This is an automated email from the ASF dual-hosted git repository.
dineshkumar-yadav pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 59bf21d96 RANGER-5724: Grant API returns 200 OK for null payload
(#1123)
59bf21d96 is described below
commit 59bf21d969d6bd75b1ad3c382bc87fdfac5759d3
Author: Sanket-Shelar <[email protected]>
AuthorDate: Wed Aug 5 15:47:11 2026 +0530
RANGER-5724: Grant API returns 200 OK for null payload (#1123)
---
.../java/org/apache/ranger/rest/ServiceREST.java | 308 +++++++++++----------
.../org/apache/ranger/rest/TestServiceREST.java | 28 ++
2 files changed, 184 insertions(+), 152 deletions(-)
diff --git
a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
index ea76f5415..e75f1018c 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
@@ -1149,114 +1149,116 @@ public List<String>
lookupResource(@PathParam("serviceName") String serviceName,
public RESTResponse grantAccess(@PathParam("serviceName") String
serviceName, GrantRevokeRequest grantRequest, @Context HttpServletRequest
request) throws Exception {
LOG.debug("==> ServiceREST.grantAccess({}, {})", serviceName,
grantRequest);
+ if (grantRequest == null) {
+ throw
restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Grant
request object is null or missing body in grant access api", false);
+ }
+
RESTResponse ret = new RESTResponse();
RangerPerfTracer perf = null;
- if (grantRequest != null) {
- if (serviceUtil.isValidateHttpsAuthentication(serviceName,
request)) {
- try {
- bizUtil.failUnauthenticatedIfNotAllowed();
-
- if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG,
"ServiceREST.grantAccess(serviceName=" + serviceName + ")");
- }
+ if (serviceUtil.isValidateHttpsAuthentication(serviceName, request)) {
+ try {
+ bizUtil.failUnauthenticatedIfNotAllowed();
- // This is an open API - dont care about who calls it.
Caller is treated as privileged user
- boolean hasAdminPrivilege = true;
- String loggedInUser = null;
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG,
"ServiceREST.grantAccess(serviceName=" + serviceName + ")");
+ }
- validateGrantRevokeRequest(grantRequest,
hasAdminPrivilege, loggedInUser);
+ // This is an open API - dont care about who calls it. Caller
is treated as privileged user
+ boolean hasAdminPrivilege = true;
+ String loggedInUser = null;
- String userName =
grantRequest.getGrantor();
- Set<String> userGroups =
CollectionUtils.isNotEmpty(grantRequest.getGrantorGroups()) ?
grantRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
- String ownerUser =
grantRequest.getOwnerUser();
- RangerAccessResource resource = new
RangerAccessResourceImpl(getAccessResourceObjectMap(grantRequest.getResource()),
ownerUser);
- Set<String> accessTypes =
grantRequest.getAccessTypes();
- VXUser vxUser =
xUserService.getXUserByUserName(userName);
+ validateGrantRevokeRequest(grantRequest, hasAdminPrivilege,
loggedInUser);
- if
(vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
- VXResponse vXResponse = new VXResponse();
+ String userName = grantRequest.getGrantor();
+ Set<String> userGroups =
CollectionUtils.isNotEmpty(grantRequest.getGrantorGroups()) ?
grantRequest.getGrantorGroups() : userMgr.getGroupsForUser(userName);
+ String ownerUser = grantRequest.getOwnerUser();
+ RangerAccessResource resource = new
RangerAccessResourceImpl(getAccessResourceObjectMap(grantRequest.getResource()),
ownerUser);
+ Set<String> accessTypes =
grantRequest.getAccessTypes();
+ VXUser vxUser =
xUserService.getXUserByUserName(userName);
-
vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
- vXResponse.setMsgDesc("Operation denied.
LoggedInUser=" + vxUser.getId() + " is not permitted to perform the action.");
+ if
(vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ VXResponse vXResponse = new VXResponse();
- throw restErrorUtil.generateRESTException(vXResponse);
- }
+ vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
+ vXResponse.setMsgDesc("Operation denied. LoggedInUser=" +
vxUser.getId() + " is not permitted to perform the action.");
- RangerService rangerService =
svcStore.getServiceByName(serviceName);
- String zoneName =
getRangerAdminZoneName(serviceName, grantRequest);
- boolean isAdmin =
bizUtil.isUserRangerAdmin(userName) ||
bizUtil.isUserServiceAdmin(rangerService, userName) ||
hasAdminAccess(serviceName, zoneName, userName, userGroups, resource,
accessTypes);
+ throw restErrorUtil.generateRESTException(vXResponse);
+ }
- if (!isAdmin) {
- throw
restErrorUtil.createGrantRevokeRESTException("User doesn't have necessary
permission to grant access");
- }
+ RangerService rangerService =
svcStore.getServiceByName(serviceName);
+ String zoneName =
getRangerAdminZoneName(serviceName, grantRequest);
+ boolean isAdmin =
bizUtil.isUserRangerAdmin(userName) ||
bizUtil.isUserServiceAdmin(rangerService, userName) ||
hasAdminAccess(serviceName, zoneName, userName, userGroups, resource,
accessTypes);
- RangerPolicy policy =
getExactMatchPolicyForResource(serviceName, resource, zoneName, userName);
+ if (!isAdmin) {
+ throw restErrorUtil.createGrantRevokeRESTException("User
doesn't have necessary permission to grant access");
+ }
- if (policy != null) {
- boolean policyUpdated =
ServiceRESTUtil.processGrantRequest(policy, grantRequest);
+ RangerPolicy policy =
getExactMatchPolicyForResource(serviceName, resource, zoneName, userName);
- if (policyUpdated) {
- policy.setZoneName(zoneName);
+ if (policy != null) {
+ boolean policyUpdated =
ServiceRESTUtil.processGrantRequest(policy, grantRequest);
- ensureAdminAccess(policy, userName);
+ if (policyUpdated) {
+ policy.setZoneName(zoneName);
- svcStore.updatePolicy(policy);
- } else {
- LOG.error("processGrantRequest processing failed");
+ ensureAdminAccess(policy, userName);
- throw new Exception("processGrantRequest
processing failed");
- }
+ svcStore.updatePolicy(policy);
} else {
- policy = new RangerPolicy();
+ LOG.error("processGrantRequest processing failed");
- policy.setService(serviceName);
- policy.setName("grant-" + System.currentTimeMillis());
// TODO: better policy name
- policy.setDescription("created by grant");
-
policy.setIsAuditEnabled(grantRequest.getEnableAudit());
- policy.setCreatedBy(userName);
+ throw new Exception("processGrantRequest processing
failed");
+ }
+ } else {
+ policy = new RangerPolicy();
- Map<String, RangerPolicyResource> policyResources =
new HashMap<>();
- Set<String> resourceNames =
resource.getKeys();
+ policy.setService(serviceName);
+ policy.setName("grant-" + System.currentTimeMillis()); //
TODO: better policy name
+ policy.setDescription("created by grant");
+ policy.setIsAuditEnabled(grantRequest.getEnableAudit());
+ policy.setCreatedBy(userName);
- if (!CollectionUtils.isEmpty(resourceNames)) {
- for (String resourceName : resourceNames) {
- policyResources.put(resourceName,
getPolicyResource(resource.getValue(resourceName), grantRequest));
- }
- }
+ Map<String, RangerPolicyResource> policyResources = new
HashMap<>();
+ Set<String> resourceNames =
resource.getKeys();
- policy.setResources(policyResources);
+ if (!CollectionUtils.isEmpty(resourceNames)) {
+ for (String resourceName : resourceNames) {
+ policyResources.put(resourceName,
getPolicyResource(resource.getValue(resourceName), grantRequest));
+ }
+ }
- RangerPolicyItem policyItem = new RangerPolicyItem();
+ policy.setResources(policyResources);
-
policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
- policyItem.addUsers(grantRequest.getUsers());
- policyItem.addGroups(grantRequest.getGroups());
- policyItem.addRoles(grantRequest.getRoles());
+ RangerPolicyItem policyItem = new RangerPolicyItem();
- for (String accessType :
grantRequest.getAccessTypes()) {
- policyItem.addAccess(new
RangerPolicyItemAccess(accessType, Boolean.TRUE));
- }
+
policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
+ policyItem.addUsers(grantRequest.getUsers());
+ policyItem.addGroups(grantRequest.getGroups());
+ policyItem.addRoles(grantRequest.getRoles());
- policy.addPolicyItem(policyItem);
- policy.setZoneName(zoneName);
+ for (String accessType : grantRequest.getAccessTypes()) {
+ policyItem.addAccess(new
RangerPolicyItemAccess(accessType, Boolean.TRUE));
+ }
- ensureAdminAccess(policy, userName);
+ policy.addPolicyItem(policyItem);
+ policy.setZoneName(zoneName);
- svcStore.createPolicy(policy);
- }
- } catch (WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("grantAccess({}, {}) failed", serviceName,
grantRequest, excp);
+ ensureAdminAccess(policy, userName);
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
+ svcStore.createPolicy(policy);
}
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("grantAccess({}, {}) failed", serviceName,
grantRequest, excp);
- ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
+ throw restErrorUtil.createRESTException(excp.getMessage());
+ } finally {
+ RangerPerfTracer.log(perf);
}
+
+ ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
}
LOG.debug("<== ServiceREST.grantAccess({}, {}) :{}", serviceName,
grantRequest, ret);
@@ -1271,114 +1273,116 @@ public RESTResponse
grantAccess(@PathParam("serviceName") String serviceName, Gr
public RESTResponse secureGrantAccess(@PathParam("serviceName") String
serviceName, GrantRevokeRequest grantRequest, @Context HttpServletRequest
request) throws Exception {
LOG.debug("==> ServiceREST.secureGrantAccess({}, {})", serviceName,
grantRequest);
+ if (grantRequest == null) {
+ throw
restErrorUtil.createRESTException(HttpServletResponse.SC_BAD_REQUEST, "Grant
request object is null or missing body in grant access api", false);
+ }
+
RESTResponse ret = new RESTResponse();
RangerPerfTracer perf = null;
bizUtil.blockAuditorRoleUser();
- if (grantRequest != null) {
- if (serviceUtil.isValidService(serviceName, request)) {
- try {
- if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
- perf = RangerPerfTracer.getPerfTracer(PERF_LOG,
"ServiceREST.scureGrantAccess(serviceName=" + serviceName + ")");
- }
+ if (serviceUtil.isValidService(serviceName, request)) {
+ try {
+ if (RangerPerfTracer.isPerfTraceEnabled(PERF_LOG)) {
+ perf = RangerPerfTracer.getPerfTracer(PERF_LOG,
"ServiceREST.scureGrantAccess(serviceName=" + serviceName + ")");
+ }
- XXService xService =
daoManager.getXXService().findByName(serviceName);
- XXServiceDef xServiceDef =
daoManager.getXXServiceDef().getById(xService.getType());
- RangerService rangerService =
svcStore.getServiceByName(serviceName);
- String loggedInUser =
bizUtil.getCurrentUserLoginId();
- boolean hasAdminPrivilege = bizUtil.isAdmin() ||
bizUtil.isUserServiceAdmin(rangerService, loggedInUser) ||
bizUtil.isUserAllowedForGrantRevoke(rangerService, loggedInUser);
+ XXService xService =
daoManager.getXXService().findByName(serviceName);
+ XXServiceDef xServiceDef =
daoManager.getXXServiceDef().getById(xService.getType());
+ RangerService rangerService =
svcStore.getServiceByName(serviceName);
+ String loggedInUser =
bizUtil.getCurrentUserLoginId();
+ boolean hasAdminPrivilege = bizUtil.isAdmin() ||
bizUtil.isUserServiceAdmin(rangerService, loggedInUser) ||
bizUtil.isUserAllowedForGrantRevoke(rangerService, loggedInUser);
- validateGrantRevokeRequest(grantRequest,
hasAdminPrivilege, loggedInUser);
+ validateGrantRevokeRequest(grantRequest, hasAdminPrivilege,
loggedInUser);
- String userName =
grantRequest.getGrantor();
- Set<String> userGroups =
grantRequest.getGrantorGroups();
- String ownerUser =
grantRequest.getOwnerUser();
- RangerAccessResource resource = new
RangerAccessResourceImpl(getAccessResourceObjectMap(grantRequest.getResource()),
ownerUser);
- Set<String> accessTypes =
grantRequest.getAccessTypes();
- String zoneName =
getRangerAdminZoneName(serviceName, grantRequest);
- boolean isAllowed = false;
+ String userName = grantRequest.getGrantor();
+ Set<String> userGroups =
grantRequest.getGrantorGroups();
+ String ownerUser = grantRequest.getOwnerUser();
+ RangerAccessResource resource = new
RangerAccessResourceImpl(getAccessResourceObjectMap(grantRequest.getResource()),
ownerUser);
+ Set<String> accessTypes =
grantRequest.getAccessTypes();
+ String zoneName =
getRangerAdminZoneName(serviceName, grantRequest);
+ boolean isAllowed = false;
- if (StringUtils.equals(xServiceDef.getImplclassname(),
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
- if (bizUtil.isKeyAdmin() ||
bizUtil.isUserAllowedForGrantRevoke(rangerService, loggedInUser)) {
- isAllowed = true;
- }
- } else {
- isAllowed = bizUtil.isUserRangerAdmin(userName) ||
bizUtil.isUserServiceAdmin(rangerService, userName) ||
hasAdminAccess(serviceName, zoneName, userName, userGroups, resource,
accessTypes);
+ if (StringUtils.equals(xServiceDef.getImplclassname(),
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
+ if (bizUtil.isKeyAdmin() ||
bizUtil.isUserAllowedForGrantRevoke(rangerService, loggedInUser)) {
+ isAllowed = true;
}
+ } else {
+ isAllowed = bizUtil.isUserRangerAdmin(userName) ||
bizUtil.isUserServiceAdmin(rangerService, userName) ||
hasAdminAccess(serviceName, zoneName, userName, userGroups, resource,
accessTypes);
+ }
- if (isAllowed) {
- RangerPolicy policy =
getExactMatchPolicyForResource(serviceName, resource, zoneName, userName);
-
- if (policy != null) {
- boolean policyUpdated =
ServiceRESTUtil.processGrantRequest(policy, grantRequest);
+ if (isAllowed) {
+ RangerPolicy policy =
getExactMatchPolicyForResource(serviceName, resource, zoneName, userName);
- if (policyUpdated) {
- policy.setZoneName(zoneName);
+ if (policy != null) {
+ boolean policyUpdated =
ServiceRESTUtil.processGrantRequest(policy, grantRequest);
- ensureAdminAccess(policy, userName);
+ if (policyUpdated) {
+ policy.setZoneName(zoneName);
- svcStore.updatePolicy(policy);
- } else {
- LOG.error("processSecureGrantRequest
processing failed");
+ ensureAdminAccess(policy, userName);
- throw new Exception("processSecureGrantRequest
processing failed");
- }
+ svcStore.updatePolicy(policy);
} else {
- policy = new RangerPolicy();
+ LOG.error("processSecureGrantRequest processing
failed");
- policy.setService(serviceName);
- policy.setName("grant-" +
System.currentTimeMillis()); // TODO: better policy name
- policy.setDescription("created by grant");
-
policy.setIsAuditEnabled(grantRequest.getEnableAudit());
- policy.setCreatedBy(userName);
+ throw new Exception("processSecureGrantRequest
processing failed");
+ }
+ } else {
+ policy = new RangerPolicy();
- Map<String, RangerPolicyResource> policyResources
= new HashMap<>();
- Set<String> resourceNames
= resource.getKeys();
+ policy.setService(serviceName);
+ policy.setName("grant-" + System.currentTimeMillis());
// TODO: better policy name
+ policy.setDescription("created by grant");
+
policy.setIsAuditEnabled(grantRequest.getEnableAudit());
+ policy.setCreatedBy(userName);
- if (!CollectionUtils.isEmpty(resourceNames)) {
- for (String resourceName : resourceNames) {
- policyResources.put(resourceName,
getPolicyResource(resource.getValue(resourceName), grantRequest));
- }
- }
+ Map<String, RangerPolicyResource> policyResources =
new HashMap<>();
+ Set<String> resourceNames =
resource.getKeys();
- policy.setResources(policyResources);
+ if (!CollectionUtils.isEmpty(resourceNames)) {
+ for (String resourceName : resourceNames) {
+ policyResources.put(resourceName,
getPolicyResource(resource.getValue(resourceName), grantRequest));
+ }
+ }
- RangerPolicyItem policyItem = new
RangerPolicyItem();
+ policy.setResources(policyResources);
-
policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
- policyItem.addUsers(grantRequest.getUsers());
- policyItem.addGroups(grantRequest.getGroups());
- policyItem.addRoles(grantRequest.getRoles());
+ RangerPolicyItem policyItem = new RangerPolicyItem();
- for (String accessType :
grantRequest.getAccessTypes()) {
- policyItem.addAccess(new
RangerPolicyItemAccess(accessType, Boolean.TRUE));
- }
+
policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
+ policyItem.addUsers(grantRequest.getUsers());
+ policyItem.addGroups(grantRequest.getGroups());
+ policyItem.addRoles(grantRequest.getRoles());
- policy.addPolicyItem(policyItem);
- policy.setZoneName(zoneName);
+ for (String accessType :
grantRequest.getAccessTypes()) {
+ policyItem.addAccess(new
RangerPolicyItemAccess(accessType, Boolean.TRUE));
+ }
- ensureAdminAccess(policy, userName);
+ policy.addPolicyItem(policyItem);
+ policy.setZoneName(zoneName);
- svcStore.createPolicy(policy);
- }
- } else {
- LOG.error("secureGrantAccess({}, {}) failed as User
doesn't have permission to grant Policy", serviceName, grantRequest);
+ ensureAdminAccess(policy, userName);
- throw
restErrorUtil.createGrantRevokeRESTException("User doesn't have necessary
permission to grant access");
+ svcStore.createPolicy(policy);
}
- } catch (WebApplicationException excp) {
- throw excp;
- } catch (Throwable excp) {
- LOG.error("secureGrantAccess({}, {}) failed", serviceName,
grantRequest, excp);
+ } else {
+ LOG.error("secureGrantAccess({}, {}) failed as User
doesn't have permission to grant Policy", serviceName, grantRequest);
- throw restErrorUtil.createRESTException(excp.getMessage());
- } finally {
- RangerPerfTracer.log(perf);
+ throw restErrorUtil.createGrantRevokeRESTException("User
doesn't have necessary permission to grant access");
}
+ } catch (WebApplicationException excp) {
+ throw excp;
+ } catch (Throwable excp) {
+ LOG.error("secureGrantAccess({}, {}) failed", serviceName,
grantRequest, excp);
- ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
+ throw restErrorUtil.createRESTException(excp.getMessage());
+ } finally {
+ RangerPerfTracer.log(perf);
}
+
+ ret.setStatusCode(RESTResponse.STATUS_SUCCESS);
}
LOG.debug("<== ServiceREST.secureGrantAccess({}, {}) :{}",
serviceName, grantRequest, ret);
diff --git
a/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
b/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
index 125940347..4f26b13f3 100644
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestServiceREST.java
@@ -3914,6 +3914,34 @@ void
test156GrantBlockedWhenUnauthenticatedAndFlagFalse() throws Exception {
Assertions.assertThrows(WebApplicationException.class, () ->
serviceREST.grantAccess("HDFS_1", grantRequest, request));
}
+ @Test
+ void test157GrantAccessRejectsNullRequest() {
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+
+
Mockito.when(restErrorUtil.createRESTException(Mockito.eq(HttpServletResponse.SC_BAD_REQUEST),
Mockito.anyString(), Mockito.eq(false)))
+ .thenReturn(new WebApplicationException());
+
+ Assertions.assertThrows(WebApplicationException.class, () ->
serviceREST.grantAccess("cm_hive", null, request));
+
+
Mockito.verify(restErrorUtil).createRESTException(HttpServletResponse.SC_BAD_REQUEST,
+ "Grant request object is null or missing body in grant access
api", false);
+ Mockito.verifyNoInteractions(serviceUtil);
+ }
+
+ @Test
+ void test158SecureGrantAccessRejectsNullRequest() {
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+
+
Mockito.when(restErrorUtil.createRESTException(Mockito.eq(HttpServletResponse.SC_BAD_REQUEST),
Mockito.anyString(), Mockito.eq(false)))
+ .thenReturn(new WebApplicationException());
+
+ Assertions.assertThrows(WebApplicationException.class, () ->
serviceREST.secureGrantAccess("cm_hive", null, request));
+
+
Mockito.verify(restErrorUtil).createRESTException(HttpServletResponse.SC_BAD_REQUEST,
+ "Grant request object is null or missing body in grant access
api", false);
+ Mockito.verifyNoInteractions(bizUtil);
+ }
+
RangerPolicy rangerPolicy() {
List<RangerPolicyItemAccess> accesses = new ArrayList<>();
List<String> users = new ArrayList<>();
