Vyom Mani Tiwari created RANGER-5838:
----------------------------------------
Summary: Add constraintDefs to RangerServiceDef and constraint
policy model to RangerPolicy
Key: RANGER-5838
URL: https://issues.apache.org/jira/browse/RANGER-5838
Project: Ranger
Issue Type: Improvement
Components: Ranger
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
Add the data model for constraint policies. This change only adds model classes
and JSON serialization. There is no change to policy evaluation, Admin
persistence, audit, or UI.
*RangerServiceDef*
* New field {{{}List<RangerConstraintDef> constraintDefs{}}}.
* {{{}RangerConstraintDef{}}}: itemId, name, label, description, rbKeyLabel,
rbKeyDescription, resources (resource names the constraint applies to),
accessTypes (access-type names), parameters
({{{}List<RangerConstraintParamDef>{}}}), options ({{{}Map<String, String>{}}}).
* {{{}RangerConstraintParamDef{}}}: itemId, name, label, description, type
(e.g. string, int, boolean, user, group, role), mandatory, defaultValue,
rbKeyLabel, rbKeyDescription.
* dataMaskDef and rowFilterDef are unchanged.
*RangerPolicy*
* New constant {{{}POLICY_TYPE_CONSTRAINTS = 4{}}}. It is not added to
{{POLICY_TYPES}} in this change, so existing engine and Admin code paths that
iterate policy types are unaffected until evaluation support is added.
* New field {{{}List<RangerConstraintPolicyItem> constraintPolicyItems{}}}.
* {{{}RangerConstraintPolicyItem extends RangerPolicyItem{}}}, carrying
{{{}RangerPolicyItemConstraintInfo{}}}: constraintName and parameters
({{{}Map<String, Object>{}}}). This follows the pattern of
RangerDataMaskPolicyItem/RangerPolicyItemDataMaskInfo, so principals, accesses
and conditions work as for other policy items.
Example constraintDef:
json
{{{color:#008000}"constraintDefs"{color}:
{color:#2b303b}[{{color}{color:#2b303b}"{color}{color:#b80a18}itemId{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}1{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}name{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"requireApproval"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}label{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"Require
approval"{color}{color:#2b303b},{color}{color:#2b303b}"{color}{color:#b80a18}resources{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{color}{color:#008000}"tool"{color}{color:#2b303b}],{color}
{color:#2b303b}"{color}{color:#b80a18}accessTypes{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{color}{color:#008000}"execute"{color}{color:#2b303b}],{color}{color:#2b303b}"{color}{color:#b80a18}parameters{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{{color}
{color:#2b303b}"{color}{color:#b80a18}itemId{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}1{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}name{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"approver"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}label{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"Approver"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}type{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"user"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}mandatory{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}true{color} {color:#2b303b}}]{color}{color:#2b303b}}]{color}}}
*Out of scope (separate sub-tasks):* DB schema and Admin validation, evaluation
in the policy engine, supported-constraint registration, audit, authz-api/PDP
result, UI, plugin capability gating.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
