mneethiraj commented on code in PR #1316:
URL: https://github.com/apache/ranger/pull/1316#discussion_r4300759129
##########
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java:
##########
@@ -299,7 +299,8 @@ public Set<List<RangerResourceDef>>
getResourceHierarchies(Integer policyType, C
Set<List<RangerResourceDef>> ret = new HashSet<>();
- if (policyType == RangerPolicy.POLICY_TYPE_AUDIT) {
+ // Audit and constraint policies are outside POLICY_TYPES and use the
access resource hierarchy.
+ if (policyType == RangerPolicy.POLICY_TYPE_AUDIT || policyType ==
RangerPolicy.POLICY_TYPE_CONSTRAINTS) {
Review Comment:
Each constraintDef has its own resources list. So, either this method should
ake an additional parameter, constraint, or add a new method that return
resources for a speciific constraint.
```
public Set<List<RangerResourceDef>>
getResourceHierarchiesForConstraint(String constraint, Collection<String> keys)
{
...
```
##########
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerConstraintResult.java:
##########
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.ranger.plugin.policyengine;
+
+import
org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher.MatchType;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+
+public class RangerConstraintResult {
+ private String constraintName;
+ private final Map<String, Object> parameters;
+ private long policyId;
+ private Long policyVersion;
Review Comment:
Please add `policyPriority` as well, as this might be necessary for
enforcement to pick appropriate constraints.
Also, consider adding a `Comparator` to make it easier to sort a constraints
list.
```
static class ConstraintResultComparator implements
Comparator<RangerConstraintResult>, java.io.Serializable {
@Override
public int compare(RangerConstraintResult me, RangerConstraintResult
other) {
int ret = compareStrings(me.getConstraintName(),
other.getConstraintName());
if (ret == 0) {
ret = Integer.compare(me.getPolicyPriority(),
other.getPolicyPriority());
if (ret == 0) {
ret =
RangerPolicyResourceMatcher.MATCH_TYPE_COMPARATOR.compare(me.getMatchType(),
other.getMatchType());
if (ret == 0) {
ret = Integer.compare(me.getPolicyId(), other.getPolicyId());
}
}
}
return ret;
}
}
private static int compareStrings(String str1, String str2) {
if (str1 == null) {
return str2 == null ? 0 : -1):
} else if (str2 == null) {
return 1;
} else {
return str1.compareTo(str2);
}
}
```
##########
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerAccessResult.java:
##########
@@ -51,11 +54,12 @@ public class RangerAccessResult {
private String auditLogId;
private long policyId = -1;
private int policyPriority;
- private String zoneName;
- private Long policyVersion;
- private long evaluatedPoliciesCount;
- private String reason;
- private Map<String, Object> additionalInfo;
+ private String zoneName;
+ private Long policyVersion;
+ private long evaluatedPoliciesCount;
+ private String reason;
+ private Map<String, Object> additionalInfo;
+ private List<RangerConstraintResult> constraintResults;
Review Comment:
`constraintResults` => `constraints`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
