This is an automated email from the ASF dual-hosted git repository.
madhan pushed a commit to branch ranger-2.2
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.2 by this push:
new 0c02716 RANGER-3332: script evaluator updated to provide JavaScript
style access to details of request/user/groups/tags
0c02716 is described below
commit 0c0271651b553409a604cf773dd3b29f0c07bd5d
Author: Madhan Neethiraj <[email protected]>
AuthorDate: Thu Jul 8 06:12:48 2021 -0700
RANGER-3332: script evaluator updated to provide JavaScript style access to
details of request/user/groups/tags
(cherry picked from commit 280d0a694886931fe5587921083a767a70ce7183)
---
.../ranger/authorization/utils/JsonUtils.java | 27 ++---
.../RangerScriptConditionEvaluator.java | 26 +++++
.../RangerScriptExecutionContext.java | 113 +++++++++++++++++++++
.../ranger/plugin/util/RangerCommonConstants.java | 24 +++++
.../RangerCustomConditionMatcherTest.java | 106 ++++++++++++++++---
5 files changed, 269 insertions(+), 27 deletions(-)
diff --git
a/agents-common/src/main/java/org/apache/ranger/authorization/utils/JsonUtils.java
b/agents-common/src/main/java/org/apache/ranger/authorization/utils/JsonUtils.java
index ee4cef6..00c9ab0 100644
---
a/agents-common/src/main/java/org/apache/ranger/authorization/utils/JsonUtils.java
+++
b/agents-common/src/main/java/org/apache/ranger/authorization/utils/JsonUtils.java
@@ -36,17 +36,18 @@ import java.util.Map;
public class JsonUtils {
private static final Log LOG = LogFactory.getLog(JsonUtils.class);
- private static final Gson gson;
-
- static {
- gson = new
GsonBuilder().setDateFormat("yyyyMMdd-HH:mm:ss.SSS-Z").create();
- }
+ private static final ThreadLocal<Gson> gson = new ThreadLocal<Gson>() {
+ @Override
+ protected Gson initialValue() {
+ return new
GsonBuilder().setDateFormat("yyyyMMdd-HH:mm:ss.SSS-Z").create();
+ }
+ };
public static String mapToJson(Map<?, ?> map) {
String ret = null;
if (MapUtils.isNotEmpty(map)) {
try {
- ret = gson.toJson(map);
+ ret = gson.get().toJson(map);
} catch (Exception e) {
LOG.error("Invalid input data: ", e);
}
@@ -58,7 +59,7 @@ public class JsonUtils {
String ret = null;
if (CollectionUtils.isNotEmpty(list)) {
try {
- ret = gson.toJson(list);
+ ret = gson.get().toJson(list);
} catch (Exception e) {
LOG.error("Invalid input data: ", e);
}
@@ -71,7 +72,7 @@ public class JsonUtils {
if(object != null) {
try {
- ret = gson.toJson(object);
+ ret = gson.get().toJson(object);
} catch(Exception excp) {
LOG.warn("objectToJson() failed to convert object to Json",
excp);
}
@@ -85,7 +86,7 @@ public class JsonUtils {
if(StringUtils.isNotEmpty(jsonStr)) {
try {
- ret = gson.fromJson(jsonStr, clz);
+ ret = gson.get().fromJson(jsonStr, clz);
} catch(Exception excp) {
LOG.warn("jsonToObject() failed to convert json to object: " +
jsonStr, excp);
}
@@ -100,7 +101,7 @@ public class JsonUtils {
if(StringUtils.isNotEmpty(jsonStr)) {
try {
Type mapType = new TypeToken<Map<String, String>>()
{}.getType();
- ret = gson.fromJson(jsonStr, mapType);
+ ret = gson.get().fromJson(jsonStr, mapType);
} catch(Exception excp) {
LOG.warn("jsonToObject() failed to convert json to object: " +
jsonStr, excp);
}
@@ -112,7 +113,7 @@ public class JsonUtils {
public static List<RangerValiditySchedule>
jsonToRangerValiditySchedule(String jsonStr) {
try {
Type listType = new TypeToken<List<RangerValiditySchedule>>()
{}.getType();
- return gson.fromJson(jsonStr, listType);
+ return gson.get().fromJson(jsonStr, listType);
} catch (Exception e) {
LOG.error("Cannot get List<RangerValiditySchedule> from " +
jsonStr, e);
return null;
@@ -122,7 +123,7 @@ public class JsonUtils {
public static List<AuditFilter> jsonToAuditFilterList(String jsonStr) {
try {
Type listType = new TypeToken<List<AuditFilter>>() {}.getType();
- return gson.fromJson(jsonStr, listType);
+ return gson.get().fromJson(jsonStr, listType);
} catch (Exception e) {
LOG.error("failed to create audit filters from: " + jsonStr, e);
return null;
@@ -133,7 +134,7 @@ public class JsonUtils {
try {
Type listType = new TypeToken<List<RangerValidityRecurrence>>() {
}.getType();
- return gson.fromJson(jsonStr, listType);
+ return gson.get().fromJson(jsonStr, listType);
} catch (Exception e) {
LOG.error("Cannot get List<RangerValidityRecurrence> from " +
jsonStr, e);
return null;
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptConditionEvaluator.java
b/agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptConditionEvaluator.java
index b306f51..e57f599 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptConditionEvaluator.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptConditionEvaluator.java
@@ -27,6 +27,7 @@ import org.apache.commons.logging.LogFactory;
import org.apache.ranger.plugin.classloader.RangerPluginClassLoader;
import org.apache.ranger.plugin.contextenricher.RangerTagForEval;
import org.apache.ranger.plugin.policyengine.RangerAccessRequest;
+import org.apache.ranger.plugin.util.RangerPerfTracer;
import javax.script.Bindings;
import javax.script.ScriptEngine;
@@ -37,10 +38,17 @@ import java.util.Collections;
import java.util.List;
import java.util.Map;
+import static org.apache.ranger.plugin.util.RangerCommonConstants.*;
+
public class RangerScriptConditionEvaluator extends
RangerAbstractConditionEvaluator {
private static final Log LOG =
LogFactory.getLog(RangerScriptConditionEvaluator.class);
+ private static final Log PERF_POLICY_CONDITION_SCRIPT_EVAL =
RangerPerfTracer.getPerfLogger("policy.condition.script.eval");
+
+ private static final String SCRIPT_PREEXEC = SCRIPT_VAR_CONTEXT +
"=JSON.parse(" + SCRIPT_VAR_CONTEXT_JSON + ");";
+
private ScriptEngine scriptEngine;
+ private boolean enableJsonCtx = false;
@Override
public void init() {
@@ -57,6 +65,8 @@ public class RangerScriptConditionEvaluator extends
RangerAbstractConditionEvalu
if (MapUtils.isNotEmpty(evalOptions)) {
engineName = evalOptions.get("engineName");
+
+ enableJsonCtx =
Boolean.parseBoolean(evalOptions.getOrDefault(SCRIPT_OPTION_ENABLE_JSON_CTX,
Boolean.toString(enableJsonCtx)));
}
if (StringUtils.isBlank(engineName)) {
@@ -147,10 +157,24 @@ public class RangerScriptConditionEvaluator extends
RangerAbstractConditionEvalu
bindings.put("tag", currentTag);
bindings.put("tagAttr", tagAttribs);
+ if (enableJsonCtx) {
+ bindings.put(SCRIPT_VAR_CONTEXT_JSON,
context.toJson());
+
+ script = SCRIPT_PREEXEC + script;
+ }
+
if (LOG.isDebugEnabled()) {
LOG.debug("RangerScriptConditionEvaluator.isMatched(): script={" + script +
"}");
}
+
+ RangerPerfTracer perf = null;
+
try {
+ long requestHash = request.hashCode();
+
+ if
(RangerPerfTracer.isPerfTraceEnabled(PERF_POLICY_CONDITION_SCRIPT_EVAL)) {
+ perf =
RangerPerfTracer.getPerfTracer(PERF_POLICY_CONDITION_SCRIPT_EVAL,
"RangerScriptConditionEvaluator.isMatched(requestHash=" + requestHash + ")");
+ }
Object ret = scriptEngine.eval(script,
bindings);
@@ -167,6 +191,8 @@ public class RangerScriptConditionEvaluator extends
RangerAbstractConditionEvalu
} catch (ScriptException exception) {
LOG.error("RangerScriptConditionEvaluator.isMatched(): failed to evaluate
script," +
" exception=" +
exception);
+ } finally {
+ RangerPerfTracer.log(perf);
}
} else {
String conditionType = condition != null ?
condition.getType() : null;
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptExecutionContext.java
b/agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptExecutionContext.java
index c0a8f9f..3563fd8 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptExecutionContext.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/conditionevaluator/RangerScriptExecutionContext.java
@@ -24,11 +24,14 @@ import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.hadoop.conf.Configuration;
+import org.apache.ranger.authorization.utils.JsonUtils;
import org.apache.ranger.authorization.utils.StringUtil;
import org.apache.ranger.plugin.contextenricher.RangerTagForEval;
import org.apache.ranger.plugin.policyengine.RangerAccessRequest;
import org.apache.ranger.plugin.policyengine.RangerAccessResource;
import org.apache.ranger.plugin.util.RangerAccessRequestUtil;
+import org.apache.ranger.plugin.util.RangerPerfTracer;
+import org.apache.ranger.plugin.util.RangerUserStore;
import java.text.ParseException;
import java.text.SimpleDateFormat;
@@ -36,14 +39,20 @@ import java.util.ArrayList;
import java.util.Arrays;
import java.util.Comparator;
import java.util.Date;
+import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.TimeZone;
+import static org.apache.ranger.plugin.util.RangerCommonConstants.*;
+
+
public final class RangerScriptExecutionContext {
private static final Log LOG =
LogFactory.getLog(RangerScriptExecutionContext.class);
+
+ private static final Log PERF_POLICY_CONDITION_SCRIPT_TOJSON
= RangerPerfTracer.getPerfLogger("policy.condition.script.tojson");
private static final String TAG_ATTR_DATE_FORMAT_PROP
= "ranger.plugin.tag.attr.additional.date.formats";
private static final String TAG_ATTR_DATE_FORMAT_SEPARATOR
= "||";
private static final String TAG_ATTR_DATE_FORMAT_SEPARATOR_REGEX
= "\\|\\|";
@@ -88,6 +97,100 @@ public final class RangerScriptExecutionContext {
this.accessRequest = accessRequest;
}
+ public String toJson() {
+ RangerPerfTracer perf = null;
+
+ long requestHash = accessRequest.hashCode();
+
+ if
(RangerPerfTracer.isPerfTraceEnabled(PERF_POLICY_CONDITION_SCRIPT_TOJSON)) {
+ perf =
RangerPerfTracer.getPerfTracer(PERF_POLICY_CONDITION_SCRIPT_TOJSON,
"RangerScriptExecutionContext.toJson(requestHash=" + requestHash + ")");
+ }
+
+ Map<String, Object> ret = new HashMap<>();
+ Map<String, Object> request = new HashMap<>();
+ RangerUserStore userStore =
RangerAccessRequestUtil.getRequestUserStoreFromContext(accessRequest.getContext());
+
+ if (accessRequest.getAccessTime() != null) {
+ request.put(SCRIPT_FIELD_ACCESS_TIME,
accessRequest.getAccessTime().getTime());
+ }
+
+ request.put(SCRIPT_FIELD_ACCESS_TYPE,
accessRequest.getAccessType());
+ request.put(SCRIPT_FIELD_ACTION, accessRequest.getAction());
+ request.put(SCRIPT_FIELD_CLIENT_IP_ADDRESS,
accessRequest.getClientIPAddress());
+ request.put(SCRIPT_FIELD_CLIENT_TYPE,
accessRequest.getClientType());
+ request.put(SCRIPT_FIELD_CLUSTER_NAME,
accessRequest.getClusterName());
+ request.put(SCRIPT_FIELD_CLUSTER_TYPE,
accessRequest.getClusterType());
+ request.put(SCRIPT_FIELD_FORWARDED_ADDRESSES,
accessRequest.getForwardedAddresses());
+ request.put(SCRIPT_FIELD_REMOTE_IP_ADDRESS,
accessRequest.getRemoteIPAddress());
+ request.put(SCRIPT_FIELD_REQUEST_DATA,
accessRequest.getRequestData());
+
+ if (accessRequest.getResource() != null) {
+ request.put(SCRIPT_FIELD_RESOURCE,
accessRequest.getResource().getAsMap());
+ request.put(SCRIPT_FIELD_RESOURCE_OWNER_USER,
accessRequest.getResource().getOwnerUser());
+ }
+
+ request.put(SCRIPT_FIELD_RESOURCE_MATCHING_SCOPE,
accessRequest.getResourceMatchingScope());
+
+ request.put(SCRIPT_FIELD_USER, accessRequest.getUser());
+ request.put(SCRIPT_FIELD_USER_GROUPS,
accessRequest.getUserGroups());
+ request.put(SCRIPT_FIELD_USER_ROLES,
accessRequest.getUserRoles());
+
+ if (userStore != null) {
+ Map<String, Map<String, String>> userAttrMapping =
userStore.getUserAttrMapping();
+ Map<String, Map<String, String>> groupAttrMapping =
userStore.getGroupAttrMapping();
+
+ if (userAttrMapping != null) {
+ request.put(SCRIPT_FIELD_USER_ATTRIBUTES,
userAttrMapping.get(accessRequest.getUser()));
+ }
+
+ if (groupAttrMapping != null &&
accessRequest.getUserGroups() != null) {
+ Map<String, Map<String, String>> groupAttrs =
new HashMap<>();
+
+ for (String groupName :
accessRequest.getUserGroups()) {
+ groupAttrs.put(groupName,
groupAttrMapping.get(groupName));
+ }
+
+ request.put(SCRIPT_FIELD_USER_GROUP_ATTRIBUTES,
groupAttrs);
+ }
+ }
+
+ ret.put(SCRIPT_FIELD_REQUEST, request);
+
+ Set<RangerTagForEval> requestTags =
RangerAccessRequestUtil.getRequestTagsFromContext(getRequestContext());
+
+ if (CollectionUtils.isNotEmpty(requestTags)) {
+ Set<Map<String, Object>> tags = new HashSet<>();
+
+ for (RangerTagForEval tag : requestTags) {
+ tags.add(toMap(tag));
+ }
+
+ ret.put(SCRIPT_FIELD_TAGS, tags);
+
+ RangerTagForEval currentTag =
RangerAccessRequestUtil.getCurrentTagFromContext(getRequestContext());
+
+ if (currentTag != null) {
+ ret.put(SCRIPT_FIELD_TAG, toMap(currentTag));
+ }
+ }
+
+ RangerAccessResource resource =
RangerAccessRequestUtil.getCurrentResourceFromContext(getRequestContext());
+
+ if (resource != null) {
+ ret.put(SCRIPT_FIELD_RESOURCE, resource.getAsMap());
+
+ if (resource.getOwnerUser() != null) {
+ ret.put(SCRIPT_FIELD_RESOURCE_OWNER_USER,
resource.getOwnerUser());
+ }
+ }
+
+ String strRet = JsonUtils.objectToJson(ret);
+
+ RangerPerfTracer.log(perf);
+
+ return strRet;
+ }
+
public static void init(Configuration config) {
StringBuilder sb = new
StringBuilder(DEFAULT_RANGER_TAG_ATTRIBUTE_DATE_FORMAT);
@@ -413,6 +516,16 @@ public final class RangerScriptExecutionContext {
return ret;
}
+ private static Map<String, Object> toMap(RangerTagForEval tag) {
+ Map<String, Object> ret = new HashMap<>();
+
+ ret.put("type", tag.getType());
+ ret.put("attributes", tag.getAttributes());
+ ret.put("matchType", tag.getMatchType());
+
+ return ret;
+ }
+
public void logDebug(Object msg) {
LOG.debug(msg);
}
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
index ed2dffd..570eb6e 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
@@ -48,4 +48,28 @@ public class RangerCommonConstants {
public static final boolean
RANGER_ADMIN_SUFFIX_IN_PLACE_TAG_UPDATES_DEFAULT = false;
public static final boolean
PLUGIN_CONFIG_SUFFIX_IN_PLACE_TAG_UPDATES_DEFAULT = false;
+ public static final String SCRIPT_OPTION_ENABLE_JSON_CTX =
"enableJsonCtx";
+ public static final String SCRIPT_VAR_CONTEXT =
"_ctx";
+ public static final String SCRIPT_VAR_CONTEXT_JSON =
"_ctx_json";
+ public static final String SCRIPT_FIELD_ACCESS_TIME =
"accessTime";
+ public static final String SCRIPT_FIELD_ACCESS_TYPE =
"accessType";
+ public static final String SCRIPT_FIELD_ACTION =
"action";
+ public static final String SCRIPT_FIELD_CLIENT_IP_ADDRESS =
"clientIPAddress";
+ public static final String SCRIPT_FIELD_CLIENT_TYPE =
"clientType";
+ public static final String SCRIPT_FIELD_CLUSTER_NAME =
"clusterName";
+ public static final String SCRIPT_FIELD_CLUSTER_TYPE =
"clusterType";
+ public static final String SCRIPT_FIELD_FORWARDED_ADDRESSES =
"forwardedAddresses";
+ public static final String SCRIPT_FIELD_REMOTE_IP_ADDRESS =
"remoteIPAddress";
+ public static final String SCRIPT_FIELD_REQUEST_DATA =
"requestData";
+ public static final String SCRIPT_FIELD_RESOURCE =
"resource";
+ public static final String SCRIPT_FIELD_RESOURCE_OWNER_USER =
"resourceOwnerUser";
+ public static final String SCRIPT_FIELD_RESOURCE_MATCHING_SCOPE =
"resourceMatchingScope";
+ public static final String SCRIPT_FIELD_TAG = "tag";
+ public static final String SCRIPT_FIELD_TAGS =
"tags";
+ public static final String SCRIPT_FIELD_USER =
"user";
+ public static final String SCRIPT_FIELD_USER_ATTRIBUTES =
"userAttributes";
+ public static final String SCRIPT_FIELD_USER_GROUPS =
"userGroups";
+ public static final String SCRIPT_FIELD_USER_GROUP_ATTRIBUTES =
"userGroupAttributes";
+ public static final String SCRIPT_FIELD_USER_ROLES =
"userRoles";
+ public static final String SCRIPT_FIELD_REQUEST =
"request";
}
diff --git
a/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerCustomConditionMatcherTest.java
b/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerCustomConditionMatcherTest.java
index 0a4dd4a..36504c7 100644
---
a/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerCustomConditionMatcherTest.java
+++
b/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerCustomConditionMatcherTest.java
@@ -21,23 +21,22 @@ package org.apache.ranger.plugin.conditionevaluator;
import org.apache.ranger.plugin.contextenricher.RangerTagForEval;
+import
org.apache.ranger.plugin.model.RangerServiceDef.RangerPolicyConditionDef;
import org.apache.ranger.plugin.model.RangerTag;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItemCondition;
import org.apache.ranger.plugin.policyengine.RangerAccessRequest;
import org.apache.ranger.plugin.policyengine.RangerAccessRequestImpl;
import org.apache.ranger.plugin.policyengine.RangerAccessResource;
import
org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher;
+import org.apache.ranger.plugin.util.RangerAccessRequestUtil;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-import java.util.UUID;
+import java.util.*;
+import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_OPTION_ENABLE_JSON_CTX;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
@@ -52,6 +51,41 @@ public class RangerCustomConditionMatcherTest {
}
@Test
+ public void testScriptConditionEvaluator() {
+ RangerAccessRequest request =
createRequest(Arrays.asList("PCI", "PII"));
+
+ RangerScriptConditionEvaluator resourceDbCondition =
createScriptConditionEvaluator("_ctx.request.resource.database.equals('db1')");
+ RangerScriptConditionEvaluator resourceDbCondition2 =
createScriptConditionEvaluator("!_ctx.request.resource.database.equals('db2')");
+ RangerScriptConditionEvaluator resourceTblCondition =
createScriptConditionEvaluator("_ctx.request.resource.table.equals('tbl1')");
+ RangerScriptConditionEvaluator resourceColCondition =
createScriptConditionEvaluator("_ctx.request.resource.column.equals('col1')");
+ RangerScriptConditionEvaluator accessTypeCondition =
createScriptConditionEvaluator("_ctx.request.accessType.equals('select')");
+ RangerScriptConditionEvaluator actionCondition =
createScriptConditionEvaluator("_ctx.request.action.equals('query')");
+ RangerScriptConditionEvaluator userCondition =
createScriptConditionEvaluator("_ctx.request.user.equals('test-user')");
+ RangerScriptConditionEvaluator userGroupsLenCondition =
createScriptConditionEvaluator("_ctx.request.userGroups.length == 1");
+ RangerScriptConditionEvaluator userRolesLenCondition =
createScriptConditionEvaluator("_ctx.request.userRoles.length == 1");
+ RangerScriptConditionEvaluator tagsLengthCondition =
createScriptConditionEvaluator("_ctx.tags.length == 2");
+ RangerScriptConditionEvaluator tagTypeCondition =
createScriptConditionEvaluator("_ctx.tag.type.equals('PCI')");
+ RangerScriptConditionEvaluator tagAttributesCondition =
createScriptConditionEvaluator("_ctx.tag.attributes.attr1.equals('PCI_value')");
+ RangerScriptConditionEvaluator tagsTypeCondition =
createScriptConditionEvaluator("switch(_ctx.tags[0].type) { case 'PCI':
_ctx.tags[1].type.equals('PII'); break; case 'PII':
_ctx.tags[1].type.equals('PCI'); break; default: false; }");
+ RangerScriptConditionEvaluator tagsAttributesCondition =
createScriptConditionEvaluator("switch(_ctx.tags[0].type) { case 'PCI':
_ctx.tags[0].attributes.attr1.equals('PCI_value') &&
_ctx.tags[1].attributes.attr1.equals('PII_value'); break; case 'PII':
_ctx.tags[0].attributes.attr1.equals('PII_value') &&
_ctx.tags[1].attributes.attr1.equals('PCI_value'); break; default: false; }");
+
+ Assert.assertTrue("request.resource.database should be db1",
resourceDbCondition.isMatched(request));
+ Assert.assertTrue("request.resource.database should not be
db2", resourceDbCondition2.isMatched(request));
+ Assert.assertTrue("request.resource.table should be tbl1",
resourceTblCondition.isMatched(request));
+ Assert.assertTrue("request.resource.column should be col1",
resourceColCondition.isMatched(request));
+ Assert.assertTrue("request.accessType should be select",
accessTypeCondition.isMatched(request));
+ Assert.assertTrue("request.action should be query",
actionCondition.isMatched(request));
+ Assert.assertTrue("request.user should be testUser",
userCondition.isMatched(request));
+ Assert.assertTrue("request.userGroups should have 1 entry",
userGroupsLenCondition.isMatched(request));
+ Assert.assertTrue("request.userRoles should have 1 entry",
userRolesLenCondition.isMatched(request));
+ Assert.assertTrue("tag.type should be PCI",
tagTypeCondition.isMatched(request));
+ Assert.assertTrue("tag.attributes.attr1 should be PCI_value",
tagAttributesCondition.isMatched(request));
+ Assert.assertTrue("should have 2 tags",
tagsLengthCondition.isMatched(request));
+ Assert.assertTrue("tags PCI and PII should be found",
tagsTypeCondition.isMatched(request));
+ Assert.assertTrue("tag attributes for PCI and PII should be
found", tagsAttributesCondition.isMatched(request));
+ }
+
+ @Test
public void testRangerAnyOfExpectedTagsPresentConditionEvaluator() {
List<String> policyConditionTags = Arrays.asList("PCI", "PII");
RangerAnyOfExpectedTagsPresentConditionEvaluator
tagsAnyPresentConditionEvaluator =
createRangerAnyOfExpectedTagsPresentConditionEvaluator(policyConditionTags);
@@ -167,22 +201,66 @@ public class RangerCustomConditionMatcherTest {
return matcher;
}
+ RangerScriptConditionEvaluator createScriptConditionEvaluator(String
script) {
+ RangerScriptConditionEvaluator ret = new
RangerScriptConditionEvaluator();
+
+ RangerPolicyConditionDef conditionDef =
mock(RangerPolicyConditionDef.class);
+ RangerPolicyItemCondition condition =
mock(RangerPolicyItemCondition.class);
+
+
when(conditionDef.getEvaluatorOptions()).thenReturn(Collections.singletonMap(SCRIPT_OPTION_ENABLE_JSON_CTX,
"true"));
+ when(condition.getValues()).thenReturn(Arrays.asList(script));
+
+ ret.setConditionDef(conditionDef);
+ ret.setPolicyItemCondition(condition);
+
+ ret.init();
+
+ return ret;
+ }
+
RangerAccessRequest createRequest(List<String> resourceTags) {
- RangerAccessResource resource =
mock(RangerAccessResource.class);
- when(resource.getAsString()).thenReturn("Dummy resource");
+ RangerAccessResource resource =
mock(RangerAccessResource.class);
+
+ Map<String, Object> resourceMap = new HashMap<>();
+
+ resourceMap.put("database", "db1");
+ resourceMap.put("table", "tbl1");
+ resourceMap.put("column", "col1");
+
+ when(resource.getAsString()).thenReturn("db1/tbl1/col1");
+ when(resource.getOwnerUser()).thenReturn("testUser");
+ when(resource.getAsMap()).thenReturn(resourceMap);
+ when(resource.getReadOnlyCopy()).thenReturn(resource);
+
+ RangerAccessRequestImpl request = new RangerAccessRequestImpl();
- RangerAccessRequest request = new
RangerAccessRequestImpl(resource,"dummy","test", null, null);
- Set<RangerTagForEval> rangerTagForEvals = new
HashSet<>();
- RangerPolicyResourceMatcher.MatchType matchType =
RangerPolicyResourceMatcher.MatchType.NONE;
+ request.setResource(resource);
+
request.setResourceMatchingScope(RangerAccessRequest.ResourceMatchingScope.SELF);
+ request.setAccessType("select");
+ request.setAction("query");
+ request.setUser("test-user");
+ request.setUserGroups(Collections.singleton("test-group"));
+ request.setUserRoles(Collections.singleton("test-role"));
if (resourceTags != null) {
+ Set<RangerTagForEval> rangerTagForEvals = new
HashSet<>();
+ RangerTagForEval currentTag = null;
+
for (String resourceTag : resourceTags) {
- RangerTag tag = new
RangerTag(UUID.randomUUID().toString(), resourceTag, null, null, null, null);
- rangerTagForEvals.add(new RangerTagForEval(tag,
matchType));
+ RangerTag tag = new
RangerTag(UUID.randomUUID().toString(), resourceTag,
Collections.singletonMap("attr1", resourceTag + "_value"), null, null, null);
+ RangerTagForEval tagForEval = new
RangerTagForEval(tag, RangerPolicyResourceMatcher.MatchType.SELF);
+
+ rangerTagForEvals.add(tagForEval);
+
+ if (currentTag == null) {
+ currentTag = tagForEval;
+ }
}
- request.getContext().put("TAGS", rangerTagForEvals);
+
+
RangerAccessRequestUtil.setRequestTagsInContext(request.getContext(),
rangerTagForEvals);
+
RangerAccessRequestUtil.setCurrentTagInContext(request.getContext(),
currentTag);
} else {
- request.getContext().put("TAGS", null);
+
RangerAccessRequestUtil.setRequestTagsInContext(request.getContext(), null);
}
return request;
