vyommani opened a new pull request, #1327:
URL: https://github.com/apache/ranger/pull/1327
## What changes were proposed in this pull request?
RANGER-5851: store `constraintDefs` (added to `RangerServiceDef` in
RANGER-5838) in Ranger Admin. Without this change, constraintDefs are dropped
when a service def is created or updated.
**DB**
- New table `x_constraint_def`, following the existing service-def child
tables (`x_policy_condition_def`, `x_context_enricher_def`).
- Columns:
- `def_id` (FK to `x_service_def`), `item_id`;
- name, label, description and rb keys;
- `resources`, `access_types`, `parameters` and `options` as JSON text;
- `sort_order`.
- Index on `def_id`.
- Added to the current schema for MySQL, Oracle, Postgres, SQL Server and
SQL Anywhere, with upgrade patch `079-add-x_constraint_def.sql` for each.
- The patches create the table and index only if they don't exist, so they
are safe to re-run.
**Admin**
- `XXConstraintDef` entity and `XXConstraintDefDao`, with find-by-def-id and
find-by-def-id-and-name queries.
- `RangerServiceDefServiceBase`: maps constraintDefs between the model and
the entity, and loads them when a service def is read.
- `ServiceDBStore`:
- service def create/update stores constraintDefs, matching them by
`itemId`; constraintDefs left out of an update are removed;
- service def delete removes its constraintDefs.
- `XPortalUserService`: clears user references on user delete, as for other
service-def tables.
**Validation (`RangerServiceDefValidator`)**
- Constraint def itemId and name are unique and not empty.
- `resources` and `accessTypes` exist in the service def.
- Each listed resource's ancestors are also listed, so the constraint maps
to complete resource hierarchies.
- Parameter names are unique, and parameter `type` is one of `string, int,
bool, enum, user, group, role`.
- `enum` parameters need a `subType` naming an enum in the service def;
other types must not set `subType`.
- New error codes 2026–2032.
**Not in this change**
- Constraint policies (policyType 4) in Admin, including a policy-ref table
that blocks removing a constraintDef while policies use it: RANGER-5852 (TODO
in `ServiceDBStore`).
- UI.
- constraintDefs in shipped service-def JSONs.
## How was this patch tested?
- `TestRangerServiceDefValidator`:
- valid constraintDefs (user/group/role/enum parameters, empty resources);
- every failure case;
- `isValid()` rejecting a service def with an invalid constraintDef.
- `TestServiceDBStore`: create stores constraintDefs; update adds, changes
and removes them; delete removes them.
- `TestRangerServiceDefServiceBase` / `TestRangerServiceDefService`: model ↔
entity round-trip, null lists stored as NULL, and constraintDefs loaded when a
service def is read.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
