> On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetBearerToken.java > > Lines 44 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270179#file2270179line44> > > > > Does this have sensitive information? If so, we should print in debug > > logs
Is that a question? "Should we print in debug logs?" I considered this along with a Comcast security colleague and decided that putting this warning in the README file was sufficient: "NOTE that if this code is run with debug logging enabled, there will be a very high likelihood that sensitive content will be emitted in the log.". If you don't think it's sufficient, I can remove printing it in the debug logs, but it seems as though it would be nice to see what's in there, if an error should occur that involves the file contents. > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetBearerToken.java > > Lines 50 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270179#file2270179line50> > > > > Should strToken = null? So that the caller would know if the request > > failed? I'm not against this, but I already raise an error if the request for token fails, and execution should halt after that, shouldn't it? Or am I missing your point? > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetBearerToken.java > > Lines 63 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270179#file2270179line63> > > > > Instead of doing e.toString(), can we just pass "e" to the logger? So > > the stack trace will be printed? done > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetBearerToken.java > > Lines 64 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270179#file2270179line64> > > > > Since we are printing using logger, do we need to print to stderr also? done, removed print to stderr > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetFromDataFile.java > > Lines 60 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270180#file2270180line60> > > > > Can we pass the exception as ",e", so that we can print the stack trace? done > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetFromURL.java > > Lines 50 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270181#file2270181line50> > > > > Do we need to print in stderr done > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/HandleSecrets.java > > Lines 41 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270182#file2270182line41> > > > > Is it secure to print sensitive information? see response to getBearerToken, line 44 > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/HandleSecrets.java > > Lines 50 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270182#file2270182line50> > > > > Is it secure to print sensitive information? see response to getBearerToken, line 44 > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/HandleSecrets.java > > Lines 66 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270182#file2270182line66> > > > > Should pass the exception as parameter? So we can get the stack trace? done > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/HandleSecrets.java > > Lines 67 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270182#file2270182line67> > > > > Do we need to print this in stderr? done > On Oct. 7, 2022, 1:30 a.m., Don Bosco Durai wrote: > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/RangerExternalUserStoreRetriever.java > > Lines 69 (patched) > > <https://reviews.apache.org/r/74142/diff/1/?file=2270186#file2270186line69> > > > > This seems to be internal comcast class. What happens if this is not > > available in the opensource? Sorry, this was an oversight. It's fixed now. - Barbara ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/74142/#review224760 ----------------------------------------------------------- On Sept. 26, 2022, 7:17 p.m., Barbara Eckman wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/74142/ > ----------------------------------------------------------- > > (Updated Sept. 26, 2022, 7:17 p.m.) > > > Review request for ranger and madhan. > > > Bugs: Ranger-3855 > https://issues.apache.org/jira/browse/Ranger-3855 > > > Repository: ranger > > > Description > ------- > > RangerExternalUserStoreRetriever class Ranger-3855 > > Ranger version 3.0.0 provides a means, via a context enricher, to add or > retrieve attributes to the database of users for whom Ranger controls access. > This permits syntax like "Dumbo" in $USER.aliases any Ranger policy > condition, including row and tag filters. This greatly enhances the ability > to provide custom Attribute-based Access Control based on the specific > business needs of one's organization. > > I believe that the original assumption was that such attributes would be > added to AD/LDAP and enter Ranger via regular user sync's. However, this > process does not currently work with Azure AD, which many organizations use. > Neither does it provide timely support for organizations for whom adding each > new attribute to AD would be subject to prolonged scrutiny by overworked > security teams. > > In the spirit of the RangerAdminUserStoreRetriever context enricher, we have > written a RangerExternalUserStoreRetriever class which adds arbitrary > attributes to Ranger users via external API calls, thus freeing additions to > the UserStore from dependency on AD/LDAP. We have also written a > RangerRoleUserStoreRetriever class, which transforms role membership into > user attributes, for ease of use in complex policy conditions. > > > Diffs > ----- > > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetBearerToken.java > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetFromDataFile.java > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/GetFromURL.java > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/HandleSecrets.java > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/LICENSE > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/NOTICE > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/README.md > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/RangerExternalUserStoreRetriever.java > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/RangerRoleUserStoreRetriever.java > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/TokenInputs.java > PRE-CREATION > > agents-common/src/main/java/org/apache/ranger/plugin/contextenricher/externalUserStoreRetrievers/pom.xml > PRE-CREATION > plugin-nestedstructure/README.md ea878f6a2 > > > Diff: https://reviews.apache.org/r/74142/diff/1/ > > > Testing > ------- > > > Thanks, > > Barbara Eckman > >
