Examples with ServicePolicies org.apache.ranger.plugin.util.ServicePolicies used on opensource projects

Example 6 with ServicePolicies

use of org.apache.ranger.plugin.util.ServicePolicies in project ranger by apache.

the class PerfTestEngine method init.

public boolean init() {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> init()");
    }
    boolean ret = false;
    Gson gsonBuilder = new GsonBuilder().setDateFormat("yyyyMMdd-HH:mm:ss.SSS-Z").setPrettyPrinting().create();
    Reader reader = null;
    ServicePolicies servicePolicies;
    try {
        InputStream in = servicePoliciesFileURL.openStream();
        reader = new InputStreamReader(in, Charset.forName("UTF-8"));
        servicePolicies = gsonBuilder.fromJson(reader, ServicePolicies.class);
        policyEvaluationEngine = new RangerPolicyEngineImpl("perf-test", servicePolicies, policyEngineOptions);
        requestCount.set(0L);
        ret = true;
    } catch (Exception excp) {
        LOG.error("Error opening service-policies file or loading service-policies from file, URL=" + servicePoliciesFileURL, excp);
    } finally {
        if (reader != null) {
            try {
                reader.close();
            } catch (Exception excp) {
                LOG.error("Error closing file", excp);
            }
        }
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== init() : " + ret);
    }
    return ret;
}

Example 7 with ServicePolicies

use of org.apache.ranger.plugin.util.ServicePolicies in project ranger by apache.

the class ServiceDBStore method getServicePoliciesIfUpdated.

@Override
public ServicePolicies getServicePoliciesIfUpdated(String serviceName, Long lastKnownVersion) throws Exception {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> ServiceDBStore.getServicePoliciesIfUpdated(" + serviceName + ", " + lastKnownVersion + ")");
    }
    ServicePolicies ret = null;
    XXService serviceDbObj = daoMgr.getXXService().findByName(serviceName);
    if (serviceDbObj == null) {
        throw new Exception("service does not exist. name=" + serviceName);
    }
    XXServiceVersionInfo serviceVersionInfoDbObj = daoMgr.getXXServiceVersionInfo().findByServiceName(serviceName);
    if (serviceVersionInfoDbObj == null) {
        LOG.warn("serviceVersionInfo does not exist. name=" + serviceName);
    }
    if (lastKnownVersion == null || serviceVersionInfoDbObj == null || serviceVersionInfoDbObj.getPolicyVersion() == null || !lastKnownVersion.equals(serviceVersionInfoDbObj.getPolicyVersion())) {
        ret = RangerServicePoliciesCache.getInstance().getServicePolicies(serviceName, serviceDbObj.getId(), this);
    }
    if (ret != null && lastKnownVersion != null && lastKnownVersion.equals(ret.getPolicyVersion())) {
        // ServicePolicies are not changed
        ret = null;
    }
    if (LOG.isDebugEnabled()) {
        RangerServicePoliciesCache.getInstance().dump();
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== ServiceDBStore.getServicePoliciesIfUpdated(" + serviceName + ", " + lastKnownVersion + "): count=" + ((ret == null || ret.getPolicies() == null) ? 0 : ret.getPolicies().size()));
    }
    return ret;
}

Example 8 with ServicePolicies

use of org.apache.ranger.plugin.util.ServicePolicies in project nifi by apache.

the class RangerBasePluginWithPolicies method createPolicyLookup.

private PolicyLookup createPolicyLookup(final ServicePolicies servicePolicies) {
    final Map<String, AccessPolicy> policiesByIdentifier = new HashMap<>();
    final Map<String, Map<RequestAction, AccessPolicy>> policiesByResource = new HashMap<>();
    logger.info("Converting Ranger ServicePolicies model into NiFi policy model for viewing purposes in NiFi UI.");
    servicePolicies.getPolicies().stream().forEach(policy -> {
        // only consider policies that are enabled
        if (Boolean.TRUE.equals(policy.getIsEnabled())) {
            // get all the resources for this policy - excludes/recursive support disabled
            final Set<String> resources = policy.getResources().values().stream().filter(resource -> {
                final boolean isMissingResource;
                final boolean isWildcard;
                if (resource.getValues() == null) {
                    isMissingResource = true;
                    isWildcard = false;
                } else {
                    isMissingResource = false;
                    isWildcard = resource.getValues().stream().anyMatch(value -> value.contains(WILDCARD_ASTERISK));
                }
                final boolean isExclude = Boolean.TRUE.equals(resource.getIsExcludes());
                final boolean isRecursive = Boolean.TRUE.equals(resource.getIsRecursive());
                if (isMissingResource) {
                    logger.warn("Encountered resources missing values. Skipping policy for viewing purposes. Will still be used for access decisions.");
                }
                if (isWildcard) {
                    logger.warn(String.format("Resources [%s] include a wildcard value. Skipping policy for viewing purposes. " + "Will still be used for access decisions.", StringUtils.join(resource.getValues(), ", ")));
                }
                if (isExclude) {
                    logger.warn(String.format("Resources [%s] marked as an exclude policy. Skipping policy for viewing purposes. " + "Will still be used for access decisions.", StringUtils.join(resource.getValues(), ", ")));
                }
                if (isRecursive) {
                    logger.warn(String.format("Resources [%s] marked as a recursive policy. Skipping policy for viewing purposes. " + "Will still be used for access decisions.", StringUtils.join(resource.getValues(), ", ")));
                }
                return !isMissingResource && !isWildcard && !isExclude && !isRecursive;
            }).flatMap(resource -> resource.getValues().stream()).collect(Collectors.toSet());
            policy.getPolicyItems().forEach(policyItem -> {
                // get all the users for this policy item, excluding unknown users
                final Set<String> userIds = policyItem.getUsers().stream().map(userIdentity -> getUser(userIdentity)).filter(Objects::nonNull).map(user -> user.getIdentifier()).collect(Collectors.toSet());
                // get all groups for this policy item, excluding unknown groups
                final Set<String> groupIds = policyItem.getGroups().stream().map(groupName -> getGroup(groupName)).filter(Objects::nonNull).map(group -> group.getIdentifier()).collect(Collectors.toSet());
                // check if this policy item is a delegate admin
                final boolean isDelegateAdmin = Boolean.TRUE.equals(policyItem.getDelegateAdmin());
                policyItem.getAccesses().forEach(access -> {
                    try {
                        // interpret the request action
                        final RequestAction action = RequestAction.valueOf(access.getType());
                        // function for creating an access policy
                        final Function<String, AccessPolicy> createPolicy = resource -> new AccessPolicy.Builder().identifierGenerateFromSeed(resource + access.getType()).resource(resource).action(action).addUsers(userIds).addGroups(groupIds).build();
                        resources.forEach(resource -> {
                            // create the access policy for the specified resource
                            final AccessPolicy accessPolicy = createPolicy.apply(resource);
                            policiesByIdentifier.put(accessPolicy.getIdentifier(), accessPolicy);
                            policiesByResource.computeIfAbsent(resource, r -> new HashMap<>()).put(action, accessPolicy);
                            // if this is a delegate admin, also create the admin policy for the specified resource
                            if (isDelegateAdmin) {
                                // build the admin resource identifier
                                final String adminResource;
                                if (resource.startsWith("/")) {
                                    adminResource = "/policies" + resource;
                                } else {
                                    adminResource = "/policies/" + resource;
                                }
                                final AccessPolicy adminAccessPolicy = createPolicy.apply(adminResource);
                                policiesByIdentifier.put(adminAccessPolicy.getIdentifier(), adminAccessPolicy);
                                policiesByResource.computeIfAbsent(adminResource, ar -> new HashMap<>()).put(action, adminAccessPolicy);
                            }
                        });
                    } catch (final IllegalArgumentException e) {
                        logger.warn(String.format("Unrecognized request action '%s'. Skipping policy for viewing purposes. Will still be used for access decisions.", access.getType()));
                    }
                });
            });
        }
    });
    return new PolicyLookup(policiesByIdentifier, policiesByResource);
}

Example 9 with ServicePolicies

use of org.apache.ranger.plugin.util.ServicePolicies in project nifi by apache.

the class TestRangerBasePluginWithPolicies method testPoliciesWithUserGroupProvider.

@Test
public void testPoliciesWithUserGroupProvider() {
    // unknown according to user group provider
    final String user1 = "user-1";
    // known according to user group provider
    final String user2 = "user-2";
    // unknown according to user group provider
    final String group1 = "group-1";
    // known according to user group provider
    final String group2 = "group-2";
    final UserGroupProvider userGroupProvider = new UserGroupProvider() {

        @Override
        public Set<User> getUsers() throws AuthorizationAccessException {
            return Stream.of(new User.Builder().identifierGenerateFromSeed(user2).identity(user2).build()).collect(Collectors.toSet());
        }

        @Override
        public User getUser(String identifier) throws AuthorizationAccessException {
            final User u2 = new User.Builder().identifierGenerateFromSeed(user2).identity(user2).build();
            if (u2.getIdentifier().equals(identifier)) {
                return u2;
            } else {
                return null;
            }
        }

        @Override
        public User getUserByIdentity(String identity) throws AuthorizationAccessException {
            if (user2.equals(identity)) {
                return new User.Builder().identifierGenerateFromSeed(user2).identity(user2).build();
            } else {
                return null;
            }
        }

        @Override
        public Set<Group> getGroups() throws AuthorizationAccessException {
            return Stream.of(new Group.Builder().identifierGenerateFromSeed(group2).name(group2).build()).collect(Collectors.toSet());
        }

        @Override
        public Group getGroup(String identifier) throws AuthorizationAccessException {
            final Group g2 = new Group.Builder().identifierGenerateFromSeed(group2).name(group2).build();
            if (g2.getIdentifier().equals(identifier)) {
                return g2;
            } else {
                return null;
            }
        }

        @Override
        public UserAndGroups getUserAndGroups(String identity) throws AuthorizationAccessException {
            if (user2.equals(identity)) {
                return new UserAndGroups() {

                    @Override
                    public User getUser() {
                        return new User.Builder().identifierGenerateFromSeed(user2).identity(user2).build();
                    }

                    @Override
                    public Set<Group> getGroups() {
                        return Collections.EMPTY_SET;
                    }
                };
            } else {
                return null;
            }
        }

        @Override
        public void initialize(UserGroupProviderInitializationContext initializationContext) throws AuthorizerCreationException {
        }

        @Override
        public void onConfigured(AuthorizerConfigurationContext configurationContext) throws AuthorizerCreationException {
        }

        @Override
        public void preDestruction() throws AuthorizerDestructionException {
        }
    };
    final String resourceIdentifier1 = "/resource-1";
    RangerPolicyResource resource1 = new RangerPolicyResource(resourceIdentifier1);
    final Map<String, RangerPolicyResource> policy1Resources = new HashMap<>();
    policy1Resources.put(resourceIdentifier1, resource1);
    final RangerPolicyItem policy1Item = new RangerPolicyItem();
    policy1Item.setAccesses(Stream.of(new RangerPolicyItemAccess("READ")).collect(Collectors.toList()));
    policy1Item.setUsers(Stream.of(user1).collect(Collectors.toList()));
    policy1Item.setGroups(Stream.of(group2).collect(Collectors.toList()));
    final RangerPolicy policy1 = new RangerPolicy();
    policy1.setResources(policy1Resources);
    policy1.setPolicyItems(Stream.of(policy1Item).collect(Collectors.toList()));
    final String resourceIdentifier2 = "/resource-2";
    RangerPolicyResource resource2 = new RangerPolicyResource(resourceIdentifier2);
    final Map<String, RangerPolicyResource> policy2Resources = new HashMap<>();
    policy2Resources.put(resourceIdentifier2, resource2);
    final RangerPolicyItem policy2Item = new RangerPolicyItem();
    policy2Item.setAccesses(Stream.of(new RangerPolicyItemAccess("READ"), new RangerPolicyItemAccess("WRITE")).collect(Collectors.toList()));
    policy2Item.setUsers(Stream.of(user2).collect(Collectors.toList()));
    policy2Item.setGroups(Stream.of(group1).collect(Collectors.toList()));
    final RangerPolicy policy2 = new RangerPolicy();
    policy2.setResources(policy2Resources);
    policy2.setPolicyItems(Stream.of(policy2Item).collect(Collectors.toList()));
    final List<RangerPolicy> policies = new ArrayList<>();
    policies.add(policy1);
    policies.add(policy2);
    final RangerServiceDef serviceDef = new RangerServiceDef();
    serviceDef.setName("nifi");
    final ServicePolicies servicePolicies = new ServicePolicies();
    servicePolicies.setPolicies(policies);
    servicePolicies.setServiceDef(serviceDef);
    // set all the policies in the plugin
    final RangerBasePluginWithPolicies pluginWithPolicies = new RangerBasePluginWithPolicies("nifi", "nifi", userGroupProvider);
    pluginWithPolicies.setPolicies(servicePolicies);
    // ensure the two ranger policies converted into 3 nifi access policies
    final Set<AccessPolicy> accessPolicies = pluginWithPolicies.getAccessPolicies();
    assertEquals(3, accessPolicies.size());
    // resource 1 -> read but no write
    assertFalse(pluginWithPolicies.doesPolicyExist(resourceIdentifier1, RequestAction.WRITE));
    assertTrue(pluginWithPolicies.doesPolicyExist(resourceIdentifier1, RequestAction.READ));
    // read
    final AccessPolicy readResource1 = pluginWithPolicies.getAccessPolicy(resourceIdentifier1, RequestAction.READ);
    assertNotNull(readResource1);
    assertTrue(accessPolicies.contains(readResource1));
    assertTrue(readResource1.equals(pluginWithPolicies.getAccessPolicy(readResource1.getIdentifier())));
    assertTrue(readResource1.getUsers().isEmpty());
    assertEquals(1, readResource1.getGroups().size());
    assertTrue(readResource1.getGroups().contains(new Group.Builder().identifierGenerateFromSeed(group2).name(group2).build().getIdentifier()));
    // but no write
    assertNull(pluginWithPolicies.getAccessPolicy(resourceIdentifier1, RequestAction.WRITE));
    // resource 2 -> read and write
    assertTrue(pluginWithPolicies.doesPolicyExist(resourceIdentifier2, RequestAction.WRITE));
    assertTrue(pluginWithPolicies.doesPolicyExist(resourceIdentifier2, RequestAction.READ));
    // read
    final AccessPolicy readResource2 = pluginWithPolicies.getAccessPolicy(resourceIdentifier2, RequestAction.READ);
    assertNotNull(readResource2);
    assertTrue(accessPolicies.contains(readResource2));
    assertTrue(readResource2.equals(pluginWithPolicies.getAccessPolicy(readResource2.getIdentifier())));
    assertEquals(1, readResource2.getUsers().size());
    assertTrue(readResource2.getUsers().contains(new User.Builder().identifierGenerateFromSeed(user2).identity(user2).build().getIdentifier()));
    assertTrue(readResource2.getGroups().isEmpty());
    // and write
    final AccessPolicy writeResource2 = pluginWithPolicies.getAccessPolicy(resourceIdentifier2, RequestAction.READ);
    assertNotNull(writeResource2);
    assertTrue(accessPolicies.contains(writeResource2));
    assertTrue(writeResource2.equals(pluginWithPolicies.getAccessPolicy(writeResource2.getIdentifier())));
    assertEquals(1, writeResource2.getUsers().size());
    assertTrue(writeResource2.getUsers().contains(new User.Builder().identifierGenerateFromSeed(user2).identity(user2).build().getIdentifier()));
    assertTrue(writeResource2.getGroups().isEmpty());
}

Example 10 with ServicePolicies

use of org.apache.ranger.plugin.util.ServicePolicies in project nifi by apache.

the class TestRangerBasePluginWithPolicies method testPoliciesWithoutUserGroupProvider.

@Test
public void testPoliciesWithoutUserGroupProvider() {
    final String user1 = "user-1";
    final String group1 = "group-1";
    final String resourceIdentifier1 = "/resource-1";
    RangerPolicyResource resource1 = new RangerPolicyResource(resourceIdentifier1);
    final Map<String, RangerPolicyResource> policy1Resources = new HashMap<>();
    policy1Resources.put(resourceIdentifier1, resource1);
    final RangerPolicyItem policy1Item = new RangerPolicyItem();
    policy1Item.setAccesses(Stream.of(new RangerPolicyItemAccess("READ")).collect(Collectors.toList()));
    policy1Item.setUsers(Stream.of(user1).collect(Collectors.toList()));
    final RangerPolicy policy1 = new RangerPolicy();
    policy1.setResources(policy1Resources);
    policy1.setPolicyItems(Stream.of(policy1Item).collect(Collectors.toList()));
    final String resourceIdentifier2 = "/resource-2";
    RangerPolicyResource resource2 = new RangerPolicyResource(resourceIdentifier2);
    final Map<String, RangerPolicyResource> policy2Resources = new HashMap<>();
    policy2Resources.put(resourceIdentifier2, resource2);
    final RangerPolicyItem policy2Item = new RangerPolicyItem();
    policy2Item.setAccesses(Stream.of(new RangerPolicyItemAccess("READ"), new RangerPolicyItemAccess("WRITE")).collect(Collectors.toList()));
    policy2Item.setGroups(Stream.of(group1).collect(Collectors.toList()));
    final RangerPolicy policy2 = new RangerPolicy();
    policy2.setResources(policy2Resources);
    policy2.setPolicyItems(Stream.of(policy2Item).collect(Collectors.toList()));
    final List<RangerPolicy> policies = new ArrayList<>();
    policies.add(policy1);
    policies.add(policy2);
    final RangerServiceDef serviceDef = new RangerServiceDef();
    serviceDef.setName("nifi");
    final ServicePolicies servicePolicies = new ServicePolicies();
    servicePolicies.setPolicies(policies);
    servicePolicies.setServiceDef(serviceDef);
    // set all the policies in the plugin
    final RangerBasePluginWithPolicies pluginWithPolicies = new RangerBasePluginWithPolicies("nifi", "nifi");
    pluginWithPolicies.setPolicies(servicePolicies);
    // ensure the two ranger policies converted into 3 nifi access policies
    final Set<AccessPolicy> accessPolicies = pluginWithPolicies.getAccessPolicies();
    assertEquals(3, accessPolicies.size());
    // resource 1 -> read but no write
    assertFalse(pluginWithPolicies.doesPolicyExist(resourceIdentifier1, RequestAction.WRITE));
    assertTrue(pluginWithPolicies.doesPolicyExist(resourceIdentifier1, RequestAction.READ));
    // read
    final AccessPolicy readResource1 = pluginWithPolicies.getAccessPolicy(resourceIdentifier1, RequestAction.READ);
    assertNotNull(readResource1);
    assertTrue(accessPolicies.contains(readResource1));
    assertTrue(readResource1.equals(pluginWithPolicies.getAccessPolicy(readResource1.getIdentifier())));
    assertEquals(1, readResource1.getUsers().size());
    assertTrue(readResource1.getUsers().contains(new User.Builder().identifierGenerateFromSeed(user1).identity(user1).build().getIdentifier()));
    assertTrue(readResource1.getGroups().isEmpty());
    // but no write
    assertNull(pluginWithPolicies.getAccessPolicy(resourceIdentifier1, RequestAction.WRITE));
    // resource 2 -> read and write
    assertTrue(pluginWithPolicies.doesPolicyExist(resourceIdentifier2, RequestAction.WRITE));
    assertTrue(pluginWithPolicies.doesPolicyExist(resourceIdentifier2, RequestAction.READ));
    // read
    final AccessPolicy readResource2 = pluginWithPolicies.getAccessPolicy(resourceIdentifier2, RequestAction.READ);
    assertNotNull(readResource2);
    assertTrue(accessPolicies.contains(readResource2));
    assertTrue(readResource2.equals(pluginWithPolicies.getAccessPolicy(readResource2.getIdentifier())));
    assertTrue(readResource2.getUsers().isEmpty());
    assertEquals(1, readResource2.getGroups().size());
    assertTrue(readResource2.getGroups().contains(new Group.Builder().identifierGenerateFromSeed(group1).name(group1).build().getIdentifier()));
    // and write
    final AccessPolicy writeResource2 = pluginWithPolicies.getAccessPolicy(resourceIdentifier2, RequestAction.READ);
    assertNotNull(writeResource2);
    assertTrue(accessPolicies.contains(writeResource2));
    assertTrue(writeResource2.equals(pluginWithPolicies.getAccessPolicy(writeResource2.getIdentifier())));
    assertTrue(writeResource2.getUsers().isEmpty());
    assertEquals(1, writeResource2.getGroups().size());
    assertTrue(writeResource2.getGroups().contains(new Group.Builder().identifierGenerateFromSeed(group1).name(group1).build().getIdentifier()));
    // resource 3 -> no read or write
    assertFalse(pluginWithPolicies.doesPolicyExist("resource-3", RequestAction.WRITE));
    assertFalse(pluginWithPolicies.doesPolicyExist("resource-3", RequestAction.READ));
    // no read or write
    assertNull(pluginWithPolicies.getAccessPolicy("resource-3", RequestAction.WRITE));
    assertNull(pluginWithPolicies.getAccessPolicy("resource-3", RequestAction.READ));
}