akash-gupta2813 commented on code in PR #1290:
URL: https://github.com/apache/ranger/pull/1290#discussion_r4208064879
##########
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java:
##########
@@ -4472,6 +4420,86 @@ private RangerService
hideCriticalServiceDetailsForRoleUser(RangerService ranger
return rangerService;
}
+ private RangerPolicy createRangerPolicy(String serviceName, String
userName, String zoneName, RangerAccessResource resource, GrantRevokeRequest
grantRequest) throws Exception {
+ RangerPolicy policy = new RangerPolicy();
+ String guid = guidUtil.genGUID();
+
+ policy.setService(serviceName);
+ policy.setGuid(guid);
+ policy.setName("grant-" + guid);
+ policy.setDescription("created by grant");
+ policy.setIsAuditEnabled(grantRequest.getEnableAudit());
+ policy.setCreatedBy(userName);
+
+ Map<String, RangerPolicyResource> policyResources = new HashMap<>();
+ Set<String> resourceNames = resource.getKeys();
+
+ if (!CollectionUtils.isEmpty(resourceNames)) {
+ for (String resourceName : resourceNames) {
+ policyResources.put(resourceName,
getPolicyResource(resource.getValue(resourceName), grantRequest));
+ }
+ }
+
+ policy.setResources(policyResources);
+
+ RangerPolicyItem policyItem = new RangerPolicyItem();
+
+ policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
+ policyItem.addUsers(grantRequest.getUsers());
+ policyItem.addGroups(grantRequest.getGroups());
+ policyItem.addRoles(grantRequest.getRoles());
+
+ for (String accessType : grantRequest.getAccessTypes()) {
+ policyItem.addAccess(new RangerPolicyItemAccess(accessType,
Boolean.TRUE));
+ }
+
+ policy.addPolicyItem(policyItem);
+ policy.setZoneName(zoneName);
+
+ ensureAdminAccess(policy, userName);
+
+ try {
+ return svcStore.createPolicy(policy);
+ } catch (Exception excp) {
+ if
(ServiceRESTUtil.isXPolicyServiceSignatureUniqueConstraintViolation(excp)) {
+ LOG.debug("createRangerPolicy: signature conflict detected;
trying merge flow. serviceName={}, zoneName={}, policyName={}",
+ serviceName, zoneName, policy.getName());
+
+ String signature = new
RangerPolicyResourceSignature(policy).getSignature();
+ List<RangerPolicy> matchedPolicies =
svcStore.getPoliciesByResourceSignature(serviceName, signature, true);
+ RangerPolicy existingPolicy = null;
+
+ if (CollectionUtils.isNotEmpty(matchedPolicies)) {
+ if (matchedPolicies.size() > 1) {
+ LOG.warn("createRangerPolicy: multiple policies found
for signature conflict fallback. serviceName={}, signature={}, count={}",
+ serviceName, signature,
matchedPolicies.size());
+ }
+
+ existingPolicy = matchedPolicies.get(0);
+ } else {
+ LOG.error("createRangerPolicy: DB signature lookup could
not find policy after signature conflict. serviceName={}, zoneName={},
signature={}",
+ serviceName, zoneName, signature);
+ }
+
+ if (existingPolicy != null &&
ServiceRESTUtil.processGrantRequest(existingPolicy, grantRequest)) {
+ existingPolicy.setZoneName(zoneName);
+ ensureAdminAccess(existingPolicy, userName);
+ RangerPolicy updatedPolicy =
svcStore.updatePolicy(existingPolicy);
+
+ LOG.debug("createRangerPolicy: merge succeeded after
signature conflict. serviceName={}, zoneName={}, policyId={}",
+ serviceName, zoneName, existingPolicy.getId());
+
+ return updatedPolicy;
+ } else if (existingPolicy != null) {
+ LOG.error("createRangerPolicy: processGrantRequest
returned false while merging conflicting create request. serviceName={},
zoneName={}, policyId={}",
+ serviceName, zoneName, existingPolicy.getId());
+ }
+ }
+
+ throw excp;
Review Comment:
when merge fails we are logging error here. client should always see retry
error when grantaccess fails and 409 error code
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
