This is an automated email from the ASF dual-hosted git repository.
kumaab pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new a93f26817 RANGER-5807: Exclude KMS privileges from config super users
and fix RANGER-5627 related bugs (#1257)
a93f26817 is described below
commit a93f26817e945fe25c136fdf3a3fb4d476b49536
Author: Abhishek Kumar <[email protected]>
AuthorDate: Wed Sep 30 15:47:44 2026 -0700
RANGER-5807: Exclude KMS privileges from config super users and fix
RANGER-5627 related bugs (#1257)
Config super users/groups (ranger.admin.super.users/groups, RANGER-5627)
now get system admin privileges only, independent of Ranger DB roles:
- Session: the super-user flag no longer makes isKeyAdmin() and
isAuditKeyAdmin() true; key-admin and auditor flags from DB roles are
cleared for super users.
- Auditor block: blockAuditorRoleUser() no longer rejects super users.
Before, isAuditUserAdmin() and isAuditKeyAdmin() were true for every
super user, so it rejected them wherever auditors are rejected.
- Roles: super users get ROLE_SYS_ADMIN only, whatever their roles in
Ranger DB, for Spring authorities, the session and the profile.
RangerSuperUserConfig.getSuperUserRoles replaces
mergeConfigSuperUserRoles and getConfigSuperUserProfileRoles, whose
result was always ROLE_SYS_ADMIN (plus ROLE_USER, which had no
effect). A warning is logged when a super user also has a KMS role in
Ranger DB.
- KMS service-def create/update/delete follows system admin rules.
- KMS entries are excluded from access audits and the admin audit log
for super users.
- Key Manager module removed from the session of all admins (DB sys
admins are never assigned it either) and from the super-user profile.
- User visibility (hasAccessToGetUserInfo, searchXUsers,
checkUserAccessible) follows system admin rules, so KMS users are not
visible/manageable by super users. As for system admins, searchXUsers
only adds the non-KMS roles to the role filter; the per-user checks
in hasAccessToGetUserInfo and checkUserAccessible do the enforcing.
Two exceptions are kept in hasAccessToGetUserInfo: rangerusersync
(when configured as a super user) still sees all users, as it does as
a DB system admin, and a super user can always read its own user,
even if its DB role is a KMS role.
- New UserMgr.getDBRolesByLoginId returns DB portal roles without the
merged super-user roles. checkUserAccessible uses it for the target
user: before, a target that is a super user always carried
ROLE_KEY_ADMIN, so system admins could not create or update any
super-user account; now only a target with a KMS role in Ranger DB
is rejected. createDefaultAccountUser also uses it to compare the
existing roles of an external user.
- Plugin grant/revoke is not blocked by DB auditor roles for super
users. New RangerBizUtil.isConfigSuperUser keeps this exemption
limited to config super users; a DB user with both system admin and
auditor roles is still blocked, as before.
- Config descriptions updated; unit tests updated and added.
UserMgr.mapXXPortalUserToVXPortalUser replaced the role list of every
mapped user with the config super-user roles ([ROLE_SYS_ADMIN]) whenever
the logged-in session was a config super user. With the auditor block
for super users lifted in the previous commit, within a super-user
session:
- /users APIs reported every user as ROLE_SYS_ADMIN.
- UserMgr.checkAccess saw every target as a system admin, so super users
could update the profile (name, email, roles) of KMS users (key
admin / key admin auditor) through PUT /service/users, which system
admins cannot.
- Role-change bookkeeping in XUserMgr compared new roles against the
wrong existing roles (e.g. promoting a user to ROLE_SYS_ADMIN via
setUserRolesByName/ByExternalID was a no-op).
Apply the config roles only when the mapped user is the logged-in super
user; other users keep their DB roles.
---
.../scripts/ranger-admin-site-template.xml | 4 +-
.../java/org/apache/ranger/biz/RangerBizUtil.java | 60 ++++++-----
.../java/org/apache/ranger/biz/SessionMgr.java | 16 ++-
.../main/java/org/apache/ranger/biz/UserMgr.java | 93 ++++++++++-------
.../main/java/org/apache/ranger/biz/XUserMgr.java | 12 ++-
.../ranger/common/RangerSuperUserConfig.java | 38 ++-----
.../org/apache/ranger/common/UserSessionBase.java | 4 +-
.../java/org/apache/ranger/rest/AssetREST.java | 19 ++--
.../java/org/apache/ranger/rest/ServiceREST.java | 4 +-
.../java/org/apache/ranger/rest/XUserREST.java | 4 +-
.../main/resources/conf.dist/ranger-admin-site.xml | 4 +-
.../org/apache/ranger/biz/TestRangerBizUtil.java | 77 ++++++++++++--
.../java/org/apache/ranger/biz/TestSessionMgr.java | 116 +++++++++++++++++++--
.../java/org/apache/ranger/biz/TestUserMgr.java | 107 +++++++++++++++++--
.../java/org/apache/ranger/biz/TestXUserMgr.java | 62 +++++++++++
.../ranger/common/TestRangerSuperUserConfig.java | 48 +--------
.../java/org/apache/ranger/rest/TestAssetREST.java | 13 ++-
17 files changed, 484 insertions(+), 197 deletions(-)
diff --git a/security-admin/scripts/ranger-admin-site-template.xml
b/security-admin/scripts/ranger-admin-site-template.xml
index ed6211cc9..f22b8322f 100644
--- a/security-admin/scripts/ranger-admin-site-template.xml
+++ b/security-admin/scripts/ranger-admin-site-template.xml
@@ -251,11 +251,11 @@
<property>
<name>ranger.admin.super.users</name>
<value></value>
- <description>Comma-separated list of users granted full Ranger
administrative privileges at login (system admin and key admin capabilities),
independent of database roles. Empty or absent disables config-based super
users.</description>
+ <description>Comma-separated list of users granted full Ranger
administrative privileges at login (system admin capabilities), independent of
database roles. Empty or absent disables config-based super users.</description>
</property>
<property>
<name>ranger.admin.super.groups</name>
<value></value>
- <description>Comma-separated list of groups whose members are
granted full Ranger administrative privileges at login (system admin and key
admin capabilities), independent of database roles. Empty or absent disables
config-based super groups.</description>
+ <description>Comma-separated list of groups whose members are
granted full Ranger administrative privileges at login (system admin
capabilities), independent of database roles. Empty or absent disables
config-based super groups.</description>
</property>
</configuration>
diff --git
a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
index 75756e6dd..4ccb753bb 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
@@ -1041,28 +1041,20 @@ public void hasKMSPermissions(String objType, String
implClassName) {
throw restErrorUtil.createRESTException("UserSession cannot be
null, only KeyAdmin can create/update/delete " + objType,
MessageEnums.OPER_NO_PERMISSION);
}
- if (!session.isSuperUser()) {
- boolean isKmsServiceType =
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClassName);
+ boolean isKmsServiceType =
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClassName);
- if (session.isKeyAdmin() && !isKmsServiceType) {
- throw restErrorUtil.createRESTException("KeyAdmin can
create/update/delete only KMS " + objType, MessageEnums.OPER_NO_PERMISSION);
- }
+ if (session.isKeyAdmin() && !isKmsServiceType) {
+ throw restErrorUtil.createRESTException("KeyAdmin can
create/update/delete only KMS " + objType, MessageEnums.OPER_NO_PERMISSION);
+ }
- if (session.isUserAdmin() && isKmsServiceType &&
"Service-Def".equalsIgnoreCase(objType)) {
- throw restErrorUtil.createRESTException("System Admin cannot
create/update/delete KMS " + objType, MessageEnums.OPER_NO_PERMISSION);
- }
+ if (session.isUserAdmin() && isKmsServiceType &&
"Service-Def".equalsIgnoreCase(objType)) {
+ throw restErrorUtil.createRESTException("System Admin cannot
create/update/delete KMS " + objType, MessageEnums.OPER_NO_PERMISSION);
}
}
public boolean checkUserAccessible(VXUser vXUser) {
- // Config super-user (ranger.admin.super.users/groups) bypasses the
- // mutual admin/key-admin visibility restrictions below.
- if (isSuperUser()) {
- return true;
- }
-
boolean isAccessible = true;
- Collection<String> roleList =
userMgr.getRolesByLoginId(vXUser.getName());
+ Collection<String> roleList =
userMgr.getDBRolesByLoginId(vXUser.getName());
Collection<String> payloadRoles = vXUser.getUserRoleList();
if (isKeyAdmin()) {
@@ -1144,17 +1136,7 @@ public boolean isUserRangerAdmin(String username) {
}
// Config super-user when no session context (e.g. grantor checks).
- final boolean configSuperUser;
-
- if (RangerSuperUserConfig.isSuperUser(username)) {
- configSuperUser = true;
- } else if (RangerSuperUserConfig.isSuperGroupsConfigured() && xUserMgr
!= null) {
- configSuperUser = RangerSuperUserConfig.isSuperUser(username,
xUserMgr.getGroupsForUser(username));
- } else {
- configSuperUser = false;
- }
-
- if (configSuperUser) {
+ if (isConfigSuperUser(username)) {
return true;
}
@@ -1173,6 +1155,20 @@ public boolean isUserRangerAdmin(String username) {
return isAdmin;
}
+ /* True when username matches ranger.admin.super.users/groups, regardless
of
+ * the current session and of the user's DB portal roles. */
+ public boolean isConfigSuperUser(String username) {
+ if (StringUtils.isBlank(username)) {
+ return false;
+ } else if (RangerSuperUserConfig.isSuperUser(username)) {
+ return true;
+ } else if (RangerSuperUserConfig.isSuperGroupsConfigured() && xUserMgr
!= null) {
+ return RangerSuperUserConfig.isSuperUser(username,
xUserMgr.getGroupsForUser(username));
+ }
+
+ return false;
+ }
+
public boolean isHealthCheckUser(String user) {
return HEALTHCHECK_USERNAME.equalsIgnoreCase(user);
}
@@ -1238,13 +1234,15 @@ public void blockAuditorRoleUser() {
UserSessionBase session = ContextUtil.getCurrentUserSession();
if (session != null) {
- if (session.isAuditKeyAdmin() || session.isAuditUserAdmin()) {
- VXResponse vXResponse = new VXResponse();
+ if (!session.isSuperUser()) {
+ if (session.isAuditKeyAdmin() || session.isAuditUserAdmin()) {
+ VXResponse vXResponse = new VXResponse();
- vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
- vXResponse.setMsgDesc("Operation denied. LoggedInUser=" +
session.getXXPortalUser().getId() + " ,isn't permitted to perform the action.");
+ vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
+ vXResponse.setMsgDesc("Operation denied. LoggedInUser=" +
session.getXXPortalUser().getId() + " ,isn't permitted to perform the action.");
- throw restErrorUtil.generateRESTException(vXResponse);
+ throw restErrorUtil.generateRESTException(vXResponse);
+ }
}
} else {
VXResponse vXResponse = new VXResponse();
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
b/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
index 55e37fcbc..b2b6d591a 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
@@ -267,7 +267,10 @@ public void resetUserModulePermission(UserSessionBase
userSession) {
List<String> permissionList;
if (userSession.isUserAdmin()) {
- permissionList =
daoManager.getXXModuleDef().getAllModuleNames();
+ permissionList = new
ArrayList<>(daoManager.getXXModuleDef().getAllModuleNames());
+
+ // Key Manager is for key admins only, not for sys admins or
config super-users.
+ permissionList.remove(RangerConstants.MODULE_KEY_MANAGER);
} else {
permissionList =
daoManager.getXXModuleDef().findAccessibleModulesByUserId(userSession.getUserId(),
xUser.getId());
}
@@ -804,7 +807,16 @@ private void setUserRoles(UserSessionBase userSession) {
applyConfigSuperUserSessionFlags(userSession);
if (userSession.isSuperUser()) {
- strRoleList =
RangerSuperUserConfig.mergeConfigSuperUserRoles(strRoleList, true);
+ if (strRoleList.contains(RangerConstants.ROLE_KEY_ADMIN) ||
strRoleList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ logger.warn("User {} is configured as a config super-user but
has KMS role(s) {} in Ranger DB; KMS privileges are not granted to config
super-users. Remove the user from ranger.admin.super.users/groups or remove the
KMS role.", userSession.getLoginId(), strRoleList);
+ }
+
+ // Config super-users act as system admin regardless of DB portal
roles.
+ userSession.setKeyAdmin(false);
+ userSession.setAuditKeyAdmin(false);
+ userSession.setAuditUserAdmin(false);
+
+ strRoleList = RangerSuperUserConfig.getSuperUserRoles();
}
userSession.setUserRoleList(strRoleList);
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
index 63da869df..7f6b7c020 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
@@ -640,8 +640,9 @@ public VXPortalUser
mapXXPortalUserToVXPortalUser(XXPortalUser user, Collection<
if (userRoleList == null) {
userRoleList = new ArrayList<>();
- if (sess.isSuperUser()) {
-
userRoleList.addAll(RangerSuperUserConfig.getConfigSuperUserProfileRoles());
+ // Config roles apply only to the super user's own profile;
other users keep their DB roles.
+ if (sess.isSuperUser() && sess.getXXPortalUser() != null &&
sess.getXXPortalUser().getId().equals(user.getId())) {
+
userRoleList.addAll(RangerSuperUserConfig.getSuperUserRoles());
} else {
List<XXPortalUserRole> gjUserRoleList =
daoManager.getXXPortalUserRole().findByParentId(user.getId());
@@ -1018,7 +1019,7 @@ public VXPortalUser createDefaultAccountUser(VXPortalUser
userProfile) {
if (userProfile.getUserRoleList() != null &&
!userProfile.getUserRoleList().isEmpty() && ((List<String>)
userProfile.getUserRoleList()).get(0) != null) {
reqRoleList = userProfile.getUserRoleList();
- existingRoleList = this.getRolesByLoginId(loginId);
+ existingRoleList = this.getDBRolesByLoginId(loginId);
XXPortalUser xxPortalUser =
daoManager.getXXPortalUser().findByLoginId(userProfile.getLoginId());
@@ -1126,31 +1127,7 @@ public void checkAdminAccess() {
}
public Collection<String> getRolesByLoginId(String loginId) {
- if (loginId == null || loginId.trim().isEmpty()) {
- return DEFAULT_ROLE_LIST;
- }
-
- XXPortalUser xXPortalUser =
daoManager.getXXPortalUser().findByLoginId(loginId);
-
- if (xXPortalUser == null) {
- return DEFAULT_ROLE_LIST;
- }
-
- Collection<XXPortalUserRole> xXPortalUserRoles =
daoManager.getXXPortalUserRole().findByUserId(xXPortalUser.getId());
-
- if (xXPortalUserRoles == null) {
- return DEFAULT_ROLE_LIST;
- }
-
- Collection<String> roleList = new ArrayList<>();
-
- for (XXPortalUserRole role : xXPortalUserRoles) {
- if (role != null && VALID_ROLE_LIST.contains(role.getUserRole())) {
- if (!roleList.contains(role.getUserRole())) {
- roleList.add(role.getUserRole());
- }
- }
- }
+ Collection<String> roleList = findDBRolesByLoginId(loginId);
if (roleList.isEmpty()) {
return DEFAULT_ROLE_LIST;
@@ -1171,12 +1148,20 @@ public Collection<String> getRolesByLoginId(String
loginId) {
}
if (configSuperUser) {
- return RangerSuperUserConfig.mergeConfigSuperUserRoles(roleList,
false);
+ return RangerSuperUserConfig.getSuperUserRoles();
}
return roleList;
}
+ /* Portal roles stored in Ranger DB, without config super-user roles; use
when
+ * checking or updating the roles of a user other than the logged-in one.
*/
+ public Collection<String> getDBRolesByLoginId(String loginId) {
+ Collection<String> roleList = findDBRolesByLoginId(loginId);
+
+ return roleList.isEmpty() ? DEFAULT_ROLE_LIST : roleList;
+ }
+
public boolean isUserNotActive(String loginId) {
if (loginId == null || loginId.trim().isEmpty()) {
return false;
@@ -1343,7 +1328,7 @@ private void applyConfigSuperUserProfileOverrides(final
VXPortalUser userProfile
return;
}
- List<String> effectiveRoles =
RangerSuperUserConfig.getConfigSuperUserProfileRoles();
+ List<String> effectiveRoles =
RangerSuperUserConfig.getSuperUserRoles();
userProfile.setUserRoleList(effectiveRoles);
@@ -1355,14 +1340,17 @@ private void applyConfigSuperUserProfileOverrides(final
VXPortalUser userProfile
Long xUserId = xUser != null ? xUser.getId() : null;
for (XXModuleDef moduleDef : moduleDefs) {
- VXUserPermission vxUserPermission = new VXUserPermission();
+ // Config super-users get sys-admin modules only.
+ if
(!RangerConstants.MODULE_KEY_MANAGER.equals(moduleDef.getModule())) {
+ VXUserPermission vxUserPermission = new VXUserPermission();
- vxUserPermission.setModuleId(moduleDef.getId());
- vxUserPermission.setModuleName(moduleDef.getModule());
- vxUserPermission.setUserId(xUserId);
- vxUserPermission.setIsAllowed(RangerCommonEnums.IS_ALLOWED);
+ vxUserPermission.setModuleId(moduleDef.getId());
+ vxUserPermission.setModuleName(moduleDef.getModule());
+ vxUserPermission.setUserId(xUserId);
+
vxUserPermission.setIsAllowed(RangerCommonEnums.IS_ALLOWED);
- effectiveModules.add(vxUserPermission);
+ effectiveModules.add(vxUserPermission);
+ }
}
}
@@ -1607,11 +1595,42 @@ private String encodeString(String text, String salt,
String algorithm) {
}
}
+ private Collection<String> findDBRolesByLoginId(String loginId) {
+ Collection<String> roleList = new ArrayList<>();
+
+ if (loginId == null || loginId.trim().isEmpty()) {
+ return roleList;
+ }
+
+ XXPortalUser xXPortalUser =
daoManager.getXXPortalUser().findByLoginId(loginId);
+
+ if (xXPortalUser == null) {
+ return roleList;
+ }
+
+ Collection<XXPortalUserRole> xXPortalUserRoles =
daoManager.getXXPortalUserRole().findByUserId(xXPortalUser.getId());
+
+ if (xXPortalUserRoles != null) {
+ for (XXPortalUserRole role : xXPortalUserRoles) {
+ if (role != null &&
VALID_ROLE_LIST.contains(role.getUserRole()) &&
!roleList.contains(role.getUserRole())) {
+ roleList.add(role.getUserRole());
+ }
+ }
+ }
+
+ return roleList;
+ }
+
private boolean hasAccessToGetUserInfo(final VXPortalUser requestedVXUser)
{
UserSessionBase userSession = ContextUtil.getCurrentUserSession();
if (userSession != null && userSession.isSuperUser()) {
- return true;
+ /* rangerusersync must see all users; a super user can always see
self. */
+ if ("rangerusersync".equalsIgnoreCase(userSession.getLoginId()) ||
StringUtils.equals(requestedVXUser.getLoginId(), userSession.getLoginId())) {
+ return true;
+ }
+
+ return
requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) ||
requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)
|| requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER);
}
if (userSession != null && userSession.getLoginId() != null) {
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
index 3e97601ab..6bd205d9b 100755
--- a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
@@ -3322,7 +3322,17 @@ private boolean hasAccessToGetUserInfo(VXUser
requestedVXUser) {
UserSessionBase userSession = ContextUtil.getCurrentUserSession();
if (userSession != null && userSession.isSuperUser()) {
- return true;
+ if (requestedVXUser == null ||
CollectionUtils.isEmpty(requestedVXUser.getUserRoleList())) {
+ return false;
+ }
+
+ /* rangerusersync must see all users; a super user can always see
self,
+ * even when its DB role is a KMS role. */
+ if ("rangerusersync".equalsIgnoreCase(userSession.getLoginId()) ||
StringUtils.equals(requestedVXUser.getName(), userSession.getLoginId())) {
+ return true;
+ }
+
+ return
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_SYS_ADMIN) ||
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_ADMIN_AUDITOR) ||
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_USER);
}
if (userSession != null && userSession.getLoginId() != null) {
diff --git
a/security-admin/src/main/java/org/apache/ranger/common/RangerSuperUserConfig.java
b/security-admin/src/main/java/org/apache/ranger/common/RangerSuperUserConfig.java
index d2bc2f65e..e78192452 100644
---
a/security-admin/src/main/java/org/apache/ranger/common/RangerSuperUserConfig.java
+++
b/security-admin/src/main/java/org/apache/ranger/common/RangerSuperUserConfig.java
@@ -23,10 +23,8 @@
import org.apache.commons.lang3.StringUtils;
import java.util.ArrayList;
-import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
-import java.util.LinkedHashSet;
import java.util.List;
import java.util.Set;
@@ -34,8 +32,7 @@
* Configuration-based Ranger Admin superusers and super groups.
* When {@code ranger.admin.super.users} or
* {@code ranger.admin.super.groups} are set, matching authenticated users
- * receive full Ranger administrative privileges (system admin and key admin
- * capabilities) without requiring corresponding roles in the Ranger database.
+ * receive full Ranger administrative privileges (system admin) without
requiring corresponding roles in the Ranger database.
*/
public final class RangerSuperUserConfig {
private static volatile RangerSuperUserConfig instance;
@@ -117,35 +114,14 @@ public static boolean isSuperUser(final String userName,
final Set<String> userG
}
/**
- * Merges config super-user admin roles with existing portal roles.
- * Used for Spring Security authentication and session role lists.
+ * Portal roles of a config super-user: {@code ROLE_SYS_ADMIN} only,
whatever
+ * its roles in the Ranger DB. Used for Spring Security authorities, the
+ * session role list and {@code GET /users/profile}.
*
- * @param existingRoles DB portal roles (may be null)
- * @param includeRoleUser when true, adds {@code ROLE_USER} (session lists)
- * @return merged role list with stable ordering
+ * @return a new, modifiable list
*/
- public static List<String> mergeConfigSuperUserRoles(final
Collection<String> existingRoles, final boolean includeRoleUser) {
- LinkedHashSet<String> merged = new LinkedHashSet<>();
-
- merged.add(RangerConstants.ROLE_SYS_ADMIN);
- merged.add(RangerConstants.ROLE_KEY_ADMIN);
-
- if (includeRoleUser) {
- merged.add(RangerConstants.ROLE_USER);
- }
-
- if (existingRoles != null) {
- merged.addAll(existingRoles);
- }
-
- return new ArrayList<>(merged);
- }
-
- /**
- * Admin roles exposed on {@code GET /user/profile} for config super-users.
- */
- public static List<String> getConfigSuperUserProfileRoles() {
- return mergeConfigSuperUserRoles(Collections.emptyList(), false);
+ public static List<String> getSuperUserRoles() {
+ return new
ArrayList<>(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN));
}
private static Set<String> parsePropertyValues(final String[] values) {
diff --git
a/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
b/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
index 08bb55dde..3847fee2e 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
@@ -122,7 +122,7 @@ public void setClientTimeOffsetInMinute(int
clientTimeOffsetInMinute) {
}
public boolean isKeyAdmin() {
- return superUser || keyAdmin;
+ return keyAdmin;
}
public void setKeyAdmin(boolean keyAdmin) {
@@ -149,7 +149,7 @@ public boolean isSingleRoleUserSession() {
}
public boolean isAuditKeyAdmin() {
- return superUser || auditKeyAdmin;
+ return auditKeyAdmin;
}
public void setAuditKeyAdmin(boolean auditKeyAdmin) {
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
index 9104cd1e4..0e93fd9af 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
@@ -568,17 +568,14 @@ public VXAccessAuditList getAccessLogs(@Context
HttpServletRequest request, @Que
searchUtil.extractString(request, searchCriteria, "datasets",
"DataSets", null);
searchUtil.extractLong(request, searchCriteria, "datasetIds", "Dataset
Ids");
- // Config super-users see all audit logs (same as full admin), not
KMS-only filtering.
- if (!msBizUtil.isSuperUser()) {
- XXServiceDef xxServiceDef =
daoManager.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME);
-
- if (xxServiceDef != null) {
- // Key admin / audit key admin: KMS audits only; others:
exclude KMS.
- if (msBizUtil.isKeyAdmin() || msBizUtil.isAuditKeyAdmin()) {
- searchCriteria.getParamList().put("repoType",
xxServiceDef.getId());
- } else if (xxServiceDef != null) {
- searchCriteria.getParamList().put("-repoType",
xxServiceDef.getId());
- }
+ XXServiceDef xxServiceDef =
daoManager.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME);
+
+ if (xxServiceDef != null) {
+ // Key admin / audit key admin: KMS audits only; others: exclude
KMS.
+ if (msBizUtil.isKeyAdmin() || msBizUtil.isAuditKeyAdmin()) {
+ searchCriteria.getParamList().put("repoType",
xxServiceDef.getId());
+ } else if (xxServiceDef != null) {
+ searchCriteria.getParamList().put("-repoType",
xxServiceDef.getId());
}
}
diff --git
a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
index 25534c214..5197b2aff 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
@@ -1190,7 +1190,7 @@ public RESTResponse grantAccess(@PathParam("serviceName")
String serviceName, Gr
Set<String> accessTypes =
grantRequest.getAccessTypes();
VXUser vxUser =
xUserService.getXUserByUserName(userName);
- if
(vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ if
((vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) &&
!bizUtil.isConfigSuperUser(userName)) {
VXResponse vXResponse = new VXResponse();
vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
@@ -1435,7 +1435,7 @@ public RESTResponse
revokeAccess(@PathParam("serviceName") String serviceName, G
Set<String> accessTypes =
revokeRequest.getAccessTypes();
VXUser vxUser =
xUserService.getXUserByUserName(userName);
- if
(vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ if
((vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) &&
!bizUtil.isConfigSuperUser(userName)) {
VXResponse vXResponse = new VXResponse();
vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
index 1e8d24d0a..0b93b6c4f 100755
--- a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
@@ -438,8 +438,8 @@ public VXUserList searchXUsers(@Context HttpServletRequest
request, @QueryParam(
if (userSession != null && userSession.getLoginId() != null) {
VXUser loggedInVXUser =
xUserService.getXUserByUserName(userSession.getLoginId());
- if (loggedInVXUser != null &&
loggedInVXUser.getUserRoleList().size() == 1) {
- if
(loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) ||
loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ if (loggedInVXUser != null && (userSession.isSuperUser() ||
loggedInVXUser.getUserRoleList().size() == 1)) {
+ if (userSession.isSuperUser() ||
loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) ||
loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
boolean hasRole = false;
hasRole =
!userRolesList.contains(RangerConstants.ROLE_SYS_ADMIN) ?
userRolesList.add(RangerConstants.ROLE_SYS_ADMIN) : hasRole;
diff --git a/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
b/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
index 17c9aec1c..4309c3c36 100644
--- a/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
+++ b/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
@@ -492,12 +492,12 @@
<property>
<name>ranger.admin.super.users</name>
<value></value>
- <description>Comma-separated list of users granted full
Ranger administrative privileges at login (system admin and key admin
capabilities), independent of database roles. Empty or absent disables
config-based super users.</description>
+ <description>Comma-separated list of users granted full
Ranger administrative privileges at login (system admin capabilities),
independent of database roles. Empty or absent disables config-based super
users.</description>
</property>
<property>
<name>ranger.admin.super.groups</name>
<value></value>
- <description>Comma-separated list of groups whose
members are granted full Ranger administrative privileges at login (system
admin and key admin capabilities), independent of database roles. Empty or
absent disables config-based super groups.</description>
+ <description>Comma-separated list of groups whose
members are granted full Ranger administrative privileges at login (system
admin capabilities), independent of database roles. Empty or absent disables
config-based super groups.</description>
</property>
<property>
<name>xasecure.audit.jaas.Client.loginModuleName</name>
diff --git
a/security-admin/src/test/java/org/apache/ranger/biz/TestRangerBizUtil.java
b/security-admin/src/test/java/org/apache/ranger/biz/TestRangerBizUtil.java
index bc94001ef..4965c423b 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestRangerBizUtil.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestRangerBizUtil.java
@@ -76,6 +76,7 @@
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
+import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
@@ -453,7 +454,7 @@ public void testMatchHivePolicy() {
public void
testCheckUserAccessibleThrowErrorForKeyAdminAndUserRoleSysAdmin() {
Collection<String> roleList = new ArrayList<>();
roleList.add(RangerConstants.ROLE_SYS_ADMIN);
- Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(
+ Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(
roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
@@ -477,7 +478,7 @@ public void
testCheckUserAccessibleThrowErrorForKeyAdminAndUserRoleSysAdmin() {
public void
testCheckUserAccessibleThrowErrorForKeyAdminAndUserRoleAdminAuditor() {
Collection<String> roleList = new ArrayList<>();
roleList.add(RangerConstants.ROLE_ADMIN_AUDITOR);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(roleList);
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
currentUserSession.setKeyAdmin(true);
@@ -501,7 +502,7 @@ public void testCheckUserAccessibleSuccessForKeyAdmin() {
Collection<String> roleList = new ArrayList<>();
roleList.add(RangerConstants.ROLE_KEY_ADMIN);
roleList.add(RangerConstants.ROLE_KEY_ADMIN_AUDITOR);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(roleList);
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
currentUserSession.setKeyAdmin(true);
@@ -520,7 +521,7 @@ public void testCheckUserAccessibleSuccessForKeyAdmin() {
public void testCheckUserAccessibleThrowErrorForAdminAndUserRoleKeyAdmin()
{
Collection<String> roleList = new ArrayList<>();
roleList.add(RangerConstants.ROLE_KEY_ADMIN);
- Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(
+ Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(
roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
@@ -545,7 +546,7 @@ public void
testCheckUserAccessibleThrowErrorForAdminAndUserRoleKeyAdmin() {
public void
testCheckUserAccessibleThrowErrorForAdminAndUserRoleKeyAdminAuditor() {
Collection<String> roleList = new ArrayList<>();
roleList.add(RangerConstants.ROLE_KEY_ADMIN_AUDITOR);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(roleList);
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
currentUserSession.setUserAdmin(true);
@@ -569,7 +570,7 @@ public void
testCheckUserAccessibleThrowErrorForAdminAndUserRoleKeyAdminAuditor(
public void testCheckUserAccessibleSuccessForAdmin() {
Collection<String> roleList = new ArrayList<>();
roleList.add(RangerConstants.ROLE_SYS_ADMIN);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(roleList);
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
currentUserSession.setUserAdmin(true);
@@ -887,6 +888,32 @@ public void testIsUserRangerAdmin_ConfigSuperUser() {
RangerSuperUserConfig.resetForTests();
}
+ @Test
+ public void testIsConfigSuperUser() {
+ RangerSuperUserConfig.resetForTests();
+
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
"config-admin");
+
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_GROUPS,
"super-group");
+
+
Mockito.when(xUserMgr.getGroupsForUser("group-member")).thenReturn(Collections.singleton("super-group"));
+
Mockito.when(xUserMgr.getGroupsForUser("db-admin")).thenReturn(Collections.emptySet());
+
+ XXPortalUser portalUser = new XXPortalUser();
+ portalUser.setLoginId("db-admin");
+
+ UserSessionBase session =
RangerContextHolder.getSecurityContext().getUserSession();
+ session.setXXPortalUser(portalUser);
+ session.setUserAdmin(true);
+
+ Assertions.assertTrue(rangerBizUtil.isConfigSuperUser("config-admin"));
+ Assertions.assertTrue(rangerBizUtil.isConfigSuperUser("group-member"));
+ Assertions.assertFalse(rangerBizUtil.isConfigSuperUser("db-admin"));
+ Assertions.assertFalse(rangerBizUtil.isConfigSuperUser(" "));
+
+
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
+
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_GROUPS);
+ RangerSuperUserConfig.resetForTests();
+ }
+
@Test
public void testIsUserRangerAdmin_ConfigDisabledSkipsGroupLookup() {
Assertions.assertFalse(rangerBizUtil.isUserRangerAdmin("any-user"));
@@ -997,10 +1024,42 @@ public void
testHasKMSPermissions_ThrowsForSysAdminOnServiceDefKMS() {
}
@Test
- public void testHasKMSPermissions_AllowsConfigSuperUserOnServiceDefKMS() {
-
RangerContextHolder.getSecurityContext().getUserSession().setUserAdmin(true);
+ public void testHasKMSPermissions_DeniesConfigSuperUserOnServiceDefKMS() {
+
RangerContextHolder.getSecurityContext().getUserSession().setSuperUser(true);
+
+ WebApplicationException webExp = new WebApplicationException();
+
+ Mockito.when(restErrorUtil.createRESTException("System Admin cannot
create/update/delete KMS Service-Def",
MessageEnums.OPER_NO_PERMISSION)).thenReturn(webExp);
+
+ Assertions.assertThrows(WebApplicationException.class, () ->
rangerBizUtil.hasKMSPermissions("Service-Def",
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME));
+ }
+
+ @Test
+ public void testHasKMSPermissions_AllowsConfigSuperUserOnKMSService() {
RangerContextHolder.getSecurityContext().getUserSession().setSuperUser(true);
- Assertions.assertDoesNotThrow(() ->
rangerBizUtil.hasKMSPermissions("Service-Def",
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME));
+
+ Assertions.assertDoesNotThrow(() ->
rangerBizUtil.hasKMSPermissions("Service",
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME));
+ }
+
+ @Test
+ public void
testCheckUserAccessible_ConfigSuperUserCannotManageKeyAdminUser() {
+ List<String> roleList = new ArrayList<>();
+ roleList.add(RangerConstants.ROLE_KEY_ADMIN);
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(roleList);
+ Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
+
+ UserSessionBase session = new UserSessionBase();
+ session.setSuperUser(true);
+
+ RangerSecurityContext context = new RangerSecurityContext();
+ context.setUserSession(session);
+ RangerContextHolder.setSecurityContext(context);
+
+ WebApplicationException webExp = new WebApplicationException();
+
+ Mockito.when(restErrorUtil.createRESTException("Logged in user is not
allowed to create/update user",
MessageEnums.OPER_NO_PERMISSION)).thenReturn(webExp);
+
+ Assertions.assertThrows(WebApplicationException.class, () ->
rangerBizUtil.checkUserAccessible(vXUser));
}
@Test
diff --git
a/security-admin/src/test/java/org/apache/ranger/biz/TestSessionMgr.java
b/security-admin/src/test/java/org/apache/ranger/biz/TestSessionMgr.java
index 3d7c7a214..9270ec751 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestSessionMgr.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestSessionMgr.java
@@ -627,11 +627,11 @@ public void testSetUserRoles_ConfigSuperUserAndGroup() {
sessionMgr.resetUserSessionForProfiles(userSession);
assertTrue(userSession.isUserAdmin());
- assertTrue(userSession.isKeyAdmin());
+ assertFalse(userSession.isKeyAdmin());
+ assertFalse(userSession.isAuditKeyAdmin());
assertTrue(userSession.isSuperUser());
assertTrue(userSession.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN));
-
assertTrue(userSession.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN));
-
assertTrue(userSession.getUserRoleList().contains(RangerConstants.ROLE_USER));
+
assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
userSession.getUserRoleList());
assertFalse(userSession.isSingleRoleUserSession());
verify(xUserMgr, never()).getGroupsForUser(anyString());
@@ -648,7 +648,7 @@ public void testSetUserRoles_ConfigSuperUserAndGroup() {
sessionMgr.resetUserSessionForProfiles(userSession);
assertTrue(userSession.isUserAdmin());
- assertTrue(userSession.isKeyAdmin());
+ assertFalse(userSession.isKeyAdmin());
assertTrue(userSession.isSuperUser());
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_GROUPS);
@@ -704,7 +704,7 @@ public void testIsUserAdminIncludesSuperUserFlag() {
}
@Test
- public void testSetUserRoles_ConfigSuperUserGrantsKeyAdminForSysAdmin() {
+ public void
testSetUserRoles_ConfigSuperUserDoesNotGrantKeyAdminForSysAdmin() {
RangerSuperUserConfig.resetForTests();
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
"config-admin");
@@ -732,13 +732,117 @@ public void
testSetUserRoles_ConfigSuperUserGrantsKeyAdminForSysAdmin() {
sessionMgr.resetUserSessionForProfiles(userSession);
assertTrue(userSession.isUserAdmin());
- assertTrue(userSession.isKeyAdmin());
+ assertFalse(userSession.isKeyAdmin());
assertTrue(userSession.isSuperUser());
+
assertFalse(userSession.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN));
verify(xUserMgr, never()).getGroupsForUser(anyString());
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
}
+ @Test
+ public void
testResetUserModulePermission_ConfigSuperUserExcludesKeyManager() {
+ UserSessionBase userSession = superUserSessionWithModules();
+
+ sessionMgr.resetUserModulePermission(userSession);
+
+ Set<String> permissions =
userSession.getRangerUserPermission().getUserPermissions();
+
+ assertTrue(permissions.contains(RangerConstants.MODULE_AUDIT));
+ assertFalse(permissions.contains(RangerConstants.MODULE_KEY_MANAGER));
+ }
+
+ @Test
+ public void testResetUserModulePermission_SysAdminExcludesKeyManager() {
+ UserSessionBase userSession = superUserSessionWithModules();
+
+ userSession.setSuperUser(false);
+ userSession.setUserAdmin(true);
+
+ sessionMgr.resetUserModulePermission(userSession);
+
+ Set<String> permissions =
userSession.getRangerUserPermission().getUserPermissions();
+
+ assertTrue(permissions.contains(RangerConstants.MODULE_AUDIT));
+ assertFalse(permissions.contains(RangerConstants.MODULE_KEY_MANAGER));
+ }
+
+ @Test
+ public void
testResetUserModulePermission_ConfigSuperUserExcludesKeyManagerEvenWithKeyAdminFlag()
{
+ UserSessionBase userSession = superUserSessionWithModules();
+
+ userSession.setKeyAdmin(true);
+
+ sessionMgr.resetUserModulePermission(userSession);
+
+ Set<String> permissions =
userSession.getRangerUserPermission().getUserPermissions();
+
+ assertTrue(permissions.contains(RangerConstants.MODULE_AUDIT));
+ assertFalse(permissions.contains(RangerConstants.MODULE_KEY_MANAGER));
+ }
+
+ @Test
+ public void testSetUserRoles_ConfigSuperUserIgnoresDbKeyAdminRole() {
+ RangerSuperUserConfig.resetForTests();
+
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
"config-admin");
+
+ UserSessionBase userSession = new UserSessionBase();
+ XXPortalUser portalUser = new XXPortalUser();
+
+ portalUser.setId(45L);
+ portalUser.setLoginId("config-admin");
+ userSession.setXXPortalUser(portalUser);
+
+ XXPortalUserDao portalDao = mock(XXPortalUserDao.class);
+
+ when(daoManager.getXXPortalUser()).thenReturn(portalDao);
+ when(portalDao.findByLoginId("config-admin")).thenReturn(portalUser);
+
+ XXPortalUserRole keyAdminRole = new XXPortalUserRole();
+
+ keyAdminRole.setUserRole(RangerConstants.ROLE_KEY_ADMIN);
+
+ XXPortalUserRoleDao roleDao = mock(XXPortalUserRoleDao.class);
+
+ when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
+
when(roleDao.findByUserId(45L)).thenReturn(Collections.singletonList(keyAdminRole));
+
+ sessionMgr.resetUserSessionForProfiles(userSession);
+
+ assertTrue(userSession.isSuperUser());
+ assertTrue(userSession.isUserAdmin());
+ assertFalse(userSession.isKeyAdmin());
+ assertFalse(userSession.isAuditKeyAdmin());
+
assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
userSession.getUserRoleList());
+
+
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
+ RangerSuperUserConfig.resetForTests();
+ }
+
+ private UserSessionBase superUserSessionWithModules() {
+ UserSessionBase userSession = new UserSessionBase();
+ XXPortalUser portalUser = new XXPortalUser();
+
+ portalUser.setId(44L);
+ portalUser.setLoginId("config-admin");
+ userSession.setXXPortalUser(portalUser);
+ userSession.setSuperUser(true);
+
+ XXUser xUser = new XXUser();
+
+ xUser.setId(144L);
+
+ XXUserDao xUserDao = mock(XXUserDao.class);
+ XXModuleDefDao moduleDefDao = mock(XXModuleDefDao.class);
+
+ when(daoManager.getXXUser()).thenReturn(xUserDao);
+ when(xUserDao.findByUserName("config-admin")).thenReturn(xUser);
+ when(daoManager.getXXModuleDef()).thenReturn(moduleDefDao);
+
when(moduleDefDao.getAllModuleNames()).thenReturn(Arrays.asList(RangerConstants.MODULE_AUDIT,
RangerConstants.MODULE_KEY_MANAGER));
+
+ return userSession;
+ }
+
@Test
public void testProcessSuccessLogin_LimitZeroDoesNotExpireOldestSession() {
RangerContextHolder.setSecurityContext(null);
diff --git
a/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
b/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
index ab4d0ddf6..420c2cc01 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
@@ -1689,9 +1689,7 @@ public void testGetRolesByLoginId_ConfigSuperUser() {
Collection<String> roles = userMgr.getRolesByLoginId(userLoginId);
- Assertions.assertTrue(roles.contains(RangerConstants.ROLE_USER));
- Assertions.assertTrue(roles.contains(RangerConstants.ROLE_SYS_ADMIN));
- Assertions.assertTrue(roles.contains(RangerConstants.ROLE_KEY_ADMIN));
+
Assertions.assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
new ArrayList<>(roles));
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
RangerSuperUserConfig.resetForTests();
@@ -1703,6 +1701,38 @@ public void testGetRolesByLoginId_ConfigSuperUser() {
RangerSuperUserConfig.resetForTests();
}
+ @Test
+ public void testGetDBRolesByLoginId_ConfigSuperUserKeepsDBRoles() {
+ setup();
+ XXPortalUserDao userDao = Mockito.mock(XXPortalUserDao.class);
+ XXPortalUserRoleDao roleDao = Mockito.mock(XXPortalUserRoleDao.class);
+
+ VXPortalUser userProfile = userProfile();
+ String userLoginId = userProfile.getLoginId();
+
+ XXPortalUser user = new XXPortalUser();
+ user.setLoginId(userLoginId);
+ user.setId(userProfile.getId());
+
+ XXPortalUserRole xxPortalUserRole = new XXPortalUserRole();
+ xxPortalUserRole.setUserRole(RangerConstants.ROLE_KEY_ADMIN);
+ List<XXPortalUserRole> list = new ArrayList<>();
+ list.add(xxPortalUserRole);
+
+ Mockito.when(daoManager.getXXPortalUser()).thenReturn(userDao);
+ Mockito.when(userDao.findByLoginId(userLoginId)).thenReturn(user);
+ Mockito.when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
+ Mockito.when(roleDao.findByUserId(user.getId())).thenReturn(list);
+ RangerSuperUserConfig.resetForTests();
+
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
userLoginId);
+
+
Assertions.assertEquals(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN),
new ArrayList<>(userMgr.getDBRolesByLoginId(userLoginId)));
+
Assertions.assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
new ArrayList<>(userMgr.getRolesByLoginId(userLoginId)));
+
+
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
+ RangerSuperUserConfig.resetForTests();
+ }
+
@Test
public void testGetRolesByLoginId_NoConfigMatch() {
setup();
@@ -1780,8 +1810,6 @@ public void
testGjUserToUserProfile_ConfigSuperUserOverridesRolesAndModules() {
portalUser.setId(99L);
portalUser.setLoginId("config-admin");
session.setXXPortalUser(portalUser);
- session.setUserAdmin(true);
- session.setKeyAdmin(true);
session.setSuperUser(true);
RangerSecurityContext context = new RangerSecurityContext();
@@ -1827,10 +1855,9 @@ public void
testGjUserToUserProfile_ConfigSuperUserOverridesRolesAndModules() {
userMgr.gjUserToUserProfile(user, profile);
Assertions.assertTrue(profile.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN));
-
Assertions.assertTrue(profile.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN));
- Assertions.assertEquals(2, profile.getUserPermList().size());
+
Assertions.assertFalse(profile.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN));
+ Assertions.assertEquals(1, profile.getUserPermList().size());
Assertions.assertEquals(RangerConstants.MODULE_AUDIT,
profile.getUserPermList().get(0).getModuleName());
- Assertions.assertEquals(RangerConstants.MODULE_KEY_MANAGER,
profile.getUserPermList().get(1).getModuleName());
destroySession();
}
@@ -1843,8 +1870,6 @@ public void
testMapXXPortalUserToVXPortalUser_ConfigSuperUserPreservesProfileRol
portalUser.setId(99L);
portalUser.setLoginId("config-admin");
session.setXXPortalUser(portalUser);
- session.setUserAdmin(true);
- session.setKeyAdmin(true);
session.setSuperUser(true);
RangerSecurityContext context = new RangerSecurityContext();
@@ -1887,13 +1912,73 @@ public void
testMapXXPortalUserToVXPortalUser_ConfigSuperUserPreservesProfileRol
VXPortalUser profile = userMgr.mapXXPortalUserToVXPortalUser(user,
null);
Assertions.assertEquals(
- Arrays.asList(RangerConstants.ROLE_SYS_ADMIN,
RangerConstants.ROLE_KEY_ADMIN),
+ Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
profile.getUserRoleList());
Assertions.assertFalse(profile.getUserRoleList().contains(RangerConstants.ROLE_USER));
destroySession();
}
+ @Test
+ public void
testMapXXPortalUserToVXPortalUser_ConfigSuperUserKeepsOtherUserDbRoles() {
+ XXPortalUser keyAdminUser = configSuperUserSessionAndKeyAdminUser();
+
+ VXPortalUser profile =
userMgr.mapXXPortalUserToVXPortalUser(keyAdminUser, null);
+
+
Assertions.assertEquals(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN),
profile.getUserRoleList());
+
+ destroySession();
+ }
+
+ @Test
+ public void testCheckAccess_ConfigSuperUserCannotAccessKeyAdminUser() {
+ XXPortalUser keyAdminUser = configSuperUserSessionAndKeyAdminUser();
+ XXPortalUserDao userDao = Mockito.mock(XXPortalUserDao.class);
+
+ Mockito.when(daoManager.getXXPortalUser()).thenReturn(userDao);
+
Mockito.when(userDao.findByLoginId("keyadmin-user")).thenReturn(keyAdminUser);
+
Mockito.when(restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN,
"Logged-In user is not allowed to access requested user data",
true)).thenReturn(new WebApplicationException());
+
+ Assertions.assertThrows(WebApplicationException.class, () ->
userMgr.checkAccess(keyAdminUser));
+
+ destroySession();
+ }
+
+ private XXPortalUser configSuperUserSessionAndKeyAdminUser() {
+ UserSessionBase session = new UserSessionBase();
+ XXPortalUser portalUser = new XXPortalUser();
+
+ portalUser.setId(99L);
+ portalUser.setLoginId("config-admin");
+ session.setXXPortalUser(portalUser);
+ session.setSuperUser(true);
+
+ RangerSecurityContext context = new RangerSecurityContext();
+ context.setUserSession(session);
+ RangerContextHolder.setSecurityContext(context);
+
+ XXPortalUser keyAdminUser = new XXPortalUser();
+ keyAdminUser.setId(100L);
+ keyAdminUser.setLoginId("keyadmin-user");
+ keyAdminUser.setUserSource(RangerCommonEnums.USER_APP);
+
+ XXPortalUserRole keyAdminRole = new XXPortalUserRole();
+ keyAdminRole.setUserRole(RangerConstants.ROLE_KEY_ADMIN);
+
+ XXPortalUserRoleDao roleDao =
Mockito.mock(XXPortalUserRoleDao.class);
+ XXUserPermissionDao userPermissionDao =
Mockito.mock(XXUserPermissionDao.class);
+ XXGroupPermissionDao groupPermissionDao =
Mockito.mock(XXGroupPermissionDao.class);
+
+ Mockito.when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
+
Mockito.when(roleDao.findByParentId(100L)).thenReturn(Collections.singletonList(keyAdminRole));
+
Mockito.when(daoManager.getXXUserPermission()).thenReturn(userPermissionDao);
+
Mockito.when(daoManager.getXXGroupPermission()).thenReturn(groupPermissionDao);
+
Mockito.when(userPermissionDao.findByUserPermissionIdAndIsAllowed(100L)).thenReturn(Collections.emptyList());
+
Mockito.when(groupPermissionDao.findbyVXPortalUserId(100L)).thenReturn(Collections.emptyList());
+
+ return keyAdminUser;
+ }
+
@Test
public void test31checkAccess() {
setup();
diff --git
a/security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java
b/security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java
index e98960850..e5ecf1d9f 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java
@@ -4622,6 +4622,68 @@ public void test135updateXGroupUser_userNotFound() {
});
}
+ @Test
+ public void test136checkAccess_configSuperUserCanAccessSysAdminUser() {
+ setupConfigSuperUserSession();
+
+ VXUser requestedUser = new VXUser();
+ requestedUser.setId(2L);
+
requestedUser.setUserRoleList(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN));
+
+ Assertions.assertDoesNotThrow(() ->
xUserMgr.checkAccess(requestedUser));
+ }
+
+ @Test
+ public void test137checkAccess_configSuperUserCannotAccessKeyAdminUser() {
+ setupConfigSuperUserSession();
+
+ VXUser requestedUser = new VXUser();
+ requestedUser.setId(2L);
+
requestedUser.setUserRoleList(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN));
+
+
Mockito.when(restErrorUtil.create403RESTException(Mockito.anyString())).thenReturn(new
WebApplicationException());
+
+ Assertions.assertThrows(WebApplicationException.class, () ->
xUserMgr.checkAccess(requestedUser));
+ }
+
+ @Test
+ public void
test138checkAccess_configSuperUserCanAccessSelfWithKeyAdminDBRole() {
+ setupConfigSuperUserSession();
+
+ VXUser requestedUser = new VXUser();
+ requestedUser.setId(1L);
+ requestedUser.setName("config-admin");
+
requestedUser.setUserRoleList(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN));
+
+ Assertions.assertDoesNotThrow(() ->
xUserMgr.checkAccess(requestedUser));
+ }
+
+ @Test
+ public void
test139checkAccess_rangerusersyncConfigSuperUserCanAccessKeyAdminUser() {
+ setupConfigSuperUserSession();
+
ContextUtil.getCurrentUserSession().getXXPortalUser().setLoginId("rangerusersync");
+
+ VXUser requestedUser = new VXUser();
+ requestedUser.setId(2L);
+ requestedUser.setName("keyadmin");
+
requestedUser.setUserRoleList(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN));
+
+ Assertions.assertDoesNotThrow(() ->
xUserMgr.checkAccess(requestedUser));
+ }
+
+ private void setupConfigSuperUserSession() {
+ RangerSecurityContext context = new RangerSecurityContext();
+ context.setUserSession(new UserSessionBase());
+ RangerContextHolder.setSecurityContext(context);
+
+ UserSessionBase currentUserSession =
ContextUtil.getCurrentUserSession();
+ XXPortalUser portalUser = new XXPortalUser();
+ portalUser.setLoginId("config-admin");
+ portalUser.setId(1L);
+ currentUserSession.setXXPortalUser(portalUser);
+ currentUserSession.setSuperUser(true);
+ }
+
private VXUser vxUser() {
Collection<String> userRoleList = new ArrayList<>();
userRoleList.add("ROLE_USER");
diff --git
a/security-admin/src/test/java/org/apache/ranger/common/TestRangerSuperUserConfig.java
b/security-admin/src/test/java/org/apache/ranger/common/TestRangerSuperUserConfig.java
index 8293c718f..de28dd37e 100644
---
a/security-admin/src/test/java/org/apache/ranger/common/TestRangerSuperUserConfig.java
+++
b/security-admin/src/test/java/org/apache/ranger/common/TestRangerSuperUserConfig.java
@@ -24,7 +24,6 @@
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
-import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
@@ -149,40 +148,14 @@ public void testIsSuperUser_BlankLoginId() {
}
@Test
- public void testMergeConfigSuperUserRoles_ForAuthentication() {
- List<String> merged = RangerSuperUserConfig.mergeConfigSuperUserRoles(
- Collections.singletonList(RangerConstants.ROLE_USER), false);
+ public void testGetSuperUserRoles() {
+ List<String> roles = RangerSuperUserConfig.getSuperUserRoles();
- Assertions.assertEquals(
- Arrays.asList(
- RangerConstants.ROLE_SYS_ADMIN,
- RangerConstants.ROLE_KEY_ADMIN,
- RangerConstants.ROLE_USER),
- merged);
- }
+
Assertions.assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
roles);
- @Test
- public void testMergeConfigSuperUserRoles_ForSession() {
- List<String> merged = RangerSuperUserConfig.mergeConfigSuperUserRoles(
- Collections.singletonList(RangerConstants.ROLE_ADMIN_AUDITOR),
- true);
+ roles.add(RangerConstants.ROLE_USER);
- Assertions.assertEquals(
- Arrays.asList(
- RangerConstants.ROLE_SYS_ADMIN,
- RangerConstants.ROLE_KEY_ADMIN,
- RangerConstants.ROLE_USER,
- RangerConstants.ROLE_ADMIN_AUDITOR),
- merged);
- }
-
- @Test
- public void testGetConfigSuperUserProfileRoles() {
- Assertions.assertEquals(
- Arrays.asList(
- RangerConstants.ROLE_SYS_ADMIN,
- RangerConstants.ROLE_KEY_ADMIN),
- RangerSuperUserConfig.getConfigSuperUserProfileRoles());
+
Assertions.assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
RangerSuperUserConfig.getSuperUserRoles());
}
@Test
@@ -224,17 +197,6 @@ public void
testIsEnabled_WhenWildcardConfiguredAsLiteralUser() {
Assertions.assertTrue(RangerSuperUserConfig.isSuperUser("*",
Collections.emptySet()));
}
- @Test
- public void testMergeConfigSuperUserRoles_NullExistingRoles() {
- List<String> merged =
RangerSuperUserConfig.mergeConfigSuperUserRoles(null, false);
-
- Assertions.assertEquals(
- Arrays.asList(
- RangerConstants.ROLE_SYS_ADMIN,
- RangerConstants.ROLE_KEY_ADMIN),
- merged);
- }
-
@Test
public void testConfigReloadAfterResetForTests() {
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
"alice");
diff --git
a/security-admin/src/test/java/org/apache/ranger/rest/TestAssetREST.java
b/security-admin/src/test/java/org/apache/ranger/rest/TestAssetREST.java
index 76a1f3131..62c2d36e0 100644
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestAssetREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestAssetREST.java
@@ -620,16 +620,19 @@ public void testGetAccessLogsForConfigSuperUser() {
Mockito.when(searchUtil.extractInt(Mockito.any(), Mockito.any(),
Mockito.anyString(), Mockito.anyString())).thenReturn(8);
Mockito.when(searchUtil.extractDate(Mockito.any(), Mockito.any(),
Mockito.anyString(), Mockito.anyString(), Mockito.anyString())).thenReturn(new
Date());
Mockito.when(searchUtil.extractLong(Mockito.any(), Mockito.any(),
Mockito.anyString(), Mockito.anyString())).thenReturn(8L);
- Mockito.when(msBizUtil.isSuperUser()).thenReturn(true);
+ Mockito.when(msBizUtil.isKeyAdmin()).thenReturn(false);
+ Mockito.when(msBizUtil.isAuditKeyAdmin()).thenReturn(false);
+ Mockito.when(daoManager.getXXServiceDef()).thenReturn(xxServiceDefDao);
+ XXServiceDef xServiceDef = new XXServiceDef();
+ xServiceDef.setId(Id);
+
Mockito.when(xxServiceDefDao.findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME)).thenReturn(xServiceDef);
ArgumentCaptor<SearchCriteria> criteriaCaptor =
ArgumentCaptor.forClass(SearchCriteria.class);
Mockito.when(assetMgr.getAccessLogs(criteriaCaptor.capture())).thenReturn(vXAccessAuditList);
VXAccessAuditList expectedVXAccessAuditList =
assetREST.getAccessLogs(request, null);
Assertions.assertEquals(vXAccessAuditList, expectedVXAccessAuditList);
Assertions.assertFalse(criteriaCaptor.getValue().getParamList().containsKey("repoType"));
-
Assertions.assertFalse(criteriaCaptor.getValue().getParamList().containsKey("-repoType"));
- Mockito.verify(msBizUtil).isSuperUser();
- Mockito.verify(msBizUtil, Mockito.never()).isKeyAdmin();
- Mockito.verify(daoManager, Mockito.never()).getXXServiceDef();
+ Assertions.assertEquals(Id,
criteriaCaptor.getValue().getParamList().get("-repoType"));
+ Mockito.verify(msBizUtil, Mockito.never()).isSuperUser();
Mockito.verify(assetMgr).getAccessLogs(searchCriteria);
}
