Examples with RangerDefaultPolicyResourceMatcher org.apache.ranger.plugin.policyresourcematcher.RangerDefaultPolicyResourceMatcher used on opensource projects

Example 6 with RangerDefaultPolicyResourceMatcher

use of org.apache.ranger.plugin.policyresourcematcher.RangerDefaultPolicyResourceMatcher in project ranger by apache.

the class TestDefaultPolicyResourceMatcherForPolicy method runTest.

private void runTest(DefaultPolicyResourceMatcherTestCases.TestCase testCase, RangerServiceDef serviceDef) throws Exception {
    assertTrue("invalid input: ", testCase != null && testCase.tests != null);
    RangerDefaultPolicyResourceMatcher matcher = new RangerDefaultPolicyResourceMatcher();
    matcher.setServiceDef(serviceDef);
    matcher.setPolicyResources(testCase.policyResources);
    matcher.init();
    for (DefaultPolicyResourceMatcherTestCases.TestCase.OneTest oneTest : testCase.tests) {
        if (oneTest == null) {
            continue;
        }
        boolean expected = oneTest.result;
        RangerPolicyResourceMatcher.MatchScope scope;
        if (StringUtils.equalsIgnoreCase(oneTest.type, "selfOrDescendantMatch")) {
            scope = RangerPolicyResourceMatcher.MatchScope.SELF_OR_DESCENDANT;
        } else if (StringUtils.equalsIgnoreCase(oneTest.type, "descendantMatch")) {
            scope = RangerPolicyResourceMatcher.MatchScope.DESCENDANT;
        } else if (StringUtils.equalsIgnoreCase(oneTest.type, "exactMatch")) {
            scope = RangerPolicyResourceMatcher.MatchScope.SELF;
        } else if (StringUtils.equalsIgnoreCase(oneTest.type, "selfOrAncestorMatch")) {
            scope = RangerPolicyResourceMatcher.MatchScope.SELF_OR_ANCESTOR;
        } else if (StringUtils.equalsIgnoreCase(oneTest.type, "ancestorMatch")) {
            scope = RangerPolicyResourceMatcher.MatchScope.ANCESTOR;
        } else if (StringUtils.equalsIgnoreCase(oneTest.type, "anyMatch")) {
            scope = RangerPolicyResourceMatcher.MatchScope.ANY;
        } else {
            continue;
        }
        boolean result = matcher.isMatch(oneTest.policy, scope, oneTest.evalContext);
        assertEquals("match failed! " + ":" + testCase.name + ":" + oneTest.name + ":" + oneTest.type + ": policy=" + oneTest.policy, expected, result);
    }
}

Example 7 with RangerDefaultPolicyResourceMatcher

use of org.apache.ranger.plugin.policyresourcematcher.RangerDefaultPolicyResourceMatcher in project ranger by apache.

the class RangerHiveResourcesAccessedTogetherCondition method buildMatcher.

private RangerPolicyResourceMatcher buildMatcher(String policyResourceSpec) {
    RangerPolicyResourceMatcher matcher = null;
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerHiveResourcesAccessedTogetherCondition.buildMatcher(" + policyResourceSpec + ")");
    }
    // Works only for Hive serviceDef for now
    if (serviceDef != null && EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_HIVE_NAME.equals(serviceDef.getName())) {
        // Parse policyResourceSpec
        char separator = '.';
        String any = "*";
        Map<String, RangerPolicy.RangerPolicyResource> policyResources = new HashMap<>();
        String[] elements = StringUtils.split(policyResourceSpec, separator);
        RangerPolicy.RangerPolicyResource policyResource;
        if (elements.length > 0 && elements.length < 4) {
            if (elements.length == 3) {
                policyResource = new RangerPolicy.RangerPolicyResource(elements[2]);
            } else {
                policyResource = new RangerPolicy.RangerPolicyResource(any);
            }
            policyResources.put("column", policyResource);
            if (elements.length >= 2) {
                policyResource = new RangerPolicy.RangerPolicyResource(elements[1]);
            } else {
                policyResource = new RangerPolicy.RangerPolicyResource(any);
            }
            policyResources.put("table", policyResource);
            policyResource = new RangerPolicy.RangerPolicyResource(elements[0]);
            policyResources.put("database", policyResource);
            matcher = new RangerDefaultPolicyResourceMatcher();
            matcher.setPolicyResources(policyResources);
            matcher.setServiceDef(serviceDef);
            matcher.init();
        } else {
            LOG.error("RangerHiveResourcesAccessedTogetherCondition.buildMatcher() - Incorrect elements in the hierarchy specified (" + elements.length + ")");
        }
    } else {
        LOG.error("RangerHiveResourcesAccessedTogetherCondition.buildMatcher() - ServiceDef not set or ServiceDef is not for Hive");
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerHiveResourcesAccessedTogetherCondition.buildMatcher(" + policyResourceSpec + ")" + ", matcher=" + matcher);
    }
    return matcher;
}