Repository: kylin Updated Branches: refs/heads/ranger [created] 312810744
KYLIN-2703 kylin supports managing access rights for project and cube through apache ranger. Signed-off-by: Li Yang <[email protected]> Project: http://git-wip-us.apache.org/repos/asf/kylin/repo Commit: http://git-wip-us.apache.org/repos/asf/kylin/commit/31281074 Tree: http://git-wip-us.apache.org/repos/asf/kylin/tree/31281074 Diff: http://git-wip-us.apache.org/repos/asf/kylin/diff/31281074 Branch: refs/heads/ranger Commit: 312810744e67b73f5c53eb12b0c7e674f9815bdb Parents: 7bdce5e Author: peng.jianhua <[email protected]> Authored: Wed Sep 6 17:50:51 2017 +0800 Committer: Li Yang <[email protected]> Committed: Fri Sep 8 16:11:58 2017 +0800 ---------------------------------------------------------------------- build/deploy/context.xml | 2 +- .../apache/kylin/common/KylinConfigBase.java | 12 ++ .../security/KylinAuthorizationProvider.java | 47 ++++++ .../kylin/metadata/project/ProjectManager.java | 9 ++ .../apache/kylin/rest/constant/Constant.java | 5 + .../kylin/rest/controller/AccessController.java | 17 +- .../security/ExternalAuthorizationProvider.java | 92 +++++++++++ .../security/KylinAclPermissionEvaluator.java | 159 +++++++++++++++++++ .../kylin/rest/security/KylinAuthorization.java | 35 ++++ .../apache/kylin/rest/service/JobService.java | 2 + server/src/main/resources/kylinSecurity.xml | 4 +- webapp/app/js/services/kylinProperties.js | 8 + webapp/app/partials/cubes/cube_detail.html | 3 +- .../app/partials/projects/project_detail.html | 3 +- 14 files changed, 389 insertions(+), 9 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/build/deploy/context.xml ---------------------------------------------------------------------- diff --git a/build/deploy/context.xml b/build/deploy/context.xml index 38c6ec8..4650d27 100644 --- a/build/deploy/context.xml +++ b/build/deploy/context.xml @@ -17,7 +17,7 @@ ~ limitations under the License. --> <!-- The contents of this file will be loaded for each web application --> -<Context> +<Context allowLinking="true"> <!-- Default set of monitored resources --> <WatchedResource>WEB-INF/web.xml</WatchedResource> http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java ---------------------------------------------------------------------- diff --git a/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java b/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java index 749b515..46bcfdb 100644 --- a/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java +++ b/core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java @@ -1210,4 +1210,16 @@ abstract public class KylinConfigBase implements Serializable { public String getPerfLoggerClassName() { return getOptional("kylin.metric.perf-logger.class", "org.apache.kylin.common.metrics.perflog.PerfLogger"); } + + public String getAuthorizationProvider() { + if (isRangerAclEnabled()) { + return getOptional("kylin.authorization.provider", "org.apache.kylin.rest.security.KylinAuthorization"); + } else { + return "org.apache.kylin.rest.security.KylinAuthorization"; + } + } + + public boolean isRangerAclEnabled() { + return Boolean.parseBoolean(getOptional("kylin.authorization.ranger-acl-enabled", "false")); + } } http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java ---------------------------------------------------------------------- diff --git a/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java b/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java new file mode 100644 index 0000000..3bb08e8 --- /dev/null +++ b/core-common/src/main/java/org/apache/kylin/common/security/KylinAuthorizationProvider.java @@ -0,0 +1,47 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. +*/ + +package org.apache.kylin.common.security; + +import java.util.List; + +import org.apache.kylin.common.KylinConfig; +import org.apache.kylin.common.util.ClassUtil; + +public abstract class KylinAuthorizationProvider { + + private static KylinAuthorizationProvider authorizer; + + public static KylinAuthorizationProvider getInstance(KylinConfig config) { + + synchronized (KylinAuthorizationProvider.class) { + if (authorizer != null) { + return authorizer; + } + + authorizer = (KylinAuthorizationProvider) ClassUtil.newInstance(config.getAuthorizationProvider()); + authorizer.init(); + + return authorizer; + } + } + + public abstract void init(); + + public abstract boolean checkPermission(String projectName, String cubeName, String user, List<String> userAuthorities, String permissions); +} http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java ---------------------------------------------------------------------- diff --git a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java index df5450c..baf3295 100644 --- a/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java +++ b/core-metadata/src/main/java/org/apache/kylin/metadata/project/ProjectManager.java @@ -447,6 +447,15 @@ public class ProjectManager { return projects; } + public ProjectInstance getProjectByUuid(String uuid) { + Collection<ProjectInstance> copy = new ArrayList<ProjectInstance>(projectMap.values()); + for (ProjectInstance project : copy) { + if (uuid.equals(project.getUuid())) + return project; + } + return null; + } + public ExternalFilterDesc getExternalFilterDesc(String project, String extFilter) { return l2Cache.getExternalFilterDesc(project, extFilter); } http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java index 697a660..4e320e8 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java +++ b/server-base/src/main/java/org/apache/kylin/rest/constant/Constant.java @@ -48,4 +48,9 @@ public class Constant { public final static String SERVER_MODE_JOB = "job"; public final static String SERVER_MODE_ALL = "all"; + public final static String CUBE_ADMIN = "CUBE ADMIN"; + public final static String CUBE_EDIT = "CUBE EDIT"; + public final static String CUBE_OPERATION = "CUBE OPERATION"; + public final static String CUBE_QUERY = "CUBE QUERY"; + } http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java index a88c342..ef36828 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java +++ b/server-base/src/main/java/org/apache/kylin/rest/controller/AccessController.java @@ -21,10 +21,13 @@ package org.apache.kylin.rest.controller; import java.io.IOException; import java.util.List; +import org.apache.kylin.common.KylinConfig; import org.apache.kylin.common.persistence.AclEntity; import org.apache.kylin.rest.request.AccessRequest; import org.apache.kylin.rest.response.AccessEntryResponse; +import org.apache.kylin.rest.security.AclEntityType; import org.apache.kylin.rest.security.AclPermissionFactory; +import org.apache.kylin.rest.security.ExternalAuthorizationProvider; import org.apache.kylin.rest.service.AccessService; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; @@ -50,6 +53,9 @@ public class AccessController extends BasicController { @Qualifier("accessService") private AccessService accessService; + @Autowired + private ExternalAuthorizationProvider externalAuthorizationProvider; + /** * Get access entry list of a domain object * @@ -60,10 +66,13 @@ public class AccessController extends BasicController { @RequestMapping(value = "/{type}/{uuid}", method = { RequestMethod.GET }, produces = { "application/json" }) @ResponseBody public List<AccessEntryResponse> getAccessEntities(@PathVariable String type, @PathVariable String uuid) { - AclEntity ae = accessService.getAclEntity(type, uuid); - Acl acl = accessService.getAcl(ae); - - return accessService.generateAceResponses(acl); + if (KylinConfig.getInstanceFromEnv().isRangerAclEnabled() && (AclEntityType.PROJECT_INSTANCE.equals(type) || AclEntityType.CUBE_INSTANCE.equals(type))) { + return externalAuthorizationProvider.getAcl(type, uuid); + } else { + AclEntity ae = accessService.getAclEntity(type, uuid); + Acl acl = accessService.getAcl(ae); + return accessService.generateAceResponses(acl); + } } /** http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java new file mode 100644 index 0000000..73f4752 --- /dev/null +++ b/server-base/src/main/java/org/apache/kylin/rest/security/ExternalAuthorizationProvider.java @@ -0,0 +1,92 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. +*/ + +package org.apache.kylin.rest.security; + +import java.util.ArrayList; +import java.util.List; + +import org.apache.kylin.common.KylinConfig; +import org.apache.kylin.common.persistence.AclEntity; +import org.apache.kylin.cube.CubeManager; +import org.apache.kylin.metadata.project.ProjectManager; +import org.apache.kylin.rest.constant.Constant; +import org.apache.kylin.rest.response.AccessEntryResponse; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.acls.domain.PrincipalSid; +import org.springframework.security.acls.model.Permission; +import org.springframework.security.acls.model.Sid; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.stereotype.Component; + +@Component("externalAuthorizationProvider") +public class ExternalAuthorizationProvider { + + @Autowired + private KylinAclPermissionEvaluator kylinAclPermissionEvaluator; + + private final Permission[] allPermissions = { AclPermission.ADMINISTRATION, AclPermission.MANAGEMENT, AclPermission.OPERATION, AclPermission.READ }; + + public List<AccessEntryResponse> getAcl(String type, String uuid) { + List<AccessEntryResponse> result = new ArrayList<AccessEntryResponse>(); + if (uuid == null) { + return result; + } + + AclEntity ae = null; + KylinConfig config = KylinConfig.getInstanceFromEnv(); + if (type.equals(AclEntityType.PROJECT_INSTANCE)) { + ae = ProjectManager.getInstance(config).getProjectByUuid(uuid); + } else if (type.equals(AclEntityType.CUBE_INSTANCE)) { + ae = CubeManager.getInstance(config).getCubeByUuid(uuid); + } + + if (ae != null) { + Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); + Sid sid = new PrincipalSid(authentication.getName()); + for (Permission permission : allPermissions) { + if (kylinAclPermissionEvaluator.hasPermission(authentication, ae, permission)) { + String permString = kylinAclPermissionEvaluator.transformPermission(permission); + result = generateAceResponses(permString, sid); + break; + } + } + } + + return result; + } + + private List<AccessEntryResponse> generateAceResponses(String permission, Sid sid) { + List<AccessEntryResponse> result = new ArrayList<AccessEntryResponse>(); + switch (permission) { + case Constant.CUBE_ADMIN: + result.add(new AccessEntryResponse(null, sid, AclPermission.ADMINISTRATION, true)); + case Constant.CUBE_EDIT: + result.add(new AccessEntryResponse(null, sid, AclPermission.MANAGEMENT, true)); + case Constant.CUBE_OPERATION: + result.add(new AccessEntryResponse(null, sid, AclPermission.OPERATION, true)); + case Constant.CUBE_QUERY: + result.add(new AccessEntryResponse(null, sid, AclPermission.READ, true)); + default: + break; + } + return result; + } + +} http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java new file mode 100644 index 0000000..25d1976 --- /dev/null +++ b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAclPermissionEvaluator.java @@ -0,0 +1,159 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. +*/ + +package org.apache.kylin.rest.security; + +import java.io.Serializable; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.List; + +import org.apache.commons.collections.CollectionUtils; +import org.apache.kylin.common.KylinConfig; +import org.apache.kylin.common.security.KylinAuthorizationProvider; +import org.apache.kylin.cube.CubeInstance; +import org.apache.kylin.metadata.project.ProjectInstance; +import org.apache.kylin.metadata.project.ProjectManager; +import org.apache.kylin.metadata.realization.RealizationType; +import org.apache.kylin.rest.constant.Constant; +import org.apache.kylin.rest.service.AclService; +import org.springframework.security.acls.AclPermissionEvaluator; +import org.springframework.security.acls.domain.PermissionFactory; +import org.springframework.security.acls.model.Permission; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.GrantedAuthority; + +public class KylinAclPermissionEvaluator extends AclPermissionEvaluator { + + private PermissionFactory kylinPermissionFactory; + + public KylinAclPermissionEvaluator(AclService aclService, PermissionFactory permissionFactory) { + super(aclService); + super.setPermissionFactory(permissionFactory); + this.kylinPermissionFactory = permissionFactory; + } + + @Override + public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) { + if (targetDomainObject == null) { + return false; + } + + KylinConfig kylinConfig= KylinConfig.getInstanceFromEnv(); + if (kylinConfig.isRangerAclEnabled()) { + String projectName = null; + String cubeName = null; + String owner = null; + String currentUser = authentication.getName(); + + if (targetDomainObject instanceof ProjectInstance) { + ProjectInstance projectInstance = (ProjectInstance) targetDomainObject; + projectName = projectInstance.getName(); + owner = projectInstance.getOwner(); + } else if (targetDomainObject instanceof CubeInstance) { + CubeInstance cubeInstance = (CubeInstance) targetDomainObject; + cubeName = cubeInstance.getName(); + owner = cubeInstance.getOwner(); + + List<ProjectInstance> relatedProjectInstances = ProjectManager.getInstance(kylinConfig).findProjects(RealizationType.CUBE, cubeName); + if (!CollectionUtils.isEmpty(relatedProjectInstances)) { + projectName = relatedProjectInstances.get(0).getName(); + } + } else { + return super.hasPermission(authentication, targetDomainObject, permission); + } + + if (owner != null && owner.equalsIgnoreCase(currentUser)) { + return true; + } + + List<Permission> permissions = resolveKylinPermission(permission); + List<String> authorities = getAuthorities(authentication); + for (Permission p : permissions) { + String permString = transformPermission(p); + if (KylinAuthorizationProvider.getInstance(kylinConfig).checkPermission(projectName, cubeName, currentUser, authorities, permString)) { + return true; + } + } + return false; + } + + return super.hasPermission(authentication, targetDomainObject, permission); + } + + public String transformPermission(Permission p) { + String permString = null; + if (p.equals(AclPermission.ADMINISTRATION)) { + permString = Constant.CUBE_ADMIN; + } else if (p.equals(AclPermission.MANAGEMENT)) { + permString = Constant.CUBE_EDIT; + } else if (p.equals(AclPermission.OPERATION)) { + permString = Constant.CUBE_OPERATION; + } else if (p.equals(AclPermission.READ)) { + permString = (Constant.CUBE_QUERY); + } + return permString; + } + + private List<Permission> resolveKylinPermission(Object permission) { + if (permission instanceof Integer) { + return Arrays.asList(kylinPermissionFactory.buildFromMask(((Integer)permission).intValue())); + } + + if (permission instanceof Permission) { + return Arrays.asList((Permission)permission); + } + + if (permission instanceof Permission[]) { + return Arrays.asList((Permission[])permission); + } + + if (permission instanceof String) { + String permString = (String)permission; + Permission p; + + try { + p = kylinPermissionFactory.buildFromName(permString); + } catch(IllegalArgumentException notfound) { + p = kylinPermissionFactory.buildFromName(permString.toUpperCase()); + } + + if (p != null) { + return Arrays.asList(p); + } + + } + throw new IllegalArgumentException("Unsupported permission: " + permission); + } + + private List<String> getAuthorities(Authentication authentication) { + List<String> authorities = new ArrayList<String>(); + for (GrantedAuthority auth : authentication.getAuthorities()) { + if (!authorities.contains(auth.getAuthority())) { + authorities.add(auth.getAuthority()); + } + } + return authorities; + } + + @Override + public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, + Object permission) { + return super.hasPermission(authentication, targetId, targetType, permission); + } +} http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java new file mode 100644 index 0000000..e5cd761 --- /dev/null +++ b/server-base/src/main/java/org/apache/kylin/rest/security/KylinAuthorization.java @@ -0,0 +1,35 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. +*/ +package org.apache.kylin.rest.security; + +import java.util.List; + +import org.apache.kylin.common.security.KylinAuthorizationProvider; + +public class KylinAuthorization extends KylinAuthorizationProvider { + + @Override + public void init() { + } + + @Override + public boolean checkPermission(String projectName, String cubeName, String user, List<String> userRole, String permissions) { + return false; + } + +} \ No newline at end of file http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java ---------------------------------------------------------------------- diff --git a/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java b/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java index d2180a7..7aba9a8 100644 --- a/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java +++ b/server-base/src/main/java/org/apache/kylin/rest/service/JobService.java @@ -33,6 +33,7 @@ import javax.annotation.Nullable; import org.apache.commons.lang3.StringUtils; import org.apache.directory.api.util.Strings; import org.apache.kylin.common.KylinConfig; +import org.apache.kylin.common.security.KylinAuthorizationProvider; import org.apache.kylin.common.util.ClassUtil; import org.apache.kylin.cube.CubeInstance; import org.apache.kylin.cube.CubeSegment; @@ -118,6 +119,7 @@ public class JobService extends BasicService implements InitializingBean { .scheduler(kylinConfig.getSchedulerType()); jobLock = (JobLock) ClassUtil.newInstance(kylinConfig.getJobControllerLock()); + KylinAuthorizationProvider.getInstance(kylinConfig); new Thread(new Runnable() { @Override http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/server/src/main/resources/kylinSecurity.xml ---------------------------------------------------------------------- diff --git a/server/src/main/resources/kylinSecurity.xml b/server/src/main/resources/kylinSecurity.xml index ce068d7..856fb5e 100644 --- a/server/src/main/resources/kylinSecurity.xml +++ b/server/src/main/resources/kylinSecurity.xml @@ -38,9 +38,9 @@ <property name="permissionEvaluator" ref="permissionEvaluator"/> </bean> - <bean id="permissionEvaluator" class="org.springframework.security.acls.AclPermissionEvaluator"> + <bean id="permissionEvaluator" class="org.apache.kylin.rest.security.KylinAclPermissionEvaluator"> <constructor-arg ref="aclService"/> - <property name="permissionFactory" ref="aclPermissionFactory"/> + <constructor-arg ref="aclPermissionFactory"/> </bean> <bean id="aclAuthorizationStrategy" http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/webapp/app/js/services/kylinProperties.js ---------------------------------------------------------------------- diff --git a/webapp/app/js/services/kylinProperties.js b/webapp/app/js/services/kylinProperties.js index 645ed2f..061a290 100644 --- a/webapp/app/js/services/kylinProperties.js +++ b/webapp/app/js/services/kylinProperties.js @@ -107,5 +107,13 @@ KylinApp.service('kylinConfig', function (AdminService, $log) { } } + this.isRangerAclEnabled = function() { + var status = this.getProperty("kylin.authorization.ranger-acl-enabled").trim(); + if (status === 'true') { + return true; + } + return false; + } + }); http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/webapp/app/partials/cubes/cube_detail.html ---------------------------------------------------------------------- diff --git a/webapp/app/partials/cubes/cube_detail.html b/webapp/app/partials/cubes/cube_detail.html index 0113c12..06f66f8 100755 --- a/webapp/app/partials/cubes/cube_detail.html +++ b/webapp/app/partials/cubes/cube_detail.html @@ -29,7 +29,8 @@ ng-if="userService.hasRole('ROLE_ADMIN') || hasPermission(cube, 16) && !newAccess"> <a href="" ng-click="cube.visiblePage='json';">JSON(Cube)</a> </li> - <li class="{{cube.visiblePage=='access'? 'active':''}}"> + <li class="{{cube.visiblePage=='access'? 'active':''}}" + ng-if="!kylinConfig.isRangerAclEnabled()"> <a href="" ng-click="cube.visiblePage='access';listAccess(cube, 'CubeInstance');">Access</a> </li> <li class="{{cube.visiblePage=='notification'? 'active':''}}" http://git-wip-us.apache.org/repos/asf/kylin/blob/31281074/webapp/app/partials/projects/project_detail.html ---------------------------------------------------------------------- diff --git a/webapp/app/partials/projects/project_detail.html b/webapp/app/partials/projects/project_detail.html index 5cfc091..7fffdbd 100644 --- a/webapp/app/partials/projects/project_detail.html +++ b/webapp/app/partials/projects/project_detail.html @@ -21,7 +21,8 @@ <li class="{{project.visiblePage=='cubes'? 'active':''}}"> <a href="" ng-click="project.visiblePage='cubes';">Cubes</a> </li> - <li class="{{project.visiblePage=='access'? 'active':''}}"> + <li class="{{project.visiblePage=='access'? 'active':''}}" + ng-if="!kylinConfig.isRangerAclEnabled()"> <a href="" ng-click="project.visiblePage='access';listAccess(project, 'ProjectInstance');">Access</a> </li> <li class="{{project.visiblePage=='config'? 'active':''}}">
