[
https://issues.apache.org/jira/browse/RANGER-5838?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vyom Mani Tiwari updated RANGER-5838:
-------------------------------------
Description:
Add the data model for constraint policies. This change only adds model classes
and JSON serialization. There is no change to policy evaluation, Admin
persistence, audit, or UI.
*RangerServiceDef*
* New field {{{}List<RangerConstraintDef> constraintDefs{}}}.
* {{{}RangerConstraintDef{}}}: itemId, name, label, description, rbKeyLabel,
rbKeyDescription, resources (resource names the constraint applies to),
accessTypes (access-type names), parameters
({{{}List<RangerConstraintParamDef>{}}}), options ({{{}Map<String, String>{}}}).
* {{{}RangerConstraintParamDef{}}}: itemId, name, label, description, type
(e.g. string, int, boolean, user, group, role), mandatory, defaultValue,
rbKeyLabel, rbKeyDescription.
* dataMaskDef and rowFilterDef are unchanged.
*RangerPolicy*
* New constant {{{}POLICY_TYPE_CONSTRAINTS = 4{}}}. It is not added to
{{POLICY_TYPES}} in this change, so existing engine and Admin code paths that
iterate policy types are unaffected until evaluation support is added.
* New field {{{}List<RangerConstraintPolicyItem> constraintPolicyItems{}}}.
* {{{}RangerConstraintPolicyItem extends RangerPolicyItem{}}}, carrying
{{{}RangerPolicyItemConstraintInfo{}}}: constraintName and parameters
({{{}Map<String, Object>{}}}). This follows the pattern of
RangerDataMaskPolicyItem/RangerPolicyItemDataMaskInfo, so principals, accesses
and conditions work as for other policy items.
Example constraintDef:
json
{{{}{color:#008000}"constraintDefs"{color}:
{color:#2b303b}[{{color}{color:#2b303b}"{color}{color:#b80a18}itemId{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}1{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}name{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"requireApproval"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}label{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"Require
approval"{color}{color:#2b303b},{color}{color:#2b303b}"{color}{color:#b80a18}resources{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{color}{color:#008000}"tool"{color}{color:#2b303b}],{color}
{color:#2b303b}"{color}{color:#b80a18}accessTypes{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{color}{color:#008000}"execute"{color}{color:#2b303b}],{color}{color:#2b303b}"{color}{color:#b80a18}parameters{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{{color}
{color:#2b303b}"{color}{color:#b80a18}itemId{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}1{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}name{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"approver"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}label{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"Approver"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}type{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"user"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}mandatory{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}true{color} {color:#2b303b{}}}]{color:#2b303b}}]}}]
*Out of scope (separate sub-tasks):* DB schema and Admin validation, evaluation
in the policy engine, supported-constraint registration, audit, authz-api/PDP
result, UI, plugin capability gating.
was:
Add the data model for constraint policies. This change only adds model classes
and JSON serialization. There is no change to policy evaluation, Admin
persistence, audit, or UI.
*RangerServiceDef*
* New field {{{}List<RangerConstraintDef> constraintDefs{}}}.
* {{{}RangerConstraintDef{}}}: itemId, name, label, description, rbKeyLabel,
rbKeyDescription, resources (resource names the constraint applies to),
accessTypes (access-type names), parameters
({{{}List<RangerConstraintParamDef>{}}}), options ({{{}Map<String, String>{}}}).
* {{{}RangerConstraintParamDef{}}}: itemId, name, label, description, type
(e.g. string, int, boolean, user, group, role), mandatory, defaultValue,
rbKeyLabel, rbKeyDescription.
* dataMaskDef and rowFilterDef are unchanged.
*RangerPolicy*
* New constant {{{}POLICY_TYPE_CONSTRAINTS = 4{}}}. It is not added to
{{POLICY_TYPES}} in this change, so existing engine and Admin code paths that
iterate policy types are unaffected until evaluation support is added.
* New field {{{}List<RangerConstraintPolicyItem> constraintPolicyItems{}}}.
* {{{}RangerConstraintPolicyItem extends RangerPolicyItem{}}}, carrying
{{{}RangerPolicyItemConstraintInfo{}}}: constraintName and parameters
({{{}Map<String, Object>{}}}). This follows the pattern of
RangerDataMaskPolicyItem/RangerPolicyItemDataMaskInfo, so principals, accesses
and conditions work as for other policy items.
Example constraintDef:
json
{{{color:#008000}"constraintDefs"{color}:
{color:#2b303b}[{{color}{color:#2b303b}"{color}{color:#b80a18}itemId{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}1{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}name{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"requireApproval"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}label{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"Require
approval"{color}{color:#2b303b},{color}{color:#2b303b}"{color}{color:#b80a18}resources{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{color}{color:#008000}"tool"{color}{color:#2b303b}],{color}
{color:#2b303b}"{color}{color:#b80a18}accessTypes{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{color}{color:#008000}"execute"{color}{color:#2b303b}],{color}{color:#2b303b}"{color}{color:#b80a18}parameters{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#2b303b}[{{color}
{color:#2b303b}"{color}{color:#b80a18}itemId{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}1{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}name{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"approver"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}label{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"Approver"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}type{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008000}"user"{color}{color:#2b303b},{color}
{color:#2b303b}"{color}{color:#b80a18}mandatory{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
{color:#008080}true{color} {color:#2b303b}}]{color}{color:#2b303b}}]{color}}}
*Out of scope (separate sub-tasks):* DB schema and Admin validation, evaluation
in the policy engine, supported-constraint registration, audit, authz-api/PDP
result, UI, plugin capability gating.
> Add constraintDefs to RangerServiceDef and constraint policy model to
> RangerPolicy
> ----------------------------------------------------------------------------------
>
> Key: RANGER-5838
> URL: https://issues.apache.org/jira/browse/RANGER-5838
> Project: Ranger
> Issue Type: Improvement
> Components: Ranger
> Reporter: Vyom Mani Tiwari
> Assignee: Vyom Mani Tiwari
> Priority: Major
>
> Add the data model for constraint policies. This change only adds model
> classes and JSON serialization. There is no change to policy evaluation,
> Admin persistence, audit, or UI.
> *RangerServiceDef*
> * New field {{{}List<RangerConstraintDef> constraintDefs{}}}.
> * {{{}RangerConstraintDef{}}}: itemId, name, label, description, rbKeyLabel,
> rbKeyDescription, resources (resource names the constraint applies to),
> accessTypes (access-type names), parameters
> ({{{}List<RangerConstraintParamDef>{}}}), options ({{{}Map<String,
> String>{}}}).
> * {{{}RangerConstraintParamDef{}}}: itemId, name, label, description, type
> (e.g. string, int, boolean, user, group, role), mandatory, defaultValue,
> rbKeyLabel, rbKeyDescription.
> * dataMaskDef and rowFilterDef are unchanged.
> *RangerPolicy*
> * New constant {{{}POLICY_TYPE_CONSTRAINTS = 4{}}}. It is not added to
> {{POLICY_TYPES}} in this change, so existing engine and Admin code paths that
> iterate policy types are unaffected until evaluation support is added.
> * New field {{{}List<RangerConstraintPolicyItem> constraintPolicyItems{}}}.
> * {{{}RangerConstraintPolicyItem extends RangerPolicyItem{}}}, carrying
> {{{}RangerPolicyItemConstraintInfo{}}}: constraintName and parameters
> ({{{}Map<String, Object>{}}}). This follows the pattern of
> RangerDataMaskPolicyItem/RangerPolicyItemDataMaskInfo, so principals,
> accesses and conditions work as for other policy items.
> Example constraintDef:
>
> json
> {{{}{color:#008000}"constraintDefs"{color}:
> {color:#2b303b}[{{color}{color:#2b303b}"{color}{color:#b80a18}itemId{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#008080}1{color}{color:#2b303b},{color}
> {color:#2b303b}"{color}{color:#b80a18}name{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#008000}"requireApproval"{color}{color:#2b303b},{color}
> {color:#2b303b}"{color}{color:#b80a18}label{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#008000}"Require
> approval"{color}{color:#2b303b},{color}{color:#2b303b}"{color}{color:#b80a18}resources{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#2b303b}[{color}{color:#008000}"tool"{color}{color:#2b303b}],{color}
> {color:#2b303b}"{color}{color:#b80a18}accessTypes{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
>
> {color:#2b303b}[{color}{color:#008000}"execute"{color}{color:#2b303b}],{color}{color:#2b303b}"{color}{color:#b80a18}parameters{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#2b303b}[{{color}
> {color:#2b303b}"{color}{color:#b80a18}itemId{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#008080}1{color}{color:#2b303b},{color}
> {color:#2b303b}"{color}{color:#b80a18}name{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#008000}"approver"{color}{color:#2b303b},{color}
> {color:#2b303b}"{color}{color:#b80a18}label{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#008000}"Approver"{color}{color:#2b303b},{color}
> {color:#2b303b}"{color}{color:#b80a18}type{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#008000}"user"{color}{color:#2b303b},{color}
> {color:#2b303b}"{color}{color:#b80a18}mandatory{color}{color:#2b303b}"{color}{color:#2b303b}:{color}
> {color:#008080}true{color} {color:#2b303b{}}}]{color:#2b303b}}]}}]
> *Out of scope (separate sub-tasks):* DB schema and Admin validation,
> evaluation in the policy engine, supported-constraint registration, audit,
> authz-api/PDP result, UI, plugin capability gating.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
