Re: Review Request 60421: RANGER-1491 : Automatically map group of external users to Administrator Role

2017-08-10 Thread Sailaja Polavarapu 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/60421/#review182623
---


Ship it!




Ship It!

- Sailaja Polavarapu


On Aug. 7, 2017, 2:59 p.m., bhavik patel wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/60421/
> ---
> 
> (Updated Aug. 7, 2017, 2:59 p.m.)
> 
> 
> Review request for ranger, Ankita Sinha, Don Bosco Durai, Gautam Borad, Abhay 
> Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan 
> Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
> 
> 
> Bugs: RANGER-1491
> https://issues.apache.org/jira/browse/RANGER-1491
> 
> 
> Repository: ranger
> 
> 
> Description
> ---
> 
> Currently when Ranger connect to external LDAP server than users are 
> synchronised and they will get default as "User" role.
> 
> It would be a good feature to introduce a mechanism to automatically map 
> certain users (e.g. they are in a specific group) to "Administrator" or 
> "Keyadmin" role rather than setting as default "User" role.
> 
> 
> Diffs
> -
> 
>   security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java 6f77832 
>   security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java ca06805 
>   security-admin/src/main/java/org/apache/ranger/service/XUserService.java 
> de95138 
>   security-admin/src/main/java/org/apache/ranger/view/VXUser.java ecfd1ac 
>   security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 5e0ca20 
>   security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java 
> 9846f67 
>   
> ugsync/src/main/java/org/apache/ranger/ldapusersync/process/LdapPolicyMgrUserGroupBuilder.java
>  428ad30 
>   
> ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
>  19343b2 
>   ugsync/src/main/java/org/apache/ranger/unixusersync/model/XUserInfo.java 
> 7d636fd 
>   
> ugsync/src/main/java/org/apache/ranger/unixusersync/process/PolicyMgrUserGroupBuilder.java
>  9ce4abf 
>   unixauthservice/scripts/install.properties 00ddef5 
>   unixauthservice/scripts/setup.py bbc9226 
>   unixauthservice/scripts/templates/installprop2xml.properties fc69f36 
>   unixauthservice/scripts/templates/ranger-ugsync-template.xml 5321dc6 
> 
> 
> Diff: https://reviews.apache.org/r/60421/diff/4/
> 
> 
> Testing
> ---
> 
> 1. Verified when ranger-admin connect to LDAP server than users are 
> synchronised form there they got same role which is specified in 
> usersync-side.
> 2. Verified unix authentication and usersync.
> 
> 
> Thanks,
> 
> bhavik patel
> 
>

Re: Review Request 60421: RANGER-1491 : Automatically map group of external users to Administrator Role

2017-08-07 Thread bhavik patel 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/60421/
---

(Updated Aug. 7, 2017, 2:59 p.m.)


Review request for ranger, Ankita Sinha, Don Bosco Durai, Gautam Borad, Abhay 
Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, 
Sailaja Polavarapu, and Velmurugan Periasamy.


Changes
---

Initial plan was to provide feature of setting roles for different users for 
sync source = LDAP. Extending implementation to provide same feature for all 
External users(sync source = LDAP / AD / UNIX / File).


Bugs: RANGER-1491
https://issues.apache.org/jira/browse/RANGER-1491


Repository: ranger


Description
---

Currently when Ranger connect to external LDAP server than users are 
synchronised and they will get default as "User" role.

It would be a good feature to introduce a mechanism to automatically map 
certain users (e.g. they are in a specific group) to "Administrator" or 
"Keyadmin" role rather than setting as default "User" role.


Diffs (updated)
-

  security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java 6f77832 
  security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java ca06805 
  security-admin/src/main/java/org/apache/ranger/service/XUserService.java 
de95138 
  security-admin/src/main/java/org/apache/ranger/view/VXUser.java ecfd1ac 
  security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 5e0ca20 
  security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java 9846f67 
  
ugsync/src/main/java/org/apache/ranger/ldapusersync/process/LdapPolicyMgrUserGroupBuilder.java
 428ad30 
  
ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
 19343b2 
  ugsync/src/main/java/org/apache/ranger/unixusersync/model/XUserInfo.java 
7d636fd 
  
ugsync/src/main/java/org/apache/ranger/unixusersync/process/PolicyMgrUserGroupBuilder.java
 9ce4abf 
  unixauthservice/scripts/install.properties 00ddef5 
  unixauthservice/scripts/setup.py bbc9226 
  unixauthservice/scripts/templates/installprop2xml.properties fc69f36 
  unixauthservice/scripts/templates/ranger-ugsync-template.xml 5321dc6 


Diff: https://reviews.apache.org/r/60421/diff/4/

Changes: https://reviews.apache.org/r/60421/diff/3-4/


Testing
---

1. Verified when ranger-admin connect to LDAP server than users are 
synchronised form there they got same role which is specified in usersync-side.
2. Verified unix authentication and usersync.


Thanks,

bhavik patel

Re: Review Request 60421: RANGER-1491 : Automatically map group of external users to Administrator Role

2017-07-18 Thread bhavik patel 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/60421/
---

(Updated July 19, 2017, 5:52 a.m.)


Review request for ranger, Ankita Sinha, Don Bosco Durai, Gautam Borad, Abhay 
Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, 
Sailaja Polavarapu, and Velmurugan Periasamy.


Changes
---

Updated the patch as per the latest commit.


Bugs: RANGER-1491
https://issues.apache.org/jira/browse/RANGER-1491


Repository: ranger


Description
---

Currently when Ranger connect to external LDAP server than users are 
synchronised and they will get default as "User" role.

It would be a good feature to introduce a mechanism to automatically map 
certain users (e.g. they are in a specific group) to "Administrator" or 
"Keyadmin" role rather than setting as default "User" role.


Diffs (updated)
-

  security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java 6f77832 
  security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java ca06805 
  security-admin/src/main/java/org/apache/ranger/service/XUserService.java 
de95138 
  security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 5e0ca20 
  security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java 9846f67 
  
ugsync/src/main/java/org/apache/ranger/ldapusersync/process/LdapPolicyMgrUserGroupBuilder.java
 428ad30 
  
ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
 19343b2 
  ugsync/src/main/java/org/apache/ranger/unixusersync/model/MUserInfo.java 
841bac6 
  ugsync/src/main/java/org/apache/ranger/unixusersync/model/XUserInfo.java 
7d636fd 
  unixauthservice/scripts/install.properties 00ddef5 
  unixauthservice/scripts/setup.py bbc9226 
  unixauthservice/scripts/templates/installprop2xml.properties fc69f36 
  unixauthservice/scripts/templates/ranger-ugsync-template.xml 5321dc6 


Diff: https://reviews.apache.org/r/60421/diff/3/

Changes: https://reviews.apache.org/r/60421/diff/2-3/


Testing
---

1. Verified when ranger-admin connect to LDAP server than users are 
synchronised form there they got same role which is specified in usersync-side.
2. Verified unix authentication and usersync.


Thanks,

bhavik patel

Re: Review Request 60421: RANGER-1491 : Automatically map group of external users to Administrator Role

2017-07-18 Thread Velmurugan Periasamy 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/60421/#review180900
---




unixauthservice/scripts/templates/installprop2xml.properties
Line 14 (original), 14 (patched)


Patch fails to apply. Can you update the patch?

$ git apply --check -v < ~/Downloads/RANGER-1491-master-02.patch
Checking patch 
security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java...
Checking patch 
security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java...
Hunk #2 succeeded at 563 (offset -3 lines).
Hunk #3 succeeded at 574 (offset -3 lines).
Hunk #4 succeeded at 618 (offset -3 lines).
Hunk #5 succeeded at 1291 (offset -3 lines).
Checking patch 
security-admin/src/main/java/org/apache/ranger/service/XUserService.java...
Checking patch 
security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java...
Checking patch 
security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java...
Checking patch 
ugsync/src/main/java/org/apache/ranger/ldapusersync/process/LdapPolicyMgrUserGroupBuilder.java...
Checking patch 
ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java...
Checking patch 
ugsync/src/main/java/org/apache/ranger/unixusersync/model/MUserInfo.java...
Checking patch 
ugsync/src/main/java/org/apache/ranger/unixusersync/model/XUserInfo.java...
Checking patch unixauthservice/scripts/install.properties...
Hunk #1 succeeded at 69 (offset 4 lines).
Checking patch unixauthservice/scripts/setup.py...
Checking patch 
unixauthservice/scripts/templates/installprop2xml.properties...
error: while searching for:
POLICY_MGR_URL =  ranger.usersync.policymanager.baseURL
MIN_UNIX_USER_ID_TO_SYNC = ranger.usersync.unix.minUserId
SYNC_INTERVAL = ranger.usersync.sleeptimeinmillisbetweensynccycle
SYNC_LDAP_URL = ranger.usersync.ldap.url
SYNC_LDAP_BIND_DN = ranger.usersync.ldap.binddn
SYNC_LDAP_BIND_PASSWORD = ranger.usersync.ldap.ldapbindpassword

error: patch failed: 
unixauthservice/scripts/templates/installprop2xml.properties:16
error: unixauthservice/scripts/templates/installprop2xml.properties: patch 
does not apply
Checking patch 
unixauthservice/scripts/templates/ranger-ugsync-template.xml...
Hunk #1 succeeded at 209 (offset 4 lines).


- Velmurugan Periasamy


On July 11, 2017, 5:52 a.m., bhavik patel wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/60421/
> ---
> 
> (Updated July 11, 2017, 5:52 a.m.)
> 
> 
> Review request for ranger, Ankita Sinha, Don Bosco Durai, Gautam Borad, Abhay 
> Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan 
> Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
> 
> 
> Bugs: RANGER-1491
> https://issues.apache.org/jira/browse/RANGER-1491
> 
> 
> Repository: ranger
> 
> 
> Description
> ---
> 
> Currently when Ranger connect to external LDAP server than users are 
> synchronised and they will get default as "User" role.
> 
> It would be a good feature to introduce a mechanism to automatically map 
> certain users (e.g. they are in a specific group) to "Administrator" or 
> "Keyadmin" role rather than setting as default "User" role.
> 
> 
> Diffs
> -
> 
>   security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java 6f77832 
>   security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java b973b9a 
>   security-admin/src/main/java/org/apache/ranger/service/XUserService.java 
> de95138 
>   security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 5e0ca20 
>   security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java 
> 9846f67 
>   
> ugsync/src/main/java/org/apache/ranger/ldapusersync/process/LdapPolicyMgrUserGroupBuilder.java
>  428ad30 
>   
> ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
>  19343b2 
>   ugsync/src/main/java/org/apache/ranger/unixusersync/model/MUserInfo.java 
> 841bac6 
>   ugsync/src/main/java/org/apache/ranger/unixusersync/model/XUserInfo.java 
> 7d636fd 
>   unixauthservice/scripts/install.properties 13ae1e5 
>   unixauthservice/scripts/setup.py bbc9226 
>   unixauthservice/scripts/templates/installprop2xml.properties 1a9bf36 
>   unixauthservice/scripts/templates/ranger-ugsync-template.xml 0025dc8 
> 
> 
> Diff: https://reviews.apache.org/r/60421/diff/2/
> 
> 
> Testing
> ---
> 
> 1. Verified when ranger-admin connect to LDAP server than users are 
> synchronised form there they got same role which is specified in 
> usersync-side.
> 2. Verified unix authentication and usersync.
> 
> 
> Thanks,
> 
> bhavik patel
> 
>

Re: Review Request 60421: RANGER-1491 : Automatically map group of external users to Administrator Role

2017-07-11 Thread bhavik patel 


> On July 10, 2017, 6:52 a.m., Velmurugan Periasamy wrote:
> > security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
> > Lines 1160 (patched)
> > 
> >
> > single return from the method would be better. Also no exceptions are 
> > handled here.

Updated to single return. Already we are checking for null conditions so no 
need to handle any exceptions.


- bhavik


---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/60421/#review180010
---


On July 11, 2017, 5:52 a.m., bhavik patel wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/60421/
> ---
> 
> (Updated July 11, 2017, 5:52 a.m.)
> 
> 
> Review request for ranger, Ankita Sinha, Don Bosco Durai, Gautam Borad, Abhay 
> Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan 
> Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
> 
> 
> Bugs: RANGER-1491
> https://issues.apache.org/jira/browse/RANGER-1491
> 
> 
> Repository: ranger
> 
> 
> Description
> ---
> 
> Currently when Ranger connect to external LDAP server than users are 
> synchronised and they will get default as "User" role.
> 
> It would be a good feature to introduce a mechanism to automatically map 
> certain users (e.g. they are in a specific group) to "Administrator" or 
> "Keyadmin" role rather than setting as default "User" role.
> 
> 
> Diffs
> -
> 
>   security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java 6f77832 
>   security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java b973b9a 
>   security-admin/src/main/java/org/apache/ranger/service/XUserService.java 
> de95138 
>   security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 5e0ca20 
>   security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java 
> 9846f67 
>   
> ugsync/src/main/java/org/apache/ranger/ldapusersync/process/LdapPolicyMgrUserGroupBuilder.java
>  428ad30 
>   
> ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
>  19343b2 
>   ugsync/src/main/java/org/apache/ranger/unixusersync/model/MUserInfo.java 
> 841bac6 
>   ugsync/src/main/java/org/apache/ranger/unixusersync/model/XUserInfo.java 
> 7d636fd 
>   unixauthservice/scripts/install.properties 13ae1e5 
>   unixauthservice/scripts/setup.py bbc9226 
>   unixauthservice/scripts/templates/installprop2xml.properties 1a9bf36 
>   unixauthservice/scripts/templates/ranger-ugsync-template.xml 0025dc8 
> 
> 
> Diff: https://reviews.apache.org/r/60421/diff/2/
> 
> 
> Testing
> ---
> 
> 1. Verified when ranger-admin connect to LDAP server than users are 
> synchronised form there they got same role which is specified in 
> usersync-side.
> 2. Verified unix authentication and usersync.
> 
> 
> Thanks,
> 
> bhavik patel
> 
>

Re: Review Request 60421: RANGER-1491 : Automatically map group of external users to Administrator Role

2017-07-10 Thread bhavik patel 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/60421/
---

(Updated July 11, 2017, 5:52 a.m.)


Review request for ranger, Ankita Sinha, Don Bosco Durai, Gautam Borad, Abhay 
Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan Neethiraj, 
Sailaja Polavarapu, and Velmurugan Periasamy.


Bugs: RANGER-1491
https://issues.apache.org/jira/browse/RANGER-1491


Repository: ranger


Description
---

Currently when Ranger connect to external LDAP server than users are 
synchronised and they will get default as "User" role.

It would be a good feature to introduce a mechanism to automatically map 
certain users (e.g. they are in a specific group) to "Administrator" or 
"Keyadmin" role rather than setting as default "User" role.


Diffs (updated)
-

  security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java 6f77832 
  security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java b973b9a 
  security-admin/src/main/java/org/apache/ranger/service/XUserService.java 
de95138 
  security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 5e0ca20 
  security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java 9846f67 
  
ugsync/src/main/java/org/apache/ranger/ldapusersync/process/LdapPolicyMgrUserGroupBuilder.java
 428ad30 
  
ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
 19343b2 
  ugsync/src/main/java/org/apache/ranger/unixusersync/model/MUserInfo.java 
841bac6 
  ugsync/src/main/java/org/apache/ranger/unixusersync/model/XUserInfo.java 
7d636fd 
  unixauthservice/scripts/install.properties 13ae1e5 
  unixauthservice/scripts/setup.py bbc9226 
  unixauthservice/scripts/templates/installprop2xml.properties 1a9bf36 
  unixauthservice/scripts/templates/ranger-ugsync-template.xml 0025dc8 


Diff: https://reviews.apache.org/r/60421/diff/2/

Changes: https://reviews.apache.org/r/60421/diff/1-2/


Testing
---

1. Verified when ranger-admin connect to LDAP server than users are 
synchronised form there they got same role which is specified in usersync-side.
2. Verified unix authentication and usersync.


Thanks,

bhavik patel

Re: Review Request 60421: RANGER-1491 : Automatically map group of external users to Administrator Role

2017-07-10 Thread Velmurugan Periasamy 

---
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/60421/#review180010
---




security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
Lines 1160 (patched)


single return from the method would be better. Also no exceptions are 
handled here.



security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
Lines 1169 (patched)


will this work if usersync user is customized? Also it would be a good idea 
to log debug messages for else condition, currently there is no clue if the 
execution falls on else condition.



security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
Line 1278 (original), 1298 (patched)


Logging else condition (allowing rangerusersync) would be helpful



unixauthservice/scripts/templates/ranger-ugsync-template.xml
Lines 209 (patched)


To be consistent, add prefix "ranger.usersync" to this new property



unixauthservice/scripts/templates/ranger-ugsync-template.xml
Lines 213 (patched)


To be consistent, add prefix "ranger.usersync" to this new property



unixauthservice/scripts/templates/ranger-ugsync-template.xml
Lines 217 (patched)


To be consistent, add prefix "ranger.usersync" to this new property



unixauthservice/scripts/templates/ranger-ugsync-template.xml
Lines 221 (patched)


To be consistent, add prefix "ranger.usersync" to this new property


- Velmurugan Periasamy


On June 26, 2017, 8:01 a.m., bhavik patel wrote:
> 
> ---
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/60421/
> ---
> 
> (Updated June 26, 2017, 8:01 a.m.)
> 
> 
> Review request for ranger, Ankita Sinha, Don Bosco Durai, Gautam Borad, Abhay 
> Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Selvamohan 
> Neethiraj, Sailaja Polavarapu, and Velmurugan Periasamy.
> 
> 
> Bugs: RANGER-1491
> https://issues.apache.org/jira/browse/RANGER-1491
> 
> 
> Repository: ranger
> 
> 
> Description
> ---
> 
> Currently when Ranger connect to external LDAP server than users are 
> synchronised and they will get default as "User" role.
> 
> It would be a good feature to introduce a mechanism to automatically map 
> certain users (e.g. they are in a specific group) to "Administrator" or 
> "Keyadmin" role rather than setting as default "User" role.
> 
> 
> Diffs
> -
> 
>   security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java 6f77832 
>   security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java cd1de9f 
>   security-admin/src/main/java/org/apache/ranger/service/XUserService.java 
> de95138 
>   security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java 5e0ca20 
>   security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java 
> 30525b3 
>   
> ugsync/src/main/java/org/apache/ranger/ldapusersync/process/LdapPolicyMgrUserGroupBuilder.java
>  428ad30 
>   
> ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
>  19343b2 
>   ugsync/src/main/java/org/apache/ranger/unixusersync/model/MUserInfo.java 
> 841bac6 
>   ugsync/src/main/java/org/apache/ranger/unixusersync/model/XUserInfo.java 
> 7d636fd 
>   unixauthservice/scripts/install.properties 13ae1e5 
>   unixauthservice/scripts/setup.py bbc9226 
>   unixauthservice/scripts/templates/installprop2xml.properties 1a9bf36 
>   unixauthservice/scripts/templates/ranger-ugsync-template.xml 0025dc8 
> 
> 
> Diff: https://reviews.apache.org/r/60421/diff/1/
> 
> 
> Testing
> ---
> 
> 1. Verified when ranger-admin connect to LDAP server than users are 
> synchronised form there they got same role which is specified in 
> usersync-side.
> 2. Verified unix authentication and usersync.
> 
> 
> Thanks,
> 
> bhavik patel
> 
>