Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[#5336] feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compatible for existing ranger policy #5629

Merged
merged 15 commits into from
Nov 27, 2024
Merged

[#5336] feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compatible for existing ranger policy #5629

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
642983d
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 20, 2024
77e7d68
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 21, 2024
280e0ce
Merge branch 'main' into issues_5336
theoryxu Nov 21, 2024
85a60e5
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 21, 2024
2277d5b
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 21, 2024
ddcd2c4
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 22, 2024
81a5533
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 25, 2024
b8063aa
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 25, 2024
fbd9fc4
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 25, 2024
552f08e
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 26, 2024
190fb26
Merge branch 'main' into issues_5336
theoryxu Nov 26, 2024
c773e5b
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 26, 2024
03e2c39
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 26, 2024
c59749f
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 27, 2024
a67359b
[#5336]feat(auth-ranger): Remove MANAGED_BY_GRAVITINO limit and compa…
Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 13 additions & 14 deletions ...rization-ranger/src/main/java/org/apache/gravitino/authorization/ranger/RangerHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,9 @@ public RangerHelper(
*/
void checkPolicyItemAccess(RangerPolicy.RangerPolicyItem policyItem)
throws AuthorizationPluginException {
if (!isGravitinoManagedPolicyItemAccess(policyItem)) {
return;
theoryxu marked this conversation as resolved.
Show resolved Hide resolved
}
if (policyItem.getAccesses().size() != 1) {
throw new AuthorizationPluginException(
"The access type only have one in the delegate Gravitino management policy");
Expand Down Expand Up @@ -124,7 +127,9 @@ void addPolicyItem(RangerPolicy policy, String roleName, RangerSecurableObject s
policyItem -> {
return policyItem.getAccesses().stream()
.anyMatch(
access -> access.getType().equals(rangerPrivilege.getName()));
access ->
access.getType().equals(rangerPrivilege.getName())
&& isGravitinoManagedPolicyItemAccess(policyItem));
})
.collect(Collectors.toList());
} else {
Expand All @@ -134,7 +139,9 @@ void addPolicyItem(RangerPolicy policy, String roleName, RangerSecurableObject s
policyItem -> {
return policyItem.getAccesses().stream()
.anyMatch(
access -> access.getType().equals(rangerPrivilege.getName()));
access ->
access.getType().equals(rangerPrivilege.getName())
&& isGravitinoManagedPolicyItemAccess(policyItem));
})
.collect(Collectors.toList());
}
Expand Down Expand Up @@ -238,18 +245,10 @@ public RangerPolicy findManagedPolicy(RangerMetadataObject rangerMetadataObject)

RangerPolicy policy = policies.get(0);
// Delegating Gravitino management policies cannot contain duplicate privilege
policy.getPolicyItems().stream()
.filter(this::isGravitinoManagedPolicyItemAccess)
.forEach(this::checkPolicyItemAccess);
policy.getDenyPolicyItems().stream()
.filter(this::isGravitinoManagedPolicyItemAccess)
.forEach(this::checkPolicyItemAccess);
policy.getRowFilterPolicyItems().stream()
.filter(this::isGravitinoManagedPolicyItemAccess)
.forEach(this::checkPolicyItemAccess);
policy.getDataMaskPolicyItems().stream()
.filter(this::isGravitinoManagedPolicyItemAccess)
.forEach(this::checkPolicyItemAccess);
policy.getPolicyItems().forEach(this::checkPolicyItemAccess);
policy.getDenyPolicyItems().forEach(this::checkPolicyItemAccess);
policy.getRowFilterPolicyItems().forEach(this::checkPolicyItemAccess);
policy.getDataMaskPolicyItems().forEach(this::checkPolicyItemAccess);

return policy;
}
Expand Down
119 changes: 92 additions & 27 deletions ...rc/test/java/org/apache/gravitino/authorization/ranger/integration/test/RangerHiveIT.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,9 @@
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import java.util.concurrent.atomic.AtomicReference;
import java.util.stream.Collectors;
import org.apache.gravitino.MetadataObject;
import org.apache.gravitino.MetadataObjects;
import org.apache.gravitino.authorization.MetadataObjectChange;
Expand Down Expand Up @@ -355,7 +357,7 @@ public void testFindManagedPolicy() {
}

@Test
public void testGravitinoAddItemsToExistingPolicy() {
public void testGravitinoCompatibleWithExistingPolicy() {
RoleEntity role = mock3TableRole(currentFunName());
role.securableObjects().stream()
.forEach(
Expand All @@ -368,8 +370,66 @@ public void testGravitinoAddItemsToExistingPolicy() {
// Manual create the Ranger Policy
createHivePolicy(Lists.newArrayList(names), DOT_JOINER.join(names));
});
// Use role to create Ranger Policy
Assertions.assertTrue(rangerAuthHivePlugin.onRoleCreated(role));
List<String> existingPolicyNames =
findRoleResourceRelatedPolicies(role).stream()
.map(RangerPolicy::getName)
.collect(Collectors.toList());
rangerAuthHivePlugin.onRoleCreated(role);
findRoleResourceRelatedPolicies(role)
.forEach(
policy -> {
List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<>();
policyItems.addAll(policy.getPolicyItems());
policyItems.addAll(policy.getDenyPolicyItems());
policyItems.addAll(policy.getRowFilterPolicyItems());
policyItems.addAll(policy.getDataMaskPolicyItems());

if (existingPolicyNames.contains(policy.getName())) {
Assertions.assertTrue(
policyItems.stream()
.anyMatch(
i ->
theoryxu marked this conversation as resolved.
Show resolved Hide resolved
!i.getRoles()
.contains(
rangerHelper.generateGravitinoRoleName(role.name()))));
}
Assertions.assertTrue(
policyItems.stream()
.anyMatch(
i ->
theoryxu marked this conversation as resolved.
Show resolved Hide resolved
i.getRoles()
.contains(rangerHelper.generateGravitinoRoleName(role.name()))));
});

rangerAuthHivePlugin.onRoleDeleted(role);
findRoleResourceRelatedPolicies(role)
.forEach(
policy -> {
List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<>();
policyItems.addAll(policy.getPolicyItems());
policyItems.addAll(policy.getDenyPolicyItems());
policyItems.addAll(policy.getRowFilterPolicyItems());
policyItems.addAll(policy.getDataMaskPolicyItems());

if (existingPolicyNames.contains(policy.getName())) {
Assertions.assertFalse(
policyItems.stream()
.anyMatch(
i ->
theoryxu marked this conversation as resolved.
Show resolved Hide resolved
i.getRoles()
.contains(
rangerHelper.generateGravitinoRoleName(role.name()))));
Assertions.assertTrue(
policyItems.stream()
.anyMatch(
i ->
theoryxu marked this conversation as resolved.
Show resolved Hide resolved
!i.getRoles()
.contains(
rangerHelper.generateGravitinoRoleName(role.name()))));
} else {
Assertions.assertEquals(0, policyItems.size());
}
});
}

static void createHivePolicy(List<String> metaObjects, String roleName) {
Expand Down Expand Up @@ -1151,34 +1211,39 @@ public void testOnRevokedRolesFromGroup() {
}

private void assertFindManagedPolicyItems(Role role, boolean gravitinoPolicyItemExist) {
role.securableObjects().stream()
.forEach(
List<RangerPolicy> policies = findRoleResourceRelatedPolicies(role);

if (gravitinoPolicyItemExist) {
Assertions.assertTrue(policies.size() > 0);
}

policies.forEach(
policy -> {
List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<>();
policyItems.addAll(policy.getPolicyItems());
policyItems.addAll(policy.getDenyPolicyItems());
policyItems.addAll(policy.getRowFilterPolicyItems());
policyItems.addAll(policy.getDataMaskPolicyItems());
if (gravitinoPolicyItemExist) {
Assertions.assertTrue(hasGravitinoManagedPolicyItemAccess(policyItems, role.name()));
} else {
Assertions.assertFalse(hasGravitinoManagedPolicyItemAccess(policyItems, role.name()));
}
});
}

private List<RangerPolicy> findRoleResourceRelatedPolicies(Role role) {
return role.securableObjects().stream()
.flatMap(
securableObject ->
rangerAuthHivePlugin.translatePrivilege(securableObject).stream()
.forEach(
.map(
rangerSecurableObject -> {
LOG.info("rangerSecurableObject: " + rangerSecurableObject);
RangerPolicy policy =
rangerHelper.findManagedPolicy(rangerSecurableObject);
List<RangerPolicy.RangerPolicyItem> policyItems = new ArrayList<>();
if (policy != null) {
policyItems.addAll(policy.getPolicyItems());
policyItems.addAll(policy.getDenyPolicyItems());
policyItems.addAll(policy.getRowFilterPolicyItems());
policyItems.addAll(policy.getDataMaskPolicyItems());
}

if (gravitinoPolicyItemExist) {
Assertions.assertNotNull(policy);
Assertions.assertTrue(
hasGravitinoManagedPolicyItemAccess(policyItems, role.name()));
} else {
Assertions.assertTrue(
(policy == null)
|| !hasGravitinoManagedPolicyItemAccess(
policyItems, role.name()));
}
}));
return rangerHelper.findManagedPolicy(rangerSecurableObject);
}))
.filter(Objects::nonNull)
.collect(Collectors.toList());
}

public boolean hasGravitinoManagedPolicyItemAccess(
Expand Down
Loading