----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/70499/#review214912 -----------------------------------------------------------
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCache.java Lines 68 (patched) <https://reviews.apache.org/r/70499/#comment301199> ```java ServicePolicies updatedServicePolicies = policies; if (zoneStore != null) { Map<String, RangerSecurityZone.RangerSecurityZoneService> securityZones = zoneStore.getSecurityZonesForService(serviceName); if (MapUtils.isNotEmpty(securityZones)) { updatedServicePolicies = getUpdatedServicePoliciesForZones(policies, securityZones); } } ``` => This part of code snippet is common within if ... else if.. .Is it possible to shift out or move to some method? agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCache.java Lines 148 (patched) <https://reviews.apache.org/r/70499/#comment301200> securityZoneInfo.setContainsAssociatedTagService(false); Just wanted to check we are explicitly setting over here and why not in below else block. agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCache.java Lines 154 (patched) <https://reviews.apache.org/r/70499/#comment301201> ret.setTagPolicies(servicePolicies.getTagPolicies()) Just wanted to check we are explicitly setting over here and why not in below else block. - bhavik patel On April 17, 2019, 10:55 p.m., Abhay Kulkarni wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/70499/ > ----------------------------------------------------------- > > (Updated April 17, 2019, 10:55 p.m.) > > > Review request for ranger, bhavik patel, Madhan Neethiraj, and Ramesh Mani. > > > Bugs: RANGER-2404 > https://issues.apache.org/jira/browse/RANGER-2404 > > > Repository: ranger > > > Description > ------- > > If user is marked as a delegated administrator for a resource by a policy > associated with a zone, then he/she is able to manipulate another policy > targeted to the same resource but not associated with any zone. > > When security zones exist in Ranger admin, Ranger policies in > service-policies object used to build policy engine are grouped under their > respective security zones. For the delegate admin processing policy engine > built within Ranger admin process, service policies were not partitioned into > zones. This caused ALL policies to be considered for delegate admin > processing. > > > Diffs > ----- > > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCache.java > c1a797791 > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCacheForEngineOptions.java > ca6a2a395 > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java > be256a9ba > security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java > 6ddb35953 > > > Diff: https://reviews.apache.org/r/70499/diff/1/ > > > Testing > ------- > > Created a policy ("policy-1") under a zone ("zone-1") which granted a user > ("user1") delegate admin privilege. > Created another policy ("policy-2") with same policy-resources as "policy-1" > for another user ("user2") and with no delegate admin privilege under > "unzoned" zone. > > Logged into Ranger as user "user1" and ensured that for "unzoned" zone, > "policy-2" was not visible. > > > Thanks, > > Abhay Kulkarni > >
