Repository: kylin
Updated Branches:
  refs/heads/ranger [created] 312810744


KYLIN-2703 kylin supports managing access rights for project and cube through 
apache ranger.

Signed-off-by: Li Yang <[email protected]>


Project: http://git-wip-us.apache.org/repos/asf/kylin/repo
Commit: http://git-wip-us.apache.org/repos/asf/kylin/commit/31281074
Tree: http://git-wip-us.apache.org/repos/asf/kylin/tree/31281074
Diff: http://git-wip-us.apache.org/repos/asf/kylin/diff/31281074

Branch: refs/heads/ranger
Commit: 312810744e67b73f5c53eb12b0c7e674f9815bdb
Parents: 7bdce5e
Author: peng.jianhua <[email protected]>
Authored: Wed Sep 6 17:50:51 2017 +0800
Committer: Li Yang <[email protected]>
Committed: Fri Sep 8 16:11:58 2017 +0800

----------------------------------------------------------------------
 build/deploy/context.xml                        |   2 +-
 .../apache/kylin/common/KylinConfigBase.java    |  12 ++
 .../security/KylinAuthorizationProvider.java    |  47 ++++++
 .../kylin/metadata/project/ProjectManager.java  |   9 ++
 .../apache/kylin/rest/constant/Constant.java    |   5 +
 .../kylin/rest/controller/AccessController.java |  17 +-
 .../security/ExternalAuthorizationProvider.java |  92 +++++++++++
 .../security/KylinAclPermissionEvaluator.java   | 159 +++++++++++++++++++
 .../kylin/rest/security/KylinAuthorization.java |  35 ++++
 .../apache/kylin/rest/service/JobService.java   |   2 +
 server/src/main/resources/kylinSecurity.xml     |   4 +-
 webapp/app/js/services/kylinProperties.js       |   8 +
 webapp/app/partials/cubes/cube_detail.html      |   3 +-
 .../app/partials/projects/project_detail.html   |   3 +-
 14 files changed, 389 insertions(+), 9 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/build/deploy/context.xml
----------------------------------------------------------------------
diff --git a/build/deploy/context.xml b/build/deploy/context.xml
index 38c6ec8..4650d27 100644
--- a/build/deploy/context.xml
+++ b/build/deploy/context.xml
@@ -17,7 +17,7 @@
   ~ limitations under the License.
   -->
 <!-- The contents of this file will be loaded for each web application -->
-<Context>
+<Context allowLinking="true">
 
     <!-- Default set of monitored resources -->
     <WatchedResource>WEB-INF/web.xml</WatchedResource>

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java
----------------------------------------------------------------------
diff --git 
a/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java 
b/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java
index 749b515..46bcfdb 100644
--- a/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java
+++ b/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java
@@ -1210,4 +1210,16 @@ abstract public class KylinConfigBase implements 
Serializable {
     public String getPerfLoggerClassName() {
         return getOptional("kylin.metric.perf-logger.class", 
"org.apache.kylin.common.metrics.perflog.PerfLogger");
     }
+
+    public String getAuthorizationProvider() {
+        if (isRangerAclEnabled()) {
+            return getOptional("kylin.authorization.provider", 
"org.apache.kylin.rest.security.KylinAuthorization");
+        } else {
+            return "org.apache.kylin.rest.security.KylinAuthorization";
+        }
+    }
+
+    public boolean isRangerAclEnabled() {
+        return 
Boolean.parseBoolean(getOptional("kylin.authorization.ranger-acl-enabled", 
"false"));
+    }
 }

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java
----------------------------------------------------------------------
diff --git 
a/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java
 
b/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java
new file mode 100644
index 0000000..3bb08e8
--- /dev/null
+++ 
b/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java
@@ -0,0 +1,47 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+*/
+
+package org.apache.kylin.common.security;
+
+import java.util.List;
+
+import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.common.util.ClassUtil;
+
+public abstract class KylinAuthorizationProvider {
+
+    private static KylinAuthorizationProvider authorizer;
+
+    public static KylinAuthorizationProvider getInstance(KylinConfig config) {
+
+        synchronized (KylinAuthorizationProvider.class) {
+            if (authorizer != null) {
+                return authorizer;
+            }
+
+            authorizer = (KylinAuthorizationProvider) 
ClassUtil.newInstance(config.getAuthorizationProvider());
+            authorizer.init();
+
+            return authorizer;
+        }
+    }
+
+    public abstract void init();
+
+    public abstract boolean checkPermission(String projectName, String 
cubeName, String user, List<String> userAuthorities, String permissions);
+}

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
----------------------------------------------------------------------
diff --git 
a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
 
b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
index df5450c..baf3295 100644
--- 
a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
+++ 
b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java
@@ -447,6 +447,15 @@ public class ProjectManager {
         return projects;
     }
 
+    public ProjectInstance getProjectByUuid(String uuid) {
+        Collection<ProjectInstance> copy = new 
ArrayList<ProjectInstance>(projectMap.values());
+        for (ProjectInstance project : copy) {
+            if (uuid.equals(project.getUuid()))
+                return project;
+        }
+        return null;
+    }
+
     public ExternalFilterDesc getExternalFilterDesc(String project, String 
extFilter) {
         return l2Cache.getExternalFilterDesc(project, extFilter);
     }

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java 
b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java
index 697a660..4e320e8 100644
--- a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java
+++ b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java
@@ -48,4 +48,9 @@ public class Constant {
     public final static String SERVER_MODE_JOB = "job";
     public final static String SERVER_MODE_ALL = "all";
 
+    public final static String CUBE_ADMIN = "CUBE ADMIN";
+    public final static String CUBE_EDIT = "CUBE EDIT";
+    public final static String CUBE_OPERATION = "CUBE OPERATION";
+    public final static String CUBE_QUERY = "CUBE QUERY";
+
 }

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
 
b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
index a88c342..ef36828 100644
--- 
a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java
@@ -21,10 +21,13 @@ package org.apache.kylin.rest.controller;
 import java.io.IOException;
 import java.util.List;
 
+import org.apache.kylin.common.KylinConfig;
 import org.apache.kylin.common.persistence.AclEntity;
 import org.apache.kylin.rest.request.AccessRequest;
 import org.apache.kylin.rest.response.AccessEntryResponse;
+import org.apache.kylin.rest.security.AclEntityType;
 import org.apache.kylin.rest.security.AclPermissionFactory;
+import org.apache.kylin.rest.security.ExternalAuthorizationProvider;
 import org.apache.kylin.rest.service.AccessService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
@@ -50,6 +53,9 @@ public class AccessController extends BasicController {
     @Qualifier("accessService")
     private AccessService accessService;
 
+    @Autowired
+    private ExternalAuthorizationProvider externalAuthorizationProvider;
+
     /**
      * Get access entry list of a domain object
      * 
@@ -60,10 +66,13 @@ public class AccessController extends BasicController {
     @RequestMapping(value = "/{type}/{uuid}", method = { RequestMethod.GET }, 
produces = { "application/json" })
     @ResponseBody
     public List<AccessEntryResponse> getAccessEntities(@PathVariable String 
type, @PathVariable String uuid) {
-        AclEntity ae = accessService.getAclEntity(type, uuid);
-        Acl acl = accessService.getAcl(ae);
-
-        return accessService.generateAceResponses(acl);
+        if (KylinConfig.getInstanceFromEnv().isRangerAclEnabled() && 
(AclEntityType.PROJECT_INSTANCE.equals(type) || 
AclEntityType.CUBE_INSTANCE.equals(type))) {
+            return externalAuthorizationProvider.getAcl(type, uuid);
+        } else {
+            AclEntity ae = accessService.getAclEntity(type, uuid);
+            Acl acl = accessService.getAcl(ae);
+            return accessService.generateAceResponses(acl);
+        }
     }
 
     /**

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java
 
b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java
new file mode 100644
index 0000000..73f4752
--- /dev/null
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java
@@ -0,0 +1,92 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+*/
+
+package org.apache.kylin.rest.security;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.common.persistence.AclEntity;
+import org.apache.kylin.cube.CubeManager;
+import org.apache.kylin.metadata.project.ProjectManager;
+import org.apache.kylin.rest.constant.Constant;
+import org.apache.kylin.rest.response.AccessEntryResponse;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.acls.domain.PrincipalSid;
+import org.springframework.security.acls.model.Permission;
+import org.springframework.security.acls.model.Sid;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+
+@Component("externalAuthorizationProvider")
+public class ExternalAuthorizationProvider {
+
+    @Autowired
+    private KylinAclPermissionEvaluator kylinAclPermissionEvaluator;
+
+    private final Permission[] allPermissions = { 
AclPermission.ADMINISTRATION, AclPermission.MANAGEMENT, 
AclPermission.OPERATION, AclPermission.READ };
+
+    public List<AccessEntryResponse> getAcl(String type, String uuid) {
+        List<AccessEntryResponse> result = new 
ArrayList<AccessEntryResponse>();
+        if (uuid == null) {
+            return result;
+        }
+
+        AclEntity ae = null;
+        KylinConfig config = KylinConfig.getInstanceFromEnv();
+        if (type.equals(AclEntityType.PROJECT_INSTANCE)) {
+            ae = ProjectManager.getInstance(config).getProjectByUuid(uuid);
+        } else if (type.equals(AclEntityType.CUBE_INSTANCE)) {
+            ae = CubeManager.getInstance(config).getCubeByUuid(uuid);
+        }
+
+        if (ae != null) {
+            Authentication authentication = 
SecurityContextHolder.getContext().getAuthentication();
+            Sid sid = new PrincipalSid(authentication.getName());
+            for (Permission permission : allPermissions) {
+                if (kylinAclPermissionEvaluator.hasPermission(authentication, 
ae, permission)) {
+                    String permString =  
kylinAclPermissionEvaluator.transformPermission(permission);
+                    result = generateAceResponses(permString, sid);
+                    break;
+                }
+            }
+        }
+
+        return result;
+    }
+
+    private List<AccessEntryResponse> generateAceResponses(String permission, 
Sid sid) {
+        List<AccessEntryResponse> result = new 
ArrayList<AccessEntryResponse>();
+        switch (permission) {
+        case Constant.CUBE_ADMIN:
+            result.add(new AccessEntryResponse(null, sid, 
AclPermission.ADMINISTRATION, true));
+        case Constant.CUBE_EDIT:
+            result.add(new AccessEntryResponse(null, sid, 
AclPermission.MANAGEMENT, true));
+        case Constant.CUBE_OPERATION:
+            result.add(new AccessEntryResponse(null, sid, 
AclPermission.OPERATION, true));
+        case Constant.CUBE_QUERY:
+            result.add(new AccessEntryResponse(null, sid, AclPermission.READ, 
true));
+        default:
+            break;
+        }
+        return result;
+    }
+
+}

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
 
b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
new file mode 100644
index 0000000..25d1976
--- /dev/null
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java
@@ -0,0 +1,159 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * 
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+*/
+
+package org.apache.kylin.rest.security;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.common.security.KylinAuthorizationProvider;
+import org.apache.kylin.cube.CubeInstance;
+import org.apache.kylin.metadata.project.ProjectInstance;
+import org.apache.kylin.metadata.project.ProjectManager;
+import org.apache.kylin.metadata.realization.RealizationType;
+import org.apache.kylin.rest.constant.Constant;
+import org.apache.kylin.rest.service.AclService;
+import org.springframework.security.acls.AclPermissionEvaluator;
+import org.springframework.security.acls.domain.PermissionFactory;
+import org.springframework.security.acls.model.Permission;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+
+public class KylinAclPermissionEvaluator extends AclPermissionEvaluator {
+
+    private PermissionFactory kylinPermissionFactory;
+
+    public KylinAclPermissionEvaluator(AclService aclService, 
PermissionFactory permissionFactory) {
+        super(aclService);
+        super.setPermissionFactory(permissionFactory);
+        this.kylinPermissionFactory = permissionFactory;
+    }
+
+    @Override
+    public boolean hasPermission(Authentication authentication, Object 
targetDomainObject, Object permission) {
+        if (targetDomainObject == null) {
+            return false;
+        }
+
+        KylinConfig kylinConfig= KylinConfig.getInstanceFromEnv();
+        if (kylinConfig.isRangerAclEnabled()) {
+            String projectName = null;
+            String cubeName = null;
+            String owner = null;
+            String currentUser = authentication.getName();
+
+            if (targetDomainObject instanceof ProjectInstance) {
+                ProjectInstance projectInstance = (ProjectInstance) 
targetDomainObject;
+                projectName = projectInstance.getName();
+                owner = projectInstance.getOwner();
+            } else if (targetDomainObject instanceof CubeInstance) {
+                CubeInstance cubeInstance = (CubeInstance) targetDomainObject;
+                cubeName = cubeInstance.getName();
+                owner = cubeInstance.getOwner();
+
+                List<ProjectInstance> relatedProjectInstances = 
ProjectManager.getInstance(kylinConfig).findProjects(RealizationType.CUBE, 
cubeName);
+                if (!CollectionUtils.isEmpty(relatedProjectInstances)) {
+                    projectName = relatedProjectInstances.get(0).getName();
+                }
+            } else {
+                return super.hasPermission(authentication, targetDomainObject, 
permission);
+            }
+
+            if (owner != null && owner.equalsIgnoreCase(currentUser)) {
+                return true;
+            }
+
+            List<Permission> permissions = resolveKylinPermission(permission);
+            List<String> authorities = getAuthorities(authentication);
+            for (Permission p : permissions) {
+                String permString = transformPermission(p);
+                if 
(KylinAuthorizationProvider.getInstance(kylinConfig).checkPermission(projectName,
 cubeName, currentUser, authorities, permString)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        return super.hasPermission(authentication, targetDomainObject, 
permission);
+    }
+
+    public String transformPermission(Permission p) {
+        String permString = null;
+        if (p.equals(AclPermission.ADMINISTRATION)) {
+            permString = Constant.CUBE_ADMIN;
+        } else if (p.equals(AclPermission.MANAGEMENT)) {
+            permString = Constant.CUBE_EDIT;
+        } else if (p.equals(AclPermission.OPERATION)) {
+            permString = Constant.CUBE_OPERATION;
+        } else if (p.equals(AclPermission.READ)) {
+            permString = (Constant.CUBE_QUERY);
+        }
+        return permString;
+    }
+
+    private List<Permission> resolveKylinPermission(Object permission) {
+        if (permission instanceof Integer) {
+            return 
Arrays.asList(kylinPermissionFactory.buildFromMask(((Integer)permission).intValue()));
+        }
+
+        if (permission instanceof Permission) {
+            return Arrays.asList((Permission)permission);
+        }
+
+        if (permission instanceof Permission[]) {
+            return Arrays.asList((Permission[])permission);
+        }
+
+        if (permission instanceof String) {
+            String permString = (String)permission;
+            Permission p;
+
+            try {
+                p = kylinPermissionFactory.buildFromName(permString);
+            } catch(IllegalArgumentException notfound) {
+                p = 
kylinPermissionFactory.buildFromName(permString.toUpperCase());
+            }
+
+            if (p != null) {
+                return Arrays.asList(p);
+            }
+
+        }
+        throw new IllegalArgumentException("Unsupported permission: " + 
permission);
+    }
+
+    private List<String> getAuthorities(Authentication authentication) {
+        List<String> authorities = new ArrayList<String>();
+        for (GrantedAuthority auth : authentication.getAuthorities()) {
+            if (!authorities.contains(auth.getAuthority())) {
+                authorities.add(auth.getAuthority());
+            }
+        }
+        return authorities;
+    }
+
+    @Override
+    public boolean hasPermission(Authentication authentication, Serializable 
targetId, String targetType,
+            Object permission) {
+        return super.hasPermission(authentication, targetId, targetType, 
permission);
+    }
+}

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java
 
b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java
new file mode 100644
index 0000000..e5cd761
--- /dev/null
+++ 
b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+*/
+package org.apache.kylin.rest.security;
+
+import java.util.List;
+
+import org.apache.kylin.common.security.KylinAuthorizationProvider;
+
+public class KylinAuthorization extends KylinAuthorizationProvider {
+
+    @Override
+    public void init() {
+    }
+
+    @Override
+    public boolean checkPermission(String projectName, String cubeName, String 
user, List<String> userRole, String permissions) {
+        return false;
+    }
+
+}
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java
----------------------------------------------------------------------
diff --git 
a/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java 
b/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java
index d2180a7..7aba9a8 100644
--- a/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java
+++ b/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java
@@ -33,6 +33,7 @@ import javax.annotation.Nullable;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.directory.api.util.Strings;
 import org.apache.kylin.common.KylinConfig;
+import org.apache.kylin.common.security.KylinAuthorizationProvider;
 import org.apache.kylin.common.util.ClassUtil;
 import org.apache.kylin.cube.CubeInstance;
 import org.apache.kylin.cube.CubeSegment;
@@ -118,6 +119,7 @@ public class JobService extends BasicService implements 
InitializingBean {
                 .scheduler(kylinConfig.getSchedulerType());
 
         jobLock = (JobLock) 
ClassUtil.newInstance(kylinConfig.getJobControllerLock());
+        KylinAuthorizationProvider.getInstance(kylinConfig);
 
         new Thread(new Runnable() {
             @Override

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server/src/main/resources/kylinSecurity.xml
----------------------------------------------------------------------
diff --git a/server/src/main/resources/kylinSecurity.xml 
b/server/src/main/resources/kylinSecurity.xml
index ce068d7..856fb5e 100644
--- a/server/src/main/resources/kylinSecurity.xml
+++ b/server/src/main/resources/kylinSecurity.xml
@@ -38,9 +38,9 @@
         <property name="permissionEvaluator" ref="permissionEvaluator"/>
     </bean>
 
-    <bean id="permissionEvaluator" 
class="org.springframework.security.acls.AclPermissionEvaluator">
+    <bean id="permissionEvaluator" 
class="org.apache.kylin.rest.security.KylinAclPermissionEvaluator">
         <constructor-arg ref="aclService"/>
-        <property name="permissionFactory" ref="aclPermissionFactory"/>
+        <constructor-arg ref="aclPermissionFactory"/>
     </bean>
 
     <bean id="aclAuthorizationStrategy"

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/webapp/app/js/services/kylinProperties.js
----------------------------------------------------------------------
diff --git a/webapp/app/js/services/kylinProperties.js 
b/webapp/app/js/services/kylinProperties.js
index 645ed2f..061a290 100644
--- a/webapp/app/js/services/kylinProperties.js
+++ b/webapp/app/js/services/kylinProperties.js
@@ -107,5 +107,13 @@ KylinApp.service('kylinConfig', function (AdminService, 
$log) {
     }
   }
 
+  this.isRangerAclEnabled = function() {
+    var status = 
this.getProperty("kylin.authorization.ranger-acl-enabled").trim();
+       if (status === 'true') {
+         return true;
+       }
+    return false;
+  }
+
 });
 

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/webapp/app/partials/cubes/cube_detail.html
----------------------------------------------------------------------
diff --git a/webapp/app/partials/cubes/cube_detail.html 
b/webapp/app/partials/cubes/cube_detail.html
index 0113c12..06f66f8 100755
--- a/webapp/app/partials/cubes/cube_detail.html
+++ b/webapp/app/partials/cubes/cube_detail.html
@@ -29,7 +29,8 @@
             ng-if="userService.hasRole('ROLE_ADMIN') || hasPermission(cube, 
16) && !newAccess">
             <a href="" ng-click="cube.visiblePage='json';">JSON(Cube)</a>
         </li>
-        <li class="{{cube.visiblePage=='access'? 'active':''}}">
+        <li class="{{cube.visiblePage=='access'? 'active':''}}"
+            ng-if="!kylinConfig.isRangerAclEnabled()">
             <a href="" ng-click="cube.visiblePage='access';listAccess(cube, 
'CubeInstance');">Access</a>
         </li>
         <li class="{{cube.visiblePage=='notification'? 'active':''}}"

http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/webapp/app/partials/projects/project_detail.html
----------------------------------------------------------------------
diff --git a/webapp/app/partials/projects/project_detail.html 
b/webapp/app/partials/projects/project_detail.html
index 5cfc091..7fffdbd 100644
--- a/webapp/app/partials/projects/project_detail.html
+++ b/webapp/app/partials/projects/project_detail.html
@@ -21,7 +21,8 @@
         <li class="{{project.visiblePage=='cubes'? 'active':''}}">
             <a href="" ng-click="project.visiblePage='cubes';">Cubes</a>
         </li>
-        <li class="{{project.visiblePage=='access'? 'active':''}}">
+        <li class="{{project.visiblePage=='access'? 'active':''}}"
+            ng-if="!kylinConfig.isRangerAclEnabled()">
             <a href="" 
ng-click="project.visiblePage='access';listAccess(project, 
'ProjectInstance');">Access</a>
         </li>
         <li class="{{project.visiblePage=='config'? 'active':''}}">

Reply via email to