Vyom Mani Tiwari created RANGER-5858:
----------------------------------------
Summary: Authz API: return constraints in the authorization result
Key: RANGER-5858
URL: https://issues.apache.org/jira/browse/RANGER-5858
Project: Ranger
Issue Type: New Feature
Components: pdp
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
RANGER-5848 added constraints to {{RangerAccessResult}}
({{{}getConstraints(){}}}). Callers of the authz API (PDP
{{/authz/v1/authorize}} and {{{}authz-embedded{}}}) receive
{{{}RangerAuthzResult{}}}, which doesn’t carry them. As a result, a PDP caller
such as the Agent Harness can’t see a returned {{{}requireApproval{}}}. This
sub-task adds constraints to the authz API result.
_Changes_
* *{{authz-api}} model:*
** New {{RangerAuthzResult.ConstraintResult}} with:
*** {{{}name{}}};
*** {{parameters}} ({{{}Map<String, Object>{}}});
*** {{policy}} (the existing {{{}PolicyInfo{}}}: id, version);
*** {{{}policyPriority{}}}.
** New {{constraints}} ({{{}List<ConstraintResult>{}}}) on {{ResultInfo}} and
{{{}PermissionResult{}}}, next to {{dataMask}} and {{{}rowFilter{}}}, so each
permission and sub-resource reports its own constraints.
** JSON: omitted when empty, the same as the other optional fields
({{{}NON_EMPTY{}}}).
* *{{authz-embedded}} ({{{}RangerAuthzPlugin{}}}):* when the access result is
allowed, map {{RangerAccessResult.getConstraints()}} into the permission’s
{{{}constraints{}}}, in the order of
{{{}RangerConstraintResult.CONSTRAINT_RESULT_COMPARATOR{}}}. On a deny, no
constraints are returned.
* {{authz-api}} does not depend on agents-common types such as
{{{}MatchType{}}}, so the match type is not returned.
Example permission result:
"execute": {
"access": \{ "decision": "ALLOW", "policy": { "id": 12, "version": 3 } },
"constraints": [
{ "name": "requireApproval",
"parameters": \{ "approver": "finance-approvers" },
"policy": \{ "id": 21, "version": 1 },
"policyPriority": 0 }
]
}
Until RANGER-5842 lands, the policy engine returns no constraints, so the
response doesn’t change.
_Out of scope:_ the caller declaring supported constraints on the request
({{{}supportedConstraints{}}}) and deny-if-unsupported (sub-task D); audit
(sub-task E).
_Testing:_
* {{RangerAuthzResult}} JSON round-trip with constraints, and constraints left
out when empty.
* {{RangerAuthzPlugin}} mapping with a mocked {{{}RangerAccessResult{}}}:
** allowed with constraints: constraints are returned, in comparator order;
** allowed without constraints: none are returned;
** denied: none are returned;
** sub-resource results carry their own constraints.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
