This is an automated email from the ASF dual-hosted git repository.
kumaab pushed a commit to branch ranger-2.10
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.10 by this push:
new 5f328d05f RANGER-5807: Exclude KMS privileges from config super users
and fix RANGER-5627 related bugs (#1257)
5f328d05f is described below
commit 5f328d05ffc54f9799e589c2b31be6d13c5fcf46
Author: Abhishek Kumar <[email protected]>
AuthorDate: Wed Sep 30 15:47:44 2026 -0700
RANGER-5807: Exclude KMS privileges from config super users and fix
RANGER-5627 related bugs (#1257)
Config super users/groups (ranger.admin.super.users/groups, RANGER-5627)
now get system admin privileges only, independent of Ranger DB roles:
- Session: the super-user flag no longer makes isKeyAdmin() and
isAuditKeyAdmin() true; key-admin and auditor flags from DB roles are
cleared for super users.
- Auditor block: blockAuditorRoleUser() no longer rejects super users.
Before, isAuditUserAdmin() and isAuditKeyAdmin() were true for every
super user, so it rejected them wherever auditors are rejected.
- Roles: super users get ROLE_SYS_ADMIN only, whatever their roles in
Ranger DB, for Spring authorities, the session and the profile.
RangerSuperUserConfig.getSuperUserRoles replaces
mergeConfigSuperUserRoles and getConfigSuperUserProfileRoles, whose
result was always ROLE_SYS_ADMIN (plus ROLE_USER, which had no
effect). A warning is logged when a super user also has a KMS role in
Ranger DB.
- KMS service-def create/update/delete follows system admin rules.
- KMS entries are excluded from access audits and the admin audit log
for super users.
- Key Manager module removed from the session of all admins (DB sys
admins are never assigned it either) and from the super-user profile.
- User visibility (hasAccessToGetUserInfo, searchXUsers,
checkUserAccessible) follows system admin rules, so KMS users are not
visible/manageable by super users. As for system admins, searchXUsers
only adds the non-KMS roles to the role filter; the per-user checks
in hasAccessToGetUserInfo and checkUserAccessible do the enforcing.
Two exceptions are kept in hasAccessToGetUserInfo: rangerusersync
(when configured as a super user) still sees all users, as it does as
a DB system admin, and a super user can always read its own user,
even if its DB role is a KMS role.
- New UserMgr.getDBRolesByLoginId returns DB portal roles without the
merged super-user roles. checkUserAccessible uses it for the target
user: before, a target that is a super user always carried
ROLE_KEY_ADMIN, so system admins could not create or update any
super-user account; now only a target with a KMS role in Ranger DB
is rejected. createDefaultAccountUser also uses it to compare the
existing roles of an external user.
- Plugin grant/revoke is not blocked by DB auditor roles for super
users. New RangerBizUtil.isConfigSuperUser keeps this exemption
limited to config super users; a DB user with both system admin and
auditor roles is still blocked, as before.
- Config descriptions updated; unit tests updated and added.
UserMgr.mapXXPortalUserToVXPortalUser replaced the role list of every
mapped user with the config super-user roles ([ROLE_SYS_ADMIN]) whenever
the logged-in session was a config super user. With the auditor block
for super users lifted in the previous commit, within a super-user
session:
- /users APIs reported every user as ROLE_SYS_ADMIN.
- UserMgr.checkAccess saw every target as a system admin, so super users
could update the profile (name, email, roles) of KMS users (key
admin / key admin auditor) through PUT /service/users, which system
admins cannot.
- Role-change bookkeeping in XUserMgr compared new roles against the
wrong existing roles (e.g. promoting a user to ROLE_SYS_ADMIN via
setUserRolesByName/ByExternalID was a no-op).
Apply the config roles only when the mapped user is the logged-in super
user; other users keep their DB roles.
(cherry picked from commit a93f26817e945fe25c136fdf3a3fb4d476b49536)
---
.../scripts/ranger-admin-site-template.xml | 4 +-
.../java/org/apache/ranger/biz/RangerBizUtil.java | 69 ++++++------
.../java/org/apache/ranger/biz/SessionMgr.java | 16 ++-
.../main/java/org/apache/ranger/biz/UserMgr.java | 92 ++++++++++------
.../main/java/org/apache/ranger/biz/XUserMgr.java | 12 ++-
.../ranger/common/RangerSuperUserConfig.java | 38 ++-----
.../org/apache/ranger/common/UserSessionBase.java | 4 +-
.../java/org/apache/ranger/rest/AssetREST.java | 18 ++--
.../java/org/apache/ranger/rest/ServiceREST.java | 4 +-
.../java/org/apache/ranger/rest/XUserREST.java | 4 +-
.../main/resources/conf.dist/ranger-admin-site.xml | 4 +-
.../org/apache/ranger/biz/TestRangerBizUtil.java | 79 ++++++++++++--
.../java/org/apache/ranger/biz/TestSessionMgr.java | 116 +++++++++++++++++++--
.../java/org/apache/ranger/biz/TestUserMgr.java | 96 ++++++++++++++++-
.../java/org/apache/ranger/biz/TestXUserMgr.java | 62 +++++++++++
.../ranger/common/TestRangerSuperUserConfig.java | 48 +--------
.../java/org/apache/ranger/rest/TestAssetREST.java | 16 +--
17 files changed, 497 insertions(+), 185 deletions(-)
diff --git a/security-admin/scripts/ranger-admin-site-template.xml
b/security-admin/scripts/ranger-admin-site-template.xml
index ed6211cc9..f22b8322f 100644
--- a/security-admin/scripts/ranger-admin-site-template.xml
+++ b/security-admin/scripts/ranger-admin-site-template.xml
@@ -251,11 +251,11 @@
<property>
<name>ranger.admin.super.users</name>
<value></value>
- <description>Comma-separated list of users granted full Ranger
administrative privileges at login (system admin and key admin capabilities),
independent of database roles. Empty or absent disables config-based super
users.</description>
+ <description>Comma-separated list of users granted full Ranger
administrative privileges at login (system admin capabilities), independent of
database roles. Empty or absent disables config-based super users.</description>
</property>
<property>
<name>ranger.admin.super.groups</name>
<value></value>
- <description>Comma-separated list of groups whose members are
granted full Ranger administrative privileges at login (system admin and key
admin capabilities), independent of database roles. Empty or absent disables
config-based super groups.</description>
+ <description>Comma-separated list of groups whose members are
granted full Ranger administrative privileges at login (system admin
capabilities), independent of database roles. Empty or absent disables
config-based super groups.</description>
</property>
</configuration>
diff --git
a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
index 1a0037eb9..b37154981 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
@@ -1339,28 +1339,22 @@ public void hasKMSPermissions(String objType, String
implClassName) {
+ objType,
MessageEnums.OPER_NO_PERMISSION);
}
- if (!session.isSuperUser()) {
- boolean isKmsServiceType =
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClassName);
+ boolean isKmsServiceType =
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClassName);
- if (session.isKeyAdmin() && !isKmsServiceType) {
- throw
restErrorUtil.createRESTException("KeyAdmin can create/update/delete only KMS "
+ objType,
-
MessageEnums.OPER_NO_PERMISSION);
- }
+ if (session.isKeyAdmin() && !isKmsServiceType) {
+ throw restErrorUtil.createRESTException("KeyAdmin can
create/update/delete only KMS " + objType,
+ MessageEnums.OPER_NO_PERMISSION);
+ }
- if (session.isUserAdmin() && isKmsServiceType &&
"Service-Def".equalsIgnoreCase(objType)) {
- throw restErrorUtil.createRESTException("System
Admin cannot create/update/delete KMS " + objType,
-
MessageEnums.OPER_NO_PERMISSION);
- }
+ if (session.isUserAdmin() && isKmsServiceType &&
"Service-Def".equalsIgnoreCase(objType)) {
+ throw restErrorUtil.createRESTException("System Admin
cannot create/update/delete KMS " + objType,
+ MessageEnums.OPER_NO_PERMISSION);
}
}
public boolean checkUserAccessible(VXUser vXUser) {
- if (isSuperUser()) {
- return true;
- }
-
boolean isAccessible = true;
- Collection<String> roleList = userMgr.getRolesByLoginId(vXUser
+ Collection<String> roleList =
userMgr.getDBRolesByLoginId(vXUser
.getName());
Collection<String> payloadRoles = vXUser.getUserRoleList();
if (isKeyAdmin()) {
@@ -1434,17 +1428,8 @@ public boolean isUserRangerAdmin(String username) {
return true;
}
- final boolean configSuperUser;
-
- if (RangerSuperUserConfig.isSuperUser(username)) {
- configSuperUser = true;
- } else if (RangerSuperUserConfig.isSuperGroupsConfigured() &&
xUserMgr != null) {
- configSuperUser =
RangerSuperUserConfig.isSuperUser(username,
xUserMgr.getGroupsForUser(username));
- } else {
- configSuperUser = false;
- }
-
- if (configSuperUser) {
+ // Config super-user when no session context (e.g. grantor
checks).
+ if (isConfigSuperUser(username)) {
return true;
}
@@ -1459,6 +1444,20 @@ public boolean isUserRangerAdmin(String username) {
return isAdmin;
}
+ /* True when username matches ranger.admin.super.users/groups,
regardless of
+ * the current session and of the user's DB portal roles. */
+ public boolean isConfigSuperUser(String username) {
+ if (StringUtils.isBlank(username)) {
+ return false;
+ } else if (RangerSuperUserConfig.isSuperUser(username)) {
+ return true;
+ } else if (RangerSuperUserConfig.isSuperGroupsConfigured() &&
xUserMgr != null) {
+ return RangerSuperUserConfig.isSuperUser(username,
xUserMgr.getGroupsForUser(username));
+ }
+
+ return false;
+ }
+
public boolean isSuperUser() {
UserSessionBase currentUserSession =
ContextUtil.getCurrentUserSession();
@@ -1515,14 +1514,16 @@ public boolean
isAnyGroupInConfigParameter(RangerService rangerService, String c
public void blockAuditorRoleUser() {
UserSessionBase session = ContextUtil.getCurrentUserSession();
if (session != null) {
- if (session.isAuditKeyAdmin() ||
session.isAuditUserAdmin()) {
- VXResponse vXResponse = new VXResponse();
-
vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
- vXResponse.setMsgDesc("Operation"
- + " denied. LoggedInUser="
- +
session.getXXPortalUser().getId()
- + " ,isn't permitted to
perform the action.");
- throw
restErrorUtil.generateRESTException(vXResponse);
+ if (!session.isSuperUser()) {
+ if (session.isAuditKeyAdmin() ||
session.isAuditUserAdmin()) {
+ VXResponse vXResponse = new
VXResponse();
+
vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
+ vXResponse.setMsgDesc("Operation"
+ + " denied.
LoggedInUser="
+ +
session.getXXPortalUser().getId()
+ + " ,isn't permitted
to perform the action.");
+ throw
restErrorUtil.generateRESTException(vXResponse);
+ }
}
} else {
VXResponse vXResponse = new VXResponse();
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
b/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
index d60e327d6..1ce109b69 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
@@ -285,7 +285,10 @@ public void resetUserModulePermission(UserSessionBase
userSession) {
if (xUser != null) {
List<String> permissionList;
if (userSession.isUserAdmin()) {
- permissionList =
daoManager.getXXModuleDef().getAllModuleNames();
+ permissionList = new
ArrayList<>(daoManager.getXXModuleDef().getAllModuleNames());
+
+ // Key Manager is for key admins only, not for
sys admins or config super-users.
+
permissionList.remove(RangerConstants.MODULE_KEY_MANAGER);
} else {
permissionList =
daoManager.getXXModuleDef().findAccessibleModulesByUserId(userSession.getUserId(),
xUser.getId());
}
@@ -364,7 +367,16 @@ private void setUserRoles(UserSessionBase userSession) {
applyConfigSuperUserSessionFlags(userSession);
if (userSession.isSuperUser()) {
- strRoleList =
RangerSuperUserConfig.mergeConfigSuperUserRoles(strRoleList, true);
+ if
(strRoleList.contains(RangerConstants.ROLE_KEY_ADMIN) ||
strRoleList.contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ logger.warn("User {} is configured as a config
super-user but has KMS role(s) {} in Ranger DB; KMS privileges are not granted
to config super-users. Remove the user from ranger.admin.super.users/groups or
remove the KMS role.", userSession.getLoginId(), strRoleList);
+ }
+
+ // Config super-users act as system admin regardless of
DB portal roles.
+ userSession.setKeyAdmin(false);
+ userSession.setAuditKeyAdmin(false);
+ userSession.setAuditUserAdmin(false);
+
+ strRoleList = RangerSuperUserConfig.getSuperUserRoles();
}
userSession.setUserRoleList(strRoleList);
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
index b0254d212..51569b652 100644
--- a/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/UserMgr.java
@@ -578,8 +578,9 @@ public VXPortalUser
mapXXPortalUserToVXPortalUser(XXPortalUser user,
if (userRoleList == null) {
userRoleList = new ArrayList<String>();
- if (sess.isSuperUser()) {
-
userRoleList.addAll(RangerSuperUserConfig.getConfigSuperUserProfileRoles());
+ // Config roles apply only to the super user's
own profile; other users keep their DB roles.
+ if (sess.isSuperUser() &&
sess.getXXPortalUser() != null &&
sess.getXXPortalUser().getId().equals(user.getId())) {
+
userRoleList.addAll(RangerSuperUserConfig.getSuperUserRoles());
} else {
List<XXPortalUserRole> gjUserRoleList =
daoManager
.getXXPortalUserRole().findByParentId(user.getId());
@@ -1131,7 +1132,7 @@ public VXPortalUser createDefaultAccountUser(VXPortalUser
userProfile) {
&& userProfile.getUserRoleList().size() > 0
&& ((List<String>) userProfile.getUserRoleList()).get(0)
!= null) {
reqRoleList = userProfile.getUserRoleList();
- existingRoleList = this.getRolesByLoginId(loginId);
+ existingRoleList = this.getDBRolesByLoginId(loginId);
XXPortalUser xxPortalUser = daoManager.getXXPortalUser()
.findByLoginId(userProfile.getLoginId());
if (xxPortalUser != null
@@ -1300,26 +1301,8 @@ public void checkAdminAccess() {
}
public Collection<String> getRolesByLoginId(String loginId) {
- if (loginId == null || loginId.trim().isEmpty()){
- return DEFAULT_ROLE_LIST;
- }
- XXPortalUser
xXPortalUser=daoManager.getXXPortalUser().findByLoginId(loginId);
- if(xXPortalUser==null){
- return DEFAULT_ROLE_LIST;
- }
- Collection<XXPortalUserRole> xXPortalUserRoles = daoManager
-
.getXXPortalUserRole().findByUserId(xXPortalUser.getId());
- if(xXPortalUserRoles==null){
- return DEFAULT_ROLE_LIST;
- }
- Collection<String> roleList = new ArrayList<String>();
- for (XXPortalUserRole role : xXPortalUserRoles) {
- if(role!=null &&
VALID_ROLE_LIST.contains(role.getUserRole())){
- if(!roleList.contains(role.getUserRole())){
- roleList.add(role.getUserRole());
- }
- }
- }
+ Collection<String> roleList = findDBRolesByLoginId(loginId);
+
if(roleList==null || roleList.size()==0){
return DEFAULT_ROLE_LIST;
}
@@ -1339,12 +1322,20 @@ public Collection<String> getRolesByLoginId(String
loginId) {
}
if (configSuperUser) {
- return
RangerSuperUserConfig.mergeConfigSuperUserRoles(roleList, false);
+ return RangerSuperUserConfig.getSuperUserRoles();
}
return roleList;
}
+ /* Portal roles stored in Ranger DB, without config super-user roles;
use when
+ * checking or updating the roles of a user other than the logged-in
one. */
+ public Collection<String> getDBRolesByLoginId(String loginId) {
+ Collection<String> roleList = findDBRolesByLoginId(loginId);
+
+ return roleList.isEmpty() ? DEFAULT_ROLE_LIST : roleList;
+ }
+
public boolean isUserNotActive(String loginId) {
if (loginId == null || loginId.trim().isEmpty()) {
return false;
@@ -1366,7 +1357,7 @@ private void applyConfigSuperUserProfileOverrides(final
VXPortalUser userProfile
return;
}
- List<String> effectiveRoles =
RangerSuperUserConfig.getConfigSuperUserProfileRoles();
+ List<String> effectiveRoles =
RangerSuperUserConfig.getSuperUserRoles();
userProfile.setUserRoleList(effectiveRoles);
@@ -1378,14 +1369,17 @@ private void applyConfigSuperUserProfileOverrides(final
VXPortalUser userProfile
Long xUserId = xUser != null ? xUser.getId() : null;
for (XXModuleDef moduleDef : moduleDefs) {
- VXUserPermission vxUserPermission = new
VXUserPermission();
+ // Config super-users get sys-admin modules
only.
+ if
(!RangerConstants.MODULE_KEY_MANAGER.equals(moduleDef.getModule())) {
+ VXUserPermission vxUserPermission = new
VXUserPermission();
- vxUserPermission.setModuleId(moduleDef.getId());
-
vxUserPermission.setModuleName(moduleDef.getModule());
- vxUserPermission.setUserId(xUserId);
-
vxUserPermission.setIsAllowed(RangerCommonEnums.IS_ALLOWED);
+
vxUserPermission.setModuleId(moduleDef.getId());
+
vxUserPermission.setModuleName(moduleDef.getModule());
+ vxUserPermission.setUserId(xUserId);
+
vxUserPermission.setIsAllowed(RangerCommonEnums.IS_ALLOWED);
- effectiveModules.add(vxUserPermission);
+ effectiveModules.add(vxUserPermission);
+ }
}
}
@@ -1484,8 +1478,44 @@ private String encodeString(String text, String salt,
String algorithm) {
}
}
+ private Collection<String> findDBRolesByLoginId(String loginId) {
+ Collection<String> roleList = new ArrayList<>();
+
+ if (loginId == null || loginId.trim().isEmpty()) {
+ return roleList;
+ }
+
+ XXPortalUser xXPortalUser =
daoManager.getXXPortalUser().findByLoginId(loginId);
+
+ if (xXPortalUser == null) {
+ return roleList;
+ }
+
+ Collection<XXPortalUserRole> xXPortalUserRoles =
daoManager.getXXPortalUserRole().findByUserId(xXPortalUser.getId());
+
+ if (xXPortalUserRoles != null) {
+ for (XXPortalUserRole role : xXPortalUserRoles) {
+ if (role != null &&
VALID_ROLE_LIST.contains(role.getUserRole()) &&
!roleList.contains(role.getUserRole())) {
+ roleList.add(role.getUserRole());
+ }
+ }
+ }
+
+ return roleList;
+ }
+
private boolean hasAccessToGetUserInfo(VXPortalUser requestedVXUser) {
UserSessionBase userSession =
ContextUtil.getCurrentUserSession();
+
+ if (userSession != null && userSession.isSuperUser()) {
+ /* rangerusersync must see all users; a super user can
always see self. */
+ if
("rangerusersync".equalsIgnoreCase(userSession.getLoginId()) ||
StringUtils.equals(requestedVXUser.getLoginId(), userSession.getLoginId())) {
+ return true;
+ }
+
+ return
requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) ||
requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)
|| requestedVXUser.getUserRoleList().contains(RangerConstants.ROLE_USER);
+ }
+
if (userSession != null && userSession.getLoginId() != null) {
VXPortalUser loggedInVXUser =
getUserProfileByLoginId(userSession.getLoginId());
if (loggedInVXUser != null &&
loggedInVXUser.getUserRoleList().size() == 1) {
diff --git a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
index 13e614d65..7293e023f 100755
--- a/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
+++ b/security-admin/src/main/java/org/apache/ranger/biz/XUserMgr.java
@@ -850,7 +850,17 @@ private boolean hasAccessToGetUserInfo(VXUser
requestedVXUser) {
UserSessionBase userSession =
ContextUtil.getCurrentUserSession();
if (userSession != null && userSession.isSuperUser()) {
- return true;
+ if (requestedVXUser == null ||
CollectionUtils.isEmpty(requestedVXUser.getUserRoleList())) {
+ return false;
+ }
+
+ /* rangerusersync must see all users; a super user can
always see self,
+ * even when its DB role is a KMS role. */
+ if
("rangerusersync".equalsIgnoreCase(userSession.getLoginId()) ||
StringUtils.equals(requestedVXUser.getName(), userSession.getLoginId())) {
+ return true;
+ }
+
+ return
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_SYS_ADMIN) ||
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_ADMIN_AUDITOR) ||
StringUtil.containsIgnoreCase(requestedVXUser.getUserRoleList(),
RangerConstants.ROLE_USER);
}
if (userSession != null && userSession.getLoginId() != null) {
diff --git
a/security-admin/src/main/java/org/apache/ranger/common/RangerSuperUserConfig.java
b/security-admin/src/main/java/org/apache/ranger/common/RangerSuperUserConfig.java
index d2bc2f65e..e78192452 100644
---
a/security-admin/src/main/java/org/apache/ranger/common/RangerSuperUserConfig.java
+++
b/security-admin/src/main/java/org/apache/ranger/common/RangerSuperUserConfig.java
@@ -23,10 +23,8 @@
import org.apache.commons.lang3.StringUtils;
import java.util.ArrayList;
-import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
-import java.util.LinkedHashSet;
import java.util.List;
import java.util.Set;
@@ -34,8 +32,7 @@
* Configuration-based Ranger Admin superusers and super groups.
* When {@code ranger.admin.super.users} or
* {@code ranger.admin.super.groups} are set, matching authenticated users
- * receive full Ranger administrative privileges (system admin and key admin
- * capabilities) without requiring corresponding roles in the Ranger database.
+ * receive full Ranger administrative privileges (system admin) without
requiring corresponding roles in the Ranger database.
*/
public final class RangerSuperUserConfig {
private static volatile RangerSuperUserConfig instance;
@@ -117,35 +114,14 @@ public static boolean isSuperUser(final String userName,
final Set<String> userG
}
/**
- * Merges config super-user admin roles with existing portal roles.
- * Used for Spring Security authentication and session role lists.
+ * Portal roles of a config super-user: {@code ROLE_SYS_ADMIN} only,
whatever
+ * its roles in the Ranger DB. Used for Spring Security authorities, the
+ * session role list and {@code GET /users/profile}.
*
- * @param existingRoles DB portal roles (may be null)
- * @param includeRoleUser when true, adds {@code ROLE_USER} (session lists)
- * @return merged role list with stable ordering
+ * @return a new, modifiable list
*/
- public static List<String> mergeConfigSuperUserRoles(final
Collection<String> existingRoles, final boolean includeRoleUser) {
- LinkedHashSet<String> merged = new LinkedHashSet<>();
-
- merged.add(RangerConstants.ROLE_SYS_ADMIN);
- merged.add(RangerConstants.ROLE_KEY_ADMIN);
-
- if (includeRoleUser) {
- merged.add(RangerConstants.ROLE_USER);
- }
-
- if (existingRoles != null) {
- merged.addAll(existingRoles);
- }
-
- return new ArrayList<>(merged);
- }
-
- /**
- * Admin roles exposed on {@code GET /user/profile} for config super-users.
- */
- public static List<String> getConfigSuperUserProfileRoles() {
- return mergeConfigSuperUserRoles(Collections.emptyList(), false);
+ public static List<String> getSuperUserRoles() {
+ return new
ArrayList<>(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN));
}
private static Set<String> parsePropertyValues(final String[] values) {
diff --git
a/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
b/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
index 61cbc5c86..cf53aae2e 100644
--- a/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
+++ b/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
@@ -119,7 +119,7 @@ public void setClientTimeOffsetInMinute(int
clientTimeOffsetInMinute) {
}
public boolean isKeyAdmin() {
- return superUser || keyAdmin;
+ return keyAdmin;
}
public boolean isSuperUser() {
@@ -146,7 +146,7 @@ public void setKeyAdmin(boolean keyAdmin) {
}
public boolean isAuditKeyAdmin() {
- return superUser || auditKeyAdmin;
+ return auditKeyAdmin;
}
public void setAuditKeyAdmin(boolean auditKeyAdmin) {
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
index 446ce48c8..e26101507 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/AssetREST.java
@@ -650,16 +650,14 @@ public VXAccessAuditList getAccessLogs(@Context
HttpServletRequest request, @Que
searchUtil.extractString(request, searchCriteria, "eventId",
"Event Id", null);
- if (!msBizUtil.isSuperUser()) {
- boolean isKeyAdmin = msBizUtil.isKeyAdmin();
- boolean isAuditKeyAdmin = msBizUtil.isAuditKeyAdmin();
- XXServiceDef xxServiceDef =
daoManager.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME);
- if(isKeyAdmin && xxServiceDef != null ||
isAuditKeyAdmin && xxServiceDef != null){
- searchCriteria.getParamList().put("repoType",
xxServiceDef.getId());
- }
- else if (xxServiceDef != null) {
- searchCriteria.getParamList().put("-repoType",
xxServiceDef.getId());
- }
+ boolean isKeyAdmin = msBizUtil.isKeyAdmin();
+ boolean isAuditKeyAdmin = msBizUtil.isAuditKeyAdmin();
+ XXServiceDef xxServiceDef =
daoManager.getXXServiceDef().findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME);
+ if(isKeyAdmin && xxServiceDef != null || isAuditKeyAdmin &&
xxServiceDef != null){
+ searchCriteria.getParamList().put("repoType",
xxServiceDef.getId());
+ }
+ else if (xxServiceDef != null) {
+ searchCriteria.getParamList().put("-repoType",
xxServiceDef.getId());
}
VXAccessAuditList vxAccessAuditList =
assetMgr.getAccessLogs(searchCriteria);
diff --git
a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
index a76da647e..27615fb31 100644
--- a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
@@ -1265,7 +1265,7 @@ public RESTResponse grantAccess(@PathParam("serviceName")
String serviceName, Gr
Set<String>
accessTypes = grantRequest.getAccessTypes();
VXUser vxUser =
xUserService.getXUserByUserName(userName);
- if
(vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ if
((vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) &&
!bizUtil.isConfigSuperUser(userName)) {
VXResponse vXResponse = new
VXResponse();
vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
vXResponse.setMsgDesc("Operation denied. LoggedInUser=" + vxUser.getId() + " is
not permitted to perform the action.");
@@ -1507,7 +1507,7 @@ public RESTResponse
revokeAccess(@PathParam("serviceName") String serviceName, G
Set<String>
accessTypes = revokeRequest.getAccessTypes();
VXUser vxUser =
xUserService.getXUserByUserName(userName);
- if
(vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) {
+ if
((vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR) ||
vxUser.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN_AUDITOR)) &&
!bizUtil.isConfigSuperUser(userName)) {
VXResponse vXResponse = new
VXResponse();
vXResponse.setStatusCode(HttpServletResponse.SC_FORBIDDEN);
vXResponse.setMsgDesc("Operation denied. LoggedInUser=" + vxUser.getId() + " is
not permitted to perform the action.");
diff --git a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
index 27dd8e777..9963cfbec 100755
--- a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
+++ b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
@@ -421,8 +421,8 @@ else if
((searchCriteria.getParamList().containsKey("name")) && userName!= null
UserSessionBase userSession =
ContextUtil.getCurrentUserSession();
if (userSession != null && userSession.getLoginId() != null) {
VXUser loggedInVXUser =
xUserService.getXUserByUserName(userSession.getLoginId());
- if (loggedInVXUser != null &&
loggedInVXUser.getUserRoleList().size() == 1) {
- if
(loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) ||
loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
+ if (loggedInVXUser != null &&
(userSession.isSuperUser() || loggedInVXUser.getUserRoleList().size() == 1)) {
+ if (userSession.isSuperUser() ||
loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN) ||
loggedInVXUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN_AUDITOR)) {
boolean hasRole = false;
hasRole =
!userRolesList.contains(RangerConstants.ROLE_SYS_ADMIN) ?
userRolesList.add(RangerConstants.ROLE_SYS_ADMIN) : hasRole;
hasRole =
!userRolesList.contains(RangerConstants.ROLE_ADMIN_AUDITOR) ?
userRolesList.add(RangerConstants.ROLE_ADMIN_AUDITOR) : hasRole;
diff --git a/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
b/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
index d8533051f..2f2d2faf7 100644
--- a/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
+++ b/security-admin/src/main/resources/conf.dist/ranger-admin-site.xml
@@ -482,12 +482,12 @@
<property>
<name>ranger.admin.super.users</name>
<value></value>
- <description>Comma-separated list of users granted full
Ranger administrative privileges at login (system admin and key admin
capabilities), independent of database roles. Empty or absent disables
config-based super users.</description>
+ <description>Comma-separated list of users granted full
Ranger administrative privileges at login (system admin capabilities),
independent of database roles. Empty or absent disables config-based super
users.</description>
</property>
<property>
<name>ranger.admin.super.groups</name>
<value></value>
- <description>Comma-separated list of groups whose
members are granted full Ranger administrative privileges at login (system
admin and key admin capabilities), independent of database roles. Empty or
absent disables config-based super groups.</description>
+ <description>Comma-separated list of groups whose
members are granted full Ranger administrative privileges at login (system
admin capabilities), independent of database roles. Empty or absent disables
config-based super groups.</description>
</property>
<property>
<name>xasecure.audit.jaas.Client.loginModuleName</name>
diff --git
a/security-admin/src/test/java/org/apache/ranger/biz/TestRangerBizUtil.java
b/security-admin/src/test/java/org/apache/ranger/biz/TestRangerBizUtil.java
index 566bc3219..53b8d5587 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestRangerBizUtil.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestRangerBizUtil.java
@@ -19,6 +19,7 @@
import java.lang.reflect.Field;
import java.util.ArrayList;
import java.util.Collection;
+import java.util.Collections;
import java.util.List;
import javax.servlet.http.HttpServletResponse;
@@ -42,6 +43,7 @@
import org.apache.ranger.entity.XXPortalUser;
import org.apache.ranger.entity.XXResource;
import org.apache.ranger.entity.XXUser;
+import org.apache.ranger.plugin.store.EmbeddedServiceDefsUtil;
import org.apache.ranger.security.context.RangerContextHolder;
import org.apache.ranger.security.context.RangerSecurityContext;
import org.apache.ranger.view.VXPortalUser;
@@ -415,7 +417,7 @@ public void
testCheckUserAccessibleThrowErrorForKeyAdminAndUserRoleSysAdmin()
Collection<String> roleList = new ArrayList<String>();
roleList.add(RangerConstants.ROLE_SYS_ADMIN);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(
roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
@@ -449,7 +451,7 @@ public void
testCheckUserAccessibleThrowErrorForKeyAdminAndUserRoleAdminAuditor(
Collection<String> roleList = new ArrayList<String>();
roleList.add(RangerConstants.ROLE_ADMIN_AUDITOR);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(
roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
@@ -482,7 +484,7 @@ public void testCheckUserAccessibleSuccessForKeyAdmin(){
Collection<String> roleList = new ArrayList<String>();
roleList.add(RangerConstants.ROLE_KEY_ADMIN);
roleList.add(RangerConstants.ROLE_KEY_ADMIN_AUDITOR);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(
roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
@@ -505,7 +507,7 @@ public void
testCheckUserAccessibleThrowErrorForAdminAndUserRoleKeyAdmin()
Collection<String> roleList = new ArrayList<String>();
roleList.add(RangerConstants.ROLE_KEY_ADMIN);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(
roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
@@ -540,7 +542,7 @@ public void
testCheckUserAccessibleThrowErrorForAdminAndUserRoleKeyAdminAuditor(
Collection<String> roleList = new ArrayList<String>();
roleList.add(RangerConstants.ROLE_KEY_ADMIN_AUDITOR);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(
roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
@@ -573,7 +575,7 @@ public void
testCheckUserAccessibleThrowErrorForAdminAndUserRoleKeyAdminAuditor(
public void testCheckUserAccessibleSuccessForAdmin(){
Collection<String> roleList = new ArrayList<String>();
roleList.add(RangerConstants.ROLE_SYS_ADMIN);
-
Mockito.when(userMgr.getRolesByLoginId(vXUser.getName())).thenReturn(
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(
roleList);
Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
@@ -671,6 +673,32 @@ public void testIsUserRangerAdmin_ConfigSuperUser() {
RangerSuperUserConfig.resetForTests();
}
+ @Test
+ public void testIsConfigSuperUser() {
+ RangerSuperUserConfig.resetForTests();
+
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
"config-admin");
+
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_GROUPS,
"super-group");
+
+
Mockito.when(xUserMgr.getGroupsForUser("group-member")).thenReturn(Collections.singleton("super-group"));
+
Mockito.when(xUserMgr.getGroupsForUser("db-admin")).thenReturn(Collections.emptySet());
+
+ XXPortalUser portalUser = new XXPortalUser();
+ portalUser.setLoginId("db-admin");
+
+ UserSessionBase session =
RangerContextHolder.getSecurityContext().getUserSession();
+ session.setXXPortalUser(portalUser);
+ session.setUserAdmin(true);
+
+
Assert.assertTrue(rangerBizUtil.isConfigSuperUser("config-admin"));
+
Assert.assertTrue(rangerBizUtil.isConfigSuperUser("group-member"));
+
Assert.assertFalse(rangerBizUtil.isConfigSuperUser("db-admin"));
+ Assert.assertFalse(rangerBizUtil.isConfigSuperUser(" "));
+
+
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
+
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_GROUPS);
+ RangerSuperUserConfig.resetForTests();
+ }
+
@Test
public void testIsUserRangerAdmin_ConfigDisabledSkipsGroupLookup() {
Assert.assertFalse(rangerBizUtil.isUserRangerAdmin("any-user"));
@@ -702,6 +730,45 @@ public void
testCheckUserAccessible_ConfigSuperUserCanManageSysAdminUser() {
Assert.assertTrue(rangerBizUtil.checkUserAccessible(vXUser));
}
+ @Test
+ public void
testHasKMSPermissions_DeniesConfigSuperUserOnServiceDefKMS() {
+
RangerContextHolder.getSecurityContext().getUserSession().setSuperUser(true);
+
+ WebApplicationException webExp = new WebApplicationException();
+
+ Mockito.when(restErrorUtil.createRESTException("System Admin
cannot create/update/delete KMS Service-Def",
MessageEnums.OPER_NO_PERMISSION)).thenReturn(webExp);
+
+ Assert.assertThrows(WebApplicationException.class, () ->
rangerBizUtil.hasKMSPermissions("Service-Def",
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME));
+ }
+
+ @Test
+ public void testHasKMSPermissions_AllowsConfigSuperUserOnKMSService() {
+
RangerContextHolder.getSecurityContext().getUserSession().setSuperUser(true);
+
+ rangerBizUtil.hasKMSPermissions("Service",
EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME);
+ }
+
+ @Test
+ public void
testCheckUserAccessible_ConfigSuperUserCannotManageKeyAdminUser() {
+ List<String> roleList = new ArrayList<>();
+ roleList.add(RangerConstants.ROLE_KEY_ADMIN);
+
Mockito.when(userMgr.getDBRolesByLoginId(vXUser.getName())).thenReturn(roleList);
+ Mockito.when(vXUser.getUserRoleList()).thenReturn(roleList);
+
+ UserSessionBase session = new UserSessionBase();
+ session.setSuperUser(true);
+
+ RangerSecurityContext context = new RangerSecurityContext();
+ context.setUserSession(session);
+ RangerContextHolder.setSecurityContext(context);
+
+ WebApplicationException webExp = new WebApplicationException();
+
+ Mockito.when(restErrorUtil.createRESTException("Logged in user
is not allowed to create/update user",
MessageEnums.OPER_NO_PERMISSION)).thenReturn(webExp);
+
+ Assert.assertThrows(WebApplicationException.class, () ->
rangerBizUtil.checkUserAccessible(vXUser));
+ }
+
@Test
public void
testFailUnauthenticatedDownload_blocksWhenNoSessionAndFlagFalse() {
RangerContextHolder.setSecurityContext(null);
diff --git
a/security-admin/src/test/java/org/apache/ranger/biz/TestSessionMgr.java
b/security-admin/src/test/java/org/apache/ranger/biz/TestSessionMgr.java
index 1cba3c1e2..0ccdab564 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestSessionMgr.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestSessionMgr.java
@@ -590,11 +590,11 @@ public void testSetUserRoles_ConfigSuperUserAndGroup() {
sessionMgr.resetUserSessionForProfiles(userSession);
assertTrue(userSession.isUserAdmin());
- assertTrue(userSession.isKeyAdmin());
+ assertFalse(userSession.isKeyAdmin());
+ assertFalse(userSession.isAuditKeyAdmin());
assertTrue(userSession.isSuperUser());
assertTrue(userSession.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN));
-
assertTrue(userSession.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN));
-
assertTrue(userSession.getUserRoleList().contains(RangerConstants.ROLE_USER));
+
assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
userSession.getUserRoleList());
assertFalse(userSession.isSingleRoleUserSession());
verify(xUserMgr, never()).getGroupsForUser(anyString());
@@ -611,7 +611,7 @@ public void testSetUserRoles_ConfigSuperUserAndGroup() {
sessionMgr.resetUserSessionForProfiles(userSession);
assertTrue(userSession.isUserAdmin());
- assertTrue(userSession.isKeyAdmin());
+ assertFalse(userSession.isKeyAdmin());
assertTrue(userSession.isSuperUser());
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_GROUPS);
@@ -667,7 +667,7 @@ public void testIsUserAdminIncludesSuperUserFlag() {
}
@Test
- public void testSetUserRoles_ConfigSuperUserGrantsKeyAdminForSysAdmin() {
+ public void
testSetUserRoles_ConfigSuperUserDoesNotGrantKeyAdminForSysAdmin() {
RangerSuperUserConfig.resetForTests();
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
"config-admin");
@@ -695,13 +695,117 @@ public void
testSetUserRoles_ConfigSuperUserGrantsKeyAdminForSysAdmin() {
sessionMgr.resetUserSessionForProfiles(userSession);
assertTrue(userSession.isUserAdmin());
- assertTrue(userSession.isKeyAdmin());
+ assertFalse(userSession.isKeyAdmin());
assertTrue(userSession.isSuperUser());
+
assertFalse(userSession.getUserRoleList().contains(RangerConstants.ROLE_KEY_ADMIN));
verify(xUserMgr, never()).getGroupsForUser(anyString());
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
}
+ @Test
+ public void
testResetUserModulePermission_ConfigSuperUserExcludesKeyManager() {
+ UserSessionBase userSession = superUserSessionWithModules();
+
+ sessionMgr.resetUserModulePermission(userSession);
+
+ Set<String> permissions =
userSession.getRangerUserPermission().getUserPermissions();
+
+ assertTrue(permissions.contains(RangerConstants.MODULE_AUDIT));
+ assertFalse(permissions.contains(RangerConstants.MODULE_KEY_MANAGER));
+ }
+
+ @Test
+ public void testResetUserModulePermission_SysAdminExcludesKeyManager() {
+ UserSessionBase userSession = superUserSessionWithModules();
+
+ userSession.setSuperUser(false);
+ userSession.setUserAdmin(true);
+
+ sessionMgr.resetUserModulePermission(userSession);
+
+ Set<String> permissions =
userSession.getRangerUserPermission().getUserPermissions();
+
+ assertTrue(permissions.contains(RangerConstants.MODULE_AUDIT));
+ assertFalse(permissions.contains(RangerConstants.MODULE_KEY_MANAGER));
+ }
+
+ @Test
+ public void
testResetUserModulePermission_ConfigSuperUserExcludesKeyManagerEvenWithKeyAdminFlag()
{
+ UserSessionBase userSession = superUserSessionWithModules();
+
+ userSession.setKeyAdmin(true);
+
+ sessionMgr.resetUserModulePermission(userSession);
+
+ Set<String> permissions =
userSession.getRangerUserPermission().getUserPermissions();
+
+ assertTrue(permissions.contains(RangerConstants.MODULE_AUDIT));
+ assertFalse(permissions.contains(RangerConstants.MODULE_KEY_MANAGER));
+ }
+
+ @Test
+ public void testSetUserRoles_ConfigSuperUserIgnoresDbKeyAdminRole() {
+ RangerSuperUserConfig.resetForTests();
+
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
"config-admin");
+
+ UserSessionBase userSession = new UserSessionBase();
+ XXPortalUser portalUser = new XXPortalUser();
+
+ portalUser.setId(45L);
+ portalUser.setLoginId("config-admin");
+ userSession.setXXPortalUser(portalUser);
+
+ XXPortalUserDao portalDao = mock(XXPortalUserDao.class);
+
+ when(daoManager.getXXPortalUser()).thenReturn(portalDao);
+ when(portalDao.findByLoginId("config-admin")).thenReturn(portalUser);
+
+ XXPortalUserRole keyAdminRole = new XXPortalUserRole();
+
+ keyAdminRole.setUserRole(RangerConstants.ROLE_KEY_ADMIN);
+
+ XXPortalUserRoleDao roleDao = mock(XXPortalUserRoleDao.class);
+
+ when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
+
when(roleDao.findByUserId(45L)).thenReturn(Collections.singletonList(keyAdminRole));
+
+ sessionMgr.resetUserSessionForProfiles(userSession);
+
+ assertTrue(userSession.isSuperUser());
+ assertTrue(userSession.isUserAdmin());
+ assertFalse(userSession.isKeyAdmin());
+ assertFalse(userSession.isAuditKeyAdmin());
+
assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
userSession.getUserRoleList());
+
+
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
+ RangerSuperUserConfig.resetForTests();
+ }
+
+ private UserSessionBase superUserSessionWithModules() {
+ UserSessionBase userSession = new UserSessionBase();
+ XXPortalUser portalUser = new XXPortalUser();
+
+ portalUser.setId(44L);
+ portalUser.setLoginId("config-admin");
+ userSession.setXXPortalUser(portalUser);
+ userSession.setSuperUser(true);
+
+ XXUser xUser = new XXUser();
+
+ xUser.setId(144L);
+
+ XXUserDao xUserDao = mock(XXUserDao.class);
+ XXModuleDefDao moduleDefDao = mock(XXModuleDefDao.class);
+
+ when(daoManager.getXXUser()).thenReturn(xUserDao);
+ when(xUserDao.findByUserName("config-admin")).thenReturn(xUser);
+ when(daoManager.getXXModuleDef()).thenReturn(moduleDefDao);
+
when(moduleDefDao.getAllModuleNames()).thenReturn(Arrays.asList(RangerConstants.MODULE_AUDIT,
RangerConstants.MODULE_KEY_MANAGER));
+
+ return userSession;
+ }
+
@Test
public void testProcessSuccessLogin_LimitZeroDoesNotExpireOldestSession() {
RangerContextHolder.setSecurityContext(null);
diff --git
a/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
b/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
index 563f66a81..ac98a6053 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestUserMgr.java
@@ -1771,9 +1771,7 @@ public void testGetRolesByLoginId_ConfigSuperUser() {
Collection<String> roles =
userMgr.getRolesByLoginId(userLoginId);
- Assert.assertTrue(roles.contains(RangerConstants.ROLE_USER));
-
Assert.assertTrue(roles.contains(RangerConstants.ROLE_SYS_ADMIN));
-
Assert.assertTrue(roles.contains(RangerConstants.ROLE_KEY_ADMIN));
+
Assert.assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
new ArrayList<>(roles));
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
RangerSuperUserConfig.resetForTests();
@@ -1785,6 +1783,98 @@ public void testGetRolesByLoginId_ConfigSuperUser() {
RangerSuperUserConfig.resetForTests();
}
+ @Test
+ public void testGetDBRolesByLoginId_ConfigSuperUserKeepsDBRoles() {
+ setup();
+ XXPortalUserDao userDao = Mockito.mock(XXPortalUserDao.class);
+ XXPortalUserRoleDao roleDao =
Mockito.mock(XXPortalUserRoleDao.class);
+
+ VXPortalUser userProfile = userProfile();
+ String userLoginId = userProfile.getLoginId();
+
+ XXPortalUser user = new XXPortalUser();
+ user.setLoginId(userLoginId);
+ user.setId(userProfile.getId());
+
+ XXPortalUserRole xxPortalUserRole = new XXPortalUserRole();
+ xxPortalUserRole.setUserRole(RangerConstants.ROLE_KEY_ADMIN);
+ List<XXPortalUserRole> list = new ArrayList<XXPortalUserRole>();
+ list.add(xxPortalUserRole);
+
+ Mockito.when(daoManager.getXXPortalUser()).thenReturn(userDao);
+
Mockito.when(userDao.findByLoginId(userLoginId)).thenReturn(user);
+
Mockito.when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
+
Mockito.when(roleDao.findByUserId(user.getId())).thenReturn(list);
+ RangerSuperUserConfig.resetForTests();
+
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
userLoginId);
+
+
Assert.assertEquals(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN),
new ArrayList<>(userMgr.getDBRolesByLoginId(userLoginId)));
+
Assert.assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
new ArrayList<>(userMgr.getRolesByLoginId(userLoginId)));
+
+
PropertiesUtil.getPropertiesMap().remove(RangerConstants.RANGER_ADMIN_SUPER_USERS);
+ RangerSuperUserConfig.resetForTests();
+ }
+
+ @Test
+ public void
testMapXXPortalUserToVXPortalUser_ConfigSuperUserKeepsOtherUserDbRoles() {
+ XXPortalUser keyAdminUser =
configSuperUserSessionAndKeyAdminUser();
+
+ VXPortalUser profile =
userMgr.mapXXPortalUserToVXPortalUser(keyAdminUser, null);
+
+
Assert.assertEquals(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN),
profile.getUserRoleList());
+
+ destroySession();
+ }
+
+ @Test
+ public void testCheckAccess_ConfigSuperUserCannotAccessKeyAdminUser() {
+ XXPortalUser keyAdminUser =
configSuperUserSessionAndKeyAdminUser();
+ XXPortalUserDao userDao = Mockito.mock(XXPortalUserDao.class);
+
+ Mockito.when(daoManager.getXXPortalUser()).thenReturn(userDao);
+
Mockito.when(userDao.findByLoginId("keyadmin-user")).thenReturn(keyAdminUser);
+
Mockito.when(restErrorUtil.createRESTException(HttpServletResponse.SC_FORBIDDEN,
"Logged-In user is not allowed to access requested user data",
true)).thenReturn(new WebApplicationException());
+
+ Assert.assertThrows(WebApplicationException.class, () ->
userMgr.checkAccess(keyAdminUser));
+
+ destroySession();
+ }
+
+ private XXPortalUser configSuperUserSessionAndKeyAdminUser() {
+ UserSessionBase session = new UserSessionBase();
+ XXPortalUser portalUser = new XXPortalUser();
+
+ portalUser.setId(99L);
+ portalUser.setLoginId("config-admin");
+ session.setXXPortalUser(portalUser);
+ session.setSuperUser(true);
+
+ RangerSecurityContext context = new RangerSecurityContext();
+ context.setUserSession(session);
+ RangerContextHolder.setSecurityContext(context);
+
+ XXPortalUser keyAdminUser = new XXPortalUser();
+ keyAdminUser.setId(100L);
+ keyAdminUser.setLoginId("keyadmin-user");
+ keyAdminUser.setUserSource(RangerCommonEnums.USER_APP);
+
+ XXPortalUserRole keyAdminRole = new XXPortalUserRole();
+ keyAdminRole.setUserRole(RangerConstants.ROLE_KEY_ADMIN);
+
+ XXPortalUserRoleDao roleDao =
Mockito.mock(XXPortalUserRoleDao.class);
+ XXUserPermissionDao userPermissionDao =
Mockito.mock(XXUserPermissionDao.class);
+ XXGroupPermissionDao groupPermissionDao =
Mockito.mock(XXGroupPermissionDao.class);
+
+
Mockito.when(daoManager.getXXPortalUserRole()).thenReturn(roleDao);
+
Mockito.when(roleDao.findByParentId(100L)).thenReturn(Collections.singletonList(keyAdminRole));
+
Mockito.when(daoManager.getXXUserPermission()).thenReturn(userPermissionDao);
+
Mockito.when(daoManager.getXXGroupPermission()).thenReturn(groupPermissionDao);
+
Mockito.when(userPermissionDao.findByUserPermissionIdAndIsAllowed(100L)).thenReturn(Collections.emptyList());
+
Mockito.when(groupPermissionDao.findbyVXPortalUserId(100L)).thenReturn(Collections.emptyList());
+
+ return keyAdminUser;
+ }
+
@Test
public void test31checkAccess() {
setup();
diff --git
a/security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java
b/security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java
index 708507809..7fa828895 100644
--- a/security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java
+++ b/security-admin/src/test/java/org/apache/ranger/biz/TestXUserMgr.java
@@ -4878,4 +4878,66 @@ public void test135updateXGroupUser_userNotFound() {
xUserMgr.updateXGroupUser(vxGroupUser);
});
}
+
+ @Test
+ public void test136checkAccess_configSuperUserCanAccessSysAdminUser() {
+ setupConfigSuperUserSession();
+
+ VXUser requestedUser = new VXUser();
+ requestedUser.setId(2L);
+
requestedUser.setUserRoleList(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN));
+
+ xUserMgr.checkAccess(requestedUser);
+ }
+
+ @Test
+ public void
test137checkAccess_configSuperUserCannotAccessKeyAdminUser() {
+ setupConfigSuperUserSession();
+
+ VXUser requestedUser = new VXUser();
+ requestedUser.setId(2L);
+
requestedUser.setUserRoleList(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN));
+
+
Mockito.when(restErrorUtil.create403RESTException(Mockito.anyString())).thenReturn(new
WebApplicationException());
+
+ Assert.assertThrows(WebApplicationException.class, () ->
xUserMgr.checkAccess(requestedUser));
+ }
+
+ @Test
+ public void
test138checkAccess_configSuperUserCanAccessSelfWithKeyAdminDBRole() {
+ setupConfigSuperUserSession();
+
+ VXUser requestedUser = new VXUser();
+ requestedUser.setId(1L);
+ requestedUser.setName("config-admin");
+
requestedUser.setUserRoleList(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN));
+
+ xUserMgr.checkAccess(requestedUser);
+ }
+
+ @Test
+ public void
test139checkAccess_rangerusersyncConfigSuperUserCanAccessKeyAdminUser() {
+ setupConfigSuperUserSession();
+
ContextUtil.getCurrentUserSession().getXXPortalUser().setLoginId("rangerusersync");
+
+ VXUser requestedUser = new VXUser();
+ requestedUser.setId(2L);
+ requestedUser.setName("keyadmin");
+
requestedUser.setUserRoleList(Collections.singletonList(RangerConstants.ROLE_KEY_ADMIN));
+
+ xUserMgr.checkAccess(requestedUser);
+ }
+
+ private void setupConfigSuperUserSession() {
+ RangerSecurityContext context = new RangerSecurityContext();
+ context.setUserSession(new UserSessionBase());
+ RangerContextHolder.setSecurityContext(context);
+
+ UserSessionBase currentUserSession =
ContextUtil.getCurrentUserSession();
+ XXPortalUser portalUser = new XXPortalUser();
+ portalUser.setLoginId("config-admin");
+ portalUser.setId(1L);
+ currentUserSession.setXXPortalUser(portalUser);
+ currentUserSession.setSuperUser(true);
+ }
}
diff --git
a/security-admin/src/test/java/org/apache/ranger/common/TestRangerSuperUserConfig.java
b/security-admin/src/test/java/org/apache/ranger/common/TestRangerSuperUserConfig.java
index 8293c718f..de28dd37e 100644
---
a/security-admin/src/test/java/org/apache/ranger/common/TestRangerSuperUserConfig.java
+++
b/security-admin/src/test/java/org/apache/ranger/common/TestRangerSuperUserConfig.java
@@ -24,7 +24,6 @@
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
-import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
@@ -149,40 +148,14 @@ public void testIsSuperUser_BlankLoginId() {
}
@Test
- public void testMergeConfigSuperUserRoles_ForAuthentication() {
- List<String> merged = RangerSuperUserConfig.mergeConfigSuperUserRoles(
- Collections.singletonList(RangerConstants.ROLE_USER), false);
+ public void testGetSuperUserRoles() {
+ List<String> roles = RangerSuperUserConfig.getSuperUserRoles();
- Assertions.assertEquals(
- Arrays.asList(
- RangerConstants.ROLE_SYS_ADMIN,
- RangerConstants.ROLE_KEY_ADMIN,
- RangerConstants.ROLE_USER),
- merged);
- }
+
Assertions.assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
roles);
- @Test
- public void testMergeConfigSuperUserRoles_ForSession() {
- List<String> merged = RangerSuperUserConfig.mergeConfigSuperUserRoles(
- Collections.singletonList(RangerConstants.ROLE_ADMIN_AUDITOR),
- true);
+ roles.add(RangerConstants.ROLE_USER);
- Assertions.assertEquals(
- Arrays.asList(
- RangerConstants.ROLE_SYS_ADMIN,
- RangerConstants.ROLE_KEY_ADMIN,
- RangerConstants.ROLE_USER,
- RangerConstants.ROLE_ADMIN_AUDITOR),
- merged);
- }
-
- @Test
- public void testGetConfigSuperUserProfileRoles() {
- Assertions.assertEquals(
- Arrays.asList(
- RangerConstants.ROLE_SYS_ADMIN,
- RangerConstants.ROLE_KEY_ADMIN),
- RangerSuperUserConfig.getConfigSuperUserProfileRoles());
+
Assertions.assertEquals(Collections.singletonList(RangerConstants.ROLE_SYS_ADMIN),
RangerSuperUserConfig.getSuperUserRoles());
}
@Test
@@ -224,17 +197,6 @@ public void
testIsEnabled_WhenWildcardConfiguredAsLiteralUser() {
Assertions.assertTrue(RangerSuperUserConfig.isSuperUser("*",
Collections.emptySet()));
}
- @Test
- public void testMergeConfigSuperUserRoles_NullExistingRoles() {
- List<String> merged =
RangerSuperUserConfig.mergeConfigSuperUserRoles(null, false);
-
- Assertions.assertEquals(
- Arrays.asList(
- RangerConstants.ROLE_SYS_ADMIN,
- RangerConstants.ROLE_KEY_ADMIN),
- merged);
- }
-
@Test
public void testConfigReloadAfterResetForTests() {
PropertiesUtil.getPropertiesMap().put(RangerConstants.RANGER_ADMIN_SUPER_USERS,
"alice");
diff --git
a/security-admin/src/test/java/org/apache/ranger/rest/TestAssetREST.java
b/security-admin/src/test/java/org/apache/ranger/rest/TestAssetREST.java
index 3a3fda25a..74e3bce58 100644
--- a/security-admin/src/test/java/org/apache/ranger/rest/TestAssetREST.java
+++ b/security-admin/src/test/java/org/apache/ranger/rest/TestAssetREST.java
@@ -676,7 +676,6 @@ public void testGetAccessLogs() {
.thenReturn(new Date());
Mockito.when(searchUtil.extractLong((HttpServletRequest)
Mockito.any(),
(SearchCriteria) Mockito.any(),
Mockito.anyString(), Mockito.anyString())).thenReturn((Long) 8l);
- Mockito.when(msBizUtil.isSuperUser()).thenReturn(false);
Mockito.when(msBizUtil.isKeyAdmin()).thenReturn(false);
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xxServiceDefDao);
XXServiceDef xServiceDef = new XXServiceDef();
@@ -730,16 +729,19 @@ public void testGetAccessLogsForConfigSuperUser() {
.thenReturn(new Date());
Mockito.when(searchUtil.extractLong((HttpServletRequest)
Mockito.any(),
(SearchCriteria) Mockito.any(),
Mockito.anyString(), Mockito.anyString())).thenReturn((Long) 8l);
- Mockito.when(msBizUtil.isSuperUser()).thenReturn(true);
+ Mockito.when(msBizUtil.isKeyAdmin()).thenReturn(false);
+ Mockito.when(msBizUtil.isAuditKeyAdmin()).thenReturn(false);
+
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xxServiceDefDao);
+ XXServiceDef xServiceDef = new XXServiceDef();
+ xServiceDef.setId(Id);
+
Mockito.when(xxServiceDefDao.findByName(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_KMS_NAME)).thenReturn(xServiceDef);
ArgumentCaptor<SearchCriteria> criteriaCaptor =
ArgumentCaptor.forClass(SearchCriteria.class);
Mockito.when(assetMgr.getAccessLogs(criteriaCaptor.capture())).thenReturn(vXAccessAuditList);
VXAccessAuditList expectedVXAccessAuditList =
assetREST.getAccessLogs(request, null);
Assert.assertEquals(vXAccessAuditList,
expectedVXAccessAuditList);
Assert.assertFalse(criteriaCaptor.getValue().getParamList().containsKey("repoType"));
-
Assert.assertFalse(criteriaCaptor.getValue().getParamList().containsKey("-repoType"));
- Mockito.verify(msBizUtil).isSuperUser();
- Mockito.verify(msBizUtil, Mockito.never()).isKeyAdmin();
- Mockito.verify(daoManager, Mockito.never()).getXXServiceDef();
+ Assert.assertEquals(Id,
criteriaCaptor.getValue().getParamList().get("-repoType"));
+ Mockito.verify(msBizUtil, Mockito.never()).isSuperUser();
Mockito.verify(assetMgr).getAccessLogs(searchCriteria);
}
@@ -764,7 +766,6 @@ public void testGetAccessLogsForKms() {
(SearchCriteria) Mockito.any(),
Mockito.anyString(), Mockito.anyString())).thenReturn((Long) 8l);
Mockito.when(searchUtil.extractLong((HttpServletRequest)
Mockito.any(),
(SearchCriteria) Mockito.any(),
Mockito.anyString(), Mockito.anyString())).thenReturn((Long) 8l);
- Mockito.when(msBizUtil.isSuperUser()).thenReturn(false);
Mockito.when(msBizUtil.isKeyAdmin()).thenReturn(true);
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xxServiceDefDao);
XXServiceDef xServiceDef = new XXServiceDef();
@@ -774,7 +775,6 @@ public void testGetAccessLogsForKms() {
Mockito.when(assetMgr.getAccessLogs(searchCriteria)).thenReturn(vXAccessAuditList);
VXAccessAuditList expectedVXAccessAuditList =
assetREST.getAccessLogs(request, null);
Assert.assertEquals(vXAccessAuditList,
expectedVXAccessAuditList);
- Mockito.verify(msBizUtil).isSuperUser();
Mockito.verify(msBizUtil).isKeyAdmin();
Mockito.verify(assetMgr).getAccessLogs(searchCriteria);
Mockito.verify(daoManager).getXXServiceDef();
