTracer(PERF_POLICY_RESOURCE_MATCHER_MATCH_LOG, "RangerDefaultPolicyResourceMatcher.getPoliciesNonLegacy()");
    }
    Map<String, RangerPolicyResource> resources = policy.getResources();
    if (policy.getPolicyType() == policyType && MapUtils.isNotEmpty(resources)) {
        List<RangerResourceDef> hierarchy = getMatchingHierarchy(resources.keySet());
        if (CollectionUtils.isNotEmpty(hierarchy)) {
            MatchType matchType = MatchType.NONE;
            RangerAccessResourceImpl accessResource = new RangerAccessResourceImpl();
            accessResource.setServiceDef(serviceDef);
            // Build up accessResource resourceDef by resourceDef.
            // For each resourceDef,
            // examine policy-values one by one.
            // The first value that is acceptable, that is,
            // value matches in any way, is used for that resourceDef, and
            // next resourceDef is processed.
            // If none of the values matches, the policy as a whole definitely will not match,
            // therefore, the match is failed
            // After all resourceDefs are processed, and some match is achieved at every
            // level, the final matchType (which is for the entire policy) is checked against
            // requested scope to determine the match-result.
            // Unit tests in TestDefaultPolicyResourceForPolicy.java, TestDefaultPolicyResourceMatcher.java
            // test_defaultpolicyresourcematcher_for_hdfs_policy.json, and
            // test_defaultpolicyresourcematcher_for_hive_policy.json, and
            // test_defaultPolicyResourceMatcher.json
            boolean skipped = false;
            for (RangerResourceDef resourceDef : hierarchy) {
                String name = resourceDef.getName();
                RangerPolicyResource policyResource = resources.get(name);
                if (policyResource != null && CollectionUtils.isNotEmpty(policyResource.getValues())) {
                    ret = false;
                    matchType = MatchType.NONE;
                    if (!skipped) {
                        for (String value : policyResource.getValues()) {
                            accessResource.setValue(name, value);
                            matchType = getMatchType(accessResource, evalContext);
                            if (matchType != MatchType.NONE) {
                                // One value for this resourceDef matched
                                ret = true;
                                break;
                            }
                        }
                    } else {
                        break;
                    }
                } else {
                    skipped = true;
                }
                if (!ret) {
                    // None of the values specified for this resourceDef matched, no point in continuing with next resourceDef
                    break;
                }
            }
            ret = ret && isMatch(scope, matchType);
        }
    }
    RangerPerfTracer.log(perf);
    return ret;
}

Example 32 with RangerResourceDef

use of org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef in project ranger by apache.

the class ServiceDefUtil method getLeafResourceLevel.

public static Integer getLeafResourceLevel(RangerServiceDef serviceDef, Map<String, RangerPolicy.RangerPolicyResource> policyResource) {
    Integer ret = null;
    RangerResourceDef resourceDef = getLeafResourceDef(serviceDef, policyResource);
    if (resourceDef != null) {
        ret = resourceDef.getLevel();
    }
    return ret;
}

Example 33 with RangerResourceDef

use of org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef in project ranger by apache.

the class ServiceDefUtil method getLeafResourceDef.

public static RangerResourceDef getLeafResourceDef(RangerServiceDef serviceDef, Map<String, RangerPolicy.RangerPolicyResource> policyResource) {
    RangerResourceDef ret = null;
    if (serviceDef != null && policyResource != null) {
        for (Map.Entry<String, RangerPolicy.RangerPolicyResource> entry : policyResource.entrySet()) {
            if (!isEmpty(entry.getValue())) {
                String resource = entry.getKey();
                RangerResourceDef resourceDef = ServiceDefUtil.getResourceDef(serviceDef, resource);
                if (resourceDef != null && resourceDef.getLevel() != null) {
                    if (ret == null) {
                        ret = resourceDef;
                    } else if (ret.getLevel() < resourceDef.getLevel()) {
                        ret = resourceDef;
                    }
                }
            }
        }
    }
    return ret;
}

Example 34 with RangerResourceDef

use of org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef in project ranger by apache.

the class TestRangerPolicyValidator method testIsValid_failures.

@Test
public final void testIsValid_failures() throws Exception {
    for (Action action : cu) {
        // passing in a null policy should fail with appropriate failure reason
        _policy = null;
        checkFailure_isValid(action, "missing", "policy");
        // policy must have a name on it
        _policy = mock(RangerPolicy.class);
        for (String name : new String[] { null, "  " }) {
            when(_policy.getName()).thenReturn(name);
            when(_policy.getResources()).thenReturn(null);
            checkFailure_isValid(action, "missing", "name");
        }
        // for update id is required!
        if (action == Action.UPDATE) {
            when(_policy.getId()).thenReturn(null);
            checkFailure_isValid(action, "missing", "id");
        }
    }
    /*
		 * Id is ignored for Create but name should not belong to an existing policy.  For update, policy should exist for its id and should match its name.
		 */
    when(_policy.getName()).thenReturn("policy-name");
    when(_policy.getService()).thenReturn("service-name");
    RangerPolicy existingPolicy = mock(RangerPolicy.class);
    when(existingPolicy.getId()).thenReturn(7L);
    List<RangerPolicy> existingPolicies = new ArrayList<>();
    existingPolicies.add(existingPolicy);
    SearchFilter filter = new SearchFilter();
    filter.setParam(SearchFilter.SERVICE_NAME, "service-name");
    filter.setParam(SearchFilter.POLICY_NAME, "policy-name");
    when(_store.getPolicies(filter)).thenReturn(existingPolicies);
    checkFailure_isValid(Action.CREATE, "semantic", "policy name");
    // update : does not exist for id
    when(_policy.getId()).thenReturn(7L);
    when(_store.getPolicy(7L)).thenReturn(null);
    checkFailure_isValid(Action.UPDATE, "semantic", "id");
    // Update: name should not point to an existing different policy, i.e. with a different id
    when(_store.getPolicy(7L)).thenReturn(existingPolicy);
    RangerPolicy anotherExistingPolicy = mock(RangerPolicy.class);
    when(anotherExistingPolicy.getId()).thenReturn(8L);
    existingPolicies.clear();
    existingPolicies.add(anotherExistingPolicy);
    when(_store.getPolicies(filter)).thenReturn(existingPolicies);
    checkFailure_isValid(Action.UPDATE, "semantic", "id/name");
    // more than one policies with same name is also an internal error
    when(_policy.getName()).thenReturn("policy-name");
    when(_store.getPolicies(filter)).thenReturn(existingPolicies);
    existingPolicies.add(existingPolicy);
    existingPolicy = mock(RangerPolicy.class);
    existingPolicies.add(existingPolicy);
    for (boolean isAdmin : new boolean[] { true, false }) {
        _failures.clear();
        Assert.assertFalse(_validator.isValid(_policy, Action.UPDATE, isAdmin, _failures));
        _utils.checkFailureForInternalError(_failures);
    }
    // policy must have service name on it and it should be valid
    when(_policy.getName()).thenReturn("policy-name");
    for (Action action : cu) {
        for (boolean isAdmin : new boolean[] { true, false }) {
            when(_policy.getService()).thenReturn(null);
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForMissingValue(_failures, "service name");
            when(_policy.getService()).thenReturn("");
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForMissingValue(_failures, "service name");
        }
    }
    // service name should be valid
    when(_store.getServiceByName("service-name")).thenReturn(null);
    when(_store.getServiceByName("another-service-name")).thenThrow(new Exception());
    for (Action action : cu) {
        for (boolean isAdmin : new boolean[] { true, false }) {
            when(_policy.getService()).thenReturn(null);
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForMissingValue(_failures, "service name");
            when(_policy.getService()).thenReturn(null);
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForMissingValue(_failures, "service name");
            when(_policy.getService()).thenReturn("service-name");
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForSemanticError(_failures, "service name");
            when(_policy.getService()).thenReturn("another-service-name");
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForSemanticError(_failures, "service name");
        }
    }
    // policy must contain at least one policy item
    List<RangerPolicyItem> policyItems = new ArrayList<>();
    when(_policy.getService()).thenReturn("service-name");
    RangerService service = mock(RangerService.class);
    when(_store.getServiceByName("service-name")).thenReturn(service);
    for (Action action : cu) {
        for (boolean isAdmin : new boolean[] { true, false }) {
            // when it is null
            when(_policy.getPolicyItems()).thenReturn(null);
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForMissingValue(_failures, "policy items");
            // or when it is not null but empty.
            when(_policy.getPolicyItems()).thenReturn(policyItems);
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForMissingValue(_failures, "policy items");
        }
    }
    // these are known good policy items -- same as used above in happypath
    policyItems = _utils.createPolicyItems(policyItemsData);
    when(_policy.getPolicyItems()).thenReturn(policyItems);
    // policy item check requires that service def should exist
    when(service.getType()).thenReturn("service-type");
    when(_store.getServiceDefByName("service-type")).thenReturn(null);
    for (Action action : cu) {
        for (boolean isAdmin : new boolean[] { true, false }) {
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForInternalError(_failures, "policy service def");
        }
    }
    // service-def should contain the right access types on it.
    _serviceDef = _utils.createServiceDefWithAccessTypes(accessTypes_bad, "service-type");
    when(_store.getServiceDefByName("service-type")).thenReturn(_serviceDef);
    for (Action action : cu) {
        for (boolean isAdmin : new boolean[] { true, false }) {
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForSemanticError(_failures, "policy item access type");
        }
    }
    // create the right service def with right resource defs - this is the same as in the happypath test above.
    _serviceDef = _utils.createServiceDefWithAccessTypes(accessTypes, "service-type");
    when(_store.getPolicies(filter)).thenReturn(null);
    List<RangerResourceDef> resourceDefs = _utils.createResourceDefs(resourceDefData);
    when(_serviceDef.getResources()).thenReturn(resourceDefs);
    when(_store.getServiceDefByName("service-type")).thenReturn(_serviceDef);
    // one mandatory is missing (tbl) and one unknown resource is specified (extra), and values of option resource don't conform to validation pattern (col)
    Map<String, RangerPolicyResource> policyResources = _utils.createPolicyResourceMap(policyResourceMap_bad);
    when(_policy.getResources()).thenReturn(policyResources);
    // ensure thta policy is kosher when it comes to resource signature
    RangerPolicyResourceSignature signature = mock(RangerPolicyResourceSignature.class);
    when(_factory.createPolicyResourceSignature(_policy)).thenReturn(signature);
    when(signature.getSignature()).thenReturn("hash-1");
    // store does not have any policies for that signature hash
    when(_store.getPoliciesByResourceSignature("service-name", "hash-1", true)).thenReturn(null);
    for (Action action : cu) {
        for (boolean isAdmin : new boolean[] { true, false }) {
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            // for spurious resource: "extra"
            _utils.checkFailureForSemanticError(_failures, "resource-values", "col");
            // for specifying it as true when def did not allow it
            _utils.checkFailureForSemanticError(_failures, "isRecursive", "db");
            // for specifying it as true when def did not allow it
            _utils.checkFailureForSemanticError(_failures, "isExcludes", "col");
        }
    }
    // Check if error around resource signature clash are reported.  have Store return policies for same signature
    when(_store.getPoliciesByResourceSignature("service-name", "hash-1", true)).thenReturn(existingPolicies);
    for (Action action : cu) {
        for (boolean isAdmin : new boolean[] { true, false }) {
            _failures.clear();
            Assert.assertFalse(_validator.isValid(_policy, action, isAdmin, _failures));
            _utils.checkFailureForSemanticError(_failures, "policy resources");
        }
    }
}

Example 35 with RangerResourceDef

use of org.apache.ranger.plugin.model.RangerServiceDef.RangerResourceDef in project ranger by apache.

the class TestRangerPolicyValidator method test_isValidResourceNames_happyPath.

@Test
public final void test_isValidResourceNames_happyPath() {
    String serviceName = "a-service-def";
    // setup service-def
    Date now = new Date();
    when(_serviceDef.getName()).thenReturn(serviceName);
    when(_serviceDef.getUpdateTime()).thenReturn(now);
    List<RangerResourceDef> resourceDefs = _utils.createResourceDefs(resourceDefData_multipleHierarchies);
    when(_serviceDef.getResources()).thenReturn(resourceDefs);
    // setup policy
    Map<String, RangerPolicyResource> policyResources = _utils.createPolicyResourceMap(policyResourceMap_goodMultipleHierarchies);
    when(_policy.getResources()).thenReturn(policyResources);
    Assert.assertTrue(_validator.isValidResourceNames(_policy, _failures, _serviceDef));
}