Java Code Examples for org.apache.ranger.plugin.model.RangerPolicy#POLICY_TYPE_DATAMASK

The following examples show how to use org.apache.ranger.plugin.model.RangerPolicy#POLICY_TYPE_DATAMASK . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: RangerPolicyService.java    From ranger with Apache License 2.0 6 votes vote down vote up 
public String restrictIsDenyAllElseLogForMaskingAndRowfilterPolicy(String fieldName, RangerPolicy vObj) {
	if (logger.isDebugEnabled()) {
		logger.debug("==> RangerPolicyService( Field Name : (" + fieldName +") RangerPolicy : ("+ vObj + ")");
	}
	String ret = "";
	if (StringUtils.isNotBlank(fieldName)
			&& StringUtils.equalsIgnoreCase(fieldName.trim(), POLICY_IS_DENY_ALL_ELSE_CLASS_FIELD_NAME)
			&& vObj != null) {
		Integer policyType = vObj.getPolicyType();
		if (policyType == null || policyType == RangerPolicy.POLICY_TYPE_ACCESS) {
			return ret;
		} else if (policyType == RangerPolicy.POLICY_TYPE_ROWFILTER
					|| policyType == RangerPolicy.POLICY_TYPE_DATAMASK) {
				ret = null;
		}
	}
	if (logger.isDebugEnabled()) {
		logger.debug("<== RangerPolicyService( Field Name : (" + fieldName +") RangerPolicy : ("+ vObj + ") ret : ( "+ret+" )");
	}
	return ret;
}
Example 2
Source File: RangerPolicyRepository.java    From ranger with Apache License 2.0 6 votes vote down vote up 
private void deletePolicyEvaluator(RangerPolicyEvaluator evaluator) {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerPolicyRepository.deletePolicyEvaluator(" + evaluator.getPolicy() + ")");
    }
    int policyType = evaluator.getPolicy().getPolicyType();

    List<RangerPolicyEvaluator> evaluators = null;

    if (policyType == RangerPolicy.POLICY_TYPE_ACCESS) {
        evaluators = this.policyEvaluators;
    } else if (policyType == RangerPolicy.POLICY_TYPE_DATAMASK) {
        evaluators = this.dataMaskPolicyEvaluators;
    } else if (policyType == RangerPolicy.POLICY_TYPE_ROWFILTER) {
        evaluators = this.rowFilterPolicyEvaluators;
    } else {
        LOG.error("Unknown policyType:[" + policyType +"]");
    }
    if (evaluators != null) {
        evaluators.remove(evaluator);
    }

    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerPolicyRepository.deletePolicyEvaluator(" + evaluator.getPolicy() + ")");
    }
}
Example 3
Source File: RangerPolicyRepository.java    From ranger with Apache License 2.0 6 votes vote down vote up 
Map<String, RangerResourceTrie> getTrie(final int policyType) {
    final Map<String, RangerResourceTrie> ret;
    switch (policyType) {
        case RangerPolicy.POLICY_TYPE_ACCESS:
            ret = policyResourceTrie;
            break;
        case RangerPolicy.POLICY_TYPE_DATAMASK:
            ret = dataMaskResourceTrie;
            break;
        case RangerPolicy.POLICY_TYPE_ROWFILTER:
            ret = rowFilterResourceTrie;
            break;
        default:
            ret = null;
    }
    return ret;
}
Example 4
Source File: RangerServiceDefHelper.java    From ranger with Apache License 2.0 6 votes vote down vote up 
List<RangerResourceDef> getResourceDefs(RangerServiceDef serviceDef, Integer policyType) {
	final List<RangerResourceDef> resourceDefs;

	if(policyType == null || policyType == RangerPolicy.POLICY_TYPE_ACCESS) {
		resourceDefs = serviceDef.getResources();
	} else if(policyType == RangerPolicy.POLICY_TYPE_DATAMASK) {
		if(serviceDef.getDataMaskDef() != null) {
			resourceDefs = serviceDef.getDataMaskDef().getResources();
		} else {
			resourceDefs = null;
		}
	} else if(policyType == RangerPolicy.POLICY_TYPE_ROWFILTER) {
		if(serviceDef.getRowFilterDef() != null) {
			resourceDefs = serviceDef.getRowFilterDef().getResources();
		} else {
			resourceDefs = null;
		}
	} else { // unknown policyType; use all resources
		resourceDefs = serviceDef.getResources();
	}

	return resourceDefs;
}
Example 5
Source File: RangerTagEnricher.java    From ranger with Apache License 2.0 6 votes vote down vote up 
void addHierarchy(int policyType, Collection<String> resourceKeys, Boolean isValid) {
	switch (policyType) {
		case RangerPolicy.POLICY_TYPE_ACCESS:
			accessHierarchies.put(resourceKeys, isValid);
			break;
		case RangerPolicy.POLICY_TYPE_DATAMASK:
			dataMaskHierarchies.put(resourceKeys, isValid);
			break;
		case RangerPolicy.POLICY_TYPE_ROWFILTER:
			rowFilterHierarchies.put(resourceKeys, isValid);
			break;
		default:
			LOG.error("unknown policy-type " + policyType);
			break;
	}
}
Example 6
Source File: RangerHiveAuditHandler.java    From ranger with Apache License 2.0 5 votes vote down vote up 
AuthzAuditEvent createAuditEvent(RangerAccessResult result) {

		AuthzAuditEvent ret = null;

		RangerAccessRequest  request  = result.getAccessRequest();
		RangerAccessResource resource = request.getResource();
		String               resourcePath = resource != null ? resource.getAsString() : null;
		int                  policyType = result.getPolicyType();

		if (policyType == RangerPolicy.POLICY_TYPE_DATAMASK && result.isMaskEnabled()) {
		    ret = createAuditEvent(result, result.getMaskType(), resourcePath);
        } else if (policyType == RangerPolicy.POLICY_TYPE_ROWFILTER) {
            ret = createAuditEvent(result, ACCESS_TYPE_ROWFILTER, resourcePath);
		} else if (policyType == RangerPolicy.POLICY_TYPE_ACCESS) {
			String accessType = null;

			if (request instanceof RangerHiveAccessRequest) {
				RangerHiveAccessRequest hiveRequest = (RangerHiveAccessRequest) request;

				accessType = hiveRequest.getHiveAccessType().toString();

				String action = request.getAction();
				if (ACTION_TYPE_METADATA_OPERATION.equals(action)) {
					accessType = ACTION_TYPE_METADATA_OPERATION;
				}
			}

			if (StringUtils.isEmpty(accessType)) {
				accessType = request.getAccessType();
			}

			ret = createAuditEvent(result, accessType, resourcePath);
		}

		return ret;
	}
Example 7
Source File: RangerPolicyRepository.java    From ranger with Apache License 2.0 5 votes vote down vote up 
List<RangerPolicyEvaluator> getPolicyEvaluators(int policyType) {
    switch (policyType) {
        case RangerPolicy.POLICY_TYPE_ACCESS:
            return getPolicyEvaluators();
        case RangerPolicy.POLICY_TYPE_DATAMASK:
            return getDataMaskPolicyEvaluators();
        case RangerPolicy.POLICY_TYPE_ROWFILTER:
            return getRowFilterPolicyEvaluators();
        default:
            return getPolicyEvaluators();
    }
}
Example 8
Source File: RangerPolicyRepository.java    From ranger with Apache License 2.0 5 votes vote down vote up 
public List<RangerPolicyEvaluator> getLikelyMatchPolicyEvaluators(RangerAccessResource resource, int policyType) {
    switch (policyType) {
        case RangerPolicy.POLICY_TYPE_ACCESS:
            return getLikelyMatchAccessPolicyEvaluators(resource);
        case RangerPolicy.POLICY_TYPE_DATAMASK:
            return getLikelyMatchDataMaskPolicyEvaluators(resource);
        case RangerPolicy.POLICY_TYPE_ROWFILTER:
            return getLikelyMatchRowFilterPolicyEvaluators(resource);
        default:
            return Collections.EMPTY_LIST;
    }
}
Example 9
Source File: RangerPolicyRepository.java    From ranger with Apache License 2.0 5 votes vote down vote up 
private RangerPolicyEvaluator addPolicy(RangerPolicy policy) {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerPolicyRepository.addPolicy(" + policy +")");
    }
    RangerPolicyEvaluator ret = null;

    if (StringUtils.equals(this.serviceDef.getName(), this.componentServiceDef.getName()) || !isPolicyNeedsPruning(policy, this.componentServiceDef.getName())) {
        policies.add(policy);

        if (!skipBuildingPolicyEvaluator(policy, options)) {

            ret = buildPolicyEvaluator(policy, serviceDef, options);

            if (ret != null) {
                if (policy.getPolicyType() == null || policy.getPolicyType() == RangerPolicy.POLICY_TYPE_ACCESS) {
                    policyEvaluators.add(ret);
                } else if (policy.getPolicyType() == RangerPolicy.POLICY_TYPE_DATAMASK) {
                    dataMaskPolicyEvaluators.add(ret);
                } else if (policy.getPolicyType() == RangerPolicy.POLICY_TYPE_ROWFILTER) {
                    rowFilterPolicyEvaluators.add(ret);
                } else {
                    LOG.warn("RangerPolicyEngine: ignoring policy id=" + policy.getId() + " - invalid policyType '" + policy.getPolicyType() + "'");
                }

                policyEvaluatorsMap.put(policy.getId(), ret);
            }
        }
    }

    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerPolicyRepository.addPolicy(" + policy +"): " + ret);
    }
    return ret;
}
Example 10
Source File: RangerDefaultPolicyEvaluator.java    From ranger with Apache License 2.0 5 votes vote down vote up 
protected RangerPolicyItemEvaluator getMatchingPolicyItem(RangerAccessRequest request, RangerAccessResult result) {
	RangerPolicyItemEvaluator ret = null;

	Integer policyType = getPolicy().getPolicyType();
	if (policyType == null) {
		policyType = RangerPolicy.POLICY_TYPE_ACCESS;
	}

	switch (policyType) {
		case RangerPolicy.POLICY_TYPE_ACCESS: {
			ret = getMatchingPolicyItem(request, denyEvaluators, denyExceptionEvaluators);

			if(ret == null && !result.getIsAccessDetermined()) { // a deny policy could have set isAllowed=true, but in such case it wouldn't set isAccessDetermined=true
				ret = getMatchingPolicyItem(request, allowEvaluators, allowExceptionEvaluators);
			}
			break;
		}
		case RangerPolicy.POLICY_TYPE_DATAMASK: {
			ret = getMatchingPolicyItem(request, dataMaskEvaluators);
			break;
		}
		case RangerPolicy.POLICY_TYPE_ROWFILTER: {
			ret = getMatchingPolicyItem(request, rowFilterEvaluators);
			break;
		}
		default:
			break;
	}

	return ret;
}
Example 11
Source File: RangerTagEnricher.java    From ranger with Apache License 2.0 5 votes vote down vote up 
Boolean isValidHierarchy(int policyType, Collection<String> resourceKeys) {
	switch (policyType) {
		case RangerPolicy.POLICY_TYPE_ACCESS:
			return accessHierarchies.get(resourceKeys);
		case RangerPolicy.POLICY_TYPE_DATAMASK:
			return dataMaskHierarchies.get(resourceKeys);
		case RangerPolicy.POLICY_TYPE_ROWFILTER:
			return rowFilterHierarchies.get(resourceKeys);
		default:
			return null;
	}
}
Example 12
Source File: RangerPolicyRepository.java    From ranger with Apache License 2.0 4 votes vote down vote up 
List<PolicyEvaluatorForTag> getLikelyMatchPolicyEvaluators(Set<RangerTagForEval> tags, int policyType, Date accessTime) {
    List<PolicyEvaluatorForTag> ret = Collections.EMPTY_LIST;

    if (CollectionUtils.isNotEmpty(tags) && getServiceDef() != null) {

        ret = new ArrayList<PolicyEvaluatorForTag>();

        for (RangerTagForEval tag : tags) {
        	if (tag.isApplicable(accessTime)) {
          RangerAccessResource resource = new RangerTagResource(tag.getType(), getServiceDef());
          List<RangerPolicyEvaluator> evaluators = getLikelyMatchPolicyEvaluators(resource, policyType);

          if (CollectionUtils.isNotEmpty(evaluators)) {
           for (RangerPolicyEvaluator evaluator : evaluators) {
               if (evaluator.isApplicable(accessTime)) {
                            ret.add(new PolicyEvaluatorForTag(evaluator, tag));
                        }
           }
          }
         } else {
        		if (LOG.isDebugEnabled()) {
        			LOG.debug("Tag:[" + tag.getType() + "] is not applicable at accessTime:[" + accessTime +"]");
          }
         }
        }

        if (CollectionUtils.isNotEmpty(ret)) {
            switch (policyType) {
                case RangerPolicy.POLICY_TYPE_ACCESS:
                    Collections.sort(ret, PolicyEvaluatorForTag.EVAL_ORDER_COMPARATOR);
                    break;
                case RangerPolicy.POLICY_TYPE_DATAMASK:
                    Collections.sort(ret, PolicyEvaluatorForTag.NAME_COMPARATOR);
                    break;
                case RangerPolicy.POLICY_TYPE_ROWFILTER:
                    Collections.sort(ret, PolicyEvaluatorForTag.NAME_COMPARATOR);
                    break;
                default:
                    LOG.warn("Unknown policy-type:[" + policyType + "]. Ignoring..");
                    break;
            }
        }
    }
    return ret;
}
Example 13
Source File: RangerPolicyDeltaUtil.java    From ranger with Apache License 2.0 4 votes vote down vote up 
public static boolean isValidDeltas(List<RangerPolicyDelta> deltas, String componentServiceType) {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> isValidDeltas(deltas=" + Arrays.toString(deltas.toArray()) + ", componentServiceType=" + componentServiceType +")");
    }
    boolean isValid = true;

    for (RangerPolicyDelta delta : deltas) {
        final Integer changeType = delta.getChangeType();
        final Long    policyId   = delta.getPolicyId();

        if (changeType == null) {
            isValid = false;
            break;
        }

        if (changeType != RangerPolicyDelta.CHANGE_TYPE_POLICY_CREATE
                && changeType != RangerPolicyDelta.CHANGE_TYPE_POLICY_UPDATE
                && changeType != RangerPolicyDelta.CHANGE_TYPE_POLICY_DELETE) {
            isValid = false;
        } else if (policyId == null) {
            isValid = false;
        } else {
            final String  serviceType = delta.getServiceType();
            final Integer policyType  = delta.getPolicyType();

            if (serviceType == null || (!serviceType.equals(EmbeddedServiceDefsUtil.EMBEDDED_SERVICEDEF_TAG_NAME) &&
                    !serviceType.equals(componentServiceType))) {
                isValid = false;
            } else if (policyType == null || (policyType != RangerPolicy.POLICY_TYPE_ACCESS
                    && policyType != RangerPolicy.POLICY_TYPE_DATAMASK
                    && policyType != RangerPolicy.POLICY_TYPE_ROWFILTER)) {
                isValid = false;
            }
        }

        if (!isValid) {
            break;
        }
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== isValidDeltas(deltas=" + Arrays.toString(deltas.toArray()) + ", componentServiceType=" + componentServiceType +"): " + isValid);
    }
    return isValid;
}