akash-gupta2813 commented on code in PR #1290:
URL: https://github.com/apache/ranger/pull/1290#discussion_r4208083308
##########
security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java:
##########
@@ -4472,6 +4420,86 @@ private RangerService
hideCriticalServiceDetailsForRoleUser(RangerService ranger
return rangerService;
}
+ private RangerPolicy createRangerPolicy(String serviceName, String
userName, String zoneName, RangerAccessResource resource, GrantRevokeRequest
grantRequest) throws Exception {
+ RangerPolicy policy = new RangerPolicy();
+ String guid = guidUtil.genGUID();
+
+ policy.setService(serviceName);
+ policy.setGuid(guid);
+ policy.setName("grant-" + guid);
+ policy.setDescription("created by grant");
+ policy.setIsAuditEnabled(grantRequest.getEnableAudit());
+ policy.setCreatedBy(userName);
+
+ Map<String, RangerPolicyResource> policyResources = new HashMap<>();
+ Set<String> resourceNames = resource.getKeys();
+
+ if (!CollectionUtils.isEmpty(resourceNames)) {
+ for (String resourceName : resourceNames) {
+ policyResources.put(resourceName,
getPolicyResource(resource.getValue(resourceName), grantRequest));
+ }
+ }
+
+ policy.setResources(policyResources);
+
+ RangerPolicyItem policyItem = new RangerPolicyItem();
+
+ policyItem.setDelegateAdmin(grantRequest.getDelegateAdmin());
+ policyItem.addUsers(grantRequest.getUsers());
+ policyItem.addGroups(grantRequest.getGroups());
+ policyItem.addRoles(grantRequest.getRoles());
+
+ for (String accessType : grantRequest.getAccessTypes()) {
+ policyItem.addAccess(new RangerPolicyItemAccess(accessType,
Boolean.TRUE));
+ }
+
+ policy.addPolicyItem(policyItem);
+ policy.setZoneName(zoneName);
+
+ ensureAdminAccess(policy, userName);
+
+ try {
+ return svcStore.createPolicy(policy);
+ } catch (Exception excp) {
+ if
(ServiceRESTUtil.isXPolicyServiceSignatureUniqueConstraintViolation(excp)) {
+ LOG.debug("createRangerPolicy: signature conflict detected;
trying merge flow. serviceName={}, zoneName={}, policyName={}",
+ serviceName, zoneName, policy.getName());
+
+ String signature = new
RangerPolicyResourceSignature(policy).getSignature();
+ List<RangerPolicy> matchedPolicies =
svcStore.getPoliciesByResourceSignature(serviceName, signature, true);
+ RangerPolicy existingPolicy = null;
+
+ if (CollectionUtils.isNotEmpty(matchedPolicies)) {
+ if (matchedPolicies.size() > 1) {
+ LOG.warn("createRangerPolicy: multiple policies found
for signature conflict fallback. serviceName={}, signature={}, count={}",
+ serviceName, signature,
matchedPolicies.size());
+ }
+
+ existingPolicy = matchedPolicies.get(0);
+ } else {
+ LOG.error("createRangerPolicy: DB signature lookup could
not find policy after signature conflict. serviceName={}, zoneName={},
signature={}",
+ serviceName, zoneName, signature);
+ }
+
+ if (existingPolicy != null &&
ServiceRESTUtil.processGrantRequest(existingPolicy, grantRequest)) {
+ existingPolicy.setZoneName(zoneName);
+ ensureAdminAccess(existingPolicy, userName);
+ RangerPolicy updatedPolicy =
svcStore.updatePolicy(existingPolicy);
Review Comment:
corrected
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
