This is an automated email from the ASF dual-hosted git repository.
dataroaring pushed a commit to branch branch-3.0
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-3.0 by this push:
new 9c19ac22f13 branch-3.0:[test](ranger) Init ranger case (#50079)
9c19ac22f13 is described below
commit 9c19ac22f13d742338ef9e09a261c3c815fd3fdc
Author: zgxme <[email protected]>
AuthorDate: Wed Apr 16 19:00:26 2025 +0800
branch-3.0:[test](ranger) Init ranger case (#50079)
### What problem does this PR solve?
bp: #48023 #49955 #49994
---
.../data/ranger_p2/test_ranger_masking.out | Bin 0 -> 4310 bytes
.../ranger_p2/test_ranger_row_level_filter.out | Bin 0 -> 3117 bytes
regression-test/framework/pom.xml | 5 +
.../doris/regression/action/HttpCliAction.groovy | 19 +-
regression-test/plugins/plugin_ranger.groovy | 86 +++++++
.../test_ranger_access_resource_catalog.groovy | 204 ++++++++++++++++
.../test_ranger_access_resource_column.groovy | 253 ++++++++++++++++++++
.../test_ranger_access_resource_database.groovy | 238 +++++++++++++++++++
.../test_ranger_access_resource_global.groovy | 165 +++++++++++++
.../test_ranger_access_resource_resource.groovy | 113 +++++++++
.../test_ranger_access_resource_table.groovy | 264 +++++++++++++++++++++
...st_ranger_access_resource_workload_group.groovy | 99 ++++++++
...test_ranger_access_role_resource_catalog.groovy | 204 ++++++++++++++++
.../suites/ranger_p2/test_ranger_masking.groovy | 194 +++++++++++++++
.../ranger_p2/test_ranger_row_level_filter.groovy | 174 ++++++++++++++
15 files changed, 2017 insertions(+), 1 deletion(-)
diff --git a/regression-test/data/ranger_p2/test_ranger_masking.out
b/regression-test/data/ranger_p2/test_ranger_masking.out
new file mode 100644
index 00000000000..2410c54f5e7
Binary files /dev/null and
b/regression-test/data/ranger_p2/test_ranger_masking.out differ
diff --git a/regression-test/data/ranger_p2/test_ranger_row_level_filter.out
b/regression-test/data/ranger_p2/test_ranger_row_level_filter.out
new file mode 100644
index 00000000000..0852bf5365b
Binary files /dev/null and
b/regression-test/data/ranger_p2/test_ranger_row_level_filter.out differ
diff --git a/regression-test/framework/pom.xml
b/regression-test/framework/pom.xml
index cad25df8ced..2a470fd2ea9 100644
--- a/regression-test/framework/pom.xml
+++ b/regression-test/framework/pom.xml
@@ -194,6 +194,11 @@ under the License.
<artifactId>kafka-clients</artifactId>
<version>2.8.1</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.ranger</groupId>
+ <artifactId>ranger-intg</artifactId>
+ <version>2.6.0</version>
+ </dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
diff --git
a/regression-test/framework/src/main/groovy/org/apache/doris/regression/action/HttpCliAction.groovy
b/regression-test/framework/src/main/groovy/org/apache/doris/regression/action/HttpCliAction.groovy
index 366905b31f5..16fa452c6eb 100644
---
a/regression-test/framework/src/main/groovy/org/apache/doris/regression/action/HttpCliAction.groovy
+++
b/regression-test/framework/src/main/groovy/org/apache/doris/regression/action/HttpCliAction.groovy
@@ -22,6 +22,7 @@ import groovy.transform.stc.ClosureParams
import groovy.transform.stc.FromString
import groovy.util.logging.Slf4j
import org.apache.doris.regression.suite.SuiteContext
+import org.apache.http.client.methods.HttpDelete
import org.apache.http.client.methods.HttpGet
import org.apache.http.entity.StringEntity
import org.apache.http.entity.ContentType
@@ -123,7 +124,23 @@ class HttpCliAction implements SuiteAction {
return new ActionResult(respCode, respJson)
}
}
- } else {
+ } else if (op == "delete") {
+ HttpDelete httpDelete = new
HttpDelete(uri)
+ for (final def header in
headers.entrySet()) {
+
httpDelete.setHeader(header.getKey(), header.getValue())
+ }
+
client.execute(httpDelete).withCloseable { resp ->
+ resp.withCloseable {
+ String respJson =
EntityUtils.toString(resp.getEntity())
+ def respCode =
resp.getStatusLine().getStatusCode()
+ if (printResponse) {
+
log.info("respCode: ${respCode}, respJson: ${respJson}")
+ }
+ return new
ActionResult(respCode, respJson)
+ }
+ }
+ }
+ else {
HttpPost httpPost = new HttpPost(uri)
for (final def header in headers.entrySet()) {
httpPost.setHeader(header.getKey(), header.getValue())
diff --git a/regression-test/plugins/plugin_ranger.groovy
b/regression-test/plugins/plugin_ranger.groovy
new file mode 100644
index 00000000000..77c4286eaee
--- /dev/null
+++ b/regression-test/plugins/plugin_ranger.groovy
@@ -0,0 +1,86 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import groovy.json.JsonOutput
+import org.apache.doris.regression.suite.Suite
+
+Suite.metaClass.createRangerUser = { String user, String password, String[]
roles ->
+ def jsonOutput = new JsonOutput()
+ def rangerEndpoint = context.config.otherConfigs.get("rangerEndpoint")
+ def rangerUser = context.config.otherConfigs.get("rangerUser")
+ def rangerPassword = context.config.otherConfigs.get("rangerPassword")
+ def map = [
+ "name":"${user}",
+ "firstName":"${user}",
+ "lastName": "${user}",
+ "loginId": "${user}",
+ "emailAddress" : null,
+ "description" : "${user} desc",
+ "password" : "${password}",
+ "status":1,
+ "isVisible":1,
+ "userRoleList": roles,
+ "userSource": 0]
+ def js = jsonOutput.toJson(map)
+ log.info("create user req: ${js} ".toString())
+ def createUserApi = { request_body, check_func ->
+ httpTest {
+ basicAuthorization "${rangerUser}","${rangerPassword}"
+ endpoint "${rangerEndpoint}"
+ uri "/service/xusers/secure/users"
+ body request_body
+ op "post"
+ check check_func
+ }
+ }
+
+ createUserApi.call(js) {
+ respCode, body ->
+ log.info("create user resp: ${body}
${respCode}".toString())
+ assertTrue(respCode == 200 || body.contains("Error
creating duplicate object"))
+ }
+}
+
+Suite.metaClass.dropRangerUser = { String userId ->
+ def rangerEndpoint = context.config.otherConfigs.get("rangerEndpoint")
+ def rangerUser = context.config.otherConfigs.get("rangerUser")
+ def rangerPassword = context.config.otherConfigs.get("rangerPassword")
+ def map = []
+ def jsonOutput = new JsonOutput()
+ def js = jsonOutput.toJson(map)
+ def dropUserApi = { check_func ->
+ httpTest {
+ basicAuthorization "${rangerUser}","${rangerPassword}"
+ endpoint "${rangerEndpoint}"
+ uri "/service/xusers/secure/users/${userId}"
+ op "delete"
+ body js
+ check check_func
+ }
+ }
+
+ dropUserApi.call {
+ respCode, body ->
+ log.info("drop user resp: ${body}
${respCode}".toString())
+ assertTrue(respCode == 204)
+ }
+}
+
+Suite.metaClass.waitPolicyEffect {
+ sleep(6000)
+ // TODO: check if policy is effective by API
+}
\ No newline at end of file
diff --git
a/regression-test/suites/ranger_p2/test_ranger_access_resource_catalog.groovy
b/regression-test/suites/ranger_p2/test_ranger_access_resource_catalog.groovy
new file mode 100644
index 00000000000..8faaf79358a
--- /dev/null
+++
b/regression-test/suites/ranger_p2/test_ranger_access_resource_catalog.groovy
@@ -0,0 +1,204 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+suite("test_ranger_access_resource_catalog", "p2,ranger,external") {
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+ def checkCatalogAccess = { catalogType, access, user, password,
catalog, dbName, tableName ->
+ connect("$user", "$password", "$defaultJdbcUrl") {
+ def executeSqlWithLogging = { sqlStatement,
errorMessage ->
+ try {
+ sql sqlStatement
+ } catch (Exception e) {
+ if (access == "allow") {
+ log.error("Error executing
${sqlStatement}: ${e.getMessage()}")
+ throw e
+ }
+ log.info("Error executing
${sqlStatement}: ${e.getMessage()}")
+ }
+ }
+ if (catalogType == "internal") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""DROP DATABASE IF
EXISTS ${dbName}""", "Error executing DROP DATABASE")
+ executeSqlWithLogging("""CREATE DATABASE IF NOT
EXISTS ${dbName}""", "Error executing CREATE DATABASE")
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ )
+ DISTRIBUTED BY HASH(id) BUCKETS 2
+ PROPERTIES (
+ "replication_num" = "1"
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""INSERT INTO
${dbName}.${tableName} VALUES (1, 'test')""", "Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""ALTER TABLE
${dbName}.${tableName} ADD COLUMN age INT""", "Error executing ALTER TABLE")
+ executeSqlWithLogging("""CREATE VIEW
${dbName}.test_view AS SELECT * FROM ${dbName}.${tableName}""", "Error
executing CREATE VIEW")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.test_view""", "Error executing SELECT VIEW")
+ executeSqlWithLogging("""SHOW CREATE VIEW
${dbName}.test_view""", "Error executing SHOW CREATE VIEW")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""DROP DATABASE
${dbName}""", "Error executing DROP DATABASE")
+ } else if (catalogType == "hive") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""CREATE DATABASE IF NOT
EXISTS ${dbName}""", "Error executing CREATE DATABASE")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ ) ENGINE=hive
+ PROPERTIES (
+ 'file_format'='parquet'
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""REFRESH CATALOG
${catalog}""", "Error executing REFRESH")
+ executeSqlWithLogging("""INSERT INTO
${dbName}.${tableName} VALUES (1, 'test')""", "Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""DROP DATABASE
${dbName}""", "Error executing DROP DATABASE")
+ } else if (catalogType == "jdbc") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'CREATE DATABASE IF NOT EXISTS ${dbName}')""", "Error executing
CREATE DATABASE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP TABLE IF EXISTS ${dbName}.${tableName}')""", "Error
executing DROP TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'CREATE TABLE IF NOT EXISTS ${dbName}.${tableName} (id BIGINT,
username VARCHAR(20))')""", "Error executing CREATE TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'INSERT INTO ${dbName}.${tableName} VALUES (1, ''test'')')""",
"Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'ALTER TABLE ${dbName}.${tableName} ADD COLUMN age INT')""",
"Error executing ALTER TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP TABLE IF EXISTS ${dbName}.${tableName}')""", "Error
executing DROP TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP DATABASE ${dbName}')""", "Error executing DROP DATABASE")
+ }
+ }
+ }
+
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String externalEnvIp = context.config.otherConfigs.get("externalEnvIp")
+ String HmsPort = context.config.otherConfigs.get("hive3HmsPort")
+ String jdbcUrl = context.config.jdbcUrl +
"&sessionVariables=return_object_data_as_binary=true"
+ String jdbcUser = context.config.jdbcUser
+ String jdbcPassword = context.config.jdbcPassword
+ String s3Endpoint = getS3Endpoint()
+ String bucket = getS3BucketName()
+ String driverUrl =
"https://${bucket}.${s3Endpoint}/regression/jdbc_driver/mysql-connector-java-8.0.25.jar";
+
+ if (enabled != null && enabled.equalsIgnoreCase("true")) {
+ String catalog1 = 'ranger_test_catalog_1'
+ String catalog2 = 'ranger_test_catalog_2'
+ // prepare catalog
+ sql """DROP CATALOG IF EXISTS ${catalog1}"""
+ sql """DROP CATALOG IF EXISTS ${catalog2}"""
+ sql """CREATE CATALOG `${catalog1}` PROPERTIES (
+ "type"="hms",
+ 'hive.metastore.uris' =
'thrift://${externalEnvIp}:${HmsPort}'
+ )"""
+
+ sql """ CREATE CATALOG `${catalog2}` PROPERTIES (
+ "user" = "${jdbcUser}",
+ "type" = "jdbc",
+ "password" = "${jdbcPassword}",
+ "jdbc_url" = "${jdbcUrl}",
+ "driver_url" = "${driverUrl}",
+ "driver_class" = "com.mysql.cj.jdbc.Driver"
+ )"""
+ // prepare doris user
+ List<String> userList = ['ranger_test_catalog_user_1',
'ranger_test_catalog_user_2', 'ranger_test_catalog_user_3']
+ String pwd = 'C123_567p'
+ userList.forEach {
+ sql """DROP USER IF EXISTS ${it}"""
+ sql """CREATE USER '${it}' IDENTIFIED BY '${pwd}'"""
+ }
+ // prepare ranger user
+ createRangerUser(userList[0], pwd, ["ROLE_USER"] as String[])
+
+ // case1
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_catalog_policy_1'
+ List<String> catalogPolicy = ["GRANT", "SELECT", "LOAD",
"ALTER", "CREATE", "DROP", "SHOW_VIEW"]
+
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("internal"))
+ RangerPolicy policy = new RangerPolicy()
+
+
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([userList[0]])
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ catalogPolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ // sleep 6s to wait for ranger policy to take effect
+ // ranger.plugin.doris.policy.pollIntervalMs is 5000ms in
ranger-doris-security.xml
+ waitPolicyEffect()
+ checkCatalogAccess("internal", "allow", userList[0], pwd,
"internal", 'ranger_test_catalog_db_1', 'ranger_test_catalog_table_1')
+ checkCatalogAccess("hive", "deny", userList[0], pwd, catalog1,
'ranger_test_catalog_db_2', 'ranger_test_catalog_table_2')
+ checkCatalogAccess("jdbc", "deny", userList[0], pwd, catalog2,
'ranger_test_catalog_db_3', 'ranger_test_catalog_table_3')
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+
+ // case2
+ String policy2 = 'ranger_test_catalog_policy_2'
+ policy.setName(policy2)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource(catalog1))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[1]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkCatalogAccess("hive", "allow", userList[1], pwd, catalog1,
'ranger_test_catalog_db_2', 'ranger_test_catalog_table_2')
+ checkCatalogAccess("internal", "deny", userList[1], pwd,
"internal", 'ranger_test_catalog_db_1', 'ranger_test_catalog_table_1')
+ checkCatalogAccess("jdbc", "deny", userList[1], pwd, catalog2,
'ranger_test_catalog_db_3', 'ranger_test_catalog_table_3')
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+
+ // case3
+ String policy3 = 'all - catalog'
+ policy.setName(policy3)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("*"))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[2], "admin", "root"])
+ rangerClient.updatePolicy(rangerServiceName,
"all%20-%20catalog", policy)
+ waitPolicyEffect()
+ checkCatalogAccess("internal", "allow", userList[2], pwd,
"internal", 'ranger_test_catalog_db_1', 'ranger_test_catalog_table_1')
+ checkCatalogAccess("hive", "allow", userList[2], pwd, catalog1,
'ranger_test_catalog_db_2', 'ranger_test_catalog_table_2')
+ checkCatalogAccess("jdbc", "allow", userList[2], pwd, catalog2,
'ranger_test_catalog_db_3', 'ranger_test_catalog_table_3')
+ }
+}
\ No newline at end of file
diff --git
a/regression-test/suites/ranger_p2/test_ranger_access_resource_column.groovy
b/regression-test/suites/ranger_p2/test_ranger_access_resource_column.groovy
new file mode 100644
index 00000000000..ae0e4990cd4
--- /dev/null
+++ b/regression-test/suites/ranger_p2/test_ranger_access_resource_column.groovy
@@ -0,0 +1,253 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+
+suite("test_ranger_access_resource_column", "p2,ranger,external") {
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+ def checkColumnAccess = { catalogType, access, user, password, catalog,
dbName, tableName, columns ->
+ connect("$user", "$password", "$defaultJdbcUrl") {
+ def executeSqlWithLogging = { sqlStatement,
errorMessage ->
+ try {
+ sql sqlStatement
+ } catch (Exception e) {
+ if (access == "allow") {
+ log.error("Error executing
${sqlStatement}: ${e.getMessage()}")
+ throw e
+ }
+ log.info("Error executing
${sqlStatement}: ${e.getMessage()}")
+ }
+ }
+ executeSqlWithLogging("""SELECT ${columns} FROM
${catalog}.${dbName}.${tableName}""", "Error executing SELECT")
+ }
+ }
+
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String externalEnvIp = context.config.otherConfigs.get("externalEnvIp")
+ String HmsPort = context.config.otherConfigs.get("hive3HmsPort")
+
+ if (enabled != null && enabled.equalsIgnoreCase("true")) {
+ String catalog1 = 'ranger_catalog_5'
+ // prepare catalog
+ sql """DROP CATALOG IF EXISTS ${catalog1}"""
+ sql """CREATE CATALOG `${catalog1}` PROPERTIES (
+ "type"="hms",
+ 'hive.metastore.uris' =
'thrift://${externalEnvIp}:${HmsPort}'
+ )"""
+ // prepare database
+ String catalogDb = 'ranger_catalog_5_db_1'
+ sql """CREATE DATABASE IF NOT EXISTS ${catalog1}.${catalogDb}"""
+
+ String internalDb = 'ranger_internal_db_4'
+ sql """DROP DATABASE IF EXISTS ${internalDb}"""
+ sql """CREATE DATABASE IF NOT EXISTS ${internalDb}"""
+
+ // prepare table
+ String catalogTable = 'ranger_catalog_5_db_1_tbl_1'
+ sql """USE ${catalog1}.${catalogDb}"""
+ sql """DROP TABLE IF EXISTS ${catalogTable}"""
+ sql """
+ CREATE TABLE IF NOT EXISTS ${catalogTable} (
+ c1 BIGINT,
+ c2 BIGINT,
+ c3 BIGINT
+ ) ENGINE=hive
+ PROPERTIES (
+ 'file_format'='parquet'
+ );
+ """
+ sql """INSERT INTO ${catalogTable} VALUES (1, 2, 3)"""
+
+ String internalTable = 'ranger_internal_db_4_tbl_1'
+ sql """USE internal.${internalDb}"""
+ sql """CREATE TABLE IF NOT EXISTS ${internalTable}(
+ id BIGINT,
+ c1 BIGINT,
+ c2 BIGINT,
+ c3 BIGINT
+ )
+ DISTRIBUTED BY HASH(id) BUCKETS 2
+ PROPERTIES (
+ "replication_num" = "1"
+ );"""
+ sql """INSERT INTO ${internalTable} VALUES (1, 2, 3, 4)"""
+
+ // prepare user
+ List<String> userList = ['ranger_test_column_user_1',
'ranger_test_column_user_2', 'ranger_test_column_user_3',
+ 'ranger_test_column_user_4',
'ranger_test_column_user_5']
+ String pwd = 'C123_567p'
+ userList.forEach {
+ sql """DROP USER IF EXISTS ${it}"""
+ sql """CREATE USER '${it}' IDENTIFIED BY '${pwd}'"""
+ }
+
+ // case1
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_column_policy_1'
+ List<String> columnPolicy = ["SELECT"]
+
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("internal"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(internalDb))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource(internalTable))
+ resource.put("column", new
RangerPolicy.RangerPolicyResource(["c3"], false, false))
+
+ RangerPolicy policy = new RangerPolicy()
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([userList[0]])
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ columnPolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ // sleep 6s to wait for ranger policy to take effect
+ // ranger.plugin.doris.policy.pollIntervalMs is 5000ms in
ranger-doris-security.xml
+ waitPolicyEffect()
+ checkColumnAccess("internal", "allow", userList[0], pwd,
"internal", internalDb, internalTable, "c3")
+ checkColumnAccess("internal", "deny", userList[0], pwd,
"internal", internalDb, internalTable, "c1,c2")
+ checkColumnAccess("internal", "deny", userList[0], pwd,
"internal", internalDb, internalTable, "c1,c3")
+ checkColumnAccess("internal", "deny", userList[0], pwd,
"internal", internalDb, internalTable, "*")
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+
+ // case2
+ String policy2 = 'ranger_test_column_policy_2'
+ policy.setName(policy2)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource(catalog1))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(catalogDb))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource(catalogTable))
+ resource.put("column", new
RangerPolicy.RangerPolicyResource(["c1", "c2"], false, false))
+
+ policy.setResources(resource)
+ policyItem.setUsers([userList[1]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ System.out.println("New Policy created with id: " +
createdPolicy.getId())
+ waitPolicyEffect()
+ checkColumnAccess("hive", "allow", userList[1], pwd, catalog1,
catalogDb, catalogTable, "c1,c2")
+ checkColumnAccess("hive", "allow", userList[1], pwd, catalog1,
catalogDb, catalogTable, "c1")
+ checkColumnAccess("hive", "allow", userList[1], pwd, catalog1,
catalogDb, catalogTable, "c2")
+ checkColumnAccess("hive", "deny", userList[1], pwd, catalog1,
catalogDb, catalogTable, "c3")
+ checkColumnAccess("hive", "deny", userList[1], pwd, catalog1,
catalogDb, catalogTable, "c1,c3")
+ checkColumnAccess("hive", "deny", userList[1], pwd, catalog1,
catalogDb, catalogTable, "*")
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+
+ // case3
+ String policy3 = 'ranger_test_column_policy_3'
+ policy.setName(policy3)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource(catalog1))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(catalogDb))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource(catalogTable))
+ resource.put("column", new
RangerPolicy.RangerPolicyResource("*"))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[2]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy3)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkColumnAccess("hive", "allow", userList[2], pwd, catalog1,
catalogDb, catalogTable, "c1,c2,c3")
+ checkColumnAccess("hive", "allow", userList[2], pwd, catalog1,
catalogDb, catalogTable, "c2")
+ checkColumnAccess("hive", "allow", userList[2], pwd, catalog1,
catalogDb, catalogTable, "*")
+ checkColumnAccess("internal", "deny", userList[2], pwd,
"internal", internalDb, internalTable, "c1")
+ checkColumnAccess("internal", "deny", userList[2], pwd,
"internal", internalDb, internalTable, "*")
+ rangerClient.deletePolicy(rangerServiceName, policy3)
+
+ // case4
+ String policy4 = 'ranger_test_column_policy_4'
+ policy.setName(policy4)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("column", new
RangerPolicy.RangerPolicyResource(["c1", "c2"], false, false))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[3]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy4)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkColumnAccess("hive", "allow", userList[3], pwd, catalog1,
catalogDb, catalogTable, "c1,c2")
+ checkColumnAccess("hive", "allow", userList[3], pwd, catalog1,
catalogDb, catalogTable, "c2")
+ checkColumnAccess("hive", "deny", userList[3], pwd, catalog1,
catalogDb, catalogTable, "c3")
+ checkColumnAccess("hive", "deny", userList[3], pwd, catalog1,
catalogDb, catalogTable, "*")
+ checkColumnAccess("internal", "allow", userList[3], pwd,
"internal", internalDb, internalTable, "c1,c2")
+ checkColumnAccess("internal", "allow", userList[3], pwd,
"internal", internalDb, internalTable, "c2")
+ checkColumnAccess("internal", "deny", userList[3], pwd,
"internal", internalDb, internalTable, "c3")
+ checkColumnAccess("internal", "deny", userList[3], pwd,
"internal", internalDb, internalTable, "*")
+ rangerClient.deletePolicy(rangerServiceName, policy4)
+
+ // case5
+ String policy5 = 'ranger_test_column_policy_5'
+ policy.setName(policy5)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("column", new
RangerPolicy.RangerPolicyResource(["c1", "c2"], true, false))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[4]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy5)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkColumnAccess("hive", "allow", userList[4], pwd, catalog1,
catalogDb, catalogTable, "c3")
+ checkColumnAccess("hive", "deny", userList[4], pwd, catalog1,
catalogDb, catalogTable, "c1")
+ checkColumnAccess("hive", "deny", userList[4], pwd, catalog1,
catalogDb, catalogTable, "*")
+ checkColumnAccess("internal", "allow", userList[4], pwd,
"internal", internalDb, internalTable, "c3")
+ checkColumnAccess("internal", "deny", userList[4], pwd,
"internal", internalDb, internalTable, "c1")
+ checkColumnAccess("internal", "deny", userList[4], pwd,
"internal", internalDb, internalTable, "*")
+ rangerClient.deletePolicy(rangerServiceName, policy5)
+
+ }
+}
\ No newline at end of file
diff --git
a/regression-test/suites/ranger_p2/test_ranger_access_resource_database.groovy
b/regression-test/suites/ranger_p2/test_ranger_access_resource_database.groovy
new file mode 100644
index 00000000000..a68125cc598
--- /dev/null
+++
b/regression-test/suites/ranger_p2/test_ranger_access_resource_database.groovy
@@ -0,0 +1,238 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+
+suite("test_ranger_access_resource_database", "p2,ranger,external") {
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+ def checkDatabaseAccess = { catalogType, access, user, password,
catalog, dbName, tableName ->
+ connect("$user", "$password", "$defaultJdbcUrl") {
+ def executeSqlWithLogging = { sqlStatement,
errorMessage ->
+ try {
+ sql sqlStatement
+ } catch (Exception e) {
+ if (access == "allow") {
+ log.error("Error executing
${sqlStatement}: ${e.getMessage()}")
+ throw e
+ }
+ log.info("Error executing
${sqlStatement}: ${e.getMessage()}")
+ }
+ }
+ if (catalogType == "internal") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ )
+ DISTRIBUTED BY HASH(id) BUCKETS 2
+ PROPERTIES (
+ "replication_num" = "1"
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""INSERT INTO
${dbName}.${tableName} VALUES (1, 'test')""", "Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""ALTER TABLE
${dbName}.${tableName} ADD COLUMN age INT""", "Error executing ALTER TABLE")
+ executeSqlWithLogging("""DROP VIEW IF EXISTS
${dbName}.test_view""", "Error executing DROP VIEW")
+ executeSqlWithLogging("""CREATE VIEW
${dbName}.test_view AS SELECT * FROM ${dbName}.${tableName}""", "Error
executing CREATE VIEW")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.test_view""", "Error executing SELECT VIEW")
+ executeSqlWithLogging("""SHOW CREATE VIEW
${dbName}.test_view""", "Error executing SHOW CREATE VIEW")
+ executeSqlWithLogging("""DROP TABLE
${dbName}.${tableName}""", "Error executing DROP DATABASE")
+ } else if (catalogType == "hive") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ ) ENGINE=hive
+ PROPERTIES (
+ 'file_format'='parquet'
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""INSERT INTO
${dbName}.${tableName} VALUES (1, 'test')""", "Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""DROP TABLE
${dbName}.${tableName}""", "Error executing DROP DATABASE")
+ }
+ }
+ }
+
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String externalEnvIp = context.config.otherConfigs.get("externalEnvIp")
+ String HmsPort = context.config.otherConfigs.get("hive3HmsPort")
+
+ if (enabled != null && enabled.equalsIgnoreCase("true")) {
+ String catalog1 = 'ranger_catalog_3'
+ // prepare catalog
+ sql """DROP CATALOG IF EXISTS ${catalog1}"""
+ sql """CREATE CATALOG `${catalog1}` PROPERTIES (
+ "type"="hms",
+ 'hive.metastore.uris' =
'thrift://${externalEnvIp}:${HmsPort}'
+ )"""
+
+ // prepare database
+ List<String> catalogDbList = ['ranger_test_catalog3_db_1',
'ranger_test_catalog3_db_2']
+ List<String> internalDbList = ['ranger_test_internal_db_1',
'ranger_test_internal_db_2']
+ catalogDbList.forEach {
+ sql """DROP DATABASE IF EXISTS ${catalog1}.${it}"""
+ sql """CREATE DATABASE IF NOT EXISTS
${catalog1}.${it}"""
+ }
+ internalDbList.forEach {
+ sql """DROP DATABASE IF EXISTS ${it}"""
+ sql """CREATE DATABASE IF NOT EXISTS ${it}"""
+ }
+
+ // prepare user
+ List<String> userList = ['ranger_test_db_user_1',
'ranger_test_db_user_2', 'ranger_test_db_user_3',
+ 'ranger_test_db_user_4',
'ranger_test_db_user_5']
+ String pwd = 'C123_567p'
+ userList.forEach {
+ sql """DROP USER IF EXISTS ${it}"""
+ sql """CREATE USER '${it}' IDENTIFIED BY '${pwd}'"""
+ }
+ // case1
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_db_policy_1'
+ List<String> dbPolicy = ["GRANT", "SELECT", "LOAD", "ALTER",
"CREATE", "DROP", "SHOW_VIEW"]
+
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("internal"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(internalDbList[0]))
+ RangerPolicy policy = new RangerPolicy()
+
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([userList[0]])
+
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ dbPolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ // sleep 6s to wait for ranger policy to take effect
+ // ranger.plugin.doris.policy.pollIntervalMs is 5000ms in
ranger-doris-security.xml
+ waitPolicyEffect()
+ checkDatabaseAccess("internal", "allow", userList[0], pwd,
"internal", internalDbList[0], 'ranger_test_internal_table_1')
+ checkDatabaseAccess("internal", "deny", userList[0], pwd,
"internal", internalDbList[1], 'ranger_test_internal_table_2')
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+
+ // case2
+ String policy2 = 'ranger_test_db_policy_2'
+ policy.setName(policy2)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("internal"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource("*"))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[1]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ System.out.println("New Policy created with id: " +
createdPolicy.getId())
+ waitPolicyEffect()
+ checkDatabaseAccess("internal", "allow", userList[1], pwd,
"internal", internalDbList[0], 'ranger_test_internal_table_1')
+ checkDatabaseAccess("internal", "allow", userList[1], pwd,
"internal", internalDbList[1], 'ranger_test_internal_table_2')
+ checkDatabaseAccess("hive", "deny", userList[1], pwd, catalog1,
catalogDbList[0], 'ranger_test_catalog_table_1')
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+
+
+ // case3
+ String policy3 = 'ranger_test_db_policy_3'
+ policy.setName(policy3)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource(catalog1))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(catalogDbList[0]))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[2]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy3)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkDatabaseAccess("hive", "allow", userList[2], pwd,
catalog1, catalogDbList[0], 'ranger_test_catalog_table_1')
+ checkDatabaseAccess("hive", "deny", userList[2], pwd, catalog1,
catalogDbList[1], 'ranger_test_catalog_table_2')
+ rangerClient.deletePolicy(rangerServiceName, policy3)
+
+ // case4
+ String policy4 = 'ranger_test_db_policy_4'
+ policy.setName(policy4)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource(catalog1))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource("*"))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[3]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy4)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkDatabaseAccess("hive", "allow", userList[3], pwd,
catalog1, catalogDbList[0], 'ranger_test_catalog_table_1')
+ checkDatabaseAccess("hive", "allow", userList[3], pwd,
catalog1, catalogDbList[1], 'ranger_test_catalog_table_2')
+ checkDatabaseAccess("internal", "deny", userList[3], pwd,
"internal", internalDbList[0], 'ranger_test_internal_table_1')
+ checkDatabaseAccess("internal", "deny", userList[3], pwd,
"internal", internalDbList[1], 'ranger_test_internal_table_2')
+ rangerClient.deletePolicy(rangerServiceName, policy4)
+
+ // case5
+ String policy5 = 'ranger_test_db_policy_5'
+ policy.setName(policy5)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource([catalogDbList[1], internalDbList[1]], false,
false))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[4]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy5)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkDatabaseAccess("hive", "deny", userList[4], pwd, catalog1,
catalogDbList[0], 'ranger_test_catalog_table_1')
+ checkDatabaseAccess("hive", "allow", userList[4], pwd,
catalog1, catalogDbList[1], 'ranger_test_catalog_table_2')
+ checkDatabaseAccess("internal", "deny", userList[4], pwd,
"internal", internalDbList[0], 'ranger_test_internal_table_1')
+ checkDatabaseAccess("internal", "allow", userList[4], pwd,
"internal", internalDbList[1], 'ranger_test_internal_table_2')
+ rangerClient.deletePolicy(rangerServiceName, policy5)
+
+ }
+}
\ No newline at end of file
diff --git
a/regression-test/suites/ranger_p2/test_ranger_access_resource_global.groovy
b/regression-test/suites/ranger_p2/test_ranger_access_resource_global.groovy
new file mode 100644
index 00000000000..ec2da95cb42
--- /dev/null
+++ b/regression-test/suites/ranger_p2/test_ranger_access_resource_global.groovy
@@ -0,0 +1,165 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+suite("test_ranger_access_resource_global", "p2,ranger,external") {
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+ def checkGlobalAccess = { catalogType, access, user, password, catalog,
dbName, tableName ->
+ connect("$user", "$password", "$defaultJdbcUrl") {
+ def executeSqlWithLogging = { sqlStatement,
errorMessage ->
+ try {
+ sql sqlStatement
+ } catch (Exception e) {
+ if (access == "allow") {
+ log.error("Error executing
${sqlStatement}: ${e.getMessage()}")
+ throw e
+ }
+ log.info("Error executing
${sqlStatement}: ${e.getMessage()}")
+ }
+ }
+ if (catalogType == "internal") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""DROP DATABASE IF
EXISTS ${dbName}""", "Error executing DROP DATABASE")
+ executeSqlWithLogging("""CREATE DATABASE IF NOT
EXISTS ${dbName}""", "Error executing CREATE DATABASE")
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ )
+ DISTRIBUTED BY HASH(id) BUCKETS 2
+ PROPERTIES (
+ "replication_num" = "1"
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""INSERT INTO
${dbName}.${tableName} VALUES (1, 'test')""", "Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""ALTER TABLE
${dbName}.${tableName} ADD COLUMN age INT""", "Error executing ALTER TABLE")
+ executeSqlWithLogging("""CREATE VIEW
${dbName}.test_view AS SELECT * FROM ${dbName}.${tableName}""", "Error
executing CREATE VIEW")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.test_view""", "Error executing SELECT VIEW")
+ executeSqlWithLogging("""SHOW CREATE VIEW
${dbName}.test_view""", "Error executing SHOW CREATE VIEW")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""DROP DATABASE
${dbName}""", "Error executing DROP DATABASE")
+ } else if (catalogType == "hive") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""CREATE DATABASE IF NOT
EXISTS ${dbName}""", "Error executing CREATE DATABASE")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ ) ENGINE=hive
+ PROPERTIES (
+ 'file_format'='parquet'
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""REFRESH CATALOG
${catalog}""", "Error executing REFRESH")
+ executeSqlWithLogging("""INSERT INTO
${dbName}.${tableName} VALUES (1, 'test')""", "Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""DROP DATABASE
${dbName}""", "Error executing DROP DATABASE")
+ } else if (catalogType == "jdbc") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'CREATE DATABASE IF NOT EXISTS ${dbName}')""", "Error executing
CREATE DATABASE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP TABLE IF EXISTS ${dbName}.${tableName}')""", "Error
executing DROP TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'CREATE TABLE IF NOT EXISTS ${dbName}.${tableName} (id BIGINT,
username VARCHAR(20))')""", "Error executing CREATE TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'INSERT INTO ${dbName}.${tableName} VALUES (1, ''test'')')""",
"Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'ALTER TABLE ${dbName}.${tableName} ADD COLUMN age INT')""",
"Error executing ALTER TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP TABLE IF EXISTS ${dbName}.${tableName}')""", "Error
executing DROP TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP DATABASE ${dbName}')""", "Error executing DROP DATABASE")
+ }
+ }
+ }
+
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String externalEnvIp = context.config.otherConfigs.get("externalEnvIp")
+ String HmsPort = context.config.otherConfigs.get("hive3HmsPort")
+ String jdbcUrl = context.config.jdbcUrl +
"&sessionVariables=return_object_data_as_binary=true"
+ String jdbcUser = context.config.jdbcUser
+ String jdbcPassword = context.config.jdbcPassword
+ String s3Endpoint = getS3Endpoint()
+ String bucket = getS3BucketName()
+ String driverUrl =
"https://${bucket}.${s3Endpoint}/regression/jdbc_driver/mysql-connector-java-8.0.25.jar";
+
+ if (enabled != null && enabled.equalsIgnoreCase("true")) {
+ String catalog1 = 'ranger_test_global_1'
+ String catalog2 = 'ranger_test_global_2'
+ // prepare catalog
+ sql """DROP CATALOG IF EXISTS ${catalog1}"""
+ sql """DROP CATALOG IF EXISTS ${catalog2}"""
+ sql """CREATE CATALOG `${catalog1}` PROPERTIES (
+ "type"="hms",
+ 'hive.metastore.uris' =
'thrift://${externalEnvIp}:${HmsPort}'
+ )"""
+
+ sql """ CREATE CATALOG `${catalog2}` PROPERTIES (
+ "user" = "${jdbcUser}",
+ "type" = "jdbc",
+ "password" = "${jdbcPassword}",
+ "jdbc_url" = "${jdbcUrl}",
+ "driver_url" = "${driverUrl}",
+ "driver_class" = "com.mysql.cj.jdbc.Driver"
+ )"""
+ // prepare doris user
+ List<String> userList = ['ranger_test_global_user_1']
+ String pwd = 'C123_567p'
+ userList.forEach {
+ sql """DROP USER IF EXISTS ${it}"""
+ sql """CREATE USER '${it}' IDENTIFIED BY '${pwd}'"""
+ }
+
+
+ // case1
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'all - global'
+ List<String> globalPolicy = ["GRANT", "SELECT", "LOAD",
"ALTER", "CREATE", "DROP", "SHOW_VIEW", "ADMIN", "NODE"]
+
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("global", new
RangerPolicy.RangerPolicyResource("*"))
+ RangerPolicy policy = new RangerPolicy()
+
+
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([userList[0], "admin", "root"])
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ globalPolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ rangerClient.updatePolicy(rangerServiceName,
"all%20-%20global", policy)
+
+
+ // sleep 6s to wait for ranger policy to take effect
+ // ranger.plugin.doris.policy.pollIntervalMs is 5000ms in
ranger-doris-security.xml
+ waitPolicyEffect()
+ checkGlobalAccess("internal", "allow", userList[0], pwd,
"internal", 'ranger_test_global_db_1', 'ranger_test_global_table_1')
+ checkGlobalAccess("hive", "allow", userList[0], pwd, catalog1,
'ranger_test_global_db_2', 'ranger_test_global_table_2')
+ checkGlobalAccess("jdbc", "allow", userList[0], pwd, catalog2,
'ranger_test_global_db_3', 'ranger_test_global_table_3')
+ }
+}
\ No newline at end of file
diff --git
a/regression-test/suites/ranger_p2/test_ranger_access_resource_resource.groovy
b/regression-test/suites/ranger_p2/test_ranger_access_resource_resource.groovy
new file mode 100644
index 00000000000..a8d4b2d3cba
--- /dev/null
+++
b/regression-test/suites/ranger_p2/test_ranger_access_resource_resource.groovy
@@ -0,0 +1,113 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+
+suite("test_ranger_access_resource", "p2,ranger,external") {
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String jdbcUrl = context.config.jdbcUrl +
"&sessionVariables=return_object_data_as_binary=true"
+ String jdbcUser = context.config.jdbcUser
+ String jdbcPassword = context.config.jdbcPassword
+ String s3Endpoint = getS3Endpoint()
+ String bucket = getS3BucketName()
+ String driverUrl =
"https://${bucket}.${s3Endpoint}/regression/jdbc_driver/mysql-connector-java-8.0.25.jar";
+
+
+ if (enabled != null && enabled.equalsIgnoreCase("true")) {
+ // prepare resource
+ List<String> resourceList = ['ranger_rs1', 'ranger_rs2']
+ resourceList.forEach {
+ sql """DROP RESOURCE IF EXISTS ${it}"""
+ sql """CREATE RESOURCE ${it} properties (
+ "type"="jdbc",
+ "user"="${jdbcUser}",
+ "password"="${jdbcPassword}",
+ "jdbc_url" = "${jdbcUrl}",
+ "driver_url" = "${driverUrl}",
+ "driver_class" = "com.mysql.cj.jdbc.Driver"
+ );"""
+ }
+ // prepare user
+ List<String> userList = ['ranger_test_rs_user1',
'ranger_test_rs_user2']
+ String pwd = 'C123_567p'
+ userList.forEach {
+ sql """DROP USER IF EXISTS ${it}"""
+ sql """CREATE USER '${it}' IDENTIFIED BY '${pwd}'"""
+ }
+
+ // case1
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_resource_policy_1'
+ List<String> resourcePolicy = ["USAGE"]
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("resource", new
RangerPolicy.RangerPolicyResource(resourceList[0]))
+ RangerPolicy policy = new RangerPolicy()
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([userList[0]])
+
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ resourcePolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ // sleep 6s to wait for ranger policy to take effect
+ // ranger.plugin.doris.policy.pollIntervalMs is 5000ms in
ranger-doris-security.xml
+ waitPolicyEffect()
+ connect("${userList[0]}", "$pwd", "$defaultJdbcUrl") {
+ def ret = sql("""SHOW RESOURCES WHERE NAME=
\"${resourceList[0]}\"""")
+ assertTrue(ret.size() > 0)
+ ret = sql("""SHOW RESOURCES WHERE NAME=
\"${resourceList[1]}\"""")
+ assertTrue(ret.size() == 0)
+ }
+ // case2
+ String policy2 = 'all - resource'
+ policy.setName(policy2)
+ resource.clear()
+ resource.put("resource", new
RangerPolicy.RangerPolicyResource("*"))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[1], "admin", "root"])
+ rangerClient.updatePolicy(rangerServiceName,
"all%20-%20resource", policy)
+ waitPolicyEffect()
+ connect("${userList[1]}", "$pwd", "$defaultJdbcUrl") {
+ def ret = sql("""SHOW RESOURCES WHERE NAME=
\"${resourceList[0]}\"""")
+ assertTrue(ret.size() > 0)
+ ret = sql("""SHOW RESOURCES WHERE NAME=
\"${resourceList[1]}\"""")
+ assertTrue(ret.size() > 0)
+ }
+ }
+}
diff --git
a/regression-test/suites/ranger_p2/test_ranger_access_resource_table.groovy
b/regression-test/suites/ranger_p2/test_ranger_access_resource_table.groovy
new file mode 100644
index 00000000000..5fde923be08
--- /dev/null
+++ b/regression-test/suites/ranger_p2/test_ranger_access_resource_table.groovy
@@ -0,0 +1,264 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+
+suite("test_ranger_access_resource_table", "p2,ranger,external") {
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+ def checkTableAccess = { catalogType, access, user, password, catalog,
dbName, tableName ->
+ connect("$user", "$password", "$defaultJdbcUrl") {
+ def executeSqlWithLogging = { sqlStatement,
errorMessage ->
+ try {
+ sql sqlStatement
+ } catch (Exception e) {
+ if (access == "allow") {
+ log.error("Error executing
${sqlStatement}: ${e.getMessage()}")
+ throw e
+ }
+ log.info("Error executing
${sqlStatement}: ${e.getMessage()}")
+ }
+ }
+ if (catalogType == "internal") {
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${catalog}.${dbName}.${tableName} (
+ id BIGINT,
+ username VARCHAR(20)
+ )
+ DISTRIBUTED BY HASH(id) BUCKETS 2
+ PROPERTIES (
+ "replication_num" = "1"
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""INSERT INTO
${catalog}.${dbName}.${tableName} VALUES (1, 'test')""", "Error executing
INSERT")
+ executeSqlWithLogging("""ALTER TABLE
${catalog}.${dbName}.${tableName} ADD COLUMN age INT""", "Error executing ALTER
TABLE")
+
+ } else if (catalogType == "hive") {
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${catalog}.${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ ) ENGINE=hive
+ PROPERTIES (
+ 'file_format'='parquet'
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""INSERT INTO
${catalog}.${dbName}.${tableName} VALUES (1, 'test')""", "Error executing
INSERT")
+ }
+ executeSqlWithLogging("""SELECT * FROM
${catalog}.${dbName}.${tableName}""", "Error executing SELECT")
+ def ret = sql("""SHOW TABLES FROM ${catalog}.${dbName}
LIKE \"${tableName}\"""")
+ if (access == "allow") {
+ assertTrue(ret.size() > 0)
+ } else {
+ assertTrue(ret.size() == 0)
+ }
+ executeSqlWithLogging("""DROP TABLE
${catalog}.${dbName}.${tableName}""", "Error executing DROP TABLE ")
+ }
+ }
+
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String externalEnvIp = context.config.otherConfigs.get("externalEnvIp")
+ String HmsPort = context.config.otherConfigs.get("hive3HmsPort")
+
+ if (enabled != null && enabled.equalsIgnoreCase("true")) {
+ String catalog1 = 'ranger_catalog_4'
+ // prepare catalog
+ sql """DROP CATALOG IF EXISTS ${catalog1}"""
+ sql """CREATE CATALOG `${catalog1}` PROPERTIES (
+ "type"="hms",
+ 'hive.metastore.uris' =
'thrift://${externalEnvIp}:${HmsPort}'
+ )"""
+ // prepare database
+ String catalogDb = 'ranger_catalog_4_db_1'
+ sql """DROP DATABASE IF EXISTS ${catalog1}.${catalogDb}"""
+ sql """CREATE DATABASE IF NOT EXISTS ${catalog1}.${catalogDb}"""
+
+ String internalDb = 'ranger_internal_db_3'
+ sql """DROP DATABASE IF EXISTS ${internalDb}"""
+ sql """CREATE DATABASE IF NOT EXISTS ${internalDb}"""
+
+ // prepare table
+ List<String> catalogTableList = ['ranger_catalog_4_db_1_tbl_1',
'ranger_catalog_4_db_1_tbl_2']
+ List<String> internalTableList = ['ranger_internal_db_3_tbl_1',
'ranger_internal_db_3_tbl_2']
+
+ // prepare user
+ List<String> userList = ['ranger_test_table_user_1',
'ranger_test_table_user_2', 'ranger_test_table_user_3',
+ 'ranger_test_table_user_4',
'ranger_test_table_user_5']
+ String pwd = 'C123_567p'
+ userList.forEach {
+ sql """DROP USER IF EXISTS ${it}"""
+ sql """CREATE USER '${it}' IDENTIFIED BY '${pwd}'"""
+ }
+
+ // case1
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_table_policy_1'
+ List<String> tablePolicy = ["GRANT", "SELECT", "LOAD", "ALTER",
"CREATE", "DROP", "SHOW_VIEW"]
+
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("internal"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(internalDb))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource(internalTableList[0]))
+ RangerPolicy policy = new RangerPolicy()
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([userList[0]])
+
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ tablePolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ // sleep 6s to wait for ranger policy to take effect
+ // ranger.plugin.doris.policy.pollIntervalMs is 5000ms in
ranger-doris-security.xml
+ waitPolicyEffect()
+ checkTableAccess("internal", "allow", userList[0], pwd,
"internal", internalDb, internalTableList[0])
+ checkTableAccess("internal", "deny", userList[0], pwd,
"internal", internalDb, internalTableList[1])
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+
+ // case2
+ String policy2 = 'ranger_test_table_policy_2'
+ policy.setName(policy2)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("internal"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(internalDb))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource("*"))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[1]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ System.out.println("New Policy created with id: " +
createdPolicy.getId())
+ waitPolicyEffect()
+ checkTableAccess("internal", "allow", userList[1], pwd,
"internal", internalDb, internalTableList[0])
+ checkTableAccess("internal", "allow", userList[1], pwd,
"internal", internalDb, internalTableList[1])
+ checkTableAccess("hive", "deny", userList[1], pwd, catalog1,
catalogDb, catalogTableList[0])
+ checkTableAccess("hive", "deny", userList[1], pwd, catalog1,
catalogDb, catalogTableList[1])
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+
+ // case3
+ String policy3 = 'ranger_test_table_policy_3'
+ policy.setName(policy3)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource(catalog1))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(catalogDb))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource(catalogTableList[0]))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[2]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy3)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkTableAccess("hive", "allow", userList[2], pwd, catalog1,
catalogDb, catalogTableList[0])
+ checkTableAccess("hive", "deny", userList[2], pwd, catalog1,
catalogDb, catalogTableList[1])
+ rangerClient.deletePolicy(rangerServiceName, policy3)
+
+ // case4
+ String policy4 = 'ranger_test_table_policy_4'
+ policy.setName(policy4)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource(catalog1))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource(catalogDb))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource("*"))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[3]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy4)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkTableAccess("hive", "allow", userList[3], pwd, catalog1,
catalogDb, catalogTableList[0])
+ checkTableAccess("hive", "allow", userList[3], pwd, catalog1,
catalogDb, catalogTableList[1])
+ checkTableAccess("internal", "deny", userList[3], pwd,
"internal", internalDb, internalTableList[0])
+ checkTableAccess("internal", "deny", userList[3], pwd,
"internal", internalDb, internalTableList[1])
+ rangerClient.deletePolicy(rangerServiceName, policy4)
+
+ // case5
+ String policy5 = 'ranger_test_table_policy_5'
+ policy.setName(policy5)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource([internalTableList[1], catalogTableList[1]],
false, false))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[4]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy5)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkTableAccess("hive", "allow", userList[4], pwd, catalog1,
catalogDb, catalogTableList[1])
+ checkTableAccess("internal", "allow", userList[4], pwd,
"internal", internalDb, internalTableList[1])
+ checkTableAccess("hive", "deny", userList[4], pwd, catalog1,
catalogDb, catalogTableList[0])
+ checkTableAccess("internal", "deny", userList[4], pwd,
"internal", internalDb, internalTableList[0])
+ rangerClient.deletePolicy(rangerServiceName, policy5)
+
+ // case6
+ String policy6 = 'ranger_test_table_policy_6'
+ policy.setName(policy6)
+ resource.clear()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource([internalTableList[1], catalogTableList[1]],
true, false))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[4]])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy6)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkTableAccess("hive", "deny", userList[4], pwd, catalog1,
catalogDb, catalogTableList[1])
+ checkTableAccess("internal", "deny", userList[4], pwd,
"internal", internalDb, internalTableList[1])
+ checkTableAccess("hive", "allow", userList[4], pwd, catalog1,
catalogDb, catalogTableList[0])
+ checkTableAccess("internal", "allow", userList[4], pwd,
"internal", internalDb, internalTableList[0])
+ rangerClient.deletePolicy(rangerServiceName, policy6)
+
+ }
+}
\ No newline at end of file
diff --git
a/regression-test/suites/ranger_p2/test_ranger_access_resource_workload_group.groovy
b/regression-test/suites/ranger_p2/test_ranger_access_resource_workload_group.groovy
new file mode 100644
index 00000000000..9bfddf8bd27
--- /dev/null
+++
b/regression-test/suites/ranger_p2/test_ranger_access_resource_workload_group.groovy
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+
+suite("test_ranger_access_workload_group", "p2,ranger,external") {
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+
+ if (enabled != null && enabled.equalsIgnoreCase("true")) {
+ // prepare workload group
+ List<String> workloadGroupList = ['ranger_wg1', 'ranger_wg2']
+ workloadGroupList.forEach {
+ sql """DROP WORKLOAD GROUP IF EXISTS ${it}"""
+ sql """CREATE WORKLOAD GROUP ${it} properties
("cpu_share"="1024");"""
+ }
+ // prepare user
+ List<String> userList = ['ranger_test_wg_user1',
'ranger_test_wg_user2']
+ String pwd = 'C123_567p'
+ userList.forEach {
+ sql """DROP USER IF EXISTS ${it}"""
+ sql """CREATE USER '${it}' IDENTIFIED BY '${pwd}'"""
+ }
+
+ // case1
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_workload_group_policy_1'
+ List<String> workloadGroupPolicy = ["USAGE"]
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("workload_group", new
RangerPolicy.RangerPolicyResource(workloadGroupList[0]))
+ RangerPolicy policy = new RangerPolicy()
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([userList[0]])
+
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ workloadGroupPolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ // sleep 6s to wait for ranger policy to take effect
+ // ranger.plugin.doris.policy.pollIntervalMs is 5000ms in
ranger-doris-security.xml
+ waitPolicyEffect()
+ connect("${userList[0]}", "$pwd", "$defaultJdbcUrl") {
+ def ret = sql("""SHOW WORKLOAD GROUPS LIKE
\"${workloadGroupList[0]}\"""")
+ assertTrue(ret.size() > 0)
+ ret = sql("""SHOW WORKLOAD GROUPS LIKE
\"${workloadGroupList[1]}\"""")
+ assertTrue(ret.size() == 0)
+ }
+ // case2
+ String policy2 = 'all - workload_group'
+ policy.setName(policy2)
+ resource.clear()
+ resource.put("workload_group", new
RangerPolicy.RangerPolicyResource("*"))
+ policy.setResources(resource)
+ policyItem.setUsers([userList[1], "admin", "root"])
+ rangerClient.updatePolicy(rangerServiceName,
"all%20-%20workload_group", policy)
+ waitPolicyEffect()
+ connect("${userList[1]}", "$pwd", "$defaultJdbcUrl") {
+ def ret = sql("""SHOW WORKLOAD GROUPS LIKE
\"${workloadGroupList[0]}\"""")
+ assertTrue(ret.size() > 0)
+ ret = sql("""SHOW WORKLOAD GROUPS LIKE
\"${workloadGroupList[1]}\"""")
+ assertTrue(ret.size() > 0)
+ }
+ }
+}
diff --git
a/regression-test/suites/ranger_p2/test_ranger_access_role_resource_catalog.groovy
b/regression-test/suites/ranger_p2/test_ranger_access_role_resource_catalog.groovy
new file mode 100644
index 00000000000..155ae871f30
--- /dev/null
+++
b/regression-test/suites/ranger_p2/test_ranger_access_role_resource_catalog.groovy
@@ -0,0 +1,204 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+import org.apache.ranger.plugin.model.RangerRole
+
+suite("test_ranger_access_role_resource_catalog", "p2,ranger,external") {
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+ def checkCatalogAccess = { catalogType, access, user, password,
catalog, dbName, tableName ->
+ connect("$user", "$password", "$defaultJdbcUrl") {
+ def executeSqlWithLogging = { sqlStatement,
errorMessage ->
+ try {
+ sql sqlStatement
+ } catch (Exception e) {
+ if (access == "allow") {
+ log.error("Error executing
${sqlStatement}: ${e.getMessage()}")
+ throw e
+ }
+ log.info("Error executing
${sqlStatement}: ${e.getMessage()}")
+ }
+ }
+ if (catalogType == "internal") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""DROP DATABASE IF
EXISTS ${dbName}""", "Error executing DROP DATABASE")
+ executeSqlWithLogging("""CREATE DATABASE IF NOT
EXISTS ${dbName}""", "Error executing CREATE DATABASE")
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ )
+ DISTRIBUTED BY HASH(id) BUCKETS 2
+ PROPERTIES (
+ "replication_num" = "1"
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""INSERT INTO
${dbName}.${tableName} VALUES (1, 'test')""", "Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""ALTER TABLE
${dbName}.${tableName} ADD COLUMN age INT""", "Error executing ALTER TABLE")
+ executeSqlWithLogging("""CREATE VIEW
${dbName}.test_view AS SELECT * FROM ${dbName}.${tableName}""", "Error
executing CREATE VIEW")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.test_view""", "Error executing SELECT VIEW")
+ executeSqlWithLogging("""SHOW CREATE VIEW
${dbName}.test_view""", "Error executing SHOW CREATE VIEW")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""DROP DATABASE
${dbName}""", "Error executing DROP DATABASE")
+ } else if (catalogType == "hive") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""CREATE DATABASE IF NOT
EXISTS ${dbName}""", "Error executing CREATE DATABASE")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""
+ CREATE TABLE IF NOT EXISTS
${dbName}.`${tableName}` (
+ id BIGINT,
+ username VARCHAR(20)
+ ) ENGINE=hive
+ PROPERTIES (
+ 'file_format'='parquet'
+ );
+ """, "Error executing CREATE TABLE")
+ executeSqlWithLogging("""REFRESH CATALOG
${catalog}""", "Error executing REFRESH")
+ executeSqlWithLogging("""INSERT INTO
${dbName}.${tableName} VALUES (1, 'test')""", "Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""DROP TABLE IF EXISTS
${dbName}.${tableName}""", "Error executing DROP TABLE")
+ executeSqlWithLogging("""DROP DATABASE
${dbName}""", "Error executing DROP DATABASE")
+ } else if (catalogType == "jdbc") {
+ executeSqlWithLogging("""SWITCH ${catalog}""",
"Error executing SWITCH")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'CREATE DATABASE IF NOT EXISTS ${dbName}')""", "Error executing
CREATE DATABASE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP TABLE IF EXISTS ${dbName}.${tableName}')""", "Error
executing DROP TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'CREATE TABLE IF NOT EXISTS ${dbName}.${tableName} (id BIGINT,
username VARCHAR(20))')""", "Error executing CREATE TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'INSERT INTO ${dbName}.${tableName} VALUES (1, ''test'')')""",
"Error executing INSERT")
+ executeSqlWithLogging("""SELECT * FROM
${dbName}.${tableName}""", "Error executing SELECT")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'ALTER TABLE ${dbName}.${tableName} ADD COLUMN age INT')""",
"Error executing ALTER TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP TABLE IF EXISTS ${dbName}.${tableName}')""", "Error
executing DROP TABLE")
+ executeSqlWithLogging("""CALL EXECUTE_STMT
('${catalog}', 'DROP DATABASE ${dbName}')""", "Error executing DROP DATABASE")
+ }
+ }
+ }
+
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String externalEnvIp = context.config.otherConfigs.get("externalEnvIp")
+ String HmsPort = context.config.otherConfigs.get("hive3HmsPort")
+ String jdbcUrl = context.config.jdbcUrl +
"&sessionVariables=return_object_data_as_binary=true"
+ String jdbcUser = context.config.jdbcUser
+ String jdbcPassword = context.config.jdbcPassword
+ String s3Endpoint = getS3Endpoint()
+ String bucket = getS3BucketName()
+ String driverUrl =
"https://${bucket}.${s3Endpoint}/regression/jdbc_driver/mysql-connector-java-8.0.25.jar";
+
+ if (enabled != null && enabled.equalsIgnoreCase("true")) {
+ String catalog1 = 'ranger_test_global_1'
+ String catalog2 = 'ranger_test_global_2'
+ // prepare catalog
+ sql """DROP CATALOG IF EXISTS ${catalog1}"""
+ sql """DROP CATALOG IF EXISTS ${catalog2}"""
+ sql """CREATE CATALOG `${catalog1}` PROPERTIES (
+ "type"="hms",
+ 'hive.metastore.uris' =
'thrift://${externalEnvIp}:${HmsPort}'
+ )"""
+
+ sql """ CREATE CATALOG `${catalog2}` PROPERTIES (
+ "user" = "${jdbcUser}",
+ "type" = "jdbc",
+ "password" = "${jdbcPassword}",
+ "jdbc_url" = "${jdbcUrl}",
+ "driver_url" = "${driverUrl}",
+ "driver_class" = "com.mysql.cj.jdbc.Driver"
+ )"""
+ // prepare doris user
+ List<String> userList = ['ranger_test_role_catalog_user_1']
+ String pwd = 'C123_567p'
+ userList.forEach {
+ sql """DROP USER IF EXISTS ${it}"""
+ sql """CREATE USER '${it}' IDENTIFIED BY '${pwd}'"""
+ }
+
+
+ // case1
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_catalog_policy_3'
+ String policy2 = 'ranger_test_role_catalog_policy_1'
+ List<String> catalogPolicy = ["GRANT", "SELECT", "LOAD",
"ALTER", "CREATE", "DROP", "SHOW_VIEW"]
+
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource(["internal", catalog1, catalog2], false,
false))
+ RangerPolicy policy = new RangerPolicy()
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([userList[0]])
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ catalogPolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ // sleep 6s to wait for ranger policy to take effect
+ // ranger.plugin.doris.policy.pollIntervalMs is 5000ms in
ranger-doris-security.xml
+ waitPolicyEffect()
+ checkCatalogAccess("internal", "allow", userList[0], pwd,
"internal", 'ranger_test_catalog_db_1', 'ranger_test_catalog_table_1')
+ checkCatalogAccess("hive", "allow", userList[0], pwd, catalog1,
'ranger_test_catalog_db_2', 'ranger_test_catalog_table_2')
+ checkCatalogAccess("jdbc", "allow", userList[0], pwd, catalog2,
'ranger_test_catalog_db_3', 'ranger_test_catalog_table_3')
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+
+ // case2
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy2)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+
+ String roleName = 'ranger_test_role'
+ try {
+ rangerClient.deleteRole(roleName, "admin",
rangerServiceName)
+ } catch (Exception e) {
+ log.info("Role not found: ${e.getMessage()}")
+ }
+
+ RangerRole rangerRole = new RangerRole()
+ rangerRole.setName(roleName)
+ rangerRole.setUsers([new RangerRole.RoleMember(userList[0],
false)])
+ rangerClient.createRole(rangerServiceName, rangerRole)
+
+ policy.setName(policy2)
+ policyItem.setUsers([])
+ policyItem.setRoles([roleName])
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ checkCatalogAccess("internal", "allow", userList[0], pwd,
"internal", 'ranger_test_global_db_1', 'ranger_test_global_table_1')
+ checkCatalogAccess("hive", "allow", userList[0], pwd, catalog1,
'ranger_test_global_db_2', 'ranger_test_global_table_2')
+ checkCatalogAccess("jdbc", "allow", userList[0], pwd, catalog2,
'ranger_test_global_db_3', 'ranger_test_global_table_3')
+ }
+}
\ No newline at end of file
diff --git a/regression-test/suites/ranger_p2/test_ranger_masking.groovy
b/regression-test/suites/ranger_p2/test_ranger_masking.groovy
new file mode 100644
index 00000000000..bd30915f8ad
--- /dev/null
+++ b/regression-test/suites/ranger_p2/test_ranger_masking.groovy
@@ -0,0 +1,194 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+
+suite("test_ranger_masking", "p2,ranger,external") {
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String enableHiveTest =
context.config.otherConfigs.get("enableHiveTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String externalEnvIp = context.config.otherConfigs.get("externalEnvIp")
+ String HmsPort = context.config.otherConfigs.get("hive3HmsPort")
+
+ if ((enabled != null && enabled.equalsIgnoreCase("true")) &&
(enableHiveTest != null && enableHiveTest.equalsIgnoreCase("true"))) {
+ String catalog1 = 'ranger_catalog_6'
+ // prepare catalog
+ sql """DROP CATALOG IF EXISTS ${catalog1}"""
+ sql """CREATE CATALOG `${catalog1}` PROPERTIES (
+ "type"="hms",
+ 'hive.metastore.uris' =
'thrift://${externalEnvIp}:${HmsPort}'
+ )"""
+ // prepare database
+ String catalogDb = 'ranger_catalog_6_db_1'
+ sql """CREATE DATABASE IF NOT EXISTS ${catalog1}.${catalogDb}"""
+
+ String internalDb = 'ranger_internal_db_5'
+ sql """CREATE DATABASE IF NOT EXISTS ${internalDb}"""
+
+ // prepare table
+ String catalogTable = 'ranger_catalog_6_db1_tbl1'
+ sql """DROP TABLE IF EXISTS
${catalog1}.${catalogDb}.${catalogTable}"""
+ sql """CREATE TABLE IF NOT EXISTS
${catalog1}.${catalogDb}.${catalogTable} (
+ id BIGINT,
+ c1 VARCHAR(20),
+ c2 VARCHAR(20),
+ c3 VARCHAR(20),
+ c4 VARCHAR(20),
+ c5 VARCHAR(20),
+ c6 VARCHAR(20),
+ c7 VARCHAR(20),
+ c8 DATE,
+ c9 DATETIME
+ ) ENGINE=hive
+ PROPERTIES (
+ 'file_format'='parquet'
+ );"""
+ String internalTable = 'ranger_internal_db_5_tbl1'
+ sql """DROP TABLE IF EXISTS
internal.${internalDb}.`${internalTable}`"""
+ sql """CREATE TABLE IF NOT EXISTS
internal.${internalDb}.`${internalTable}` (
+ id BIGINT,
+ c1 VARCHAR(20),
+ c2 VARCHAR(20),
+ c3 VARCHAR(20),
+ c4 VARCHAR(20),
+ c5 VARCHAR(20),
+ c6 VARCHAR(20),
+ c7 VARCHAR(20),
+ c8 DATE,
+ c9 DATETIME
+ )
+ DISTRIBUTED BY HASH(id) BUCKETS 2
+ PROPERTIES (
+ "replication_num" = "1"
+ );"""
+ // prepare data
+ sql """INSERT INTO ${catalog1}.${catalogDb}.${catalogTable}
(id, c1, c2, c3, c4, c5, c6, c7, c8, c9) VALUES
+ (1, 'DataOne01', 'SampleA1', 'Value1X', 'InfoX123', 'DescA1',
'Extra1A', 'AddVal1', '2023-01-01', '2010-12-02 19:28:30'),
+ (2, 'DataTwo02', 'SampleB2', 'Value2Y', 'InfoY234', 'DescB2',
'Extra2B', 'AddVal2', '2023-02-01', '2010-12-02 19:28:30'),
+ (3, 'DataThr03', 'SampleC3', 'Value3Z', 'InfoZ345', 'DescC3',
'Extra3C', 'AddVal3', '2023-03-01', '2010-12-02 19:28:30'),
+ (4, 'DataFou04', 'SampleD4', 'Value4W', 'InfoW456', 'DescD4',
'Extra4D', 'AddVal4', '2023-04-01', '2011-12-02 19:28:30'),
+ (5, 'DataFiv05', 'SampleE5', 'Value5V', 'InfoV567', 'DescE5',
'Extra5E', 'AddVal5', '2023-05-01', '2012-12-02 19:28:30'),
+ (6, 'DataSix06', 'SampleF6', 'Value6U', 'InfoU678', 'DescF6',
'Extra6F', 'AddVal6', '2023-06-01', '2013-12-02 19:28:30'),
+ (7, 'DataSev07', 'SampleG7', 'Value7T', 'InfoT789', 'DescG7',
'Extra7G', 'AddVal7', '2023-07-01', '2014-12-02 19:28:30'),
+ (8, 'DataEig08', 'SampleH8', 'Value8S', 'InfoS890', 'DescH8',
'Extra8H', 'AddVal8', '2023-08-01', '2015-12-02 19:28:30'),
+ (9, 'DataNin09', 'SampleI9', 'Value9R', 'InfoR901', 'DescI9',
'Extra9I', 'AddVal9', '2024-09-01', '2016-12-02 19:28:30'),
+ (10, 'DataTen10', 'SampleJ0', 'Value0Q', 'InfoQ012', 'DescJ0',
'Extra0J', 'AddVal0', '2025-10-01', '2017-12-02 19:28:30');"""
+
+ sql """INSERT INTO internal.${internalDb}.${internalTable} (id,
c1, c2, c3, c4, c5, c6, c7, c8, c9) VALUES
+ (1, 'DataOne01', 'SampleA1', 'Value1X', 'InfoX123', 'DescA1',
'Extra1A', 'AddVal1', '2023-01-01', '2010-12-02 19:28:30'),
+ (2, 'DataTwo02', 'SampleB2', 'Value2Y', 'InfoY234', 'DescB2',
'Extra2B', 'AddVal2', '2023-02-01', '2010-12-02 19:28:30'),
+ (3, 'DataThr03', 'SampleC3', 'Value3Z', 'InfoZ345', 'DescC3',
'Extra3C', 'AddVal3', '2023-03-01', '2010-12-02 19:28:30'),
+ (4, 'DataFou04', 'SampleD4', 'Value4W', 'InfoW456', 'DescD4',
'Extra4D', 'AddVal4', '2023-04-01', '2011-12-02 19:28:30'),
+ (5, 'DataFiv05', 'SampleE5', 'Value5V', 'InfoV567', 'DescE5',
'Extra5E', 'AddVal5', '2023-05-01', '2012-12-02 19:28:30'),
+ (6, 'DataSix06', 'SampleF6', 'Value6U', 'InfoU678', 'DescF6',
'Extra6F', 'AddVal6', '2023-06-01', '2013-12-02 19:28:30'),
+ (7, 'DataSev07', 'SampleG7', 'Value7T', 'InfoT789', 'DescG7',
'Extra7G', 'AddVal7', '2023-07-01', '2014-12-02 19:28:30'),
+ (8, 'DataEig08', 'SampleH8', 'Value8S', 'InfoS890', 'DescH8',
'Extra8H', 'AddVal8', '2023-08-01', '2015-12-02 19:28:30'),
+ (9, 'DataNin09', 'SampleI9', 'Value9R', 'InfoR901', 'DescI9',
'Extra9I', 'AddVal9', '2024-09-01', '2016-12-02 19:28:30'),
+ (10, 'DataTen10', 'SampleJ0', 'Value0Q', 'InfoQ012', 'DescJ0',
'Extra0J', 'AddVal0', '2025-10-01', '2017-12-02 19:28:30');"""
+
+ // prepare user
+ String user = 'ranger_test_masking_user_1'
+ String pwd = 'C123_567p'
+ sql """DROP USER IF EXISTS ${user}"""
+ sql """CREATE USER '${user}' IDENTIFIED BY '${pwd}'"""
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_masking_policy_access'
+ List<String> tablePolicy = ["SELECT"]
+
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource([internalTable, catalogTable], false, false))
+ resource.put("column", new
RangerPolicy.RangerPolicyResource("*"))
+
+ RangerPolicy policy = new RangerPolicy()
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([user])
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ tablePolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+
+
+ Map<String, String> columnMaskMap = new HashMap<>()
+ columnMaskMap.put("c1", "MASK")
+ columnMaskMap.put("c2", "MASK_SHOW_LAST_4")
+ columnMaskMap.put("c3", "MASK_SHOW_FIRST_4")
+ columnMaskMap.put("c4", "MASK_HASH")
+ columnMaskMap.put("c5", "MASK_NULL")
+ columnMaskMap.put("c7", "CUSTOM")
+ columnMaskMap.put("c6", "MASK_NONE")
+ columnMaskMap.put("c8", "MASK_DATE_SHOW_YEAR")
+ columnMaskMap.put("c9", "MASK_DATE_SHOW_YEAR")
+
+ policy.setPolicyItems([])
+ policy.setPolicyType(RangerPolicy.POLICY_TYPE_DATAMASK)
+ for (Map.Entry<String, String> entry :
columnMaskMap.entrySet()) {
+ String column = entry.getKey()
+ String maskType = entry.getValue()
+ String maskPolicy =
"ranger_test_masking_policy_${column}"
+ policy.setName(maskPolicy)
+
+ try {
+ rangerClient.deletePolicy(rangerServiceName,
maskPolicy)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ resource.put("column", new
RangerPolicy.RangerPolicyResource(column))
+ policy.setResources(resource)
+ RangerPolicy.RangerDataMaskPolicyItem
dataMaskPolicyItem = new RangerPolicy.RangerDataMaskPolicyItem()
+ dataMaskPolicyItem.setUsers([user])
+ dataMaskPolicyItem.setAccesses([new
RangerPolicy.RangerPolicyItemAccess("SELECT")])
+ dataMaskPolicyItem.setDataMaskInfo(new
RangerPolicy.RangerPolicyItemDataMaskInfo(maskType, "", ""))
+ if (maskType == "CUSTOM") {
+ dataMaskPolicyItem.setDataMaskInfo(new
RangerPolicy.RangerPolicyItemDataMaskInfo(maskType, "", "\"ranger test\""))
+ }
+ policy.setDataMaskPolicyItems([dataMaskPolicyItem])
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " +
createdPolicy.getId())
+ }
+ waitPolicyEffect()
+ // check
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+ connect("$user", "$pwd", "$defaultJdbcUrl") {
+ order_qt_internal("""SELECT * FROM
internal.${internalDb}.${internalTable}""")
+ }
+ connect("$user", "$pwd", "$defaultJdbcUrl") {
+ order_qt_catalog("""SELECT * FROM
${catalog1}.${catalogDb}.${catalogTable}""")
+ }
+ }
+}
\ No newline at end of file
diff --git
a/regression-test/suites/ranger_p2/test_ranger_row_level_filter.groovy
b/regression-test/suites/ranger_p2/test_ranger_row_level_filter.groovy
new file mode 100644
index 00000000000..62583eeca2a
--- /dev/null
+++ b/regression-test/suites/ranger_p2/test_ranger_row_level_filter.groovy
@@ -0,0 +1,174 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import org.apache.ranger.RangerClient
+import org.apache.ranger.plugin.model.RangerPolicy
+
+
+suite("test_ranger_row_level_filter", "p2,ranger,external") {
+ String enabled = context.config.otherConfigs.get("enableRangerTest")
+ String enableHiveTest =
context.config.otherConfigs.get("enableHiveTest")
+ String rangerEndpoint =
context.config.otherConfigs.get("rangerEndpoint")
+ String rangerUser = context.config.otherConfigs.get("rangerUser")
+ String rangerPassword =
context.config.otherConfigs.get("rangerPassword")
+ String rangerServiceName =
context.config.otherConfigs.get("rangerServiceName")
+ String externalEnvIp = context.config.otherConfigs.get("externalEnvIp")
+ String HmsPort = context.config.otherConfigs.get("hive3HmsPort")
+
+ if ((enabled != null && enabled.equalsIgnoreCase("true")) &&
(enableHiveTest != null && enableHiveTest.equalsIgnoreCase("true"))) {
+ String catalog1 = 'ranger_catalog_7'
+ // prepare catalog
+ sql """DROP CATALOG IF EXISTS ${catalog1}"""
+ sql """CREATE CATALOG `${catalog1}` PROPERTIES (
+ "type"="hms",
+ 'hive.metastore.uris' =
'thrift://${externalEnvIp}:${HmsPort}'
+ )"""
+ // prepare database
+ String catalogDb = 'ranger_catalog_7_db_1'
+ sql """CREATE DATABASE IF NOT EXISTS ${catalog1}.${catalogDb}"""
+
+ String internalDb = 'ranger_internal_db_6'
+ sql """CREATE DATABASE IF NOT EXISTS ${internalDb}"""
+
+ // prepare table
+ String catalogTable = 'ranger_catalog_7_db1_tbl1'
+ sql """DROP TABLE IF EXISTS
${catalog1}.${catalogDb}.${catalogTable}"""
+ sql """CREATE TABLE IF NOT EXISTS
${catalog1}.${catalogDb}.${catalogTable} (
+ id BIGINT,
+ c1 VARCHAR(20),
+ c2 VARCHAR(20),
+ c3 VARCHAR(20),
+ c4 VARCHAR(20),
+ c5 VARCHAR(20),
+ c6 VARCHAR(20),
+ c7 VARCHAR(20),
+ c8 DATE,
+ c9 DATETIME
+ ) ENGINE=hive
+ PROPERTIES (
+ 'file_format'='parquet'
+ );"""
+ String internalTable = 'ranger_internal_db_5_tbl1'
+ sql """DROP TABLE IF EXISTS
internal.${internalDb}.`${internalTable}`"""
+ sql """CREATE TABLE IF NOT EXISTS
internal.${internalDb}.`${internalTable}` (
+ id BIGINT,
+ c1 VARCHAR(20),
+ c2 VARCHAR(20),
+ c3 VARCHAR(20),
+ c4 VARCHAR(20),
+ c5 VARCHAR(20),
+ c6 VARCHAR(20),
+ c7 VARCHAR(20),
+ c8 DATE,
+ c9 DATETIME
+ )
+ DISTRIBUTED BY HASH(id) BUCKETS 2
+ PROPERTIES (
+ "replication_num" = "1"
+ );"""
+ // prepare data
+ sql """INSERT INTO ${catalog1}.${catalogDb}.${catalogTable}
(id, c1, c2, c3, c4, c5, c6, c7, c8, c9) VALUES
+ (1, 'DataOne01', 'SampleA1', 'Value1X', 'InfoX123', 'DescA1',
'Extra1A', 'AddVal1', '2023-01-01', '2010-12-02 19:28:30'),
+ (2, 'DataTwo02', 'SampleB2', 'Value2Y', 'InfoY234', 'DescB2',
'Extra2B', 'AddVal2', '2023-02-01', '2010-12-02 19:28:30'),
+ (3, 'DataThr03', 'SampleC3', 'Value3Z', 'InfoZ345', 'DescC3',
'Extra3C', 'AddVal3', '2023-03-01', '2010-12-02 19:28:30'),
+ (4, 'DataFou04', 'SampleD4', 'Value4W', 'InfoW456', 'DescD4',
'Extra4D', 'AddVal4', '2023-04-01', '2011-12-02 19:28:30'),
+ (5, 'DataFiv05', 'SampleE5', 'Value5V', 'InfoV567', 'DescE5',
'Extra5E', 'AddVal5', '2023-05-01', '2012-12-02 19:28:30'),
+ (6, 'DataSix06', 'SampleF6', 'Value6U', 'InfoU678', 'DescF6',
'Extra6F', 'AddVal6', '2023-06-01', '2013-12-02 19:28:30'),
+ (7, 'DataSev07', 'SampleG7', 'Value7T', 'InfoT789', 'DescG7',
'Extra7G', 'AddVal7', '2023-07-01', '2014-12-02 19:28:30'),
+ (8, 'DataEig08', 'SampleH8', 'Value8S', 'InfoS890', 'DescH8',
'Extra8H', 'AddVal8', '2023-08-01', '2015-12-02 19:28:30'),
+ (9, 'DataNin09', 'SampleI9', 'Value9R', 'InfoR901', 'DescI9',
'Extra9I', 'AddVal9', '2024-09-01', '2016-12-02 19:28:30'),
+ (10, 'DataTen10', 'SampleJ0', 'Value0Q', 'InfoQ012', 'DescJ0',
'Extra0J', 'AddVal0', '2025-10-01', '2017-12-02 19:28:30');"""
+
+ sql """INSERT INTO internal.${internalDb}.${internalTable} (id,
c1, c2, c3, c4, c5, c6, c7, c8, c9) VALUES
+ (1, 'DataOne01', 'SampleA1', 'Value1X', 'InfoX123', 'DescA1',
'Extra1A', 'AddVal1', '2023-01-01', '2010-12-02 19:28:30'),
+ (2, 'DataTwo02', 'SampleB2', 'Value2Y', 'InfoY234', 'DescB2',
'Extra2B', 'AddVal2', '2023-02-01', '2010-12-02 19:28:30'),
+ (3, 'DataThr03', 'SampleC3', 'Value3Z', 'InfoZ345', 'DescC3',
'Extra3C', 'AddVal3', '2023-03-01', '2010-12-02 19:28:30'),
+ (4, 'DataFou04', 'SampleD4', 'Value4W', 'InfoW456', 'DescD4',
'Extra4D', 'AddVal4', '2023-04-01', '2011-12-02 19:28:30'),
+ (5, 'DataFiv05', 'SampleE5', 'Value5V', 'InfoV567', 'DescE5',
'Extra5E', 'AddVal5', '2023-05-01', '2012-12-02 19:28:30'),
+ (6, 'DataSix06', 'SampleF6', 'Value6U', 'InfoU678', 'DescF6',
'Extra6F', 'AddVal6', '2023-06-01', '2013-12-02 19:28:30'),
+ (7, 'DataSev07', 'SampleG7', 'Value7T', 'InfoT789', 'DescG7',
'Extra7G', 'AddVal7', '2023-07-01', '2014-12-02 19:28:30'),
+ (8, 'DataEig08', 'SampleH8', 'Value8S', 'InfoS890', 'DescH8',
'Extra8H', 'AddVal8', '2023-08-01', '2015-12-02 19:28:30'),
+ (9, 'DataNin09', 'SampleI9', 'Value9R', 'InfoR901', 'DescI9',
'Extra9I', 'AddVal9', '2024-09-01', '2016-12-02 19:28:30'),
+ (10, 'DataTen10', 'SampleJ0', 'Value0Q', 'InfoQ012', 'DescJ0',
'Extra0J', 'AddVal0', '2025-10-01', '2017-12-02 19:28:30');"""
+
+ order_qt_internal_all("""SELECT * FROM
internal.${internalDb}.${internalTable}""")
+ order_qt_catalog_all("""SELECT * FROM
${catalog1}.${catalogDb}.${catalogTable}""")
+ // prepare user
+ String user = 'ranger_test_row_filter_user1'
+ String pwd = 'C123_567p'
+ sql """DROP USER IF EXISTS ${user}"""
+ sql """CREATE USER '${user}' IDENTIFIED BY '${pwd}'"""
+ // create policy
+ RangerClient rangerClient = new
RangerClient("http://${rangerEndpoint}";, "simple", rangerUser, rangerPassword,
null)
+ String policy1 = 'ranger_test_row_policy_access'
+ List<String> tablePolicy = ["SELECT"]
+
+ Map<String, RangerPolicy.RangerPolicyResource> resource = new
HashMap<>()
+ resource.put("catalog", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("database", new
RangerPolicy.RangerPolicyResource("*"))
+ resource.put("table", new
RangerPolicy.RangerPolicyResource([internalTable, catalogTable], false, false))
+
+ RangerPolicy policy = new RangerPolicy()
+ policy.setService(rangerServiceName)
+ policy.setName(policy1)
+ policy.setResources(resource)
+
+ RangerPolicy.RangerPolicyItem policyItem = new
RangerPolicy.RangerPolicyItem()
+ policyItem.setUsers([user])
+ List<RangerPolicy.RangerPolicyItemAccess> policyItemAccesses =
new ArrayList<RangerPolicy.RangerPolicyItemAccess>()
+ tablePolicy.forEach {
+ policyItemAccesses.add(new
RangerPolicy.RangerPolicyItemAccess(it))
+ }
+ policyItem.setAccesses(policyItemAccesses)
+ policy.setPolicyItems([policyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policy1)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ RangerPolicy createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+
+
+ policy.setPolicyItems([])
+ policy.setPolicyType(RangerPolicy.POLICY_TYPE_ROWFILTER)
+ String policyName = "ranger_test_row_level_filter_policy"
+ policy.setName(policyName)
+ RangerPolicy.RangerRowFilterPolicyItem rowFilterPolicyItem =
new RangerPolicy.RangerRowFilterPolicyItem()
+ rowFilterPolicyItem.setUsers([user])
+ rowFilterPolicyItem.setAccesses([new
RangerPolicy.RangerPolicyItemAccess("SELECT")])
+ rowFilterPolicyItem.setRowFilterInfo(new
RangerPolicy.RangerPolicyItemRowFilterInfo("id >= 5"))
+ policy.setRowFilterPolicyItems([rowFilterPolicyItem])
+ try {
+ rangerClient.deletePolicy(rangerServiceName, policyName)
+ } catch (Exception e) {
+ log.info("Policy not found: ${e.getMessage()}")
+ }
+ createdPolicy = rangerClient.createPolicy(policy)
+ println("New Policy created with id: " + createdPolicy.getId())
+ waitPolicyEffect()
+ // check
+ def tokens = context.config.jdbcUrl.split('/')
+ def defaultJdbcUrl = tokens[0] + "//" + tokens[2] + "/?"
+ connect("$user", "$pwd", "$defaultJdbcUrl") {
+ order_qt_internal("""SELECT * FROM
internal.${internalDb}.${internalTable}""")
+ }
+ connect("$user", "$pwd", "$defaultJdbcUrl") {
+ order_qt_catalog("""SELECT * FROM
${catalog1}.${catalogDb}.${catalogTable}""")
+ }
+ }
+}
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
