-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/73846/
-----------------------------------------------------------
Review request for ranger, Dhaval Shah, Dineshkumar Yadav, Gautam Borad,
Jayendra Parab, Kishor Gollapalliwar, Abhay Kulkarni, Mateen Mansoori, Mehul
Parikh, Pradeep Agrawal, VaradreawiZTV VaradreawiZTV, Vishal Suvagia, and
Velmurugan Periasamy.
Bugs: RANGER-3623
https://issues.apache.org/jira/browse/RANGER-3623
Repository: ranger
Description
-------
Currently, we have an option ranger.admin.allow.unauthenticated.access to allow
unauthenticated clients to perform a series of API operations. This option
allows the client to perform both dangerous grant/revoke permission operation
and relatively safe download operation.
In many cases, allowing anonymous downloading of policy/tag/role is not a
serious risk problem. On the contrary, the complicated kerberos and SSL
settings make it difficult for ranger plugin embedded in third-party services
to complete the task of refreshing policy, which may be a bigger problem. In
particular, refresh failure often has no obvious features for administrators to
discover.
Therefore, I suggest that ranger increase the ability to allow client to
download policy/tag/roles anonymously.
There are two ways to achieve it.
1. Just limit the ability of "ranger.admin.allow.unauthenticated.access=true"
which needs to modify
"security-admin/src/main/resources/conf.dist/security-applicationContext.xml"
to remove dangerous operations from '
security="none"'.
2. Add a candidate value "downloadonly" to
"ranger.admin.allow.unauthenticated.access"
Which needs modify ServiceRest.Java and BizUtil.java to implement the enhanced
checking logic.
I have a patch for method2.
Diffs
-----
security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
1ec1df0a3d09577c52e503532d5aea87ad6cd72d
security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
e3cdef1c2ba6411cf4d4a26cd49e56e9017f3e93
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
098188e3b9f1f837727c7d279a4fab1f0aa84e34
security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
10f91e037180a50287b8d0b0fa0ea3eec0d7f415
Diff: https://reviews.apache.org/r/73846/diff/1/
Testing
-------
mvn clean build package
fresh install and upgrade.
Thanks,
Kirby Zhou
