Examples with GrantRevokeRequest org.apache.ranger.plugin.util.GrantRevokeRequest used on opensource projects

Example 6 with GrantRevokeRequest

use of org.apache.ranger.plugin.util.GrantRevokeRequest in project ranger by apache.

the class TestServiceREST method test15revokeAccess.

@Test
public void test15revokeAccess() throws Exception {
    HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
    String serviceName = "HDFS_1";
    Set<String> userList = new HashSet<String>();
    userList.add("user1");
    userList.add("user2");
    userList.add("user3");
    Set<String> groupList = new HashSet<String>();
    groupList.add("group1");
    groupList.add("group2");
    groupList.add("group3");
    GrantRevokeRequest revokeRequest = new GrantRevokeRequest();
    revokeRequest.setDelegateAdmin(true);
    revokeRequest.setEnableAudit(true);
    revokeRequest.setGrantor("read");
    revokeRequest.setGroups(groupList);
    revokeRequest.setUsers(userList);
    RESTResponse restResponse = serviceREST.revokeAccess(serviceName, revokeRequest, request);
    Assert.assertNotNull(restResponse);
}

Example 7 with GrantRevokeRequest

use of org.apache.ranger.plugin.util.GrantRevokeRequest in project ranger by apache.

the class TestServiceREST method test14grantAccess.

@Test
public void test14grantAccess() throws Exception {
    HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
    String serviceName = "HDFS_1";
    GrantRevokeRequest grantRequestObj = new GrantRevokeRequest();
    grantRequestObj.setAccessTypes(null);
    grantRequestObj.setDelegateAdmin(true);
    grantRequestObj.setEnableAudit(true);
    grantRequestObj.setGrantor("read");
    grantRequestObj.setIsRecursive(true);
    Mockito.when(serviceUtil.isValidateHttpsAuthentication(serviceName, request)).thenReturn(false);
    RESTResponse restResponse = serviceREST.grantAccess(serviceName, grantRequestObj, request);
    Assert.assertNotNull(restResponse);
    Mockito.verify(serviceUtil).isValidateHttpsAuthentication(serviceName, request);
}

Example 8 with GrantRevokeRequest

use of org.apache.ranger.plugin.util.GrantRevokeRequest in project ranger by apache.

the class TestServiceUtil method testToGrantRevokeRequestForHbase.

@Test
public void testToGrantRevokeRequestForHbase() throws Exception {
    GrantRevokeRequest expectedGrantRevokeRequest = new GrantRevokeRequest();
    expectedGrantRevokeRequest.setGrantor("rangerAdmin");
    expectedGrantRevokeRequest.setEnableAudit(true);
    expectedGrantRevokeRequest.setIsRecursive(false);
    expectedGrantRevokeRequest.setReplaceExistingPermissions(true);
    Map<String, String> mapResource = new HashMap<String, String>();
    mapResource.put("table", "myTable");
    mapResource.put("column", "myColumn");
    mapResource.put("column-family", "myColumnFamily");
    expectedGrantRevokeRequest.setResource(mapResource);
    String serviceName = "hbase";
    RangerService rangerService = new RangerService();
    rangerService.setId(1L);
    rangerService.setName("hbaseService");
    rangerService.setIsEnabled(true);
    rangerService.setType("hbase");
    VXPolicy vXPolicy = new VXPolicy();
    vXPolicy.setRepositoryName("hbase");
    vXPolicy.setGrantor("rangerAdmin");
    vXPolicy.setReplacePerm(true);
    vXPolicy.setColumns("myColumn");
    vXPolicy.setColumnFamilies("myColumnFamily");
    vXPolicy.setTables("myTable");
    Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService);
    GrantRevokeRequest actualGrantRevokeRequest = serviceUtil.toGrantRevokeRequest(vXPolicy);
    Assert.assertNotNull(actualGrantRevokeRequest);
    Assert.assertTrue(actualGrantRevokeRequest.getEnableAudit());
    Assert.assertFalse(actualGrantRevokeRequest.getIsRecursive());
    Assert.assertTrue(actualGrantRevokeRequest.getReplaceExistingPermissions());
    Assert.assertEquals(expectedGrantRevokeRequest.getGrantor(), actualGrantRevokeRequest.getGrantor());
    Assert.assertEquals(expectedGrantRevokeRequest.getResource(), actualGrantRevokeRequest.getResource());
}

Example 9 with GrantRevokeRequest

use of org.apache.ranger.plugin.util.GrantRevokeRequest in project ranger by apache.

the class RangerHivePlugin method createGrantRevokeData.

private GrantRevokeRequest createGrantRevokeData(RangerHiveResource resource, List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges, HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAccessControlException {
    if (resource == null || !(resource.getObjectType() == HiveObjectType.DATABASE || resource.getObjectType() == HiveObjectType.TABLE || resource.getObjectType() == HiveObjectType.VIEW || resource.getObjectType() == HiveObjectType.COLUMN)) {
        throw new HiveAccessControlException("grant/revoke: unexpected object type '" + (resource == null ? null : resource.getObjectType().name()));
    }
    GrantRevokeRequest ret = new GrantRevokeRequest();
    ret.setGrantor(getGrantorUsername(grantorPrincipal));
    ret.setGrantorGroups(getGrantorGroupNames(grantorPrincipal));
    ret.setDelegateAdmin(grantOption ? Boolean.TRUE : Boolean.FALSE);
    ret.setEnableAudit(Boolean.TRUE);
    ret.setReplaceExistingPermissions(Boolean.FALSE);
    String database = StringUtils.isEmpty(resource.getDatabase()) ? "*" : resource.getDatabase();
    String table = StringUtils.isEmpty(resource.getTable()) ? "*" : resource.getTable();
    String column = StringUtils.isEmpty(resource.getColumn()) ? "*" : resource.getColumn();
    Map<String, String> mapResource = new HashMap<String, String>();
    mapResource.put(RangerHiveResource.KEY_DATABASE, database);
    mapResource.put(RangerHiveResource.KEY_TABLE, table);
    mapResource.put(RangerHiveResource.KEY_COLUMN, column);
    ret.setOwnerUser(resource.getOwnerUser());
    ret.setResource(mapResource);
    SessionState ss = SessionState.get();
    if (ss != null) {
        ret.setClientIPAddress(ss.getUserIpAddress());
        ret.setSessionId(ss.getSessionId());
        HiveConf hiveConf = ss.getConf();
        if (hiveConf != null) {
            ret.setRequestData(hiveConf.get(HIVE_CONF_VAR_QUERY_STRING));
        }
    }
    HiveAuthzSessionContext sessionContext = getHiveAuthzSessionContext();
    if (sessionContext != null) {
        ret.setClientType(sessionContext.getClientType() == null ? null : sessionContext.getClientType().toString());
    }
    for (HivePrincipal principal : hivePrincipals) {
        switch(principal.getType()) {
            case USER:
                ret.getUsers().add(principal.getName());
                break;
            case GROUP:
                ret.getGroups().add(principal.getName());
                break;
            case ROLE:
                ret.getRoles().add(principal.getName());
                break;
            case UNKNOWN:
                break;
        }
    }
    for (HivePrivilege privilege : hivePrivileges) {
        String privName = privilege.getName();
        if (StringUtils.equalsIgnoreCase(privName, HiveAccessType.ALL.name()) || StringUtils.equalsIgnoreCase(privName, HiveAccessType.ALTER.name()) || StringUtils.equalsIgnoreCase(privName, HiveAccessType.CREATE.name()) || StringUtils.equalsIgnoreCase(privName, HiveAccessType.DROP.name()) || StringUtils.equalsIgnoreCase(privName, HiveAccessType.INDEX.name()) || StringUtils.equalsIgnoreCase(privName, HiveAccessType.LOCK.name()) || StringUtils.equalsIgnoreCase(privName, HiveAccessType.SELECT.name()) || StringUtils.equalsIgnoreCase(privName, HiveAccessType.UPDATE.name())) {
            ret.getAccessTypes().add(privName.toLowerCase());
        } else if (StringUtils.equalsIgnoreCase(privName, "Insert") || StringUtils.equalsIgnoreCase(privName, "Delete")) {
            // Mapping Insert/Delete to Update
            ret.getAccessTypes().add(HiveAccessType.UPDATE.name().toLowerCase());
        } else {
            LOG.warn("grant/revoke: unexpected privilege type '" + privName + "'. Ignored");
        }
    }
    return ret;
}

Example 10 with GrantRevokeRequest

use of org.apache.ranger.plugin.util.GrantRevokeRequest in project ranger by apache.

the class RangerHivePlugin method revokePrivileges.

/**
 * Revoke privileges for principals on the object
 * @param hivePrincipals
 * @param hivePrivileges
 * @param hivePrivObject
 * @param grantorPrincipal
 * @param grantOption
 * @throws HiveAuthzPluginException
 * @throws HiveAccessControlException
 */
@Override
public void revokePrivileges(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException, HiveAccessControlException {
    if (!RangerHivePlugin.UpdateXaPoliciesOnGrantRevoke) {
        throw new HiveAuthzPluginException("GRANT/REVOKE not supported in Ranger HiveAuthorizer. Please use Ranger Security Admin to setup access control.");
    }
    RangerHiveAuditHandler auditHandler = new RangerHiveAuditHandler(hivePlugin.getConfig());
    try {
        List<HivePrivilegeObject> outputs = new ArrayList<>(Arrays.asList(hivePrivObject));
        RangerHiveResource resource = getHiveResource(HiveOperationType.REVOKE_PRIVILEGE, hivePrivObject, null, outputs);
        GrantRevokeRequest request = createGrantRevokeData(resource, hivePrincipals, hivePrivileges, grantorPrincipal, grantOption);
        LOG.info("revokePrivileges(): " + request);
        if (LOG.isDebugEnabled()) {
            LOG.debug("revokePrivileges(): " + request);
        }
        hivePlugin.revokeAccess(request, auditHandler);
    } catch (Exception excp) {
        throw new HiveAccessControlException(excp);
    } finally {
        auditHandler.flushAudit();
    }
}