This is an automated email from the ASF dual-hosted git repository.
kumaab pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new b39c559b3 RANGER-5809: Use Ranger Admin secure endpoints by default in
plugins (#1259)
b39c559b3 is described below
commit b39c559b3d9f55966729f1bd367bebc868c2034a
Author: Abhishek Kumar <[email protected]>
AuthorDate: Tue Sep 29 13:08:38 2026 -0700
RANGER-5809: Use Ranger Admin secure endpoints by default in plugins (#1259)
---
.../admin/client/AbstractRangerAdminClient.java | 3 +-
.../client/TestAbstractRangerAdminClient.java | 42 +++++++++
.../admin/client/TestRangerAdminRESTClient.java | 103 ++++++++++++++-------
.../knox/ranger-knox-plugin-install.properties | 2 +-
.../client/TestRangerAdminJersey2RESTClient.java | 61 +++++++-----
5 files changed, 152 insertions(+), 59 deletions(-)
diff --git
a/agents-common/src/main/java/org/apache/ranger/admin/client/AbstractRangerAdminClient.java
b/agents-common/src/main/java/org/apache/ranger/admin/client/AbstractRangerAdminClient.java
index 551111f0c..dc542f25b 100644
---
a/agents-common/src/main/java/org/apache/ranger/admin/client/AbstractRangerAdminClient.java
+++
b/agents-common/src/main/java/org/apache/ranger/admin/client/AbstractRangerAdminClient.java
@@ -58,7 +58,8 @@ public void init(String serviceName, String appId, String
configPropertyPrefix,
this.gson = gson;
this.forceNonKerberos =
config.getBoolean(configPropertyPrefix + ".forceNonKerberos", false);
- this.forceSecureEndpointAccess =
config.getBoolean(configPropertyPrefix + ".forceSecureEndpointAccess", false);
+ /* secure endpoints by default; Using non-secure endpoints will
require explicit setting of forceSecureEndpointAccess=false */
+ this.forceSecureEndpointAccess =
config.getBoolean(configPropertyPrefix + ".forceSecureEndpointAccess", true);
}
@Override
diff --git
a/agents-common/src/test/java/org/apache/ranger/admin/client/TestAbstractRangerAdminClient.java
b/agents-common/src/test/java/org/apache/ranger/admin/client/TestAbstractRangerAdminClient.java
index 549051b7d..4dfd962b6 100644
---
a/agents-common/src/test/java/org/apache/ranger/admin/client/TestAbstractRangerAdminClient.java
+++
b/agents-common/src/test/java/org/apache/ranger/admin/client/TestAbstractRangerAdminClient.java
@@ -21,6 +21,7 @@
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.ranger.audit.provider.MiscUtil;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.MethodOrderer;
import org.junit.jupiter.api.Test;
@@ -104,4 +105,45 @@ public void test04_isSecureEndpointAccess() {
c.init("svc", "app", "ranger.plugin", cfg);
Assertions.assertTrue(c.isAuthenticationEnabled());
}
+
+ @Test
+ public void test05_secureEndpointAccessIsDefault() {
+ DummyClient c = new DummyClient();
+ c.init("svc", "app", "p", new Configuration(false));
+ Assertions.assertTrue(c.isAuthenticationEnabled());
+ }
+
+ @Test
+ public void
test06_forceNonKerberos_keepsSecureEndpointAccessUnlessDisabled() {
+ DummyClient c = new DummyClient();
+ Configuration cfg = new Configuration(false);
+ cfg.setBoolean("p.forceNonKerberos", true);
+ c.init("svc", "app", "p", cfg);
+ Assertions.assertTrue(c.isAuthenticationEnabled());
+
+ cfg.setBoolean("p.forceSecureEndpointAccess", false);
+ c.init("svc", "app", "p", cfg);
+ Assertions.assertFalse(c.isAuthenticationEnabled());
+ }
+
+ @Test
+ public void test07_secureEndpointAccessDisabled_followsKerberos() {
+ DummyClient c = new DummyClient();
+ Configuration cfg = new Configuration(false);
+ cfg.setBoolean("p.forceSecureEndpointAccess", false);
+ c.init("svc", "app", "p", cfg);
+
+ UserGroupInformation ugi = Mockito.mock(UserGroupInformation.class);
+ try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class);
+ MockedStatic<UserGroupInformation> ugiStatic =
Mockito.mockStatic(UserGroupInformation.class)) {
+ misc.when(MiscUtil::getUGILoginUser).thenReturn(ugi);
+
ugiStatic.when(UserGroupInformation::isSecurityEnabled).thenReturn(true);
+
+ Mockito.when(ugi.hasKerberosCredentials()).thenReturn(true);
+ Assertions.assertTrue(c.isAuthenticationEnabled());
+
+ Mockito.when(ugi.hasKerberosCredentials()).thenReturn(false);
+ Assertions.assertFalse(c.isAuthenticationEnabled());
+ }
+ }
}
diff --git
a/agents-common/src/test/java/org/apache/ranger/admin/client/TestRangerAdminRESTClient.java
b/agents-common/src/test/java/org/apache/ranger/admin/client/TestRangerAdminRESTClient.java
index 08f0d6feb..1ffd1731b 100644
---
a/agents-common/src/test/java/org/apache/ranger/admin/client/TestRangerAdminRESTClient.java
+++
b/agents-common/src/test/java/org/apache/ranger/admin/client/TestRangerAdminRESTClient.java
@@ -320,14 +320,11 @@ public void
test10_secureModeBranches_usePrivilegedAction() throws Exception {
RangerRESTClient rest = Mockito.mock(RangerRESTClient.class);
setPrivateField(client, "restClient", rest);
- UserGroupInformation ugi = Mockito.mock(UserGroupInformation.class);
- try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class);
- MockedStatic<UserGroupInformation> ugiStatic =
Mockito.mockStatic(UserGroupInformation.class)) {
- misc.when(MiscUtil::getUGILoginUser).thenReturn(ugi);
-
ugiStatic.when(UserGroupInformation::isSecurityEnabled).thenReturn(true);
- Mockito.when(ugi.hasKerberosCredentials()).thenReturn(true);
-
+ try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class))
{
Assertions.assertNull(client.getServicePoliciesIfUpdated(1L, 2L));
+
+ misc.verify(() ->
MiscUtil.executePrivilegedAction(Mockito.<PrivilegedExceptionAction<Response>>any()));
+ Mockito.verify(rest, Mockito.never()).get(Mockito.anyString(),
Mockito.anyMap(), Mockito.any());
}
}
@@ -582,6 +579,8 @@ public void test19_grantAccess_branches() throws Exception {
Mockito.when(ok.getStatus()).thenReturn(200);
Mockito.when(rest.post(Mockito.anyString(), Mockito.anyMap(),
Mockito.any(), Mockito.isNull())).thenReturn(ok);
client.grantAccess(req);
+
+ Mockito.verify(rest,
Mockito.times(4)).post(Mockito.eq("/service/plugins/secure/services/grant/svc"),
Mockito.anyMap(), Mockito.any(), Mockito.isNull());
}
@Test
@@ -624,6 +623,8 @@ public void test20_revokeAccess_branches() throws Exception
{
Mockito.when(ok.getStatus()).thenReturn(200);
Mockito.when(rest.post(Mockito.anyString(), Mockito.anyMap(),
Mockito.any(), Mockito.isNull())).thenReturn(ok);
client.revokeAccess(req);
+
+ Mockito.verify(rest,
Mockito.times(4)).post(Mockito.eq("/service/plugins/secure/services/revoke/svc"),
Mockito.anyMap(), Mockito.any(), Mockito.isNull());
}
@Test
@@ -959,12 +960,7 @@ public void
test36_getRolesIfUpdated_secureMode_usesSecureUrl() throws Exception
RangerRESTClient rest = Mockito.mock(RangerRESTClient.class);
setPrivateField(client, "restClient", rest);
- UserGroupInformation ugi = Mockito.mock(UserGroupInformation.class);
- try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class);
- MockedStatic<UserGroupInformation> ugiStatic =
Mockito.mockStatic(UserGroupInformation.class)) {
- misc.when(MiscUtil::getUGILoginUser).thenReturn(ugi);
-
ugiStatic.when(UserGroupInformation::isSecurityEnabled).thenReturn(true);
- Mockito.when(ugi.hasKerberosCredentials()).thenReturn(true);
+ try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class))
{
misc.when(() ->
MiscUtil.executePrivilegedAction(Mockito.<PrivilegedExceptionAction<Response>>any()))
.thenAnswer(inv -> {
PrivilegedExceptionAction<Response> action =
inv.getArgument(0);
@@ -992,12 +988,7 @@ public void
test37_getServiceTagsIfUpdated_secureMode_usesSecureUrl() throws Exc
RangerRESTClient rest = Mockito.mock(RangerRESTClient.class);
setPrivateField(client, "restClient", rest);
- UserGroupInformation ugi = Mockito.mock(UserGroupInformation.class);
- try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class);
- MockedStatic<UserGroupInformation> ugiStatic =
Mockito.mockStatic(UserGroupInformation.class)) {
- misc.when(MiscUtil::getUGILoginUser).thenReturn(ugi);
-
ugiStatic.when(UserGroupInformation::isSecurityEnabled).thenReturn(true);
- Mockito.when(ugi.hasKerberosCredentials()).thenReturn(true);
+ try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class))
{
misc.when(() ->
MiscUtil.executePrivilegedAction(Mockito.<PrivilegedExceptionAction<Response>>any()))
.thenAnswer(inv -> {
PrivilegedExceptionAction<Response> action =
inv.getArgument(0);
@@ -1025,12 +1016,7 @@ public void
test38_getUserStoreIfUpdated_secureMode_usesSecureUrl() throws Excep
RangerRESTClient rest = Mockito.mock(RangerRESTClient.class);
setPrivateField(client, "restClient", rest);
- UserGroupInformation ugi = Mockito.mock(UserGroupInformation.class);
- try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class);
- MockedStatic<UserGroupInformation> ugiStatic =
Mockito.mockStatic(UserGroupInformation.class)) {
- misc.when(MiscUtil::getUGILoginUser).thenReturn(ugi);
-
ugiStatic.when(UserGroupInformation::isSecurityEnabled).thenReturn(true);
- Mockito.when(ugi.hasKerberosCredentials()).thenReturn(true);
+ try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class))
{
misc.when(() ->
MiscUtil.executePrivilegedAction(Mockito.<PrivilegedExceptionAction<Response>>any()))
.thenAnswer(inv -> {
PrivilegedExceptionAction<Response> action =
inv.getArgument(0);
@@ -1058,12 +1044,7 @@ public void
test39_getGdsInfoIfUpdated_secureMode_usesSecureUrl() throws Excepti
RangerRESTClient rest = Mockito.mock(RangerRESTClient.class);
setPrivateField(client, "restClient", rest);
- UserGroupInformation ugi = Mockito.mock(UserGroupInformation.class);
- try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class);
- MockedStatic<UserGroupInformation> ugiStatic =
Mockito.mockStatic(UserGroupInformation.class)) {
- misc.when(MiscUtil::getUGILoginUser).thenReturn(ugi);
-
ugiStatic.when(UserGroupInformation::isSecurityEnabled).thenReturn(true);
- Mockito.when(ugi.hasKerberosCredentials()).thenReturn(true);
+ try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class))
{
misc.when(() ->
MiscUtil.executePrivilegedAction(Mockito.<PrivilegedExceptionAction<Response>>any()))
.thenAnswer(inv -> {
PrivilegedExceptionAction<Response> action =
inv.getArgument(0);
@@ -1083,11 +1064,12 @@ public void
test39_getGdsInfoIfUpdated_secureMode_usesSecureUrl() throws Excepti
}
@Test
- public void test40_forceNonKerberos_disablesSecureMode_forRolesEndpoint()
throws Exception {
+ public void
test40_secureEndpointAccessDisabled_withForceNonKerberos_usesNonSecureRolesUrl()
throws Exception {
RangerAdminRESTClient client = new RangerAdminRESTClient();
Configuration cfg = new Configuration(false);
cfg.set("p.policy.rest.url", "http://localhost:6080";);
cfg.setBoolean("p.forceNonKerberos", true);
+ cfg.setBoolean("p.forceSecureEndpointAccess", false);
client.init("svc", "app", "p", cfg);
RangerRESTClient rest = Mockito.mock(RangerRESTClient.class);
setPrivateField(client, "restClient", rest);
@@ -1107,4 +1089,61 @@ public void
test40_forceNonKerberos_disablesSecureMode_forRolesEndpoint() throws
Assertions.assertEquals("/service/roles/download/svc",
url.getValue());
}
}
+
+ @Test
+ public void test41_defaultConfig_withoutKerberos_usesSecureUrl() throws
Exception {
+ RangerAdminRESTClient client = new RangerAdminRESTClient();
+ Configuration cfg = new Configuration(false);
+ cfg.set("p.policy.rest.url", "http://localhost:6080";);
+ client.init("svc", "app", "p", cfg);
+ RangerRESTClient rest = Mockito.mock(RangerRESTClient.class);
+ setPrivateField(client, "restClient", rest);
+
+ try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class))
{
+ misc.when(() ->
MiscUtil.executePrivilegedAction(Mockito.<PrivilegedExceptionAction<Response>>any()))
+ .thenAnswer(inv -> {
+ PrivilegedExceptionAction<Response> action =
inv.getArgument(0);
+ return action.run();
+ });
+
+ Response notModified = Mockito.mock(Response.class);
+ Mockito.when(notModified.getStatus()).thenReturn(304);
+ Mockito.when(rest.get(Mockito.anyString(), Mockito.anyMap(),
Mockito.any())).thenReturn(notModified);
+
+ Assertions.assertNull(client.getServicePoliciesIfUpdated(1L, 2L));
+
+ ArgumentCaptor<String> url = ArgumentCaptor.forClass(String.class);
+ Mockito.verify(rest).get(url.capture(), Mockito.anyMap(),
Mockito.any());
+
Assertions.assertEquals("/service/plugins/secure/policies/download/svc",
url.getValue());
+ }
+ }
+
+ @Test
+ public void
test42_secureEndpointAccessDisabled_withoutKerberos_usesNonSecureUrl() throws
Exception {
+ RangerAdminRESTClient client = new RangerAdminRESTClient();
+ Configuration cfg = new Configuration(false);
+ cfg.set("p.policy.rest.url", "http://localhost:6080";);
+ cfg.setBoolean("p.forceSecureEndpointAccess", false);
+ client.init("svc", "app", "p", cfg);
+ RangerRESTClient rest = Mockito.mock(RangerRESTClient.class);
+ setPrivateField(client, "restClient", rest);
+
+ UserGroupInformation ugi = Mockito.mock(UserGroupInformation.class);
+ try (MockedStatic<MiscUtil> misc = Mockito.mockStatic(MiscUtil.class);
+ MockedStatic<UserGroupInformation> ugiStatic =
Mockito.mockStatic(UserGroupInformation.class)) {
+ misc.when(MiscUtil::getUGILoginUser).thenReturn(ugi);
+
ugiStatic.when(UserGroupInformation::isSecurityEnabled).thenReturn(false);
+
+ Response notModified = Mockito.mock(Response.class);
+ Mockito.when(notModified.getStatus()).thenReturn(304);
+ Mockito.when(rest.get(Mockito.anyString(), Mockito.anyMap(),
Mockito.any())).thenReturn(notModified);
+
+ Assertions.assertNull(client.getServicePoliciesIfUpdated(1L, 2L));
+
+ ArgumentCaptor<String> url = ArgumentCaptor.forClass(String.class);
+ Mockito.verify(rest).get(url.capture(), Mockito.anyMap(),
Mockito.any());
+ Assertions.assertEquals("/service/plugins/policies/download/svc",
url.getValue());
+ misc.verify(() ->
MiscUtil.executePrivilegedAction(Mockito.<PrivilegedExceptionAction<Response>>any()),
Mockito.never());
+ }
+ }
}
diff --git
a/dev-support/ranger-docker/scripts/knox/ranger-knox-plugin-install.properties
b/dev-support/ranger-docker/scripts/knox/ranger-knox-plugin-install.properties
index 3b7d99b54..b5fac7e35 100644
---
a/dev-support/ranger-docker/scripts/knox/ranger-knox-plugin-install.properties
+++
b/dev-support/ranger-docker/scripts/knox/ranger-knox-plugin-install.properties
@@ -13,7 +13,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-POLICY_MGR_URL=http://ranger:6080
+POLICY_MGR_URL=http://ranger.rangernw:6080
REPOSITORY_NAME=dev_knox
COMPONENT_INSTALL_DIR_NAME=/opt/knox
diff --git
a/knox-agent/src/test/java/org/apache/ranger/admin/client/TestRangerAdminJersey2RESTClient.java
b/knox-agent/src/test/java/org/apache/ranger/admin/client/TestRangerAdminJersey2RESTClient.java
index c88a70586..9ba9e5958 100644
---
a/knox-agent/src/test/java/org/apache/ranger/admin/client/TestRangerAdminJersey2RESTClient.java
+++
b/knox-agent/src/test/java/org/apache/ranger/admin/client/TestRangerAdminJersey2RESTClient.java
@@ -59,9 +59,7 @@
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.mockito.Mockito.doReturn;
import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.spy;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
@@ -90,7 +88,6 @@ private Configuration buildBaseConfig(String baseUrl) {
conf.set(PREFIX + ".access.cluster.name", "");
conf.setBoolean(PREFIX + ".policy.rest.client.cookie.enabled", true);
conf.set(PREFIX + ".policy.rest.client.session.cookie.name",
COOKIE_NAME);
- conf.setBoolean(PREFIX + ".forceNonKerberos", true);
return conf;
}
@@ -324,7 +321,7 @@ public void test06_grant_and_revoke_access_paths() throws
Exception {
}
@Test
- public void test07_getUserStore_paths_non_secure() throws Exception {
+ public void test07_getUserStore_paths() throws Exception {
Client clientMock = mock(Client.class);
WebTarget targetMock = mock(WebTarget.class);
Invocation.Builder builderMock = mock(Invocation.Builder.class);
@@ -334,7 +331,6 @@ public void test07_getUserStore_paths_non_secure() throws
Exception {
Response response500 = mock(Response.class);
Configuration conf = buildBaseConfig(BASE_URL);
- conf.setBoolean(PREFIX + ".forceNonKerberos", true);
RangerAdminJersey2RESTClient underTest = new
RangerAdminJersey2RESTClient();
initWithMockClient(underTest, clientMock, conf);
@@ -414,11 +410,8 @@ public void test12_policies_secure_mode_uses_secure_url()
throws Exception {
Response response200 = mock(Response.class);
Configuration conf = buildBaseConfig(BASE_URL);
- conf.setBoolean(PREFIX + ".forceNonKerberos", false);
- RangerAdminJersey2RESTClient underTest = spy(new
RangerAdminJersey2RESTClient());
- underTest.client = clientMock;
- underTest.init(SERVICE, APPID, PREFIX, conf);
- doReturn(true).when(underTest).isKerberosEnabled();
+ RangerAdminJersey2RESTClient underTest = new
RangerAdminJersey2RESTClient();
+ initWithMockClient(underTest, clientMock, conf);
Map<String, NewCookie> cookies = new HashMap<>();
cookies.put(COOKIE_NAME, new NewCookie(COOKIE_NAME, "v"));
@@ -453,11 +446,8 @@ public void test13_tags_secure_mode_uses_secure_url()
throws Exception {
Response response200 = mock(Response.class);
Configuration conf = buildBaseConfig(BASE_URL);
- conf.setBoolean(PREFIX + ".forceNonKerberos", false);
- RangerAdminJersey2RESTClient underTest = spy(new
RangerAdminJersey2RESTClient());
- underTest.client = clientMock;
- underTest.init(SERVICE, APPID, PREFIX, conf);
- doReturn(true).when(underTest).isKerberosEnabled();
+ RangerAdminJersey2RESTClient underTest = new
RangerAdminJersey2RESTClient();
+ initWithMockClient(underTest, clientMock, conf);
Map<String, NewCookie> cookies = new HashMap<>();
cookies.put(COOKIE_NAME, new NewCookie(COOKIE_NAME, "v"));
@@ -491,11 +481,8 @@ public void test14_roles_secure_mode_uses_secure_url()
throws Exception {
Response response200 = mock(Response.class);
Configuration conf = buildBaseConfig(BASE_URL);
- conf.setBoolean(PREFIX + ".forceNonKerberos", false);
- RangerAdminJersey2RESTClient underTest = spy(new
RangerAdminJersey2RESTClient());
- underTest.client = clientMock;
- underTest.init(SERVICE, APPID, PREFIX, conf);
- doReturn(true).when(underTest).isKerberosEnabled();
+ RangerAdminJersey2RESTClient underTest = new
RangerAdminJersey2RESTClient();
+ initWithMockClient(underTest, clientMock, conf);
Map<String, NewCookie> cookies = new HashMap<>();
cookies.put(COOKIE_NAME, new NewCookie(COOKIE_NAME, "v"));
@@ -529,11 +516,8 @@ public void test15_userstore_secure_mode_uses_secure_url()
throws Exception {
Response response200 = mock(Response.class);
Configuration conf = buildBaseConfig(BASE_URL);
- conf.setBoolean(PREFIX + ".forceNonKerberos", false);
- RangerAdminJersey2RESTClient underTest = spy(new
RangerAdminJersey2RESTClient());
- underTest.client = clientMock;
- underTest.init(SERVICE, APPID, PREFIX, conf);
- doReturn(true).when(underTest).isKerberosEnabled();
+ RangerAdminJersey2RESTClient underTest = new
RangerAdminJersey2RESTClient();
+ initWithMockClient(underTest, clientMock, conf);
when(response200.getStatus()).thenReturn(200);
when(response200.readEntity(String.class)).thenReturn("{}");
@@ -777,4 +761,31 @@ public void test22_tags_cookie_default_and_minus1() throws
Exception {
ServiceTags third = underTest.getServiceTagsIfUpdated(1L, 2L);
assertNull(third);
}
+
+ @Test
+ public void
test23_policies_secureEndpointAccessDisabled_uses_non_secure_url() throws
Exception {
+ Client clientMock = mock(Client.class);
+ WebTarget targetMock = mock(WebTarget.class);
+ Invocation.Builder builderMock = mock(Invocation.Builder.class);
+ Response response200 = mock(Response.class);
+
+ Configuration conf = buildBaseConfig(BASE_URL);
+ conf.setBoolean(PREFIX + ".forceSecureEndpointAccess", false);
+ RangerAdminJersey2RESTClient underTest = new
RangerAdminJersey2RESTClient();
+ initWithMockClient(underTest, clientMock, conf);
+
+ when(response200.getStatus()).thenReturn(200);
+ when(response200.readEntity(String.class)).thenReturn("{}");
+
+ ArgumentCaptor<String> urlCaptor =
ArgumentCaptor.forClass(String.class);
+
+ when(clientMock.target(urlCaptor.capture())).thenReturn(targetMock);
+ when(targetMock.queryParam(ArgumentMatchers.anyString(),
ArgumentMatchers.any())).thenReturn(targetMock);
+
when(targetMock.request(MediaType.APPLICATION_JSON_TYPE)).thenReturn(builderMock);
+
when(builderMock.cookie(ArgumentMatchers.nullable(Cookie.class))).thenReturn(builderMock);
+ when(builderMock.get()).thenReturn(response200);
+
+ assertNotNull(underTest.getServicePoliciesIfUpdated(1L, 2L));
+
Assertions.assertTrue(urlCaptor.getValue().contains(RangerRESTUtils.REST_URL_POLICY_GET_FOR_SERVICE_IF_UPDATED
+ SERVICE));
+ }
}
