This is an automated email from the ASF dual-hosted git repository.
vikaskr22 pushed a commit to branch ranger-2.10
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.10 by this push:
new a77d36275 RANGER-5792: Align to best practices for User rest API
(#1230) (#1248)
a77d36275 is described below
commit a77d36275feff5934c81462bd5eb52c3528e2756
Author: Dineshkumar Yadav <[email protected]>
AuthorDate: Sat Sep 26 19:14:01 2026 +0530
RANGER-5792: Align to best practices for User rest API (#1230) (#1248)
Co-authored-by: Vikas Kumar <[email protected]>
Co-authored-by: Madhan Neethiraj <[email protected]>
Co-authored-by: Cursor <[email protected]>
---
.../java/org/apache/ranger/biz/RangerBizUtil.java | 17 +++++++++--------
.../main/java/org/apache/ranger/biz/UserMgr.java | 4 ++--
.../main/java/org/apache/ranger/biz/XUserMgr.java | 22 ++++++++++------------
.../java/org/apache/ranger/common/StringUtil.java | 9 +++++++++
4 files changed, 30 insertions(+), 22 deletions(-)
diff --git
a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
index d48752fba..cb096f0d3 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
@@ -1361,19 +1361,20 @@ public boolean checkUserAccessible(VXUser vXUser) {
boolean isAccessible = true;
Collection<String> roleList = userMgr.getRolesByLoginId(vXUser
.getName());
+ Collection<String> payloadRoles = vXUser.getUserRoleList();
if (isKeyAdmin()) {
- if
(vXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN)
- ||
vXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)
- ||
roleList.contains(RangerConstants.ROLE_SYS_ADMIN)
- ||
roleList.contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ if (StringUtil.containsIgnoreCase(payloadRoles,
RangerConstants.ROLE_SYS_ADMIN)
+ ||
StringUtil.containsIgnoreCase(payloadRoles, RangerConstants.ROLE_ADMIN_AUDITOR)
+ ||
StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_SYS_ADMIN)
+ ||
StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_ADMIN_AUDITOR)) {
isAccessible = false;
}
}
if (isAdmin()) {
- if
(vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN)
- ||
vXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)
- ||
roleList.contains(RangerConstants.ROLE_KEY_ADMIN)
- ||
roleList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ if (StringUtil.containsIgnoreCase(payloadRoles,
RangerConstants.ROLE_KEY_ADMIN)
+ ||
StringUtil.containsIgnoreCase(payloadRoles,
RangerConstants.ROLE_KEY_ADMIN_AUDITOR)
+ ||
StringUtil.containsIgnoreCase(roleList, RangerConstants.ROLE_KEY_ADMIN)
+ ||
StringUtil.containsIgnoreCase(roleList,
RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
isAccessible = false;
}
}
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
index 35be7580d..b0254d212 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
@@ -283,10 +283,10 @@ public boolean updateRoles(Long userId,
Collection<String> rolesList) {
}
List<String> stringRolesList = new ArrayList<String>();
for (String userRole : rolesList) {
- if(!VALID_ROLE_LIST.contains(userRole.toUpperCase())){
+ if (userRole == null ||
!VALID_ROLE_LIST.contains(userRole.trim().toUpperCase())) {
throw
restErrorUtil.createRESTException("Invalid user role, please provide valid user
role.",MessageEnums.INVALID_INPUT_DATA);
}
- stringRolesList.add(userRole);
+ stringRolesList.add(userRole.trim().toUpperCase());
}
xUserMgr.checkAccessRoles(stringRolesList);
rangerBizUtil.blockAuditorRoleUser();
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
index 973936239..61c781090 100755
--- a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
@@ -848,17 +848,15 @@ private boolean hasAccessToGetUserInfo(VXUser
requestedVXUser) {
if (userSession != null && userSession.getLoginId() != null) {
VXUser loggedInVXUser =
xUserService.getXUserByUserName(userSession.getLoginId());
if (requestedVXUser != null &&
CollectionUtils.isNotEmpty(requestedVXUser.getUserRoleList()) && loggedInVXUser
!= null && loggedInVXUser.getUserRoleList().size() == 1) {
- if
(loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) {
- return
requestedVXUser.getId().equals(loggedInVXUser.getId()) ? true : false;
- } else if
(loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN) ||
loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR))
{
- if
(requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN) ||
requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)
|| requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) {
- return true;
- }
- } else if
(loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) ||
loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
- if
(loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) &&
"rangerusersync".equalsIgnoreCase(userSession.getLoginId())) {
- return true;
- } else if
(requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) ||
requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)
|| requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER)) {
+ if
(StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(),
RangerConstants.ROLE_USER)) {
+ return
requestedVXUser.getId().equals(loggedInVXUser.getId());
+ } else if
(StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(),
RangerConstants.ROLE_KEY_ADMIN) ||
StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(),
RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ return
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_KEY_ADMIN) ||
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_KEY_ADMIN_AUDITOR) ||
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_USER);
+ } else if
(StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(),
RangerConstants.ROLE_SYS_ADMIN) ||
StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(),
RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ if
(StringUtil.containsIgnoreCase(loggedInVXUser.getUserRoleList(),
RangerConstants.ROLE_SYS_ADMIN) &&
"rangerusersync".equalsIgnoreCase(userSession.getLoginId())) {
return true;
+ } else {
+ return
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_SYS_ADMIN) ||
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_ADMIN_AUDITOR) ||
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_USER);
}
}
}
@@ -1502,9 +1500,9 @@ public void checkAccessRoles(List<String>
stringRolesList) {
throw
restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" +
(session != null ? session.getXXPortalUser().getId() : "Not Logged In") + "
,isn't permitted to perform the action.");
} else {
if
(!"rangerusersync".equals(session.getXXPortalUser().getLoginId())) {// new
logic for rangerusersync user
- if (session.isUserAdmin() &&
(stringRolesList.contains(RangerConstants.ROLE_KEY_ADMIN) ||
stringRolesList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR))) {
+ if (session.isUserAdmin() &&
(StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_KEY_ADMIN)
|| StringUtil.containsIgnoreCase(stringRolesList,
RangerConstants.ROLE_KEY_ADMIN_AUDITOR))) {
throw
restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" +
(session != null ? session.getXXPortalUser().getId() : "") + " isn't permitted
to perform the action.");
- } else if (session.isKeyAdmin() &&
(stringRolesList.contains(RangerConstants.ROLE_SYS_ADMIN) ||
stringRolesList.contains(RangerConstants.ROLE_ADMIN_AUDITOR))) {
+ } else if (session.isKeyAdmin() &&
(StringUtil.containsIgnoreCase(stringRolesList, RangerConstants.ROLE_SYS_ADMIN)
|| StringUtil.containsIgnoreCase(stringRolesList,
RangerConstants.ROLE_ADMIN_AUDITOR))) {
throw
restErrorUtil.create403RESTException("Permission denied. LoggedInUser=" +
(session != null ? session.getXXPortalUser().getId() : "") + " isn't permitted
to perform the action.");
}
}
diff --git
a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
index 275c883c5..870e35664 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/StringUtil.java
@@ -23,6 +23,7 @@
import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
+import java.util.Collection;
import java.util.HashMap;
import java.util.List;
import java.util.regex.Matcher;
@@ -258,4 +259,12 @@ public static String getUTFEncodedString(String username)
throws UnsupportedEnco
return URLEncoder.encode(username,
StandardCharsets.UTF_8.toString());
}
+ public static boolean containsIgnoreCase(Collection<String> values,
String str) {
+ if (values != null && str != null) {
+ return values.stream().anyMatch(str::equalsIgnoreCase);
+ }
+
+ return false;
+ }
+
}
