This is an automated email from the ASF dual-hosted git repository. dineshkumar-yadav pushed a commit to branch sandbox/dineshkumar-yadav/RANGER-5792 in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 6851d7b95198c9a7fe539095bf2e5489d2475593 Author: Vikas Kumar <[email protected]> AuthorDate: Sun Sep 13 10:17:16 2026 +0530 RANGER-5792: Align to best practices for User rest API (#1230) Co-authored-by: Madhan Neethiraj <[email protected]> Co-authored-by: Cursor <[email protected]> --- .../java/org/apache/ranger/biz/RangerBizUtil.java | 17 +++++++++-------- .../main/java/org/apache/ranger/biz/UserMgr.java | 4 ++-- .../main/java/org/apache/ranger/biz/XUserMgr.java | 22 ++++++++++------------ .../java/org/apache/ranger/common/StringUtil.java | 9 +++++++++ 4 files changed, 30 insertions(+), 22 deletions(-) diff --git a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java index d48752fba..cb096f0d3 100644 --- a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java +++ b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java @@ -1361,19 +1361,20 @@ public boolean checkUserAccessible(VXUser vXUser) { boolean isAccessible = true; Collection<String> roleList = userMgr.getRolesByLoginId(vXUser .getName()); + Collection<String> payloadRoles = vXUser.getUserRoleList(); if (isKeyAdmin()) { - if (vXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) - || vXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) - || roleList.contains(RangerConstants.ROLE_SYS_ADMIN) - || roleList.contains(RangerConstants.ROLE_ADMIN_AUDITOR)) { + if (StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_SYS_ADMIN) + || StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_ADMIN_AUDITOR) + || StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_SYS_ADMIN) + || StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_ADMIN_AUDITOR)) { isAccessible = false; } } if (isAdmin()) { - if (vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN) - || vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR) - || roleList.contains(RangerConstants.ROLE_KEY_ADMIN) - || roleList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) { + if (StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_KEY_ADMIN) + || StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_KEY_ADMIN_AUDITOR) + || StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_KEY_ADMIN) + || StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) { isAccessible = false; } } diff --git a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java index 35be7580d..b0254d212 100644 --- a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java +++ b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java @@ -283,10 +283,10 @@ public boolean updateRoles(Long userId, Collection<String> rolesList) { } List<String> stringRolesList = new ArrayList<String>(); for (String userRole : rolesList) { - if(!VALID_ROLE_LIST.contains(userRole.toUpperCase())){ + if (userRole == null || !VALID_ROLE_LIST.contains(userRole.trim().toUpperCase())) { throw restErrorUtil.createRESTException("Invalid user role, please provide valid user role.",MessageEnums.INVALID_INPUT_DATA); } - stringRolesList.add(userRole); + stringRolesList.add(userRole.trim().toUpperCase()); } xUserMgr.checkAccessRoles(stringRolesList); rangerBizUtil.blockAuditorRoleUser(); diff --git a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java index 1b013b314..116f5969a 100755 --- a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java +++ b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java @@ -826,17 +826,15 @@ private boolean hasAccessToGetUserInfo(VXUser requestedVXUser) { if (userSession != null && userSession.getLoginId() != null) { VXUser loggedInVXUser = xUserService.getXUserByUserName(userSession.getLoginId()); if (requestedVXUser != null && CollectionUtils.isNotEmpty(requestedVXUser.getUserRoleList()) && loggedInVXUser != null && loggedInVXUser.getUserRoleList().size() == 1) { - if (loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) { - return requestedVXUser.getId().equals(loggedInVXUser.getId()) ? true : false; - } else if (loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN) || loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) { - if (requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN) || requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR) || requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) { - return true; - } - } else if (loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) || loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)) { - if (loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) && "rangerusersync".equalsIgnoreCase(userSession.getLoginId())) { - return true; - } else if (requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) || requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) || requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) { + if (StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_USER)) { + return requestedVXUser.getId().equals(loggedInVXUser.getId()); + } else if (StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_KEY_ADMIN) || StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) { + return StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_KEY_ADMIN) || StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_KEY_ADMIN_AUDITOR) || StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_USER); + } else if (StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_SYS_ADMIN) || StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_ADMIN_AUDITOR)) { + if (StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(), RangerConstants.ROLE_SYS_ADMIN) && "rangerusersync".equalsIgnoreCase(userSession.getLoginId())) { return true; + } else { + return StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_SYS_ADMIN) || StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_ADMIN_AUDITOR) || StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(), RangerConstants.ROLE_USER); } } } @@ -1480,9 +1478,9 @@ public void checkAccessRoles(List<String> stringRolesList) { throw restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" + (session != null ? session.getXXPortalUser().getId() : "Not Logged In") + " ,isn't permitted to perform the action."); } else { if (!"rangerusersync".equals(session.getXXPortalUser().getLoginId())) {// new logic for rangerusersync user - if (session.isUserAdmin() && (stringRolesList.contains(RangerConstants.ROLE_KEY_ADMIN) || stringRolesList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR))) { + if (session.isUserAdmin() && (StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_KEY_ADMIN) || StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_KEY_ADMIN_AUDITOR))) { throw restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" + (session != null ? session.getXXPortalUser().getId() : "") + " isn't permitted to perform the action."); - } else if (session.isKeyAdmin() && (stringRolesList.contains(RangerConstants.ROLE_SYS_ADMIN) || stringRolesList.contains(RangerConstants.ROLE_ADMIN_AUDITOR))) { + } else if (session.isKeyAdmin() && (StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_SYS_ADMIN) || StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_ADMIN_AUDITOR))) { throw restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" + (session != null ? session.getXXPortalUser().getId() : "") + " isn't permitted to perform the action."); } } diff --git a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java index 275c883c5..870e35664 100644 --- a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java +++ b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java @@ -23,6 +23,7 @@ import java.io.UnsupportedEncodingException; import java.net.URLEncoder; import java.nio.charset.StandardCharsets; +import java.util.Collection; import java.util.HashMap; import java.util.List; import java.util.regex.Matcher; @@ -258,4 +259,12 @@ public static String getUTFEncodedString(String username) throws UnsupportedEnco return URLEncoder.encode(username, StandardCharsets.UTF_8.toString()); } + public static boolean containsIgnoreCase(Collection<String> values, String str) { + if (values != null && str != null) { + return values.stream().anyMatch(str::equalsIgnoreCase); + } + + return false; + } + }
