vyommani commented on code in PR #1316:
URL: https://github.com/apache/ranger/pull/1316#discussion_r4430776006
##########
agents-common/src/main/java/org/apache/ranger/plugin/model/validation/RangerServiceDefHelper.java:
##########
@@ -316,6 +317,66 @@ public Set<List<RangerResourceDef>>
getResourceHierarchies(Integer policyType, C
return ret;
}
+ /**
+ * Resource hierarchies for one constraint. Each access hierarchy
contributes its longest prefix
+ * whose resources are all named on the constraint def. A def that lists
no resources uses the access hierarchy.
+ * A prefix is returned only when it contains every key.
+ */
+ public Set<List<RangerResourceDef>>
getResourceHierarchiesForConstraint(String constraint, Collection<String> keys)
{
+ if (LOG.isDebugEnabled()) {
+ LOG.debug("==> getResourceHierarchiesForConstraint(constraint={},
keys={})", constraint, StringUtils.join(keys, ","));
+ }
+
+ Set<List<RangerResourceDef>> ret = new HashSet<>();
+ RangerConstraintDef constraintDef =
getConstraintDef(constraint);
+
+ if (constraintDef == null) {
+ ret = Collections.emptySet();
+ } else if (CollectionUtils.isEmpty(constraintDef.getResources())) {
+ ret.addAll(getResourceHierarchies(RangerPolicy.POLICY_TYPE_ACCESS,
keys));
+ } else {
+ Set<String> names = new HashSet<>(constraintDef.getResources());
+
+ for (List<RangerResourceDef> hierarchy :
getResourceHierarchies(RangerPolicy.POLICY_TYPE_ACCESS)) {
Review Comment:
done
##########
agents-common/src/main/java/org/apache/ranger/plugin/policyengine/RangerPolicyRepository.java:
##########
@@ -954,6 +1010,9 @@ private void init(RangerPolicyEngineOptions options) {
rowFilterPolicyEvaluators.sort(RangerPolicyEvaluator.NAME_COMPARATOR);
this.rowFilterPolicyEvaluators = rowFilterPolicyEvaluators;
+ // Constraint matches are all returned. Do not sort them by policy
priority.
Review Comment:
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
