This is an automated email from the ASF dual-hosted git repository.
mneethiraj pushed a commit to branch ranger-2.10
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.10 by this push:
new 60bf30ca8 RANGER-5822: make application supplied context attributes
accessible in expressions (#1302)
60bf30ca8 is described below
commit 60bf30ca8173aced908c3f268396d536cd0cb79c
Author: Madhan Neethiraj <[email protected]>
AuthorDate: Wed Oct 14 02:11:05 2026 +0530
RANGER-5822: make application supplied context attributes accessible in
expressions (#1302)
(cherry picked from commit fdda472fb2cf540d6e97b3f8b08bad0c29426793)
---
.../ranger/authorization/utils/JsonUtils.java | 16 ++
.../policyengine/RangerRequestScriptEvaluator.java | 8 +
.../plugin/util/RangerAccessRequestUtil.java | 29 +++
.../ranger/plugin/util/RangerCommonConstants.java | 2 +
.../RangerRequestScriptEvaluatorTest.java | 47 ++++
.../plugin/util/TestRangerAccessRequestUtil.java | 289 +++++++++++++++++++++
6 files changed, 391 insertions(+)
diff --git
a/agents-common/src/main/java/org/apache/ranger/authorization/utils/JsonUtils.java
b/agents-common/src/main/java/org/apache/ranger/authorization/utils/JsonUtils.java
index 575ac1de4..53ee0d2b6 100755
---
a/agents-common/src/main/java/org/apache/ranger/authorization/utils/JsonUtils.java
+++
b/agents-common/src/main/java/org/apache/ranger/authorization/utils/JsonUtils.java
@@ -40,6 +40,7 @@
import java.util.List;
import java.util.Map;
import java.util.Set;
+import java.util.Collections;
import static com.fasterxml.jackson.databind.DeserializationFeature.*;
@@ -47,6 +48,7 @@ public class JsonUtils {
private static final Logger LOG = LoggerFactory.getLogger(JsonUtils.class);
private static final TypeReference<Map<String, String>>
TYPE_MAP_STRING_STRING = new TypeReference<Map<String,
String>>() {};
+ private static final TypeReference<Map<String, Object>>
TYPE_MAP_STRING_OBJECT = new TypeReference<Map<String,
Object>>() {};
private static final TypeReference<Set<String>>
TYPE_SET_STRING = new TypeReference<Set<String>>() {};
private static final TypeReference<List<String>>
TYPE_LIST_STRING = new TypeReference<List<String>>() {};
private static final TypeReference<List<RangerValiditySchedule>>
TYPE_LIST_RANGER_VALIDITY_SCHEDULE = new
TypeReference<List<RangerValiditySchedule>>() {};
@@ -177,6 +179,20 @@ public static Map<String, String>
jsonToMapStringString(String jsonStr) {
return null;
}
+ public static Map<String, Object> jsonToMapStringObject(String jsonStr) {
+ Map<String, Object> ret = null;
+
+ if (StringUtils.isNotEmpty(jsonStr)) {
+ try {
+ ret = getMapper().readValue(jsonStr, TYPE_MAP_STRING_OBJECT);
+ } catch (Exception excp) {
+ LOG.warn("jsonToMapStringObject() failed to convert json to
object: {}", jsonStr, excp);
+ }
+ }
+
+ return ret == null ? Collections.emptyMap() : ret;
+ }
+
public static Set<String> jsonToSetString(String jsonStr) {
if (StringUtils.isNotEmpty(jsonStr)) {
try {
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
index 7dc7fc30e..812a75c49 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerRequestScriptEvaluator.java
@@ -60,6 +60,7 @@
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_FIELD_ACCESS_TIME;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_FIELD_ACCESS_TYPE;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_FIELD_ACTION;
+import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_FIELD_ATTR;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_FIELD_CLIENT_IP_ADDRESS;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_FIELD_CLIENT_TYPE;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_FIELD_CLUSTER_NAME;
@@ -134,6 +135,7 @@
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_MACRO_USER_ATTR_NAMES_Q_CSV;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_POLYFILL_INCLUDES;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_POLYFILL_INTERSECTS;
+import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_VAR_ATTR;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_VAR_REQ;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_VAR_RES;
import static
org.apache.ranger.plugin.util.RangerCommonConstants.SCRIPT_VAR_TAG;
@@ -167,6 +169,7 @@ public final class RangerRequestScriptEvaluator {
SCRIPT_VAR_RES + "=" + SCRIPT_VAR_REQ + "." +
SCRIPT_FIELD_RESOURCE + ";" +
SCRIPT_VAR_USER + "=" + SCRIPT_VAR_REQ + "." +
SCRIPT_FIELD_USER_ATTRIBUTES + ";" +
SCRIPT_VAR_UGNAMES + "=" + SCRIPT_VAR_REQ + "." +
SCRIPT_FIELD_USER_GROUPS + ";" +
+ SCRIPT_VAR_ATTR + "=" + SCRIPT_VAR_REQ + "." + SCRIPT_FIELD_ATTR +
";" +
SCRIPT_VAR_UG + "=" + SCRIPT_VAR_REQ + "." +
SCRIPT_FIELD_USER_GROUP_ATTRIBUTES + ";" +
SCRIPT_VAR_UGA + "=" + SCRIPT_VAR_REQ + "." + SCRIPT_FIELD_UGA +
";" +
SCRIPT_VAR_URNAMES + "=" + SCRIPT_VAR_REQ + "." +
SCRIPT_FIELD_USER_ROLES + ";" +
@@ -916,6 +919,10 @@ private String toJson() {
request.put(SCRIPT_FIELD_USER_GROUP_ATTRIBUTES, groupAttrs);
request.put(SCRIPT_FIELD_UGA, new UserGroupsAttributes(userGroups,
groupAttrs).getAttributes());
+ String attrJson =
RangerAccessRequestUtil.getContextAttrJson(getRequestContext());
+
+ request.put(SCRIPT_FIELD_ATTR,
JsonUtils.jsonToMapStringObject(attrJson));
+
ret.put(SCRIPT_FIELD_REQUEST, request);
ret.put(SCRIPT_FIELD_TAGS, tags);
@@ -1156,6 +1163,7 @@ private static String getJsonVarNamesPattern() {
*
*/
varNames.add(SCRIPT_VAR__CTX);
+ varNames.add(SCRIPT_VAR_ATTR);
varNames.add(SCRIPT_VAR_REQ);
varNames.add(SCRIPT_VAR_RES);
varNames.add(SCRIPT_VAR_TAG);
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerAccessRequestUtil.java
b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerAccessRequestUtil.java
index f1e85774b..f5942d392 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerAccessRequestUtil.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerAccessRequestUtil.java
@@ -52,6 +52,35 @@ public class RangerAccessRequestUtil {
public static final String KEY_CONTEXT_ALL_ACCESSTYPE_GROUPS
= "ALLACCESSTYPEGROUPS";
public static final String KEY_CONTEXT_ALL_ACCESS_TYPE_ACL_RESULTS
= "ALL_ACCESS_TYPE_ACL_RESULTS";
public static final String KEY_CONTEXT_ACL_ENFORCER
= "_ACL_ENFORCER";
+ public static final String KEY_CONTEXT_ATTR_JSON
= "_ATTR_JSON";
+
+ private RangerAccessRequestUtil() {
+ // to avoid instantiation
+ }
+
+ public static void setContextAttrJson(Map<String, Object> context,
String attrJson) {
+ if (context != null) {
+ if (attrJson == null) {
+ context.remove(KEY_CONTEXT_ATTR_JSON);
+ } else {
+ context.put(KEY_CONTEXT_ATTR_JSON, attrJson);
+ }
+ }
+ }
+
+ public static String getContextAttrJson(Map<String, Object> context) {
+ Object ret = context != null ?
context.get(KEY_CONTEXT_ATTR_JSON) : null;
+
+ if (ret != null) {
+ if (ret instanceof String) {
+ return (String) ret;
+ } else {
+ LOG.error("getContextAttrJson(): failed to get
{} from context", KEY_CONTEXT_ATTR_JSON);
+ }
+ }
+
+ return null;
+ }
public static void setRequestTagsInContext(Map<String, Object> context,
Set<RangerTagForEval> tags) {
if (CollectionUtils.isEmpty(tags)) {
diff --git
a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
index 8a0ba8d71..2e2989550 100644
---
a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
+++
b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerCommonConstants.java
@@ -84,6 +84,7 @@ private RangerCommonConstants() {
public static final String SCRIPT_VAR_UGNAMES =
"UGNAMES";
public static final String SCRIPT_VAR_URNAMES =
"URNAMES";
public static final String SCRIPT_VAR_USER =
"USER";
+ public static final String SCRIPT_VAR_ATTR =
"ATTR";
public static final String SCRIPT_FIELD_ACCESS_TIME =
"accessTime";
public static final String SCRIPT_FIELD_ACCESS_TYPE =
"accessType";
@@ -114,6 +115,7 @@ private RangerCommonConstants() {
public static final String SCRIPT_FIELD_USER_GROUP_ATTRIBUTES =
"userGroupAttributes";
public static final String SCRIPT_FIELD_UGA = "uga";
public static final String SCRIPT_FIELD_USER_ROLES =
"userRoles";
+ public static final String SCRIPT_FIELD_ATTR =
"attr";
public static final String SCRIPT_MACRO_GET_TAG_NAMES =
"GET_TAG_NAMES";
public static final String SCRIPT_MACRO_GET_TAG_NAMES_Q =
"GET_TAG_NAMES_Q";
diff --git
a/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java
b/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java
index 956762c1c..87f5a44f3 100644
---
a/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java
+++
b/agents-common/src/test/java/org/apache/ranger/plugin/conditionevaluator/RangerRequestScriptEvaluatorTest.java
@@ -582,6 +582,44 @@ public void
testBlockJavaClassReferencesWithDefaultConfig() {
Assertions.assertTrue(escaped.isEmpty(), "Sandbox escape OS command
executed via:\n " + String.join("\n ", escaped));
}
+ @Test
+ public void testContextAttributes() {
+ String attrJson = "{\"trx_amount\":10000}";
+ RangerAccessRequest request = createRequest("test-user",
attrJson);
+ RangerRequestScriptEvaluator evaluator = new
RangerRequestScriptEvaluator(request, scriptEngine);
+
+ // trx_amount=10,000; test if less-than-or-equals 10,000 => true
+ String expr = "ATTR.trx_amount <= 10000";
+ Assertions.assertTrue((Boolean) evaluator.evaluateScript(expr), expr);
+
+ // trx_amount=10,000; test if greater than 10,000 => false
+ expr = "ATTR.trx_amount > 10000";
+ Assertions.assertFalse((Boolean) evaluator.evaluateScript(expr), expr);
+
+ // trx_amount=10,000; default approved_amount is 5,000 => false
+ expr = "ATTR.trx_amount <= (ATTR.approved_amount != null ?
ATTR.approved_amount : 5000)";
+ Assertions.assertFalse((Boolean) evaluator.evaluateScript(expr), expr);
+
+ // trx_amount=10,000; default approved_amount is 15,000 => true
+ expr = "ATTR.trx_amount <= (ATTR.approved_amount != null ?
ATTR.approved_amount : 15000)";
+ Assertions.assertTrue((Boolean) evaluator.evaluateScript(expr), expr);
+
+ // trx_amount=10,000; approved_amount=5,000 => false
+ attrJson = "{\"trx_amount\":10000, \"approved_amount\":5000}";
+ request = createRequest("test-user", attrJson);
+ expr = "ATTR.trx_amount <= (ATTR.approved_amount != null ?
ATTR.approved_amount : 5000)";
+ evaluator = new RangerRequestScriptEvaluator(request, scriptEngine,
RangerRequestScriptEvaluator.needsJsonCtxEnabled(expr));
+ Assertions.assertFalse((Boolean) evaluator.evaluateScript(expr), expr);
+
+ // trx_amount=10,000; approved_amount=15000 => true
+ expr = "ATTR.trx_amount <= (ATTR.approved_amount != null ?
ATTR.approved_amount : 5000)";
+ attrJson = "{\"trx_amount\":10000, \"approved_amount\":15000}";
+ request = createRequest("test-user", attrJson);
+ evaluator = new RangerRequestScriptEvaluator(request, scriptEngine,
RangerRequestScriptEvaluator.needsJsonCtxEnabled(expr));
+
+ Assertions.assertTrue((Boolean) evaluator.evaluateScript(expr), expr);
+ }
+
private RangerRequestScriptEvaluator createEvaluator() {
RangerAccessRequest request = createRequest("test-user",
Collections.emptySet(), Collections.emptySet(),
Collections.singletonList(new RangerTag("PII",
Collections.singletonMap("attr1", "v1"))));
@@ -591,6 +629,15 @@ private RangerRequestScriptEvaluator createEvaluator() {
private static String tempFilePath(String tag, long nonce) {
return new File(System.getProperty("java.io.tmpdir"), "ranger_test_" +
tag + "_" + nonce).getAbsolutePath();
}
+
+ RangerAccessRequest createRequest(String userName, String attributes) {
+ RangerAccessRequestImpl ret = (RangerAccessRequestImpl)
createRequest(userName, Collections.emptySet(), Collections.emptySet(),
Collections.emptyList());
+
+ RangerAccessRequestUtil.setContextAttrJson(ret.getContext(),
attributes);
+
+ return ret;
+ }
+
RangerAccessRequest createRequest(String userName, Set<String> userGroups,
Set<String> userRoles, List<RangerTag> resourceTags) {
RangerAccessResource resource = mock(RangerAccessResource.class);
diff --git
a/agents-common/src/test/java/org/apache/ranger/plugin/util/TestRangerAccessRequestUtil.java
b/agents-common/src/test/java/org/apache/ranger/plugin/util/TestRangerAccessRequestUtil.java
new file mode 100644
index 000000000..2516cc07c
--- /dev/null
+++
b/agents-common/src/test/java/org/apache/ranger/plugin/util/TestRangerAccessRequestUtil.java
@@ -0,0 +1,289 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ranger.plugin.util;
+
+import org.apache.ranger.authorization.utils.JsonUtils;
+import org.apache.ranger.plugin.contextenricher.RangerTagForEval;
+import org.apache.ranger.plugin.model.RangerServiceDef;
+import org.apache.ranger.plugin.model.RangerTag;
+import org.apache.ranger.plugin.policyengine.RangerAccessRequest;
+import org.apache.ranger.plugin.policyengine.RangerAccessResource;
+import
org.apache.ranger.plugin.policyresourcematcher.RangerPolicyResourceMatcher;
+import org.junit.jupiter.api.MethodOrderer;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestMethodOrder;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+* @generated by Cursor
+* @description <Unit Test for RangerAccessRequestUtil class>
+*/
+@ExtendWith(MockitoExtension.class)
+@TestMethodOrder(MethodOrderer.MethodName.class)
+public class TestRangerAccessRequestUtil {
+ @Test
+ public void test01_setAndGetTagsAndCurrentTag() {
+ Map<String, Object> ctx = new HashMap<>();
+ RangerAccessRequestUtil.setRequestTagsInContext(ctx, null);
+ assertNull(RangerAccessRequestUtil.getRequestTagsFromContext(ctx));
+ Set<RangerTagForEval> tags = new HashSet<>();
+ RangerTag tag = new RangerTag();
+ tag.setType("T");
+ tags.add(new RangerTagForEval(tag,
RangerPolicyResourceMatcher.MatchType.SELF));
+ RangerAccessRequestUtil.setRequestTagsInContext(ctx, tags);
+ assertEquals(tags,
RangerAccessRequestUtil.getRequestTagsFromContext(ctx));
+
+ RangerAccessRequestUtil.setCurrentTagInContext(ctx, null);
+ assertNull(RangerAccessRequestUtil.getCurrentTagFromContext(ctx));
+ }
+
+ @Test
+ public void test02_requestedResourcesAndResourceAndCopyContext() {
+ Map<String, Object> ctx = new HashMap<>();
+ RangerRequestedResources reqRes = new RangerRequestedResources();
+ RangerAccessRequestUtil.setRequestedResourcesInContext(ctx, reqRes);
+ assertEquals(reqRes,
RangerAccessRequestUtil.getRequestedResourcesFromContext(ctx));
+
+ RangerAccessResource resource = new RangerAccessResource() {
+ public String getOwnerUser() {
+ return null;
+ }
+
+ public boolean exists(String name) {
+ return false;
+ }
+
+ public Object getValue(String name) {
+ return null;
+ }
+
+ public RangerServiceDef getServiceDef() {
+ return null;
+ }
+
+ public Set<String> getKeys() {
+ return Collections.emptySet();
+ }
+
+ public String getLeafName() {
+ return null;
+ }
+
+ public String getAsString() {
+ return "";
+ }
+
+ public String getCacheKey() {
+ return "k";
+ }
+
+ public Map<String, Object> getAsMap() {
+ return Collections.emptyMap();
+ }
+
+ public RangerAccessResource getReadOnlyCopy() {
+ return this;
+ }
+ };
+ RangerAccessRequestUtil.setCurrentResourceInContext(ctx, resource);
+ assertEquals(resource,
RangerAccessRequestUtil.getCurrentResourceFromContext(ctx));
+
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_TAGS, new Object());
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_TAG_OBJECT, new Object());
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_RESOURCE, new Object());
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_REQUEST, new Object());
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_IS_ANY_ACCESS,
Boolean.TRUE);
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_ALL_ACCESSTYPES, new
Object());
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_ALL_ACCESSTYPE_GROUPS, new
Object());
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_ALL_ACCESS_TYPE_RESULTS,
new Object());
+
ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_ALL_ACCESS_TYPE_ACL_RESULTS, new
Object());
+ ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_IS_REQUEST_PREPROCESSED,
Boolean.TRUE);
+
ctx.put(RangerAccessRequestUtil.KEY_CONTEXT_IGNORE_IF_NOT_DENIED_ACCESSTYPES,
new Object());
+
+ Map<String, Object> copy = RangerAccessRequestUtil.copyContext(ctx);
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_TAGS));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_TAG_OBJECT));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_RESOURCE));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_REQUEST));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_IS_ANY_ACCESS));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_ALL_ACCESSTYPES));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_ALL_ACCESSTYPE_GROUPS));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_ALL_ACCESS_TYPE_RESULTS));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_ALL_ACCESS_TYPE_ACL_RESULTS));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_IS_REQUEST_PREPROCESSED));
+
assertFalse(copy.containsKey(RangerAccessRequestUtil.KEY_CONTEXT_IGNORE_IF_NOT_DENIED_ACCESSTYPES));
+ }
+
+ @Test
+ public void test03_tokens_users_roles_and_flags() {
+ Map<String, Object> ctx = new HashMap<>();
+ RangerAccessRequestUtil.setCurrentUserInContext(ctx, "u");
+ RangerAccessRequestUtil.setOwnerInContext(ctx, "o");
+ assertEquals("u",
RangerAccessRequestUtil.getCurrentUserFromContext(ctx));
+ RangerAccessRequestUtil.setTokenInContext(ctx, "custom", 5);
+ assertEquals(5, RangerAccessRequestUtil.getTokenFromContext(ctx,
"custom"));
+
+ RangerAccessRequestUtil.setIsAnyAccessInContext(ctx, Boolean.TRUE);
+ assertTrue(RangerAccessRequestUtil.getIsAnyAccessInContext(ctx));
+ RangerAccessRequestUtil.setIsRequestPreprocessed(ctx, Boolean.TRUE);
+ assertTrue(RangerAccessRequestUtil.getIsRequestPreprocessed(ctx));
+
+ Set<String> rs = new HashSet<>();
+ rs.add("r1");
+ RangerAccessRequestUtil.setCurrentUserRolesInContext(ctx, rs);
+ assertEquals(rs,
RangerAccessRequestUtil.getCurrentUserRolesFromContext(ctx));
+
+ RangerAccessRequest req = new RangerAccessRequest() {
+ public RangerAccessResource getResource() {
+ return null;
+ }
+
+ public String getAccessType() {
+ return null;
+ }
+
+ public boolean isAccessTypeAny() {
+ return false;
+ }
+
+ public boolean isAccessTypeDelegatedAdmin() {
+ return false;
+ }
+
+ public String getUser() {
+ return "user";
+ }
+
+ public Set<String> getUserGroups() {
+ return Collections.emptySet();
+ }
+
+ public Set<String> getUserRoles() {
+ return Collections.emptySet();
+ }
+
+ public Date getAccessTime() {
+ return null;
+ }
+
+ public String getClientIPAddress() {
+ return null;
+ }
+
+ public String getRemoteIPAddress() {
+ return null;
+ }
+
+ public List<String> getForwardedAddresses() {
+ return Collections.emptyList();
+ }
+
+ public String getClientType() {
+ return null;
+ }
+
+ public String getAction() {
+ return null;
+ }
+
+ public String getRequestData() {
+ return null;
+ }
+
+ public String getSessionId() {
+ return null;
+ }
+
+ public String getClusterName() {
+ return null;
+ }
+
+ public String getClusterType() {
+ return null;
+ }
+
+ public Map<String, Object> getContext() {
+ return ctx;
+ }
+
+ public RangerAccessRequest getReadOnlyCopy() {
+ return this;
+ }
+
+ public ResourceMatchingScope getResourceMatchingScope() {
+ return ResourceMatchingScope.SELF;
+ }
+ };
+ assertEquals(rs, RangerAccessRequestUtil.getUserRoles(req));
+ }
+
+ @Test
+ public void testContextAttributes() {
+ Map<String, Object> context = new HashMap<>();
+
+ // null context
+ assertEquals(Collections.emptyMap(),
JsonUtils.jsonToMapStringObject(null));
+
+ Map<String, Map<String, Object>> tests = new HashMap<>();
+
+ tests.put(null, Collections.emptyMap()); // null
+ tests.put("", Collections.emptyMap()); // empty
+ tests.put("[]", Collections.emptyMap()); // invalid map value
+ tests.put("xyz", Collections.emptyMap()); // invalid map value
+ tests.put("xyz=43", Collections.emptyMap()); // invalid map value
+ tests.put("xyz: 43", Collections.emptyMap()); // invalid map value
+ tests.put("{xyz: 43", Collections.emptyMap()); // invalid map value
+ tests.put("{}", Collections.emptyMap()); // valid map value:
empty
+ tests.put("{'amount': 43}", toMap("amount", 43)); // valid map
value, one entry
+ tests.put("{\"amount\": 43}", toMap("amount", 43)); // valid map
value, one entry
+ tests.put("{\"amount\": 43, \"limit\": 127}", toMap("amount", 43,
"limit", 127)); // valid map value, two entries
+
+ tests.forEach((key, value) -> {
+ RangerAccessRequestUtil.setContextAttrJson(context, key);
+ assertEquals(value,
JsonUtils.jsonToMapStringObject(RangerAccessRequestUtil.getContextAttrJson(context)));
+ });
+ }
+
+ private static Map<String, Object> toMap(Object...args) {
+ if (args.length % 2 != 0) {
+ throw new IllegalArgumentException("toMap(): invalid args length "
+ args.length + ". Must be an even number, representing key/value pairs");
+ }
+
+ Map<String, Object> ret = new HashMap<>();
+
+ for (int idx = 0; args.length > idx; idx += 2) {
+ ret.put(String.valueOf(args[idx]), args[idx + 1]);
+ }
+
+ return ret;
+ }
+}
