Skip to content

RANGER-5709: Fix KMS secure download for roles, tags, and userstore #1114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ramackri merged 2 commits into from
Jul 29, 2026
Merged

RANGER-5709: Fix KMS secure download for roles, tags, and userstore #1114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
536ca96
RANGER-5709: Fix KMS secure download for roles, tags, and userstore
Jul 28, 2026
40a9c75
RANGER-5709: Add KMS secure roles download unit test
Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions security-admin/src/main/java/org/apache/ranger/rest/RoleREST.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1085,7 +1085,7 @@ public RangerRoles getSecureRangerRolesIfUpdated(@PathParam("serviceName") Strin
boolean isKeyAdmin = bizUtil.isKeyAdmin();
Long downloadedVersion = null;
boolean isValid = false;
boolean isAllowed;
boolean isAllowed = false;

request.setAttribute("downloadPolicy", "secure");

Expand All @@ -1110,18 +1110,22 @@ public RangerRoles getSecureRangerRolesIfUpdated(@PathParam("serviceName") Strin
}

XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
RangerService rangerService = svcStore.getServiceByName(serviceName);
RangerService rangerService;

if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
rangerService = svcStore.getServiceByNameForDP(serviceName);

if (isKeyAdmin) {
isAllowed = true;
} else {
} else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService, POLICY_DOWNLOAD_USERS);
}
} else {
rangerService = svcStore.getServiceByName(serviceName);

if (isAdmin) {
isAllowed = true;
} else {
} else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService, POLICY_DOWNLOAD_USERS);
}
}
Expand Down
12 changes: 8 additions & 4 deletions security-admin/src/main/java/org/apache/ranger/rest/TagREST.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1316,7 +1316,7 @@ public ServiceTags getSecureServiceTagsIfUpdated(@PathParam("serviceName") Strin
Long downloadedVersion = null;
String clusterName = null;
String logMsg;
boolean isAllowed;
boolean isAllowed = false;

if (request != null) {
clusterName = !StringUtils.isEmpty(request.getParameter(SearchFilter.CLUSTER_NAME)) ? request.getParameter(SearchFilter.CLUSTER_NAME) : "";
Expand All @@ -1332,18 +1332,22 @@ public ServiceTags getSecureServiceTagsIfUpdated(@PathParam("serviceName") Strin
}

XXServiceDef xServiceDef = daoManager.getXXServiceDef().getById(xService.getType());
RangerService rangerService = svcStore.getServiceByName(serviceName);
RangerService rangerService;

if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
rangerService = svcStore.getServiceByNameForDP(serviceName);

if (isKeyAdmin) {
isAllowed = true;
} else {
} else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService, Allowed_User_List_For_Tag_Download);
}
} else {
rangerService = svcStore.getServiceByName(serviceName);

if (isAdmin) {
isAllowed = true;
} else {
} else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService, Allowed_User_List_For_Tag_Download);
}
}
Expand Down
12 changes: 8 additions & 4 deletions security-admin/src/main/java/org/apache/ranger/rest/XUserREST.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1444,7 +1444,7 @@ public RangerUserStore getSecureRangerUserStoreIfUpdated(@PathParam("serviceName
boolean isKeyAdmin = bizUtil.isKeyAdmin();
Long downloadedVersion = null;
boolean isValid = false;
boolean isAllowed;
boolean isAllowed = false;

try {
isValid = serviceUtil.isValidService(serviceName, request);
Expand All @@ -1465,18 +1465,22 @@ public RangerUserStore getSecureRangerUserStoreIfUpdated(@PathParam("serviceName

if (isValid && xService != null) {
XXServiceDef xServiceDef = rangerDaoManager.getXXServiceDef().getById(xService.getType());
RangerService rangerService = svcStore.getServiceByName(serviceName);
RangerService rangerService;

if (StringUtils.equals(xServiceDef.getImplclassname(), EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME)) {
rangerService = svcStore.getServiceByNameForDP(serviceName);

if (isKeyAdmin) {
isAllowed = true;
} else {
} else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService, USERSTORE_DOWNLOAD_USERS);
}
} else {
rangerService = svcStore.getServiceByName(serviceName);

if (isAdmin) {
isAllowed = true;
} else {
} else if (rangerService != null) {
isAllowed = bizUtil.isUserAllowed(rangerService, USERSTORE_DOWNLOAD_USERS);
}
}
Expand Down
44 changes: 44 additions & 0 deletions security-admin/src/test/java/org/apache/ranger/rest/TestRoleREST.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,14 +35,17 @@
import org.apache.ranger.db.XXRoleRefGroupDao;
import org.apache.ranger.db.XXRoleRefRoleDao;
import org.apache.ranger.db.XXRoleRefUserDao;
import org.apache.ranger.db.XXServiceDefDao;
import org.apache.ranger.entity.XXPortalUser;
import org.apache.ranger.entity.XXRoleRefGroup;
import org.apache.ranger.entity.XXRoleRefUser;
import org.apache.ranger.entity.XXService;
import org.apache.ranger.entity.XXServiceDef;
import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyItem;
import org.apache.ranger.plugin.model.RangerPolicy.RangerPolicyResource;
import org.apache.ranger.plugin.model.RangerRole;
import org.apache.ranger.plugin.model.RangerService;
import org.apache.ranger.plugin.model.validation.RangerRoleValidator;
import org.apache.ranger.plugin.util.GrantRevokeRoleRequest;
import org.apache.ranger.plugin.util.RangerRoles;
Expand Down Expand Up @@ -879,6 +882,47 @@ public void test17dGetSecureRangerRolesIfUpdated() {
});
}

@Test
public void test17eGetSecureRangerRolesIfUpdatedKmsUsesServiceByNameForDP() throws Exception {
RangerRoles rangerRoles = createRangerRoles();
String serviceName = "dev_kms";
String pluginId = "kms-plugin";
String clusterName = "";
String pluginCapabilities = "";

XXService xService = createXXService();
xService.setName(serviceName);
xService.setType(Id);

XXServiceDef xServiceDef = new XXServiceDef();
xServiceDef.setId(Id);
xServiceDef.setImplclassname("org.apache.ranger.services.kms.RangerServiceKMS");

RangerService rangerService = new RangerService();
rangerService.setId(Id);
rangerService.setName(serviceName);

XXServiceDefDao xServiceDefDao = Mockito.mock(XXServiceDefDao.class);
HttpServletRequest request = Mockito.mock(HttpServletRequest.class);

Mockito.when(serviceUtil.isValidService(serviceName, request)).thenReturn(true);
Mockito.when(daoMgr.getXXService().findByName(serviceName)).thenReturn(xService);
Mockito.when(daoMgr.getXXServiceDef()).thenReturn(xServiceDefDao);
Mockito.when(xServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
Mockito.when(bizUtil.isAdmin()).thenReturn(false);
Mockito.when(bizUtil.isKeyAdmin()).thenReturn(false);
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
Mockito.when(bizUtil.isUserAllowed(rangerService, RoleREST.POLICY_DOWNLOAD_USERS)).thenReturn(true);
Mockito.when(roleStore.getRoles(serviceName, -1L)).thenReturn(rangerRoles);

RangerRoles result = roleRest.getSecureRangerRolesIfUpdated(serviceName, -1L, 0L, pluginId, clusterName, pluginCapabilities, request);

Assertions.assertNotNull(result);
Assertions.assertEquals(rangerRoles.getRangerRoles().size(), result.getRangerRoles().size());
Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
Mockito.verify(bizUtil).isUserAllowed(rangerService, RoleREST.POLICY_DOWNLOAD_USERS);
}

// empty request roles (requestParamRoles = 0, dbRoles = 5, return = all dbRoles)
@Test
public void test18GetRolesInJson() throws Exception {
Expand Down
8 changes: 4 additions & 4 deletions security-admin/src/test/java/org/apache/ranger/rest/TestTagREST.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1604,7 +1604,7 @@ public void test52getSecureServiceTagsIfUpdatedIsKeyAdminTrue() {
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xXServiceDefDao);
Mockito.when(xXServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
try {
Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService);
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
} catch (Exception e) {
}

Expand All @@ -1625,7 +1625,7 @@ public void test52getSecureServiceTagsIfUpdatedIsKeyAdminTrue() {
Mockito.verify(daoManager).getXXServiceDef();
Mockito.verify(xXServiceDefDao).getById(xService.getType());
try {
Mockito.verify(svcStore).getServiceByName(serviceName);
Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
} catch (Exception e) {
}
try {
Expand Down Expand Up @@ -1730,7 +1730,7 @@ public void test54getSecureServiceTagsIfUpdatedIsKeyAdminFalse() {
Mockito.when(daoManager.getXXServiceDef()).thenReturn(xXServiceDefDao);
Mockito.when(xXServiceDefDao.getById(xService.getType())).thenReturn(xServiceDef);
try {
Mockito.when(svcStore.getServiceByName(serviceName)).thenReturn(rangerService);
Mockito.when(svcStore.getServiceByNameForDP(serviceName)).thenReturn(rangerService);
} catch (Exception e) {
}

Expand All @@ -1752,7 +1752,7 @@ public void test54getSecureServiceTagsIfUpdatedIsKeyAdminFalse() {
Mockito.verify(daoManager).getXXServiceDef();
Mockito.verify(xXServiceDefDao).getById(xService.getType());
try {
Mockito.verify(svcStore).getServiceByName(serviceName);
Mockito.verify(svcStore).getServiceByNameForDP(serviceName);
} catch (Exception e) {
}
Mockito.verify(bizUtil).isUserAllowed(rangerService, Allowed_User_List_For_Tag_Download);
Expand Down
Loading