Examples with RangerServiceValidator org.apache.ranger.plugin.model.validation.RangerServiceValidator used on opensource projects

Example 1 with RangerServiceValidator

use of org.apache.ranger.plugin.model.validation.RangerServiceValidator in project ranger by apache.

the class ServiceREST method updateService.

@PUT
@Path("/services/{id}")
@Produces({ "application/json", "application/xml" })
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.UPDATE_SERVICE + "\")")
public RangerService updateService(RangerService service, @Context HttpServletRequest request) {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> ServiceREST.updateService(): " + service);
    }
    RangerService ret = null;
    RangerPerfTracer perf = null;
    try {
        if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
            perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.updateService(serviceName=" + service.getName() + ")");
        }
        RangerServiceValidator validator = validatorFactory.getServiceValidator(svcStore);
        validator.validate(service, Action.UPDATE);
        bizUtil.hasAdminPermissions("Services");
        // TODO: As of now we are allowing SYS_ADMIN to create all the
        // services including KMS
        XXServiceDef xxServiceDef = daoManager.getXXServiceDef().findByName(service.getType());
        bizUtil.hasKMSPermissions("Service", xxServiceDef.getImplclassname());
        bizUtil.blockAuditorRoleUser();
        Map<String, Object> options = getOptions(request);
        ret = svcStore.updateService(service, options);
    } catch (WebApplicationException excp) {
        throw excp;
    } catch (Throwable excp) {
        LOG.error("updateService(" + service + ") failed", excp);
        throw restErrorUtil.createRESTException(excp.getMessage());
    } finally {
        RangerPerfTracer.log(perf);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== ServiceREST.updateService(" + service + "): " + ret);
    }
    return ret;
}

Example 2 with RangerServiceValidator

use of org.apache.ranger.plugin.model.validation.RangerServiceValidator in project ranger by apache.

the class ServiceREST method createService.

@POST
@Path("/services")
@Produces({ "application/json", "application/xml" })
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.CREATE_SERVICE + "\")")
public RangerService createService(RangerService service) {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> ServiceREST.createService(" + service + ")");
    }
    RangerService ret = null;
    RangerPerfTracer perf = null;
    try {
        if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
            perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.createService(serviceName=" + service.getName() + ")");
        }
        RangerServiceValidator validator = validatorFactory.getServiceValidator(svcStore);
        validator.validate(service, Action.CREATE);
        UserSessionBase session = ContextUtil.getCurrentUserSession();
        XXServiceDef xxServiceDef = daoManager.getXXServiceDef().findByName(service.getType());
        if (session != null && !session.isSpnegoEnabled()) {
            bizUtil.hasAdminPermissions("Services");
            // TODO: As of now we are allowing SYS_ADMIN to create all the
            // services including KMS
            bizUtil.hasKMSPermissions("Service", xxServiceDef.getImplclassname());
        }
        if (session != null && session.isSpnegoEnabled()) {
            if (session.isKeyAdmin() && !EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(xxServiceDef.getImplclassname())) {
                throw restErrorUtil.createRESTException("KeyAdmin can create/update/delete only KMS ", MessageEnums.OPER_NO_PERMISSION);
            }
            if ((!session.isKeyAdmin() && !session.isUserAdmin()) && EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(xxServiceDef.getImplclassname())) {
                throw restErrorUtil.createRESTException("User cannot create/update/delete KMS Service", MessageEnums.OPER_NO_PERMISSION);
            }
        }
        bizUtil.blockAuditorRoleUser();
        ret = svcStore.createService(service);
    } catch (WebApplicationException excp) {
        throw excp;
    } catch (Throwable excp) {
        LOG.error("createService(" + service + ") failed", excp);
        throw restErrorUtil.createRESTException(excp.getMessage());
    } finally {
        RangerPerfTracer.log(perf);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== ServiceREST.createService(" + service + "): " + ret);
    }
    return ret;
}

Example 3 with RangerServiceValidator

use of org.apache.ranger.plugin.model.validation.RangerServiceValidator in project ranger by apache.

the class ServiceREST method deleteService.

@DELETE
@Path("/services/{id}")
@Produces({ "application/json", "application/xml" })
@PreAuthorize("@rangerPreAuthSecurityHandler.isAPIAccessible(\"" + RangerAPIList.DELETE_SERVICE + "\")")
public void deleteService(@PathParam("id") Long id) {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> ServiceREST.deleteService(" + id + ")");
    }
    RangerPerfTracer perf = null;
    try {
        if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
            perf = RangerPerfTracer.getPerfTracer(PERF_LOG, "ServiceREST.deleteService(serviceId=" + id + ")");
        }
        RangerServiceValidator validator = validatorFactory.getServiceValidator(svcStore);
        validator.validate(id, Action.DELETE);
        bizUtil.hasAdminPermissions("Services");
        // TODO: As of now we are allowing SYS_ADMIN to create all the
        // services including KMS
        XXService service = daoManager.getXXService().getById(id);
        EmbeddedServiceDefsUtil embeddedServiceDefsUtil = EmbeddedServiceDefsUtil.instance();
        if (service.getType().equals(embeddedServiceDefsUtil.getTagServiceDefId())) {
            List<XXService> referringServices = daoManager.getXXService().findByTagServiceId(id);
            if (!CollectionUtils.isEmpty(referringServices)) {
                Set<String> referringServiceNames = new HashSet<String>();
                for (XXService xXService : referringServices) {
                    referringServiceNames.add(xXService.getName());
                    if (referringServiceNames.size() >= 10) {
                        break;
                    }
                }
                if (referringServices.size() <= 10) {
                    throw restErrorUtil.createRESTException("Tag service '" + service.getName() + "' is being referenced by " + referringServices.size() + " services: " + referringServiceNames, MessageEnums.OPER_NOT_ALLOWED_FOR_STATE);
                } else {
                    throw restErrorUtil.createRESTException("Tag service '" + service.getName() + "' is being referenced by " + referringServices.size() + " services: " + referringServiceNames + " and more..", MessageEnums.OPER_NOT_ALLOWED_FOR_STATE);
                }
            }
        }
        XXServiceDef xxServiceDef = daoManager.getXXServiceDef().getById(service.getType());
        bizUtil.hasKMSPermissions("Service", xxServiceDef.getImplclassname());
        bizUtil.blockAuditorRoleUser();
        tagStore.deleteAllTagObjectsForService(service.getName());
        svcStore.deleteService(id);
    } catch (WebApplicationException excp) {
        throw excp;
    } catch (Throwable excp) {
        LOG.error("deleteService(" + id + ") failed", excp);
        throw restErrorUtil.createRESTException(excp.getMessage());
    } finally {
        RangerPerfTracer.log(perf);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== ServiceREST.deleteService(" + id + ")");
    }
}