diff --git a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java index 1011f6d717..1790cc1ca2 100644 --- a/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java +++ b/security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java @@ -1085,7 +1085,7 @@ public RangerRoles getSecureRangerRolesIfUpdated(@PathParam("serviceName") Strin boolean isKeyAdmin = bizUtil.isKeyAdmin(); Long downloadedVersion = null; boolean isValid = false; - boolean isAllowed; + boolean isAllowed = false; request.setAttribute("downloadPolicy", "secure"); @@ -1110,18 +1110,22 @@ public RangerRoles getSecureRangerRolesIfUpdated(@PathParam("serviceName") Strin } XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType()); - RangerService rangerService = svcStore.getServiceByName(serviceName); + RangerService rangerService; if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) { + rangerService = svcStore.getServiceByNameForDP(serviceName); + if (isKeyAdmin) { isAllowed = true; - } else { + } else if (rangerService != null) { isAllowed = bizUtil.isUserAllowed(rangerService, POLICY_DOWNLOAD_USERS); } } else { + rangerService = svcStore.getServiceByName(serviceName); + if (isAdmin) { isAllowed = true; - } else { + } else if (rangerService != null) { isAllowed = bizUtil.isUserAllowed(rangerService, POLICY_DOWNLOAD_USERS); } } diff --git a/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java b/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java index c314e2f4d2..03094f0b1f 100755 --- a/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java +++ b/security-admin/src/main/java/org/apache/ranger/rest/TagREST.java @@ -1316,7 +1316,7 @@ public ServiceTags getSecureServiceTagsIfUpdated(@PathParam("serviceName") Strin Long downloadedVersion = null; String clusterName = null; String logMsg; - boolean isAllowed; + boolean isAllowed = false; if (request != null) { clusterName = !StringUtils.isEmpty(request.getParameter(SearchFilter.CLUSTER_NAME)) ? request.getParameter(SearchFilter.CLUSTER_NAME) : ""; @@ -1332,18 +1332,22 @@ public ServiceTags getSecureServiceTagsIfUpdated(@PathParam("serviceName") Strin } XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType()); - RangerService rangerService = svcStore.getServiceByName(serviceName); + RangerService rangerService; if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) { + rangerService = svcStore.getServiceByNameForDP(serviceName); + if (isKeyAdmin) { isAllowed = true; - } else { + } else if (rangerService != null) { isAllowed = bizUtil.isUserAllowed(rangerService, Allowed_User_List_For_Tag_Download); } } else { + rangerService = svcStore.getServiceByName(serviceName); + if (isAdmin) { isAllowed = true; - } else { + } else if (rangerService != null) { isAllowed = bizUtil.isUserAllowed(rangerService, Allowed_User_List_For_Tag_Download); } } diff --git a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java index ced8b42277..1e8d24d0ae 100755 --- a/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java +++ b/security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java @@ -1444,7 +1444,7 @@ public RangerUserStore getSecureRangerUserStoreIfUpdated(@PathParam("serviceName boolean isKeyAdmin = bizUtil.isKeyAdmin(); Long downloadedVersion = null; boolean isValid = false; - boolean isAllowed; + boolean isAllowed = false; try { isValid = serviceUtil.isValidService(serviceName, request); @@ -1465,18 +1465,22 @@ public RangerUserStore getSecureRangerUserStoreIfUpdated(@PathParam("serviceName if (isValid && xService != null) { XXServiceDef xServiceDef = rangerDaoManager.getXXServiceDef().getById(xService.getType()); - RangerService rangerService = svcStore.getServiceByName(serviceName); + RangerService rangerService; if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) { + rangerService = svcStore.getServiceByNameForDP(serviceName); + if (isKeyAdmin) { isAllowed = true; - } else { + } else if (rangerService != null) { isAllowed = bizUtil.isUserAllowed(rangerService, USERSTORE_DOWNLOAD_USERS); } } else { + rangerService = svcStore.getServiceByName(serviceName); + if (isAdmin) { isAllowed = true; - } else { + } else if (rangerService != null) { isAllowed = bizUtil.isUserAllowed(rangerService, USERSTORE_DOWNLOAD_USERS); } } diff --git a/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java b/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java index 876dadad66..64a90dc430 100644 --- a/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java +++ b/security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java @@ -35,14 +35,17 @@ import org.apache.ranger.db.XXRoleRefGroupDao; import org.apache.ranger.db.XXRoleRefRoleDao; import org.apache.ranger.db.XXRoleRefUserDao; +import org.apache.ranger.db.XXServiceDefDao; import org.apache.ranger.entity.XXPortalUser; import org.apache.ranger.entity.XXRoleRefGroup; import org.apache.ranger.entity.XXRoleRefUser; import org.apache.ranger.entity.XXService; +import org.apache.ranger.entity.XXServiceDef; import org.apache.ranger.plugin.model.RangerPolicy; import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem; import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyResource; import org.apache.ranger.plugin.model.RangerRole; +import org.apache.ranger.plugin.model.RangerService; import org.apache.ranger.plugin.model.validation.RangerRoleValidator; import org.apache.ranger.plugin.util.GrantRevokeRoleRequest; import org.apache.ranger.plugin.util.RangerRoles; @@ -879,6 +882,47 @@ public void test17dGetSecureRangerRolesIfUpdated() { }); } + @Test + public void test17eGetSecureRangerRolesIfUpdatedKmsUsesServiceByNameForDP() throws Exception { + RangerRoles rangerRoles = createRangerRoles(); + String serviceName = "dev_kms"; + String pluginId = "kms-plugin"; + String clusterName = ""; + String pluginCapabilities = ""; + + XXService xService = createXXService(); + xService.setName(serviceName); + xService.setType(Id); + + XXServiceDef xServiceDef = new XXServiceDef(); + xServiceDef.setId(Id); + xServiceDef.setImplclassname("org.apache.ranger.services.kms.RangerServiceKMS"); + + RangerService rangerService = new RangerService(); + rangerService.setId(Id); + rangerService.setName(serviceName); + + XXServiceDefDao xServiceDefDao = Mockito.mock(XXServiceDefDao.class); + HttpServletRequest request = Mockito.mock(HttpServletRequest.class); + + Mockito.when(serviceUtil.isValidService(serviceName, request)).thenReturn(true); + Mockito.when(daoMgr.getXXService().findByName(serviceName)).thenReturn(xService); + Mockito.when(daoMgr.getXXServiceDef()).thenReturn(xServiceDefDao); + Mockito.when(xServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef); + Mockito.when(bizUtil.isAdmin()).thenReturn(false); + Mockito.when(bizUtil.isKeyAdmin()).thenReturn(false); + Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService); + Mockito.when(bizUtil.isUserAllowed(rangerService, RoleREST.POLICY_DOWNLOAD_USERS)).thenReturn(true); + Mockito.when(roleStore.getRoles(serviceName, -1L)).thenReturn(rangerRoles); + + RangerRoles result = roleRest.getSecureRangerRolesIfUpdated(serviceName, -1L, 0L, pluginId, clusterName, pluginCapabilities, request); + + Assertions.assertNotNull(result); + Assertions.assertEquals(rangerRoles.getRangerRoles().size(), result.getRangerRoles().size()); + Mockito.verify(svcStore).getServiceByNameForDP(serviceName); + Mockito.verify(bizUtil).isUserAllowed(rangerService, RoleREST.POLICY_DOWNLOAD_USERS); + } + // empty request roles (requestParamRoles = 0, dbRoles = 5, return = all dbRoles) @Test public void test18GetRolesInJson() throws Exception { diff --git a/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java b/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java index ce5ddc3e1a..c92a7200a1 100755 --- a/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java +++ b/security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java @@ -1604,7 +1604,7 @@ public void test52getSecureServiceTagsIfUpdatedIsKeyAdminTrue() { Mockito.when(daoManager.getXXServiceDef()).thenReturn(xXServiceDefDao); Mockito.when(xXServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef); try { - Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService); + Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService); } catch (Exception e) { } @@ -1625,7 +1625,7 @@ public void test52getSecureServiceTagsIfUpdatedIsKeyAdminTrue() { Mockito.verify(daoManager).getXXServiceDef(); Mockito.verify(xXServiceDefDao).getById(xService.getType()); try { - Mockito.verify(svcStore).getServiceByName(serviceName); + Mockito.verify(svcStore).getServiceByNameForDP(serviceName); } catch (Exception e) { } try { @@ -1730,7 +1730,7 @@ public void test54getSecureServiceTagsIfUpdatedIsKeyAdminFalse() { Mockito.when(daoManager.getXXServiceDef()).thenReturn(xXServiceDefDao); Mockito.when(xXServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef); try { - Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService); + Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService); } catch (Exception e) { } @@ -1752,7 +1752,7 @@ public void test54getSecureServiceTagsIfUpdatedIsKeyAdminFalse() { Mockito.verify(daoManager).getXXServiceDef(); Mockito.verify(xXServiceDefDao).getById(xService.getType()); try { - Mockito.verify(svcStore).getServiceByName(serviceName); + Mockito.verify(svcStore).getServiceByNameForDP(serviceName); } catch (Exception e) { } Mockito.verify(bizUtil).isUserAllowed(rangerService, Allowed_User_List_For_Tag_Download);