Skip to content

Commit fc77219

Browse files
pradeepagrawal8184pradeepagrawal8184
committed
RANGER-4607: Ranger REST API improvements
RANGER-4545: DELETE /assets/resources/{resource_id} API should return proper status code for non admin users RANGER-4546: /assets/ugsyncAudits/{sync_source} API is accessible by user without permission on audit module RANGER-4548: Return proper error message in the response for /tags/tags, /tags/resources and /tags/types API for non admin users RANGER-4547: The reponse metrics (pagination values) for the /assets/ugsyncAudits/{sync_source} API is not proper RANGER-4549: Non admin users cannot access /public/v2/api/roles/names and /public/v2/api/roles/name/{name} API, but can access /public/v2/api/roles API RANGER-4551: No response returned for /assets/policyList/{service_name} API RANGER-4550: API request to /assets/resource/{id} returns no response RANGER-4552: Response metrics for /assets/report is not proper, and pagination does not work RANGER-4553: Response metrics for /xaudit/trx_log not proper RANGER-4554: Response metrics for /assets/resources not proper RANGER-4555: Response metrics for /assets/assets API not proper RANGER-4573: /xaudit/trx_log API not accessible by keyadmin user RANGER-4578: /xuser/groupgroups and /xuser/groupusers APIs allow creation of entities even without groupId / userId fields in the request RANGER-4574: /public/v2/api/service/{service_name}/policy/{policy_name} API returns policies for users without access to the policy RANGER-4575: /plugins/policy/{policy_id}/version/{version_number} API returns policies for users without access to the policy RANGER-4576: User without access to policy is able to fetch policy details using /plugins/policies/{service_type}/for-resource API endpoint RANGER-4577: UI and API behaviour for fetching users not consistent for keyadmin users RANGER-4589: keyadmin user can update the user password via UI but cannot update the user password using /users/{user_id}/passwordchange API RANGER-4588: /xaudit/trx_log/{trx_log_id} is not accessible by keyadmin user RANGER-4591: keyadmin user can access non kms related admin audits using /assets/report/{transaction_id} API RANGER-4594: keyadmin user can mark ROLE_USER users as disabled by setting status to 0 using /users API RANGER-4595: keyadmin user able to view the user permission objects via /users API RANGER-4596: keyadmin can fetch the details of admin and auditor users through /users API endpoint RANGER-4598: ROLE_USER cannot acccess /xusers/groups API but can access /xusers/groups/groupName/{group_name} API RANGER-4586: XUserREST and UserREST API improvement for keyadmin users Change-Id: I1fa52a99049d81e58c40d071211d62b278ff8ef1
1 parent 19a3e11 commit fc77219

26 files changed

+643
-971
lines changed

‎security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java

Lines changed: 3 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@
1919

2020
package org.apache.ranger.biz;
2121

22-
import java.io.File;
23-
import java.io.IOException;
2422
import java.security.cert.X509Certificate;
2523
import java.util.ArrayList;
2624
import java.util.Date;
@@ -68,8 +66,6 @@
6866
import org.apache.ranger.view.*;
6967
import org.apache.ranger.view.VXTrxLogV2.AttributeChangeInfo;
7068
import org.apache.ranger.view.VXTrxLogV2.ObjectChangeInfo;
71-
import com.fasterxml.jackson.core.JsonGenerationException;
72-
import com.fasterxml.jackson.databind.JsonMappingException;
7369
import org.slf4j.Logger;
7470
import org.slf4j.LoggerFactory;
7571
import org.springframework.beans.factory.annotation.Autowired;
@@ -165,53 +161,6 @@ public void init() {
165161
logger.info("<== AssetMgr.init()");
166162
}
167163

168-
public File getXResourceFile(Long id, String fileType) {
169-
VXResource xResource = xResourceService.readResource(id);
170-
if (xResource == null) {
171-
throw this.restErrorUtil.createRESTException(
172-
"serverMsg.datasourceIdEmpty" + "id " + id,
173-
MessageEnums.DATA_NOT_FOUND, id, "dataSourceId",
174-
"DataSource not found with " + "id " + id);
175-
}
176-
177-
return getXResourceFile(xResource, fileType);
178-
}
179-
180-
public File getXResourceFile(VXResource xResource, String fileType) {
181-
File file = null;
182-
try {
183-
if (fileType != null) {
184-
if ("json".equalsIgnoreCase(fileType)) {
185-
file = jsonUtil.writeJsonToFile(xResource,
186-
xResource.getName());
187-
} else {
188-
throw restErrorUtil.createRESTException(
189-
"Please send the supported filetype.",
190-
MessageEnums.INVALID_INPUT_DATA);
191-
}
192-
} else {
193-
throw restErrorUtil
194-
.createRESTException(
195-
"Please send the file format in which you want to export.",
196-
MessageEnums.DATA_NOT_FOUND);
197-
}
198-
} catch (JsonGenerationException e) {
199-
throw this.restErrorUtil.createRESTException(
200-
"serverMsg.jsonGeneration" + " : " + e.getMessage(),
201-
MessageEnums.ERROR_SYSTEM);
202-
} catch (JsonMappingException e) {
203-
throw this.restErrorUtil.createRESTException(
204-
"serverMsg.jsonMapping" + " : " + e.getMessage(),
205-
MessageEnums.ERROR_SYSTEM);
206-
} catch (IOException e) {
207-
throw this.restErrorUtil.createRESTException(
208-
"serverMsg.ioException" + " : " + e.getMessage(),
209-
MessageEnums.ERROR_SYSTEM);
210-
}
211-
212-
return file;
213-
}
214-
215164
public String getLatestRepoPolicy(VXAsset xAsset, List<VXResource> xResourceList, Long updatedTime,
216165
X509Certificate[] certchain, boolean httpEnabled, String epoch,
217166
String ipAddress, boolean isSecure, String count, String agentId) {
@@ -1365,6 +1314,9 @@ public VXUgsyncAuditInfoList getUgsyncAudits(SearchCriteria searchCriteria) {
13651314
}
13661315

13671316
public VXUgsyncAuditInfoList getUgsyncAuditsBySyncSource(String syncSource) {
1317+
if (!msBizUtil.hasModuleAccess(RangerConstants.MODULE_AUDIT)) {
1318+
throw restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN, "User is not having permissions on the "+RangerConstants.MODULE_AUDIT+" module.", true);
1319+
}
13681320
if(syncSource!=null && !syncSource.trim().isEmpty()){
13691321
return xUgsyncAuditInfoService.searchXUgsyncAuditInfoBySyncSource(syncSource);
13701322
}else{

‎security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java

Lines changed: 50 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -5051,62 +5051,62 @@ public int compare(RangerPolicy c1, RangerPolicy c2) {
50515051

50525052
// fetch policies maintained for the roles and groups belonging to the group
50535053
String groupName = searchFilter.getParam("group");
5054-
if (!StringUtils.isEmpty(groupName)) {
5055-
Set<String> groupNames = daoMgr.getXXGroupGroup().findGroupNamesByGroupName(groupName);
5056-
groupNames.add(RangerConstants.GROUP_PUBLIC);
5057-
groupNames.add(groupName);
5058-
Set<Long> processedSvcIdsForGroup = new HashSet<>();
5059-
Set<String> processedGroupsName = new HashSet<>();
5060-
List<XXPolicy> xPolList2;
5061-
for (String grpName : groupNames) {
5062-
searchFilter.setParam("group", grpName);
5063-
xPolList2 = policyService.searchResources(searchFilter, policyService.searchFields, policyService.sortFields, retList);
5064-
if (!CollectionUtils.isEmpty(xPolList2)) {
5065-
for (XXPolicy xPol2 : xPolList2) {
5066-
if(xPol2!=null){
5067-
if (!processedPolicies.contains(xPol2.getId())) {
5068-
if (!processedSvcIdsForGroup.contains(xPol2.getService())
5069-
|| !processedGroupsName.contains(groupName)) {
5070-
loadRangerPolicies(xPol2.getService(), processedSvcIdsForGroup, policyMap, searchFilter);
5071-
processedGroupsName.add(groupName);
5072-
}
5073-
if (policyMap.containsKey(xPol2.getId())) {
5074-
policyList.add(policyMap.get(xPol2.getId()));
5075-
processedPolicies.add(xPol2.getId());
5076-
}
5054+
if (StringUtils.isBlank(groupName)) {
5055+
groupName = RangerConstants.GROUP_PUBLIC;
5056+
}
5057+
Set<String> groupNames = daoMgr.getXXGroupGroup().findGroupNamesByGroupName(groupName);
5058+
groupNames.add(groupName);
5059+
Set<Long> processedSvcIdsForGroup = new HashSet<>();
5060+
Set<String> processedGroupsName = new HashSet<>();
5061+
List<XXPolicy> xPolList2;
5062+
for (String grpName : groupNames) {
5063+
searchFilter.setParam("group", grpName);
5064+
xPolList2 = policyService.searchResources(searchFilter, policyService.searchFields, policyService.sortFields, retList);
5065+
if (!CollectionUtils.isEmpty(xPolList2)) {
5066+
for (XXPolicy xPol2 : xPolList2) {
5067+
if(xPol2!=null){
5068+
if (!processedPolicies.contains(xPol2.getId())) {
5069+
if (!processedSvcIdsForGroup.contains(xPol2.getService())
5070+
|| !processedGroupsName.contains(groupName)) {
5071+
loadRangerPolicies(xPol2.getService(), processedSvcIdsForGroup, policyMap, searchFilter);
5072+
processedGroupsName.add(groupName);
5073+
}
5074+
if (policyMap.containsKey(xPol2.getId())) {
5075+
policyList.add(policyMap.get(xPol2.getId()));
5076+
processedPolicies.add(xPol2.getId());
50775077
}
50785078
}
50795079
}
50805080
}
50815081
}
5082+
}
50825083

5083-
searchFilter.removeParam("group");
5084-
XXGroup xxGroup = daoMgr.getXXGroup().findByGroupName(groupName);
5085-
if (xxGroup != null) {
5086-
Set<Long> allContainedRoles = new HashSet<>();
5087-
List<XXRole> xxRoles = daoMgr.getXXRole().findByGroupId(xxGroup.getId());
5088-
for (XXRole xxRole : xxRoles) {
5089-
getContainingRoles(xxRole.getId(), allContainedRoles);
5090-
}
5091-
Set<String> roleNames = getRoleNames(allContainedRoles);
5092-
Set<String> processedRoleName = new HashSet<>();
5093-
List<XXPolicy> xPolList3;
5094-
for (String roleName : roleNames) {
5095-
searchFilter.setParam("role", roleName);
5096-
xPolList3 = policyService.searchResources(searchFilter, policyService.searchFields, policyService.sortFields, retList);
5097-
if (!CollectionUtils.isEmpty(xPolList3)) {
5098-
for (XXPolicy xPol3 : xPolList3) {
5099-
if (xPol3 != null) {
5100-
if (!processedPolicies.contains(xPol3.getId())) {
5101-
if (!processedSvcIdsForRole.contains(xPol3.getService())
5102-
|| !processedRoleName.contains(roleName)) {
5103-
loadRangerPolicies(xPol3.getService(), processedSvcIdsForRole, policyMap, searchFilter);
5104-
processedRoleName.add(roleName);
5105-
}
5106-
if (policyMap.containsKey(xPol3.getId())) {
5107-
policyList.add(policyMap.get(xPol3.getId()));
5108-
processedPolicies.add(xPol3.getId());
5109-
}
5084+
searchFilter.removeParam("group");
5085+
XXGroup xxGroup = daoMgr.getXXGroup().findByGroupName(groupName);
5086+
if (xxGroup != null) {
5087+
Set<Long> allContainedRoles = new HashSet<>();
5088+
List<XXRole> xxRoles = daoMgr.getXXRole().findByGroupId(xxGroup.getId());
5089+
for (XXRole xxRole : xxRoles) {
5090+
getContainingRoles(xxRole.getId(), allContainedRoles);
5091+
}
5092+
Set<String> roleNames = getRoleNames(allContainedRoles);
5093+
Set<String> processedRoleName = new HashSet<>();
5094+
List<XXPolicy> xPolList3;
5095+
for (String roleName : roleNames) {
5096+
searchFilter.setParam("role", roleName);
5097+
xPolList3 = policyService.searchResources(searchFilter, policyService.searchFields, policyService.sortFields, retList);
5098+
if (!CollectionUtils.isEmpty(xPolList3)) {
5099+
for (XXPolicy xPol3 : xPolList3) {
5100+
if (xPol3 != null) {
5101+
if (!processedPolicies.contains(xPol3.getId())) {
5102+
if (!processedSvcIdsForRole.contains(xPol3.getService())
5103+
|| !processedRoleName.contains(roleName)) {
5104+
loadRangerPolicies(xPol3.getService(), processedSvcIdsForRole, policyMap, searchFilter);
5105+
processedRoleName.add(roleName);
5106+
}
5107+
if (policyMap.containsKey(xPol3.getId())) {
5108+
policyList.add(policyMap.get(xPol3.getId()));
5109+
processedPolicies.add(xPol3.getId());
51105110
}
51115111
}
51125112
}

0 commit comments

Comments
 (0)