pradeepagrawal8184 commented on code in PR #1266:
URL: https://github.com/apache/ranger/pull/1266#discussion_r4144978250
##########
security-admin/src/main/java/org/apache/ranger/biz/ServiceMgr.java:
##########
@@ -460,6 +444,82 @@ Long parseLong(String str) {
}
}
+ private void enforceSavedServiceEndpointConfigs(RangerService service)
throws Exception {
+ if
(!Boolean.parseBoolean(PropertiesUtil.getProperty(PROP_SERVICE_CONFIG_VALIDATE_REQUIRE_SAVED_SERVICE,
"false"))) {
+ return;
+ }
+
+ String serviceName = service.getName();
+ if (StringUtils.isBlank(serviceName)) {
+ return;
+ }
+
+ RangerService savedService = svcDBStore.getServiceByName(serviceName);
+ if (savedService == null) {
+ throw new Exception("Configuration validation requires a saved
service: " + serviceName);
+ }
+
+ if (StringUtils.isNotBlank(service.getType()) &&
StringUtils.isNotBlank(savedService.getType())
+ && !StringUtils.equals(service.getType(),
savedService.getType())) {
+ throw new Exception("Configuration validation service type does
not match saved service: " + serviceName);
+ }
+
+ Map<String, String> savedConfigs =
rangerSvcService.getConfigsWithDecryptedPassword(savedService);
+ if (savedConfigs == null) {
+ savedConfigs = Collections.emptyMap();
+ }
+
+ for (Map.Entry<String, String> entry :
service.getConfigs().entrySet()) {
+ String requestValue = entry.getValue();
+ if (requestValue == null || requestValue.trim().isEmpty()) {
+ continue;
+ }
+
+ String requestHost = extractHost(requestValue);
+ if (requestHost == null) {
+ continue;
+ }
+
+ String savedValue = savedConfigs.get(entry.getKey());
+ if (savedValue == null) {
+ throw new Exception("Invalid value for configuration " +
entry.getKey() + ": endpoint property is not present in saved service
configuration");
+ }
+
+ String savedHost = extractHost(savedValue);
+ if (savedHost == null || !requestHost.equalsIgnoreCase(savedHost))
{
Review Comment:
Replaced host-only comparison with full connection-URL pinning (scheme,
userInfo, comma-separated authority segments including port, path). Non-URL
config values are excluded. Unparseable connection URLs are rejected when the
flag is on. Added tests for port/path/userinfo/JDBC multi-host/loadbalance and
username-only changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
