This is an automated email from the ASF dual-hosted git repository.
ramackri pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new 7e2af7a0e RANGER-5709: Fix KMS secure download for roles, tags, and
userstore (#1114)
7e2af7a0e is described below
commit 7e2af7a0eabde62a49ed09e8a39fe1fdecdc2a91
Author: Ramachandran Krishnan <[email protected]>
AuthorDate: Wed Jul 29 10:54:55 2026 +0530
RANGER-5709: Fix KMS secure download for roles, tags, and userstore (#1114)
* RANGER-5709: Fix KMS secure download for roles, tags, and userstore
Use getServiceByNameForDP() for KMS services in RoleREST, TagREST, and
XUserREST secure download paths, matching policy download behavior.
* RANGER-5709: Add KMS secure roles download unit test
Assert RoleREST uses getServiceByNameForDP() for KMS services.
---------
Co-authored-by: ramk <[email protected]>
---
.../main/java/org/apache/ranger/rest/RoleREST.java | 12 ++++--
.../main/java/org/apache/ranger/rest/TagREST.java | 12 ++++--
.../java/org/apache/ranger/rest/XUserREST.java | 12 ++++--
.../java/org/apache/ranger/rest/TestRoleREST.java | 44 ++++++++++++++++++++++
.../java/org/apache/ranger/rest/TestTagREST.java | 8 ++--
5 files changed, 72 insertions(+), 16 deletions(-)
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
index 1011f6d71..1790cc1ca 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
@@ -1085,7 +1085,7 @@ public RangerRoles
getSecureRangerRolesIfUpdated(@PathParam("serviceName") Strin
boolean isKeyAdmin = bizUtil.isKeyAdmin();
Long downloadedVersion = null;
boolean isValid = false;
- boolean isAllowed;
+ boolean isAllowed = false;
request.setAttribute("downloadPolicy", "secure");
@@ -1110,18 +1110,22 @@ public RangerRoles
getSecureRangerRolesIfUpdated(@PathParam("serviceName") Strin
}
XXServiceDef xServiceDef =
daoManager.getXXServiceDef().getById(xService.getType());
- RangerService rangerService =
svcStore.getServiceByName(serviceName);
+ RangerService rangerService;
if (StringUtils.equals(xServiceDef.getImplclassname(),
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
+ rangerService =
svcStore.getServiceByNameForDP(serviceName);
+
if (isKeyAdmin) {
isAllowed = true;
- } else {
+ } else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService,
POLICY_DOWNLOAD_USERS);
}
} else {
+ rangerService = svcStore.getServiceByName(serviceName);
+
if (isAdmin) {
isAllowed = true;
- } else {
+ } else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService,
POLICY_DOWNLOAD_USERS);
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
index c314e2f4d..03094f0b1 100755
--- a/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
@@ -1316,7 +1316,7 @@ public ServiceTags
getSecureServiceTagsIfUpdated(@PathParam("serviceName") Strin
Long downloadedVersion = null;
String clusterName = null;
String logMsg;
- boolean isAllowed;
+ boolean isAllowed = false;
if (request != null) {
clusterName =
!StringUtils.isEmpty(request.getParameter(SearchFilter.CLUSTER_NAME)) ?
request.getParameter(SearchFilter.CLUSTER_NAME) : "";
@@ -1332,18 +1332,22 @@ public ServiceTags
getSecureServiceTagsIfUpdated(@PathParam("serviceName") Strin
}
XXServiceDef xServiceDef =
daoManager.getXXServiceDef().getById(xService.getType());
- RangerService rangerService =
svcStore.getServiceByName(serviceName);
+ RangerService rangerService;
if (StringUtils.equals(xServiceDef.getImplclassname(),
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
+ rangerService = svcStore.getServiceByNameForDP(serviceName);
+
if (isKeyAdmin) {
isAllowed = true;
- } else {
+ } else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService,
Allowed_User_List_For_Tag_Download);
}
} else {
+ rangerService = svcStore.getServiceByName(serviceName);
+
if (isAdmin) {
isAllowed = true;
- } else {
+ } else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService,
Allowed_User_List_For_Tag_Download);
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
index ced8b4227..1e8d24d0a 100755
--- a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
@@ -1444,7 +1444,7 @@ public RangerUserStore
getSecureRangerUserStoreIfUpdated(@PathParam("serviceName
boolean isKeyAdmin = bizUtil.isKeyAdmin();
Long downloadedVersion = null;
boolean isValid = false;
- boolean isAllowed;
+ boolean isAllowed = false;
try {
isValid = serviceUtil.isValidService(serviceName, request);
@@ -1465,18 +1465,22 @@ public RangerUserStore
getSecureRangerUserStoreIfUpdated(@PathParam("serviceName
if (isValid && xService != null) {
XXServiceDef xServiceDef =
rangerDaoManager.getXXServiceDef().getById(xService.getType());
- RangerService rangerService =
svcStore.getServiceByName(serviceName);
+ RangerService rangerService;
if (StringUtils.equals(xServiceDef.getImplclassname(),
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
+ rangerService =
svcStore.getServiceByNameForDP(serviceName);
+
if (isKeyAdmin) {
isAllowed = true;
- } else {
+ } else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService,
USERSTORE_DOWNLOAD_USERS);
}
} else {
+ rangerService = svcStore.getServiceByName(serviceName);
+
if (isAdmin) {
isAllowed = true;
- } else {
+ } else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService,
USERSTORE_DOWNLOAD_USERS);
}
}
diff --git
a/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
b/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
index 876dadad6..64a90dc43 100644
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
@@ -35,14 +35,17 @@
import org.apache.ranger.db.XXRoleRefGroupDao;
import org.apache.ranger.db.XXRoleRefRoleDao;
import org.apache.ranger.db.XXRoleRefUserDao;
+import org.apache.ranger.db.XXServiceDefDao;
import org.apache.ranger.entity.XXPortalUser;
import org.apache.ranger.entity.XXRoleRefGroup;
import org.apache.ranger.entity.XXRoleRefUser;
import org.apache.ranger.entity.XXService;
+import org.apache.ranger.entity.XXServiceDef;
import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyResource;
import org.apache.ranger.plugin.model.RangerRole;
+import org.apache.ranger.plugin.model.RangerService;
import org.apache.ranger.plugin.model.validation.RangerRoleValidator;
import org.apache.ranger.plugin.util.GrantRevokeRoleRequest;
import org.apache.ranger.plugin.util.RangerRoles;
@@ -879,6 +882,47 @@ public void test17dGetSecureRangerRolesIfUpdated() {
});
}
+ @Test
+ public void
test17eGetSecureRangerRolesIfUpdatedKmsUsesServiceByNameForDP() throws
Exception {
+ RangerRoles rangerRoles = createRangerRoles();
+ String serviceName = "dev_kms";
+ String pluginId = "kms-plugin";
+ String clusterName = "";
+ String pluginCapabilities = "";
+
+ XXService xService = createXXService();
+ xService.setName(serviceName);
+ xService.setType(Id);
+
+ XXServiceDef xServiceDef = new XXServiceDef();
+ xServiceDef.setId(Id);
+
xServiceDef.setImplclassname("org.apache.ranger.services.kms.RangerServiceKMS");
+
+ RangerService rangerService = new RangerService();
+ rangerService.setId(Id);
+ rangerService.setName(serviceName);
+
+ XXServiceDefDao xServiceDefDao = Mockito.mock(XXServiceDefDao.class);
+ HttpServletRequest request = Mockito.mock(HttpServletRequest.class);
+
+ Mockito.when(serviceUtil.isValidService(serviceName,
request)).thenReturn(true);
+
Mockito.when(daoMgr.getXXService().findByName(serviceName)).thenReturn(xService);
+ Mockito.when(daoMgr.getXXServiceDef()).thenReturn(xServiceDefDao);
+
Mockito.when(xServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
+ Mockito.when(bizUtil.isAdmin()).thenReturn(false);
+ Mockito.when(bizUtil.isKeyAdmin()).thenReturn(false);
+
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
+ Mockito.when(bizUtil.isUserAllowed(rangerService,
RoleREST.POLICY_DOWNLOAD_USERS)).thenReturn(true);
+ Mockito.when(roleStore.getRoles(serviceName,
-1L)).thenReturn(rangerRoles);
+
+ RangerRoles result =
roleRest.getSecureRangerRolesIfUpdated(serviceName, -1L, 0L, pluginId,
clusterName, pluginCapabilities, request);
+
+ Assertions.assertNotNull(result);
+ Assertions.assertEquals(rangerRoles.getRangerRoles().size(),
result.getRangerRoles().size());
+ Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
+ Mockito.verify(bizUtil).isUserAllowed(rangerService,
RoleREST.POLICY_DOWNLOAD_USERS);
+ }
+
// empty request roles (requestParamRoles = 0, dbRoles = 5, return = all
dbRoles)
@Test
public void test18GetRolesInJson() throws Exception {
diff --git
a/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
b/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
index ce5ddc3e1..c92a7200a 100755
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
@@ -1604,7 +1604,7 @@ public void
test52getSecureServiceTagsIfUpdatedIsKeyAdminTrue() {
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xXServiceDefDao);
Mockito.when(xXServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
try {
-
Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService);
+
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
} catch (Exception e) {
}
@@ -1625,7 +1625,7 @@ public void
test52getSecureServiceTagsIfUpdatedIsKeyAdminTrue() {
Mockito.verify(daoManager).getXXServiceDef();
Mockito.verify(xXServiceDefDao).getById(xService.getType());
try {
- Mockito.verify(svcStore).getServiceByName(serviceName);
+ Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
} catch (Exception e) {
}
try {
@@ -1730,7 +1730,7 @@ public void
test54getSecureServiceTagsIfUpdatedIsKeyAdminFalse() {
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xXServiceDefDao);
Mockito.when(xXServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
try {
-
Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService);
+
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
} catch (Exception e) {
}
@@ -1752,7 +1752,7 @@ public void
test54getSecureServiceTagsIfUpdatedIsKeyAdminFalse() {
Mockito.verify(daoManager).getXXServiceDef();
Mockito.verify(xXServiceDefDao).getById(xService.getType());
try {
- Mockito.verify(svcStore).getServiceByName(serviceName);
+ Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
} catch (Exception e) {
}
Mockito.verify(bizUtil).isUserAllowed(rangerService,
Allowed_User_List_For_Tag_Download);
