mneethiraj commented on code in PR #1265:
URL: https://github.com/apache/ranger/pull/1265#discussion_r4131063903
##########
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java:
##########
@@ -130,9 +121,18 @@ public void preProcess(RangerAccessRequest request) {
Set<String> roles = request.getUserRoles();
if (pluginContext != null && CollectionUtils.isEmpty(roles)) {
- roles =
pluginContext.getAuthContext().getRolesForUserAndGroups(request.getUser(),
request.getUserGroups());
+ if (batchEvalContext != null &&
batchEvalContext.hasUserRoles(originalUser, originalGroups)) {
Review Comment:
Consider simplifying 124-133 with the following:
```
if (batchEvalContext != null) {
roles = batchEvalContext.getUserRoles(originalUser, originalGroups);
if (roles == null) {
roles =
pluginContext.getAuthContext().getRolesForUserAndGroups(request.getUser(),
request.getUserGroups());
batchEvalContext.putUserRoles(originalUser, originalGroups,
readOnly(roles));
}
} else {
roles =
pluginContext.getAuthContext().getRolesForUserAndGroups(request.getUser(),
request.getUserGroups());
}
```
```
Set<String> readOnly(Set<String> values) {
return values == null || values.isEmpty() ? Collections.emptySet() :
Collections.unmodifiableSet(values);
}
```
##########
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerDefaultRequestProcessor.java:
##########
@@ -173,6 +173,68 @@ public void enrich(RangerAccessRequest request) {
}
}
+ private void normalizeUserAndGroups(RangerAccessRequestImpl reqImpl,
RangerPluginContext pluginContext, RangerBatchEvalContext batchEvalContext,
String originalUser, Set<String> originalGroups) {
+ RangerPluginConfig config =
pluginContext.getConfig();
+ boolean isNameTransformationSupported =
config.getBoolean(config.getPropertyPrefix() +
RangerCommonConstants.PLUGIN_CONFIG_SUFFIX_NAME_TRANSFORMATION, false);
+
+ LOG.debug("isNameTransformationSupported = {}",
isNameTransformationSupported);
+
+ if (batchEvalContext != null &&
batchEvalContext.hasUserName(originalUser)) {
+ reqImpl.setUser(batchEvalContext.getUserName(originalUser));
+ } else {
+ if (isNameTransformationSupported) {
+ reqImpl.setUser(getTransformedUser(policyEngine, reqImpl));
+ }
+
+ convertEmailToUsername(reqImpl);
+
+ if (batchEvalContext != null) {
+ batchEvalContext.putUserName(originalUser, reqImpl.getUser());
+ }
+ }
+
+ if (batchEvalContext != null &&
batchEvalContext.hasUserGroups(originalUser, originalGroups)) {
Review Comment:
For readability, I suggest replacing 196 to 220 with:
```
if (batchEvalContext != null) {
String mappedUser = batchEvalContext.getUserName(originalUser);
Set<String> mappedUserGroups =
batchEvalContext.getUserGroups(originalUser, originalGroups);
if (mappedUser == null || mappedUserGroups == null) {
mapUserAndGroups(reqImpl);
batchEvalContext.putUserName(originalUser, reqImpl.getUser());
batchEvalContext.putUserGroups(originalUser, originalGroups,
copyReadOnly(reqImpl.getUserGroups()));
} else {
reqImpl.setUser(mappedUser);
reqImpl.setUserGroups(mappedUserGroups);
}
} else {
mapUserAndGroups(reqImpl);
}
```
```
void mapUserAndGroups(RangerAccessRequestImpl req) {
RangerPluginConfig config =
policyEngine.getPluginContext().getConfig();
boolean needsTransform =
config.getBoolean(config.getPropertyPrefix() +
RangerCommonConstants.PLUGIN_CONFIG_SUFFIX_NAME_TRANSFORMATION, false);
if (needsTransform) {
reqImpl.setUser(getTransformedUser(policyEngine, req));
reqImpl.setUserGroups(getTransformedGroups(policyEngine, req));
}
convertEmailToUsername(req);
updateUserGroups(req);
}
Set<String> copyReadOnly(Set<String> values) {
return values == null || values.isEmpty() ? Collections.emptySet() :
Collections.unmodifiableSet(new HashSet<>(values));
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
