> On April 26, 2019, 6:15 a.m., bhavik patel wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCache.java > > Lines 154 (patched) > > <https://reviews.apache.org/r/70499/diff/1/?file=2140127#file2140127line154> > > > > ret.setTagPolicies(servicePolicies.getTagPolicies()) > > > > Just wanted to check we are explicitly setting over here and why not in > > below else block.
The else block deals with the case of incremental policy updates. For incremental policy updates, policy deltas for tag policies are not separated out from resource policy deltas; they are already included in the resource policy deltas. Therefore, ret.setTagPolicies() is not required for incremental policy update case. - Abhay ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/70499/#review214912 ----------------------------------------------------------- On April 17, 2019, 10:55 p.m., Abhay Kulkarni wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/70499/ > ----------------------------------------------------------- > > (Updated April 17, 2019, 10:55 p.m.) > > > Review request for ranger, bhavik patel, Madhan Neethiraj, and Ramesh Mani. > > > Bugs: RANGER-2404 > https://issues.apache.org/jira/browse/RANGER-2404 > > > Repository: ranger > > > Description > ------- > > If user is marked as a delegated administrator for a resource by a policy > associated with a zone, then he/she is able to manipulate another policy > targeted to the same resource but not associated with any zone. > > When security zones exist in Ranger admin, Ranger policies in > service-policies object used to build policy engine are grouped under their > respective security zones. For the delegate admin processing policy engine > built within Ranger admin process, service policies were not partitioned into > zones. This caused ALL policies to be considered for delegate admin > processing. > > > Diffs > ----- > > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCache.java > c1a797791 > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCacheForEngineOptions.java > ca6a2a395 > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java > be256a9ba > security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java > 6ddb35953 > > > Diff: https://reviews.apache.org/r/70499/diff/1/ > > > Testing > ------- > > Created a policy ("policy-1") under a zone ("zone-1") which granted a user > ("user1") delegate admin privilege. > Created another policy ("policy-2") with same policy-resources as "policy-1" > for another user ("user2") and with no delegate admin privilege under > "unzoned" zone. > > Logged into Ranger as user "user1" and ensured that for "unzoned" zone, > "policy-2" was not visible. > > > Thanks, > > Abhay Kulkarni > >
