Examples with RangerAccessResourceImpl org.apache.ranger.plugin.policyengine.RangerAccessResourceImpl used on opensource projects

Example 21 with RangerAccessResourceImpl

use of org.apache.ranger.plugin.policyengine.RangerAccessResourceImpl in project ranger by apache.

the class RangerDefaultPolicyResourceMatcher method isMatch.

@Override
public boolean isMatch(RangerPolicy policy, MatchScope scope, Map<String, Object> evalContext) {
    boolean ret = false;
    RangerPerfTracer perf = null;
    if (RangerPerfTracer.isPerfTraceEnabled(PERF_POLICY_RESOURCE_MATCHER_MATCH_LOG)) {
        perf = RangerPerfTracer.getPerfTracer(PERF_POLICY_RESOURCE_MATCHER_MATCH_LOG, "RangerDefaultPolicyResourceMatcher.getPoliciesNonLegacy()");
    }
    Map<String, RangerPolicyResource> resources = policy.getResources();
    if (policy.getPolicyType() == policyType && MapUtils.isNotEmpty(resources)) {
        List<RangerResourceDef> hierarchy = getMatchingHierarchy(resources.keySet());
        if (CollectionUtils.isNotEmpty(hierarchy)) {
            MatchType matchType = MatchType.NONE;
            RangerAccessResourceImpl accessResource = new RangerAccessResourceImpl();
            accessResource.setServiceDef(serviceDef);
            // Build up accessResource resourceDef by resourceDef.
            // For each resourceDef,
            // examine policy-values one by one.
            // The first value that is acceptable, that is,
            // value matches in any way, is used for that resourceDef, and
            // next resourceDef is processed.
            // If none of the values matches, the policy as a whole definitely will not match,
            // therefore, the match is failed
            // After all resourceDefs are processed, and some match is achieved at every
            // level, the final matchType (which is for the entire policy) is checked against
            // requested scope to determine the match-result.
            // Unit tests in TestDefaultPolicyResourceForPolicy.java, TestDefaultPolicyResourceMatcher.java
            // test_defaultpolicyresourcematcher_for_hdfs_policy.json, and
            // test_defaultpolicyresourcematcher_for_hive_policy.json, and
            // test_defaultPolicyResourceMatcher.json
            boolean skipped = false;
            for (RangerResourceDef resourceDef : hierarchy) {
                String name = resourceDef.getName();
                RangerPolicyResource policyResource = resources.get(name);
                if (policyResource != null && CollectionUtils.isNotEmpty(policyResource.getValues())) {
                    ret = false;
                    matchType = MatchType.NONE;
                    if (!skipped) {
                        for (String value : policyResource.getValues()) {
                            accessResource.setValue(name, value);
                            matchType = getMatchType(accessResource, evalContext);
                            if (matchType != MatchType.NONE) {
                                // One value for this resourceDef matched
                                ret = true;
                                break;
                            }
                        }
                    } else {
                        break;
                    }
                } else {
                    skipped = true;
                }
                if (!ret) {
                    // None of the values specified for this resourceDef matched, no point in continuing with next resourceDef
                    break;
                }
            }
            ret = ret && isMatch(scope, matchType);
        }
    }
    RangerPerfTracer.log(perf);
    return ret;
}

Example 22 with RangerAccessResourceImpl

use of org.apache.ranger.plugin.policyengine.RangerAccessResourceImpl in project ranger by apache.

the class StormRangerPlugin method buildAccessRequest.

public RangerAccessRequest buildAccessRequest(String _user, String[] _groups, String _clientIp, String _topology, String _operation, String clusterName) {
    RangerAccessRequestImpl request = new RangerAccessRequestImpl();
    request.setUser(_user);
    if (_groups != null && _groups.length > 0) {
        Set<String> groups = Sets.newHashSet(_groups);
        request.setUserGroups(groups);
    }
    request.setAccessType(getAccessType(_operation));
    request.setClientIPAddress(_clientIp);
    request.setAction(_operation);
    // build resource and connect stuff into request
    RangerAccessResourceImpl resource = new RangerAccessResourceImpl();
    resource.setValue(ResourceName.Topology, _topology);
    request.setResource(resource);
    request.setClusterName(clusterName);
    if (LOG.isDebugEnabled()) {
        LOG.debug("Returning request: " + request.toString());
    }
    return request;
}