Vyom Mani Tiwari created RANGER-5842:
----------------------------------------
Summary: Evaluate constraint policies in the policy engine and
return applicable constraints in the access result
Key: RANGER-5842
URL: https://issues.apache.org/jira/browse/RANGER-5842
Project: Ranger
Issue Type: Improvement
Components: Ranger
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
Add policy-engine support for constraint policies
({{{}RangerPolicy.POLICY_TYPE_CONSTRAINTS{}}}), building on the model added in
RANGER-5838.
When an access request is allowed, the engine evaluates the constraint policies
of the service and returns every applicable constraint in the access result.
The plugin, or the application calling Ranger, then enforces those constraints,
for example by pausing for human approval ({{{}requireApproval{}}}) or limiting
rows ({{{}maxRows{}}}). When the request is denied, no constraints are returned.
*Scope*
* {{{}RangerPolicyRepository{}}}: build evaluators for constraint policies and
keep them in a separate list. {{POLICY_TYPE_CONSTRAINTS}} is not added to
{{{}RangerPolicy.POLICY_TYPES{}}}, so existing evaluation paths (access, data
mask, row filter, resource ACLs) are unchanged.
* Policy engine: after the access decision, and only if access is allowed,
evaluate all constraint policies that match the request (resource, access type,
user/groups/roles, policy conditions). Collect all matches rather than stopping
at the first.
* {{{}RangerAccessResult{}}}: add a list of applicable constraints. Each entry
has the constraint name, parameter values, policy ID, policy version and
{{{}RangerPolicyResourceMatcher.MatchType{}}}. This is separate from
{{{}additionalInfo{}}}, which carries data-mask and row-filter details.
* Conditions on constraint policy items are evaluated like other policy-item
conditions, including script conditions that use {{ATTR}} (RANGER-5822).
*Out of scope (separate sub-tasks)*
* Registering supported constraints in a plugin, and denying access when a
returned constraint is not supported
* Tag-based constraint policies, and the effect of policy priority on
constraints
* Admin persistence and validation of {{constraintDefs}} and constraint
policies
* Audit of returned constraints
* Returning constraints in {{RangerAuthzResult}} (authz-api / PDP)
* Policy UI
*Depends on:* RANGER-5838
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
