This is an automated email from the ASF dual-hosted git repository.
ramackri pushed a commit to branch ranger-2.9
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.9 by this push:
new d80c1be33 RANGER-5709: Fix KMS secure download for roles, tags, and
userstore
d80c1be33 is described below
commit d80c1be33248b73b5710d4f1b787861677c2776c
Author: ramk <[email protected]>
AuthorDate: Wed Jul 29 11:01:31 2026 +0530
RANGER-5709: Fix KMS secure download for roles, tags, and userstore
Use getServiceByNameForDP() for KMS services in RoleREST, TagREST, and
XUserREST secure download paths, matching policy download behavior.
Backport of 7e2af7a0eabde62a49ed09e8a39fe1fdecdc2a91 from master.
---
.../main/java/org/apache/ranger/rest/RoleREST.java | 12 ++++---
.../main/java/org/apache/ranger/rest/TagREST.java | 14 +++++---
.../java/org/apache/ranger/rest/XUserREST.java | 10 ++++--
.../java/org/apache/ranger/rest/TestRoleREST.java | 42 ++++++++++++++++++++++
.../java/org/apache/ranger/rest/TestTagREST.java | 8 ++---
5 files changed, 70 insertions(+), 16 deletions(-)
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
index 13ca10fe3..b8b4b41af 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
@@ -1088,18 +1088,22 @@ public RangerRoles getSecureRangerRolesIfUpdated(
false);
}
XXServiceDef xServiceDef =
daoManager.getXXServiceDef().getById(xService.getType());
- RangerService rangerService =
svcStore.getServiceByName(serviceName);
+ RangerService rangerService;
if (StringUtils.equals(xServiceDef.getImplclassname(),
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
+ rangerService =
svcStore.getServiceByNameForDP(serviceName);
+
if (isKeyAdmin) {
isAllowed = true;
- }else {
+ } else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService,
POLICY_DOWNLOAD_USERS);
}
- }else{
+ } else {
+ rangerService = svcStore.getServiceByName(serviceName);
+
if (isAdmin) {
isAllowed = true;
- }else{
+ } else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService,
POLICY_DOWNLOAD_USERS);
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
index b13a01bc1..2988a94d3 100755
--- a/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
@@ -1489,18 +1489,22 @@ public ServiceTags
getSecureServiceTagsIfUpdated(@PathParam("serviceName") Strin
false);
}
XXServiceDef xServiceDef =
daoManager.getXXServiceDef().getById(xService.getType());
- RangerService rangerService =
svcStore.getServiceByName(serviceName);
-
+ RangerService rangerService;
+
if (StringUtils.equals(xServiceDef.getImplclassname(),
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
+ rangerService =
svcStore.getServiceByNameForDP(serviceName);
+
if (isKeyAdmin) {
isAllowed = true;
- }else {
+ } else if (rangerService != null) {
isAllowed =
bizUtil.isUserAllowed(rangerService, Allowed_User_List_For_Tag_Download);
}
- }else{
+ } else {
+ rangerService = svcStore.getServiceByName(serviceName);
+
if (isAdmin) {
isAllowed = true;
- }else{
+ } else if (rangerService != null) {
isAllowed =
bizUtil.isUserAllowed(rangerService, Allowed_User_List_For_Tag_Download);
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
index 36b9f0816..27dd8e777 100755
--- a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
@@ -1507,18 +1507,22 @@ public RangerUserStore
getSecureRangerUserStoreIfUpdated(@PathParam("serviceName
}
if (isValid) {
XXServiceDef xServiceDef =
rangerDaoManager.getXXServiceDef().getById(xService.getType());
- RangerService rangerService =
svcStore.getServiceByName(serviceName);
+ RangerService rangerService;
if
(StringUtils.equals(xServiceDef.getImplclassname(),
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
+ rangerService =
svcStore.getServiceByNameForDP(serviceName);
+
if (isKeyAdmin) {
isAllowed = true;
- } else {
+ } else if (rangerService != null) {
isAllowed =
bizUtil.isUserAllowed(rangerService, USERSTORE_DOWNLOAD_USERS);
}
} else {
+ rangerService =
svcStore.getServiceByName(serviceName);
+
if (isAdmin) {
isAllowed = true;
- } else {
+ } else if (rangerService != null) {
isAllowed =
bizUtil.isUserAllowed(rangerService, USERSTORE_DOWNLOAD_USERS);
}
}
diff --git
a/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
b/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
index a30589e6c..4842ac9dc 100644
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
@@ -26,6 +26,7 @@
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyResource;
import org.apache.ranger.plugin.model.RangerRole;
+import org.apache.ranger.plugin.model.RangerService;
import org.apache.ranger.plugin.model.validation.RangerRoleValidator;
import org.apache.ranger.plugin.util.GrantRevokeRoleRequest;
import org.apache.ranger.plugin.util.RangerRoles;
@@ -816,6 +817,47 @@ public void test17dGetSecureRangerRolesIfUpdated(){
}
}
+ @Test
+ public void
test17eGetSecureRangerRolesIfUpdatedKmsUsesServiceByNameForDP() throws
Exception {
+ RangerRoles rangerRoles = createRangerRoles();
+ String serviceName = "dev_kms";
+ String pluginId = "kms-plugin";
+ String clusterName = "";
+ String pluginCapabilities = "";
+
+ XXService xService = createXXService();
+ xService.setName(serviceName);
+ xService.setType(Id);
+
+ XXServiceDef xServiceDef = new XXServiceDef();
+ xServiceDef.setId(Id);
+
xServiceDef.setImplclassname("org.apache.ranger.services.kms.RangerServiceKMS");
+
+ RangerService rangerService = new RangerService();
+ rangerService.setId(Id);
+ rangerService.setName(serviceName);
+
+ XXServiceDefDao xServiceDefDao = Mockito.mock(XXServiceDefDao.class);
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+
+ Mockito.when(serviceUtil.isValidService(serviceName,
request)).thenReturn(true);
+
Mockito.when(daoMgr.getXXService().findByName(serviceName)).thenReturn(xService);
+ Mockito.when(daoMgr.getXXServiceDef()).thenReturn(xServiceDefDao);
+
Mockito.when(xServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
+ Mockito.when(bizUtil.isAdmin()).thenReturn(false);
+ Mockito.when(bizUtil.isKeyAdmin()).thenReturn(false);
+
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
+ Mockito.when(bizUtil.isUserAllowed(rangerService,
RoleREST.POLICY_DOWNLOAD_USERS)).thenReturn(true);
+ Mockito.when(roleStore.getRoles(serviceName,
-1L)).thenReturn(rangerRoles);
+
+ RangerRoles result =
roleRest.getSecureRangerRolesIfUpdated(serviceName, -1L, 0L, pluginId,
clusterName, pluginCapabilities, request);
+
+ Assert.assertNotNull(result);
+ Assert.assertEquals(rangerRoles.getRangerRoles().size(),
result.getRangerRoles().size());
+ Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
+ Mockito.verify(bizUtil).isUserAllowed(rangerService,
RoleREST.POLICY_DOWNLOAD_USERS);
+ }
+
// empty request roles (requestParamRoles = 0, dbRoles = 5, return =
all dbRoles)
@Test
public void test18GetRolesInJson() throws Exception {
diff --git
a/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
b/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
index 34122dd79..187a98cd3 100755
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
@@ -1626,7 +1626,7 @@ public void
test52getSecureServiceTagsIfUpdatedIsKeyAdminTrue() {
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xXServiceDefDao);
Mockito.when(xXServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
try {
-
Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService);
+
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
} catch (Exception e) {
}
@@ -1647,7 +1647,7 @@ public void
test52getSecureServiceTagsIfUpdatedIsKeyAdminTrue() {
Mockito.verify(daoManager).getXXServiceDef();
Mockito.verify(xXServiceDefDao).getById(xService.getType());
try {
- Mockito.verify(svcStore).getServiceByName(serviceName);
+
Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
} catch (Exception e) {
}
try {
@@ -1752,7 +1752,7 @@ public void
test54getSecureServiceTagsIfUpdatedIsKeyAdminFalse() {
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xXServiceDefDao);
Mockito.when(xXServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
try {
-
Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService);
+
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
} catch (Exception e) {
}
@@ -1774,7 +1774,7 @@ public void
test54getSecureServiceTagsIfUpdatedIsKeyAdminFalse() {
Mockito.verify(daoManager).getXXServiceDef();
Mockito.verify(xXServiceDefDao).getById(xService.getType());
try {
- Mockito.verify(svcStore).getServiceByName(serviceName);
+
Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
} catch (Exception e) {
}
Mockito.verify(bizUtil).isUserAllowed(rangerService,
Allowed_User_List_For_Tag_Download);
