Skip to content

Commit 63d5aab

Browse files
mneethirajmneethiraj
authored
RANGER-5529: RangerAuthorizer update to be REST friendly (#890)
1 parent 15ffb04 commit 63d5aab

6 files changed

Lines changed: 130 additions & 23 deletions

File tree

‎authz-api/src/main/java/org/apache/ranger/authz/api/RangerAuthorizer.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.apache.ranger.authz.model.RangerMultiAuthzResult;
2929
import org.apache.ranger.authz.model.RangerResourceInfo;
3030
import org.apache.ranger.authz.model.RangerResourcePermissions;
31+
import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
3132
import org.apache.ranger.authz.model.RangerUserInfo;
3233

3334
import java.util.HashMap;
@@ -56,7 +57,7 @@ protected RangerAuthorizer(Properties properties) {
5657

5758
public abstract RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws RangerAuthzException;
5859

59-
public abstract RangerResourcePermissions getResourcePermissions(RangerResourceInfo resource, RangerAccessContext context) throws RangerAuthzException;
60+
public abstract RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) throws RangerAuthzException;
6061

6162
protected void validateRequest(RangerAuthzRequest request) throws RangerAuthzException {
6263
validateUserInfo(request.getUser());
@@ -78,6 +79,11 @@ protected void validateRequest(RangerMultiAuthzRequest request) throws RangerAut
7879
validateAccessContext(request.getContext());
7980
}
8081

82+
protected void validateRequest(RangerResourcePermissionsRequest request) throws RangerAuthzException {
83+
validateResourceInfo(request.getResource());
84+
validateAccessContext(request.getContext());
85+
}
86+
8187
protected void validateUserInfo(RangerUserInfo user) throws RangerAuthzException {
8288
if (user == null || StringUtils.isBlank(user.getName())) {
8389
throw new RangerAuthzException(INVALID_REQUEST_USER_INFO_MISSING);

‎authz-api/src/main/java/org/apache/ranger/authz/model/RangerResourcePermissionsRequest.java‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
20+
package org.apache.ranger.authz.model;
21+
22+
import com.fasterxml.jackson.annotation.JsonAutoDetect;
23+
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
24+
import com.fasterxml.jackson.annotation.JsonInclude;
25+
26+
import java.util.Objects;
27+
28+
@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
29+
@JsonInclude(JsonInclude.Include.NON_EMPTY)
30+
@JsonIgnoreProperties(ignoreUnknown = true)
31+
public class RangerResourcePermissionsRequest {
32+
private String requestId;
33+
private RangerResourceInfo resource;
34+
private RangerAccessContext context;
35+
36+
public RangerResourcePermissionsRequest() {
37+
}
38+
39+
public RangerResourcePermissionsRequest(RangerResourceInfo resource, RangerAccessContext context) {
40+
this(null, resource, context);
41+
}
42+
43+
public RangerResourcePermissionsRequest(String requestId, RangerResourceInfo resource, RangerAccessContext context) {
44+
this.requestId = requestId;
45+
this.resource = resource;
46+
this.context = context;
47+
}
48+
49+
public String getRequestId() {
50+
return requestId;
51+
}
52+
53+
public void setRequestId(String requestId) {
54+
this.requestId = requestId;
55+
}
56+
57+
public RangerResourceInfo getResource() {
58+
return resource;
59+
}
60+
61+
public void setResource(RangerResourceInfo resource) {
62+
this.resource = resource;
63+
}
64+
65+
public RangerAccessContext getContext() {
66+
return context;
67+
}
68+
69+
public void setContext(RangerAccessContext context) {
70+
this.context = context;
71+
}
72+
73+
@Override
74+
public int hashCode() {
75+
return Objects.hash(requestId, resource, context);
76+
}
77+
78+
@Override
79+
public boolean equals(Object o) {
80+
if (this == o) {
81+
return true;
82+
} else if (o == null || getClass() != o.getClass()) {
83+
return false;
84+
}
85+
86+
RangerResourcePermissionsRequest that = (RangerResourcePermissionsRequest) o;
87+
88+
return Objects.equals(requestId, that.requestId) &&
89+
Objects.equals(resource, that.resource) &&
90+
Objects.equals(context, that.context);
91+
}
92+
93+
@Override
94+
public String toString() {
95+
return "RangerResourcePermissionsRequest{" +
96+
"requestId='" + requestId + '\'' +
97+
", resource=" + resource +
98+
", context=" + context +
99+
'}';
100+
}
101+
}

‎authz-api/src/test/java/org/apache/ranger/authz/DummyAuthorizer.java‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,12 @@
2020
package org.apache.ranger.authz;
2121

2222
import org.apache.ranger.authz.api.RangerAuthorizer;
23-
import org.apache.ranger.authz.model.RangerAccessContext;
2423
import org.apache.ranger.authz.model.RangerAuthzRequest;
2524
import org.apache.ranger.authz.model.RangerAuthzResult;
2625
import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
2726
import org.apache.ranger.authz.model.RangerMultiAuthzResult;
28-
import org.apache.ranger.authz.model.RangerResourceInfo;
2927
import org.apache.ranger.authz.model.RangerResourcePermissions;
28+
import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
3029

3130
import java.util.Properties;
3231

@@ -54,7 +53,7 @@ public RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) {
5453
}
5554

5655
@Override
57-
public RangerResourcePermissions getResourcePermissions(RangerResourceInfo resource, RangerAccessContext context) {
56+
public RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) {
5857
return null;
5958
}
6059
}

‎authz-embedded/src/main/java/org/apache/ranger/authz/embedded/RangerAuthzPlugin.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@
3535
import org.apache.ranger.authz.model.RangerAuthzResult.PolicyInfo;
3636
import org.apache.ranger.authz.model.RangerAuthzResult.ResultInfo;
3737
import org.apache.ranger.authz.model.RangerAuthzResult.RowFilterResult;
38-
import org.apache.ranger.authz.model.RangerResourceInfo;
3938
import org.apache.ranger.authz.model.RangerResourcePermissions;
39+
import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
4040
import org.apache.ranger.authz.model.RangerUserInfo;
4141
import org.apache.ranger.authz.util.RangerResourceNameParser;
4242
import org.apache.ranger.plugin.model.RangerPolicy;
@@ -64,7 +64,7 @@
6464
import static org.apache.ranger.plugin.policyevaluator.RangerPolicyEvaluator.ACCESS_CONDITIONAL;
6565
import static org.apache.ranger.plugin.policyevaluator.RangerPolicyEvaluator.ACCESS_DENIED;
6666

67-
public class RangerAuthzPlugin {
67+
class RangerAuthzPlugin {
6868
private static final Logger LOG = LoggerFactory.getLogger(RangerAuthzPlugin.class);
6969

7070
private final RangerBasePlugin plugin;
@@ -154,15 +154,15 @@ public RangerAuthzResult authorize(RangerAuthzRequest request, RangerAuthzAuditH
154154
return ret;
155155
}
156156

157-
public RangerResourcePermissions getResourcePermissions(RangerResourceInfo resource, RangerAccessContext context) throws RangerAuthzException {
158-
RangerResourcePermissions ret = new RangerResourcePermissions();
159-
RangerAccessRequestImpl request = new RangerAccessRequestImpl();
157+
public RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) throws RangerAuthzException {
158+
RangerResourcePermissions ret = new RangerResourcePermissions();
159+
RangerAccessRequestImpl req = new RangerAccessRequestImpl();
160160

161-
ret.setResource(resource);
162-
request.setResource(getResource(resource.getName(), null));
163-
initializeRequest(request, null, context);
161+
ret.setResource(request.getResource());
162+
req.setResource(getResource(request.getResource().getName(), null));
163+
initializeRequest(req, null, request.getContext());
164164

165-
RangerResourceACLs acls = plugin.getResourceACLs(request);
165+
RangerResourceACLs acls = plugin.getResourceACLs(req);
166166

167167
if (acls != null) {
168168
for (Map.Entry<String, Map<String, RangerResourceACLs.AccessResult>> entry : acls.getUserACLs().entrySet()) {

‎authz-embedded/src/main/java/org/apache/ranger/authz/embedded/RangerEmbeddedAuthorizer.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@
3030
import org.apache.ranger.authz.model.RangerAuthzResult.AccessDecision;
3131
import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
3232
import org.apache.ranger.authz.model.RangerMultiAuthzResult;
33-
import org.apache.ranger.authz.model.RangerResourceInfo;
3433
import org.apache.ranger.authz.model.RangerResourcePermissions;
34+
import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
3535
import org.slf4j.Logger;
3636
import org.slf4j.LoggerFactory;
3737

@@ -106,29 +106,29 @@ public RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws
106106
}
107107
}
108108

109-
public RangerAuthzResult authorize(RangerAuthzRequest request, RangerAuthzAuditHandler auditHandler) throws RangerAuthzException {
109+
@Override
110+
public RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) throws RangerAuthzException {
110111
validateRequest(request);
111112

112113
RangerAuthzPlugin plugin = getOrCreatePlugin(request.getContext().getServiceName(), request.getContext().getServiceType());
113114

114-
return authorize(request, plugin, auditHandler);
115+
return plugin.getResourcePermissions(request);
115116
}
116117

117-
public RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request, RangerAuthzAuditHandler auditHandler) throws RangerAuthzException {
118+
public RangerAuthzResult authorize(RangerAuthzRequest request, RangerAuthzAuditHandler auditHandler) throws RangerAuthzException {
118119
validateRequest(request);
119120

120121
RangerAuthzPlugin plugin = getOrCreatePlugin(request.getContext().getServiceName(), request.getContext().getServiceType());
121122

122123
return authorize(request, plugin, auditHandler);
123124
}
124125

125-
@Override
126-
public RangerResourcePermissions getResourcePermissions(RangerResourceInfo resource, RangerAccessContext context) throws RangerAuthzException {
127-
validateAccessContext(context);
126+
public RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request, RangerAuthzAuditHandler auditHandler) throws RangerAuthzException {
127+
validateRequest(request);
128128

129-
RangerAuthzPlugin plugin = getOrCreatePlugin(context.getServiceName(), context.getServiceType());
129+
RangerAuthzPlugin plugin = getOrCreatePlugin(request.getContext().getServiceName(), request.getContext().getServiceType());
130130

131-
return plugin.getResourcePermissions(resource, context);
131+
return authorize(request, plugin, auditHandler);
132132
}
133133

134134
@Override

‎authz-embedded/src/test/java/org/apache/ranger/authz/embedded/TestEmbeddedAuthorizer.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import org.apache.ranger.authz.model.RangerMultiAuthzResult;
3131
import org.apache.ranger.authz.model.RangerResourceInfo;
3232
import org.apache.ranger.authz.model.RangerResourcePermissions;
33+
import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
3334
import org.junit.jupiter.api.Test;
3435

3536
import java.io.InputStream;
@@ -86,7 +87,7 @@ private void runResourcePermissionsTest(String testName) throws Exception {
8687
continue;
8788
}
8889

89-
RangerResourcePermissions permissions = authorizer.getResourcePermissions(test.resource, test.context);
90+
RangerResourcePermissions permissions = authorizer.getResourcePermissions(new RangerResourcePermissionsRequest(test.resource, test.context));
9091

9192
assertEquals(test.permissions, permissions, "Resource permissions do not match for resource=" + test.resource);
9293
}

0 commit comments

Comments
 (0)