Skip to content

Commit 6d46c54

Browse files
dhavalshah9131dhavalshah9131
committed
RANGER-5215 : Policy authroisation fails for Ranger Plugins in case of users/groups converted by Ranger userysnc as per given Regex
1 parent 6325ed3 commit 6d46c54

10 files changed

Lines changed: 114 additions & 133 deletions

File tree

‎agents-common/src/main/java/org/apache/ranger/plugin/model/UgsyncNameTransformRules.java‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,9 @@
88
* with the License. You may obtain a copy of the License at
99
*
1010
* http://www.apache.org/licenses/LICENSE-2.0
11-
*=-0987654321`o6 bftware distributed under the License is distributed on an
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
1214
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
1315
* KIND, either express or implied. See the License for the
1416
* specific language governing permissions and limitations
@@ -34,12 +36,13 @@
3436
@XmlRootElement
3537
@XmlAccessorType(XmlAccessType.FIELD)
3638
public class UgsyncNameTransformRules extends RangerBaseModelObject implements java.io.Serializable {
37-
3839
private static final long serialVersionUID = 1L;
40+
private final String name;
3941
Map<String, String> nameTransformRules;
40-
private final String name;
4142

42-
public UgsyncNameTransformRules() {this(null, null, null);}
43+
public UgsyncNameTransformRules() {
44+
this(null, null, null);
45+
}
4346

4447
public UgsyncNameTransformRules(String guid, String name, Map<String, String> nameTransformRules) {
4548
super();
@@ -63,4 +66,4 @@ public String toString() {
6366
return "{nameTransformRules=" + RangerUserStoreUtil.getPrintableOptions(nameTransformRules)
6467
+ "}";
6568
}
66-
}
69+
}

‎agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPluginContext.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ public class RangerPluginContext {
4040

4141
private final RangerPluginConfig config;
4242
private final Map<String, Map<RangerPolicy.RangerPolicyResource, RangerResourceMatcher>> resourceMatchers = new HashMap<>();
43-
private final ReentrantReadWriteLock lock = new ReentrantReadWriteLock(true);// fair lock
43+
private final ReentrantReadWriteLock lock = new ReentrantReadWriteLock(true); // fair lock
4444
private Mapper userNameTransformInst;
4545
private Mapper groupNameTransformInst;
4646
private String userNameCaseConversion;

‎agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java‎

Lines changed: 0 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@
4040
import org.apache.ranger.plugin.util.RangerReadWriteLock;
4141
import org.apache.ranger.plugin.util.RangerRoles;
4242
import org.apache.ranger.plugin.util.ServicePolicies;
43-
import org.apache.ranger.ugsyncutil.transform.Mapper;
4443
import org.slf4j.Logger;
4544
import org.slf4j.LoggerFactory;
4645

@@ -84,53 +83,6 @@ public RangerPolicyEngineImpl(ServicePolicies servicePolicies, RangerPluginConte
8483
policyEngine = new PolicyEngine(servicePolicies, pluginContext, roles, isUseReadWriteLock);
8584
serviceConfig = new ServiceConfig(servicePolicies.getServiceConfig());
8685
requestProcessor = new RangerDefaultRequestProcessor(policyEngine);
87-
88-
Map<String, String> serviceConfigMap = servicePolicies.getServiceConfig();
89-
if (MapUtils.isNotEmpty(serviceConfigMap)) {
90-
if (LOG.isDebugEnabled()) {
91-
LOG.debug("==> RangerBasePlugin(" + serviceConfigMap.keySet() + ")");
92-
}
93-
pluginContext.setUserNameCaseConversion(serviceConfigMap.get(RangerCommonConstants.PLUGINS_USERNAME_CASE_CONVERSION_PARAM));
94-
pluginContext.setGroupNameCaseConversion(serviceConfigMap.get(RangerCommonConstants.PLUGINS_GROUPNAME_CASE_CONVERSION_PARAM));
95-
String mappingUserNameHandler = serviceConfigMap.get(RangerCommonConstants.PLUGINS_MAPPING_USERNAME_HANDLER);
96-
try {
97-
if (mappingUserNameHandler != null) {
98-
Class<Mapper> regExClass = (Class<Mapper>) Class.forName(mappingUserNameHandler);
99-
Mapper userNameRegExInst = regExClass.newInstance();
100-
if (userNameRegExInst != null) {
101-
String baseProperty = RangerCommonConstants.PLUGINS_MAPPING_USERNAME;
102-
userNameRegExInst.init(baseProperty, getAllRegexPatterns(baseProperty, serviceConfigMap),
103-
serviceConfigMap.get(RangerCommonConstants.PLUGINS_MAPPING_SEPARATOR));
104-
pluginContext.setUserNameTransformInst(userNameRegExInst);
105-
} else {
106-
LOG.error("RegEx handler instance for username is null!");
107-
}
108-
}
109-
} catch (ClassNotFoundException cne) {
110-
LOG.error("Failed to load " + mappingUserNameHandler + " " + cne);
111-
} catch (Throwable te) {
112-
LOG.error("Failed to instantiate " + mappingUserNameHandler + " " + te);
113-
}
114-
String mappingGroupNameHandler = serviceConfigMap.get(RangerCommonConstants.PLUGINS_MAPPING_GROUPNAME_HANDLER);
115-
try {
116-
if (mappingGroupNameHandler != null) {
117-
Class<Mapper> regExClass = (Class<Mapper>) Class.forName(mappingGroupNameHandler);
118-
Mapper groupNameRegExInst = regExClass.newInstance();
119-
if (groupNameRegExInst != null) {
120-
String baseProperty = RangerCommonConstants.PLUGINS_MAPPING_GROUPNAME;
121-
groupNameRegExInst.init(baseProperty, getAllRegexPatterns(baseProperty, serviceConfigMap),
122-
serviceConfigMap.get(RangerCommonConstants.PLUGINS_MAPPING_SEPARATOR));
123-
pluginContext.setGroupNameTransformInst(groupNameRegExInst);
124-
} else {
125-
LOG.error("RegEx handler instance for groupname is null!");
126-
}
127-
}
128-
} catch (ClassNotFoundException cne) {
129-
LOG.error("Failed to load " + mappingGroupNameHandler + " " + cne);
130-
} catch (Throwable te) {
131-
LOG.error("Failed to instantiate " + mappingGroupNameHandler + " " + te);
132-
}
133-
}
13486
}
13587

13688
private RangerPolicyEngineImpl(final PolicyEngine policyEngine, RangerPolicyEngineImpl other) {
@@ -602,31 +554,6 @@ public RangerAccessRequestProcessor getRequestProcessor() {
602554
return requestProcessor;
603555
}
604556

605-
private List<String> getAllRegexPatterns(String baseProperty, Map<String, String> serviceConfig) throws Throwable {
606-
List<String> regexPatterns = new ArrayList<String>();
607-
String baseRegex = serviceConfig.get(baseProperty);
608-
if (LOG.isDebugEnabled()) {
609-
LOG.debug("==> getAllRegexPatterns(" + baseProperty + ")");
610-
LOG.debug("baseRegex = " + baseRegex);
611-
LOG.debug("pluginConfig = " + serviceConfig.keySet());
612-
}
613-
if (baseRegex == null) {
614-
return regexPatterns;
615-
}
616-
regexPatterns.add(baseRegex);
617-
int i = 1;
618-
String nextRegex = serviceConfig.get(baseProperty + "." + i);
619-
while (nextRegex != null) {
620-
regexPatterns.add(nextRegex);
621-
i++;
622-
nextRegex = serviceConfig.get(baseProperty + "." + i);
623-
}
624-
if (LOG.isDebugEnabled()) {
625-
LOG.debug("<== getAllRegexPatterns(" + regexPatterns + ")");
626-
}
627-
return regexPatterns;
628-
}
629-
630557
private RangerAccessResult zoneAwareAccessEvaluationWithNoAudit(RangerAccessRequest request, int policyType) {
631558
LOG.debug("==> RangerPolicyEngineImpl.zoneAwareAccessEvaluationWithNoAudit({}, policyType={})", request, policyType);
632559

‎agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java‎

Lines changed: 72 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161
import org.apache.ranger.plugin.util.GrantRevokeRoleRequest;
6262
import org.apache.ranger.plugin.util.PerfDataRecorder;
6363
import org.apache.ranger.plugin.util.PolicyRefresher;
64+
import org.apache.ranger.plugin.util.RangerCommonConstants;
6465
import org.apache.ranger.plugin.util.RangerPolicyDeltaUtil;
6566
import org.apache.ranger.plugin.util.RangerRoles;
6667
import org.apache.ranger.plugin.util.RangerRolesUtil;
@@ -69,6 +70,7 @@
6970
import org.apache.ranger.plugin.util.ServiceGdsInfo;
7071
import org.apache.ranger.plugin.util.ServicePolicies;
7172
import org.apache.ranger.plugin.util.ServiceTags;
73+
import org.apache.ranger.ugsyncutil.transform.Mapper;
7274
import org.slf4j.Logger;
7375
import org.slf4j.LoggerFactory;
7476

@@ -208,7 +210,7 @@ public RangerBasePlugin(RangerPluginConfig pluginConfig, ServicePolicies policie
208210
this(pluginConfig);
209211

210212
init();
211-
213+
configurePluginContextFromServicePoliciesForUserGroupName(policies);
212214
setPolicies(policies);
213215
setRoles(roles);
214216

@@ -887,7 +889,7 @@ public Set<RangerRole> getRangerRoleForPrincipal(String principal, String type)
887889
RangerPolicyEngine policyEngine = this.policyEngine;
888890
RangerRoles roles = policyEngine != null ? policyEngine.getRangerRoles() : null;
889891
Set<RangerRole> rangerRoles = roles != null ? roles.getRangerRoles() : null;
890-
Map<String, Set<String>> roleMapping = null;
892+
Map<String, Set<String>> roleMapping = null;
891893

892894
if (rangerRoles != null) {
893895
RangerPluginContext rangerPluginContext = policyEngine.getPluginContext();
@@ -1274,6 +1276,74 @@ private RangerAdminClient getAdminClient() throws Exception {
12741276
return admin;
12751277
}
12761278

1279+
private void configurePluginContextFromServicePoliciesForUserGroupName(ServicePolicies servicePolicies) {
1280+
Map<String, String> serviceConfigMap = servicePolicies.getServiceConfig();
1281+
if (MapUtils.isNotEmpty(serviceConfigMap)) {
1282+
LOG.debug("==> RangerBasePlugin(" + serviceConfigMap.keySet() + ")");
1283+
pluginContext.setUserNameCaseConversion(serviceConfigMap.get(RangerCommonConstants.PLUGINS_USERNAME_CASE_CONVERSION_PARAM));
1284+
pluginContext.setGroupNameCaseConversion(serviceConfigMap.get(RangerCommonConstants.PLUGINS_GROUPNAME_CASE_CONVERSION_PARAM));
1285+
String mappingUserNameHandler = serviceConfigMap.get(RangerCommonConstants.PLUGINS_MAPPING_USERNAME_HANDLER);
1286+
try {
1287+
if (mappingUserNameHandler != null) {
1288+
Class<Mapper> regExClass = (Class<Mapper>) Class.forName(mappingUserNameHandler);
1289+
Mapper userNameRegExInst = regExClass.newInstance();
1290+
if (userNameRegExInst != null) {
1291+
String baseProperty = RangerCommonConstants.PLUGINS_MAPPING_USERNAME;
1292+
userNameRegExInst.init(baseProperty, getAllRegexPatterns(baseProperty, serviceConfigMap),
1293+
serviceConfigMap.get(RangerCommonConstants.PLUGINS_MAPPING_SEPARATOR));
1294+
pluginContext.setUserNameTransformInst(userNameRegExInst);
1295+
} else {
1296+
LOG.error("RegEx handler instance for username is null!");
1297+
}
1298+
}
1299+
} catch (ClassNotFoundException cne) {
1300+
LOG.error("Failed to load " + mappingUserNameHandler + " ", cne);
1301+
} catch (Throwable te) {
1302+
LOG.error("Failed to instantiate " + mappingUserNameHandler + " ", te);
1303+
}
1304+
String mappingGroupNameHandler = serviceConfigMap.get(RangerCommonConstants.PLUGINS_MAPPING_GROUPNAME_HANDLER);
1305+
try {
1306+
if (mappingGroupNameHandler != null) {
1307+
Class<Mapper> regExClass = (Class<Mapper>) Class.forName(mappingGroupNameHandler);
1308+
Mapper groupNameRegExInst = regExClass.newInstance();
1309+
if (groupNameRegExInst != null) {
1310+
String baseProperty = RangerCommonConstants.PLUGINS_MAPPING_GROUPNAME;
1311+
groupNameRegExInst.init(baseProperty, getAllRegexPatterns(baseProperty, serviceConfigMap),
1312+
serviceConfigMap.get(RangerCommonConstants.PLUGINS_MAPPING_SEPARATOR));
1313+
pluginContext.setGroupNameTransformInst(groupNameRegExInst);
1314+
} else {
1315+
LOG.error("RegEx handler instance for groupname is null!");
1316+
}
1317+
}
1318+
} catch (ClassNotFoundException cne) {
1319+
LOG.error("Failed to load " + mappingGroupNameHandler + " ", cne);
1320+
} catch (Throwable te) {
1321+
LOG.error("Failed to instantiate " + mappingGroupNameHandler + " ", te);
1322+
}
1323+
}
1324+
}
1325+
1326+
private List<String> getAllRegexPatterns(String baseProperty, Map<String, String> serviceConfig) throws Throwable {
1327+
List<String> regexPatterns = new ArrayList<String>();
1328+
String baseRegex = serviceConfig.get(baseProperty);
1329+
LOG.debug("==> getAllRegexPatterns(" + baseProperty + ")");
1330+
LOG.debug("baseRegex = " + baseRegex);
1331+
LOG.debug("pluginConfig = " + serviceConfig.keySet());
1332+
if (baseRegex == null) {
1333+
return regexPatterns;
1334+
}
1335+
regexPatterns.add(baseRegex);
1336+
int i = 1;
1337+
String nextRegex = serviceConfig.get(baseProperty + "." + i);
1338+
while (nextRegex != null) {
1339+
regexPatterns.add(nextRegex);
1340+
i++;
1341+
nextRegex = serviceConfig.get(baseProperty + "." + i);
1342+
}
1343+
LOG.debug("<== getAllRegexPatterns(" + regexPatterns + ")");
1344+
return regexPatterns;
1345+
}
1346+
12771347
private List<RangerChainedPlugin> initChainedPlugins() {
12781348
List<RangerChainedPlugin> ret = new ArrayList<>();
12791349
String chainedServicePropPrefix = pluginConfig.getPropertyPrefix() + ".chained.services";

‎agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java‎

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -104,31 +104,25 @@ public void preProcess(RangerAccessRequest request) {
104104
}
105105

106106
RangerPluginConfig config = policyEngine.getPluginContext().getConfig();
107-
if (LOG.isDebugEnabled()) {
108-
LOG.debug("RangerPluginConfig = " + config.getPropertyPrefix());
109-
}
107+
LOG.debug("RangerPluginConfig = " + config.getPropertyPrefix());
110108
if (config != null) {
111109
boolean isNameTransformationSupported = config.getBoolean(config.getPropertyPrefix() + RangerCommonConstants.PLUGIN_CONFIG_SUFFIX_NAME_TRANSFORMATION, false);
112110

113-
if (LOG.isDebugEnabled()) {
114-
LOG.debug("isNameTransformationSupported = " + isNameTransformationSupported);
115-
}
111+
LOG.debug("isNameTransformationSupported = " + isNameTransformationSupported);
112+
116113
if (isNameTransformationSupported) {
117114
String user = request.getUser();
118-
if (policyEngine.getPluginContext().getUserNameCaseConversion().equalsIgnoreCase(UgsyncCommonConstants.UGSYNC_LOWER_CASE_CONVERSION_VALUE)) {
115+
String userNameCaseConversion = policyEngine.getPluginContext().getUserNameCaseConversion();
116+
if (userNameCaseConversion != null && userNameCaseConversion.equalsIgnoreCase(UgsyncCommonConstants.UGSYNC_LOWER_CASE_CONVERSION_VALUE)) {
119117
user = user.toLowerCase();
120-
} else if (policyEngine.getPluginContext().getUserNameCaseConversion().equalsIgnoreCase(UgsyncCommonConstants.UGSYNC_UPPER_CASE_CONVERSION_VALUE)) {
118+
} else if (userNameCaseConversion != null && userNameCaseConversion.equalsIgnoreCase(UgsyncCommonConstants.UGSYNC_UPPER_CASE_CONVERSION_VALUE)) {
121119
user = user.toUpperCase();
122120
}
123121
Mapper userNameTransformInst = policyEngine.getPluginContext().getUserNameTransformInst();
124122
if (userNameTransformInst != null) {
125123
String originalUser = request.getUser();
126124
String transformedUser = userNameTransformInst.transform(user);
127-
128-
if (LOG.isDebugEnabled()) {
129-
LOG.debug("Original username = {}, Transformed username = {}", originalUser, transformedUser);
130-
}
131-
125+
LOG.debug("Original username = {}, Transformed username = {}", originalUser, transformedUser);
132126
reqImpl.setUser(transformedUser);
133127
}
134128
Mapper groupNameTransformInst = policyEngine.getPluginContext().getGroupNameTransformInst();
@@ -146,11 +140,7 @@ public void preProcess(RangerAccessRequest request) {
146140
}
147141

148142
String transformedGroup = groupNameTransformInst.transform(group);
149-
150-
if (LOG.isDebugEnabled()) {
151-
LOG.debug("Original group name = {}, Transformed group name = {}", originalGroupName, transformedGroup);
152-
}
153-
143+
LOG.debug("Original group name = {}, Transformed group name = {}", originalGroupName, transformedGroup);
154144
return transformedGroup;
155145
})
156146
.collect(Collectors.toSet());

‎agents-common/src/main/java/org/apache/ranger/plugin/util/ServicePolicies.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public static ServicePolicies copyHeader(ServicePolicies source) {
7070
ret.setPolicyVersion(source.getPolicyVersion());
7171
ret.setAuditMode(source.getAuditMode());
7272
ret.setServiceDef(source.getServiceDef());
73-
ret.setServiceConfig(source.getServiceConfig());
73+
ret.setServiceConfig(source.getServiceConfig() != null ? new HashMap<>(source.getServiceConfig()) : null);
7474
ret.setPolicyUpdateTime(source.getPolicyUpdateTime());
7575
ret.setSecurityZones(source.getSecurityZones());
7676
ret.setPolicies(Collections.emptyList());

‎security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@ public class ServiceDBStore extends AbstractServiceStore {
271271
private static String LOCAL_HOSTNAME;
272272
private static boolean isRolesDownloadedByService;
273273
private static volatile boolean legacyServiceDefsInitDone;
274-
private final String OPTION_UGSYNC_CONFIG_CHANGE = "ugsyncConfigChange";
274+
private final String optionUgsyncConfigChange = "ugsyncConfigChange";
275275
@Autowired
276276
RangerServiceDefService serviceDefService;
277277
@Autowired
@@ -1153,7 +1153,7 @@ public RangerService updateService(RangerService service, Map<String, Object> op
11531153

11541154
service = svcService.update(service);
11551155

1156-
Boolean isUgsyncConfigChange = options != null && options.get(OPTION_UGSYNC_CONFIG_CHANGE) != null ? (Boolean) options.get(OPTION_UGSYNC_CONFIG_CHANGE) : Boolean.FALSE;
1156+
Boolean isUgsyncConfigChange = options != null && options.get(optionUgsyncConfigChange) != null ? (Boolean) options.get(optionUgsyncConfigChange) : Boolean.FALSE;
11571157
if (hasTagServiceValueChanged || hasIsEnabledChanged || hasServiceConfigForPluginChanged || isUgsyncConfigChange) {
11581158
updatePolicyVersion(service, RangerPolicyDelta.CHANGE_TYPE_SERVICE_CHANGE, null, false);
11591159
}
@@ -6616,9 +6616,9 @@ private boolean isServiceActive(String serviceName) {
66166616
return ret;
66176617
}
66186618

6619-
public enum JSON_FILE_NAME_TYPE {POLICY, ROLE}
6619+
public enum JSON_FILE_NAME_TYPE { POLICY, ROLE }
66206620

6621-
public enum VERSION_TYPE {POLICY_VERSION, TAG_VERSION, ROLE_VERSION, GDS_VERSION}
6621+
public enum VERSION_TYPE { POLICY_VERSION, TAG_VERSION, ROLE_VERSION, GDS_VERSION }
66226622

66236623
public enum METRIC_TYPE {
66246624
USER_GROUP {
@@ -6699,7 +6699,7 @@ public static METRIC_TYPE getMetricTypeByName(final String metricTypeName) {
66996699
abstract String getMetric(ServiceDBStore ref, SearchCriteria searchCriteria);
67006700
}
67016701

6702-
public enum REMOVE_REF_TYPE {USER, GROUP, ROLE}
6702+
public enum REMOVE_REF_TYPE { USER, GROUP, ROLE }
67036703

67046704
private static class RangerPolicyDeltaComparator implements Comparator<RangerPolicyDelta>, java.io.Serializable {
67056705
@Override

0 commit comments

Comments
 (0)