[jira] [Commented] (RANGER-1429) Ranger Audit solrconfig.xml optimizations

[Bosco (Jira)]

[ 
https://issues.apache.org/jira/browse/RANGER-1429?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16971030#comment-16971030
 ] 

Bosco commented on RANGER-1429:
---

[~krisden] I don't think we are using spell check in Ranger audits.

> Ranger Audit solrconfig.xml optimizations
> -
>
> Key: RANGER-1429
> URL: https://issues.apache.org/jira/browse/RANGER-1429
> Project: Ranger
>  Issue Type: Bug
>  Components: audit
>Affects Versions: 0.7.0
>Reporter: Greg Senia
>Priority: Major
> Attachments: RANGER-1429.patch
>
>
> When using SolrCloud and having a single shard single replica with a large 
> number of audit records 20GB for 2 weeks. It takes Solr a very long time to 
> open up the replica for work. After doing some research I determine via 
> thread dumps that on the first request to the Solr Collection it kicks off a 
> Suggestion thread and a SpellCheck thread. I propose removing these as it 
> does not seem to impact RangerAudit and solves the issue of Solr 
> ranger_audits collection being unavailable after solr startup.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Re: Review Request 71724: RANGER-2642: Grant/Revoke REST invocations by non-service users should not specify resource owner

[Madhan Neethiraj]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71724/#review218587
---




agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyRepository.java
Line 821 (original), 821 (patched)


This change will result in policies having references to {owner} to be 
excluded from delegated-admin policy-engines - even if the the policy has other 
policy-items that don't reference {owner}. Can you please review? Also, why is 
it necessary to exclude such policies?


- Madhan Neethiraj


On Nov. 9, 2019, 7:10 a.m., Abhay Kulkarni wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71724/
> ---
> 
> (Updated Nov. 9, 2019, 7:10 a.m.)
> 
> 
> Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Sailaja 
> Polavarapu.
> 
> 
> Bugs: RANGER-2642
> https://issues.apache.org/jira/browse/RANGER-2642
> 
> 
> Repository: ranger
> 
> 
> Description
> ---
> 
> If Grant/Revoke REST API is invoked by a user which is not a admin or not 
> listed in policy.grantrevoke.auth.users config parameter value, then resource 
> being granted permission to should not specify ownership information. 
> Otherwise, such user may be able to modify a resource for which it does not 
> have delegated-admin privilege.
> 
> 
> Diffs
> -
> 
>   
> agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyRepository.java
>  065120f84 
>   security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 
> abb1b1013 
>   security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 
> 0ab733c65 
>   security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 
> 3d8a32977 
> 
> 
> Diff: https://reviews.apache.org/r/71724/diff/5/
> 
> 
> Testing
> ---
> 
> Passed all unit tests
> 
> 
> Thanks,
> 
> Abhay Kulkarni
> 
>

Re: Review Request 71724: RANGER-2642: Grant/Revoke REST invocations by non-service users should not specify resource owner

[Madhan Neethiraj]

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/71724/#review218586
---




security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
Lines 3946 (patched)


grantor, the user who performed grant/revoke operation in a service like 
Hive/HBase, can be different from the caller of grant/remove REST API - which 
is likely to be the service-account (hive/hbase).

Only authorized callers (ranger-admins and service-admins) should be 
allowed to specify ownerName.


- Madhan Neethiraj


On Nov. 9, 2019, 7:10 a.m., Abhay Kulkarni wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/71724/
> ---
> 
> (Updated Nov. 9, 2019, 7:10 a.m.)
> 
> 
> Review request for ranger, Madhan Neethiraj, Ramesh Mani, and Sailaja 
> Polavarapu.
> 
> 
> Bugs: RANGER-2642
> https://issues.apache.org/jira/browse/RANGER-2642
> 
> 
> Repository: ranger
> 
> 
> Description
> ---
> 
> If Grant/Revoke REST API is invoked by a user which is not a admin or not 
> listed in policy.grantrevoke.auth.users config parameter value, then resource 
> being granted permission to should not specify ownership information. 
> Otherwise, such user may be able to modify a resource for which it does not 
> have delegated-admin privilege.
> 
> 
> Diffs
> -
> 
>   
> agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyRepository.java
>  065120f84 
>   security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java 
> abb1b1013 
>   security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java 
> 0ab733c65 
>   security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java 
> 3d8a32977 
> 
> 
> Diff: https://reviews.apache.org/r/71724/diff/5/
> 
> 
> Testing
> ---
> 
> Passed all unit tests
> 
> 
> Thanks,
> 
> Abhay Kulkarni
> 
>

[jira] [Commented] (RANGER-1429) Ranger Audit solrconfig.xml optimizations

[Kevin Risden (Jira)]

[ 
https://issues.apache.org/jira/browse/RANGER-1429?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16970869#comment-16970869
 ] 

Kevin Risden commented on RANGER-1429:
--

It looks like this still patch is still applicable to current Solr configs for 
Ranger. Spellcheck in a thread used to be an issue (not sure if it was fixed in 
Solr itself). Either way, if Ranger doesn't need spellcheck seems like an easy 
win.

[~aarrieta] have you run into this as well? Specifically around infra-solr? 
This seems like a reasonable suggestion to prevent spell check for the 
collection. 

[~vel] not sure if spell check is used in Ranger anywhere. I don't have any 
examples off the top of my head. 

> Ranger Audit solrconfig.xml optimizations
> -
>
> Key: RANGER-1429
> URL: https://issues.apache.org/jira/browse/RANGER-1429
> Project: Ranger
>  Issue Type: Bug
>  Components: audit
>Affects Versions: 0.7.0
>Reporter: Greg Senia
>Priority: Major
> Attachments: RANGER-1429.patch
>
>
> When using SolrCloud and having a single shard single replica with a large 
> number of audit records 20GB for 2 weeks. It takes Solr a very long time to 
> open up the replica for work. After doing some research I determine via 
> thread dumps that on the first request to the Solr Collection it kicks off a 
> Suggestion thread and a SpellCheck thread. I propose removing these as it 
> does not seem to impact RangerAudit and solves the issue of Solr 
> ranger_audits collection being unavailable after solr startup.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)