-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/70499/
-----------------------------------------------------------
Review request for ranger, bhavik patel, Madhan Neethiraj, and Ramesh Mani.
Bugs: RANGER-2404
https://issues.apache.org/jira/browse/RANGER-2404
Repository: ranger
Description
-------
If user is marked as a delegated administrator for a resource by a policy
associated with a zone, then he/she is able to manipulate another policy
targeted to the same resource but not associated with any zone.
When security zones exist in Ranger admin, Ranger policies in service-policies
object used to build policy engine are grouped under their respective security
zones. For the delegate admin processing policy engine built within Ranger
admin process, service policies were not partitioned into zones. This caused
ALL policies to be considered for delegate admin processing.
Diffs
-----
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCache.java
c1a797791
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCacheForEngineOptions.java
ca6a2a395
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java
be256a9ba
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
6ddb35953
Diff: https://reviews.apache.org/r/70499/diff/1/
Testing
-------
Created a policy ("policy-1") under a zone ("zone-1") which granted a user
("user1") delegate admin privilege.
Created another policy ("policy-2") with same policy-resources as "policy-1"
for another user ("user2") and with no delegate admin privilege under "unzoned"
zone.
Logged into Ranger as user "user1" and ensured that for "unzoned" zone,
"policy-2" was not visible.
Thanks,
Abhay Kulkarni
