[
https://issues.apache.org/jira/browse/RANGER-5860?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mugdha Varadkar updated RANGER-5860:
------------------------------------
Description:
*Context:*
Add policyType 4 to the stepper.
* ServiceStep: a fourth policy-type card.
* AccessRulesStep: a "Constraint Rules" group.
* PolicyPermissionItemVertical: a constraint selector plus a parameter form
generated from RangerConstraintParamDef (type, subType, mandatory,
defaultValue).
Load and save policyType 4 policies in the edit stepper, and show them in the
review step.
* EditPolicyForm: setPolicyItemVal, generateFormData, getPolicyItemsVal,
submit, type badge.
* ReviewConfirmStep: label, RuleGroup, and constraint name and params.
*Acceptance criteria:*
* The card appears only when isRenderConstraints is true.
* The Resources section shows only the resources specified in the
constraintDefs.
* A rule's constraint drop-down options are limited to constraintDefs
compatible with the selected resources. If none are compatible, a message says
so.
* A rule whose constraint no longer fits after a resource change is flagged
and blocks save.
* The access types come from the chosen constraint's accessTypes. (Access
types shown match the selected constraint.)
* Mandatory params block submit with an inline error. A param with no
defaultValue starts empty.
* No changes on the user/group/role existing principal selector.
* Rules need principals, accesses and a constraint name. Missing pieces give
the same style of error as other policy type.
* Switching policy type in the stepper follows the existing reset-confirm
behaviour.
* Saved constraint rules (constraint name, param values, principals, accesses,
conditions) reload exactly as saved.
* Editing and saving preserves unchanged constraint rules.
* The policy type badge shows "Constraints".
* The review step lists each constraint rules and parameters.
* An unknown constraint name (constraintDefs removed or changed) shows a
non-crashing warning instead of breaking the form.
* The constraints policy type and listing tab appear only when the service def
has non-empty constraintDefs and the service is not tag.
*Other information:*
* Constraint def json example :
{code:java}
{{{
"constraintDefs": [
{
"itemId": 1,
"name": "requireApproval",
"label": "Require approval",
"resources": [
"database",
"udf"
],
"accessTypes": [
"execute"
],
"parameters": [
{
"itemId": 1,
"name": "approver",
"label": "Approver",
"type": "user",
"mandatory": true
}
]
},
{
"itemId": 2,
"name": "maxRows",
"label": "Maximum rows",
"resources": [
"database",
"table"
],
"accessTypes": [
"select"
],
"parameters": [
{
"itemId": 1,
"name": "rowCount",
"type": "int",
"mandatory": true
}
]
}
]
}}}
{code}
* PolicyItem json :
{code:java}
{{{
"policyType": 4,
"constraintPolicyItems": [
{
"groups": [
"finance-users"
],
"accesses": [
{
"type": "execute",
"isAllowed": true
}
],
"conditions": [
{
"type": "expression",
"values": [
"ATTR.trx_amount > 10000"
]
}
],
"constraintInfo": {
"constraintName": "requireApproval",
"parameters": {
"approver": "finance-approvers"
}
}
}
]
}}}
{code}
> Ranger Admin UI : Build the Constraints (policyType 4) create, edit and
> review flow in the new stepper policy form
> ------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5860
> URL: https://issues.apache.org/jira/browse/RANGER-5860
> Project: Ranger
> Issue Type: New Feature
> Components: Ranger
> Reporter: Dhaval Rajpara
> Assignee: Dhaval Rajpara
> Priority: Major
>
> *Context:*
> Add policyType 4 to the stepper.
> * ServiceStep: a fourth policy-type card.
> * AccessRulesStep: a "Constraint Rules" group.
> * PolicyPermissionItemVertical: a constraint selector plus a parameter form
> generated from RangerConstraintParamDef (type, subType, mandatory,
> defaultValue).
> Load and save policyType 4 policies in the edit stepper, and show them in the
> review step.
> * EditPolicyForm: setPolicyItemVal, generateFormData, getPolicyItemsVal,
> submit, type badge.
> * ReviewConfirmStep: label, RuleGroup, and constraint name and params.
> *Acceptance criteria:*
> * The card appears only when isRenderConstraints is true.
> * The Resources section shows only the resources specified in the
> constraintDefs.
> * A rule's constraint drop-down options are limited to constraintDefs
> compatible with the selected resources. If none are compatible, a message
> says so.
> * A rule whose constraint no longer fits after a resource change is flagged
> and blocks save.
> * The access types come from the chosen constraint's accessTypes. (Access
> types shown match the selected constraint.)
> * Mandatory params block submit with an inline error. A param with no
> defaultValue starts empty.
> * No changes on the user/group/role existing principal selector.
> * Rules need principals, accesses and a constraint name. Missing pieces give
> the same style of error as other policy type.
> * Switching policy type in the stepper follows the existing reset-confirm
> behaviour.
> * Saved constraint rules (constraint name, param values, principals,
> accesses, conditions) reload exactly as saved.
> * Editing and saving preserves unchanged constraint rules.
> * The policy type badge shows "Constraints".
> * The review step lists each constraint rules and parameters.
> * An unknown constraint name (constraintDefs removed or changed) shows a
> non-crashing warning instead of breaking the form.
> * The constraints policy type and listing tab appear only when the service
> def has non-empty constraintDefs and the service is not tag.
> *Other information:*
> * Constraint def json example :
> {code:java}
> {{{
> "constraintDefs": [
> {
> "itemId": 1,
> "name": "requireApproval",
> "label": "Require approval",
> "resources": [
> "database",
> "udf"
> ],
> "accessTypes": [
> "execute"
> ],
> "parameters": [
> {
> "itemId": 1,
> "name": "approver",
> "label": "Approver",
> "type": "user",
> "mandatory": true
> }
> ]
> },
> {
> "itemId": 2,
> "name": "maxRows",
> "label": "Maximum rows",
> "resources": [
> "database",
> "table"
> ],
> "accessTypes": [
> "select"
> ],
> "parameters": [
> {
> "itemId": 1,
> "name": "rowCount",
> "type": "int",
> "mandatory": true
> }
> ]
> }
> ]
> }}}
> {code}
> * PolicyItem json :
> {code:java}
> {{{
> "policyType": 4,
> "constraintPolicyItems": [
> {
> "groups": [
> "finance-users"
> ],
> "accesses": [
> {
> "type": "execute",
> "isAllowed": true
> }
> ],
> "conditions": [
> {
> "type": "expression",
> "values": [
> "ATTR.trx_amount > 10000"
> ]
> }
> ],
> "constraintInfo": {
> "constraintName": "requireApproval",
> "parameters": {
> "approver": "finance-approvers"
> }
> }
> }
> ]
> }}}
> {code}
>
>
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
