----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/70499/#review214938 -----------------------------------------------------------
Ship it! Ship It! - bhavik patel On April 26, 2019, 11:12 p.m., Abhay Kulkarni wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/70499/ > ----------------------------------------------------------- > > (Updated April 26, 2019, 11:12 p.m.) > > > Review request for ranger, bhavik patel, Madhan Neethiraj, and Ramesh Mani. > > > Bugs: RANGER-2404 > https://issues.apache.org/jira/browse/RANGER-2404 > > > Repository: ranger > > > Description > ------- > > If user is marked as a delegated administrator for a resource by a policy > associated with a zone, then he/she is able to manipulate another policy > targeted to the same resource but not associated with any zone. > > When security zones exist in Ranger admin, Ranger policies in > service-policies object used to build policy engine are grouped under their > respective security zones. For the delegate admin processing policy engine > built within Ranger admin process, service policies were not partitioned into > zones. This caused ALL policies to be considered for delegate admin > processing. > > > Diffs > ----- > > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCache.java > c1a797791 > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineCacheForEngineOptions.java > ca6a2a395 > > agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyEngineImpl.java > 35fa53459 > security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java > f17b65eda > > > Diff: https://reviews.apache.org/r/70499/diff/2/ > > > Testing > ------- > > Created a policy ("policy-1") under a zone ("zone-1") which granted a user > ("user1") delegate admin privilege. > Created another policy ("policy-2") with same policy-resources as "policy-1" > for another user ("user2") and with no delegate admin privilege under > "unzoned" zone. > > Logged into Ranger as user "user1" and ensured that for "unzoned" zone, > "policy-2" was not visible. > > > Thanks, > > Abhay Kulkarni > >
