RangerBizUtil { public VXResponse hasPermission(VXResource vXResource, int permission) { VXResponse vXResponse = new VXResponse(); if (!enableResourceAccessControl) { logger.debug("Resource Access Control is disabled !!!"); return vXResponse; } if (vXResource == null) { vXResponse.setStatusCode(VXResponse.STATUS_ERROR); vXResponse.setMsgDesc("Please provide valid policy."); return vXResponse; } String resourceNames = vXResource.getName(); if (stringUtil.isEmpty(resourceNames)) { vXResponse.setStatusCode(VXResponse.STATUS_ERROR); vXResponse.setMsgDesc("Please provide valid policy."); return vXResponse; } if (isAdmin()) { return vXResponse; } Long xUserId = getXUserId(); Long assetId = vXResource.getAssetId(); List<XXResource> xResourceList = daoManager.getXXResource() .findByAssetIdAndResourceStatus(assetId, AppConstants.STATUS_ENABLED); XXAsset xAsset = daoManager.getXXAsset().getById(assetId); int assetType = xAsset.getAssetType(); vXResponse.setStatusCode(VXResponse.STATUS_ERROR); vXResponse.setMsgDesc("Permission Denied !"); if (assetType == AppConstants.ASSET_HIVE) { String[] requestResNameList = resourceNames.split(","); if (stringUtil.isEmpty(vXResource.getUdfs())) { int reqTableType = vXResource.getTableType(); int reqColumnType = vXResource.getColumnType(); for (String resourceName : requestResNameList) { boolean matchFound = matchHivePolicy(resourceName, xResourceList, xUserId, permission, reqTableType, reqColumnType, false); if (!matchFound) { vXResponse .setMsgDesc("You're not permitted to perform " + "the action for resource path : " + resourceName); vXResponse.setStatusCode(VXResponse.STATUS_ERROR); return vXResponse; } } } else { for (String resourceName : requestResNameList) { boolean matchFound = matchHivePolicy(resourceName, xResourceList, xUserId, permission); if (!matchFound) { vXResponse .setMsgDesc("You're not permitted to perform " + "the action for resource path : " + resourceName); vXResponse.setStatusCode(VXResponse.STATUS_ERROR); return vXResponse; } } } vXResponse.setStatusCode(VXResponse.STATUS_SUCCESS); return vXResponse; } else if (assetType == AppConstants.ASSET_HBASE) { String[] requestResNameList = resourceNames.split(","); for (String resourceName : requestResNameList) { boolean matchFound = matchHbasePolicy(resourceName, xResourceList, vXResponse, xUserId, permission); if (!matchFound) { vXResponse.setMsgDesc("You're not permitted to perform " + "the action for resource path : " + resourceName); vXResponse.setStatusCode(VXResponse.STATUS_ERROR); return vXResponse; } } vXResponse.setStatusCode(VXResponse.STATUS_SUCCESS); return vXResponse; } else if (assetType == AppConstants.ASSET_HDFS) { String[] requestResNameList = resourceNames.split(","); for (String resourceName : requestResNameList) { boolean matchFound = matchHdfsPolicy(resourceName, xResourceList, xUserId, permission); if (!matchFound) { vXResponse.setMsgDesc("You're not permitted to perform " + "the action for resource path : " + resourceName); vXResponse.setStatusCode(VXResponse.STATUS_ERROR); return vXResponse; } } vXResponse.setStatusCode(VXResponse.STATUS_SUCCESS); return vXResponse; } else if (assetType == AppConstants.ASSET_KNOX) { String[] requestResNameList = resourceNames.split(","); for (String resourceName : requestResNameList) { boolean matchFound = matchKnoxPolicy(resourceName, xResourceList, xUserId, permission); if (!matchFound) { vXResponse.setMsgDesc("You're not permitted to perform " + "the action for resource path : " + resourceName); vXResponse.setStatusCode(VXResponse.STATUS_ERROR); return vXResponse; } } vXResponse.setStatusCode(VXResponse.STATUS_SUCCESS); return vXResponse; } else if (assetType == AppConstants.ASSET_STORM) { String[] requestResNameList = resourceNames.split(","); for (String resourceName : requestResNameList) { boolean matchFound = matchStormPolicy(resourceName, xResourceList, xUserId, permission); if (!matchFound) { vXResponse.setMsgDesc("You're not permitted to perform " + "the action for resource path : " + resourceName); vXResponse.setStatusCode(VXResponse.STATUS_ERROR); return vXResponse; } } vXResponse.setStatusCode(VXResponse.STATUS_SUCCESS); return vXResponse; } return vXResponse; } RangerBizUtil(); void checkSystemAdminAccess(); String generatePublicName(VXPortalUser userProfile,
			XXPortalUser gjUser); String generatePublicName(String firstName, String lastName); VXStringList mapStringListToVStringList(List<String> stringList); VXResponse hasPermission(VXResource vXResource, int permission); boolean isAdmin(); boolean isAuditAdmin(); String getCurrentUserLoginId(); Long getXUserId(); void failUnauthenticatedIfNotAllowed(); boolean matchHbasePolicy(String resourceName,
			List<XXResource> xResourceList, VXResponse vXResponse,
			Long xUserId, int permission); boolean matchHivePolicy(String resourceName,
			List<XXResource> xResourceList, Long xUserId, int permission); boolean matchHivePolicy(String resourceName,
			List<XXResource> xResourceList, Long xUserId, int permission,
			int reqTableType, int reqColumnType, boolean isUdfPolicy); String replaceMetaChars(String path); Long getPublicGroupId(); boolean isGroupInList(Long groupId, List<XXGroup> xGroupList); boolean isRecursiveWildCardMatch(String pathToCheck,
			String wildcardPath); List<Integer> getResorceTypeParentHirearchy(int resourceType,
			int assetType); boolean comparePathsForExactMatch(String path1, String path2); boolean nonRecursiveWildCardMatch(String pathToCheck,
			String wildcardPath); static boolean areAllEqual(int checkValue, int... otherValues); void createTrxLog(List<XXTrxLog> trxLogList); static int getDBFlavor(); String getDBVersion(); String getAuditDBType(); void setAuditDBType(String auditDBType); boolean isKeyAdmin(); boolean isAuditKeyAdmin(); Boolean hasAccess(XXDBBase xxDbBase, RangerBaseModelObject baseModel); void hasAdminPermissions(String objType); void hasKMSPermissions(String objType, String implClassName); boolean checkUserAccessible(VXUser vXUser); boolean isSSOEnabled(); boolean isUserAllowed(RangerService rangerService, String cfgNameAllowedUsers); boolean isUserAllowedForGrantRevoke(RangerService rangerService, String userName); boolean isUserRangerAdmin(String username); boolean isUserServiceAdmin(RangerService rangerService, String userName); boolean isUserInConfigParameter(RangerService rangerService, String configParamName, String userName); void blockAuditorRoleUser(); boolean hasModuleAccess(String moduleName); void removeEmptyStrings(List<String> list); void trimAll(List<String> list); static boolean isBulkMode(); static boolean setBulkMode(boolean val); void bulkModeOnlyFlushAndClear(); boolean checkAdminAccess(); final String EMPTY_CONTENT_DISPLAY_NAME; static final String AUDIT_STORE_RDBMS; static final String AUDIT_STORE_SOLR; static final String AUDIT_STORE_ElasticSearch; static final boolean batchClearEnabled; static final int policyBatchSize; static final int batchPersistSize; }
@Test public void testHasPermission_When_disableAccessControl(){ VXResource vXResource = null; rangerBizUtil.enableResourceAccessControl = false; VXResponse resp = rangerBizUtil.hasPermission(vXResource, AppConstants.XA_PERM_TYPE_UNKNOWN); Assert.assertNotNull(resp); }
@Test public void testHasPermission_When_NoResource(){ VXResource vXResource = null; VXResponse resp = rangerBizUtil.hasPermission(vXResource, AppConstants.XA_PERM_TYPE_UNKNOWN); Assert.assertNotNull(resp); Assert.assertEquals(VXResponse.STATUS_ERROR, resp.getStatusCode()); Assert.assertEquals("Please provide valid policy.", resp.getMsgDesc()); }
@Test public void testHasPermission_emptyResourceName(){ VXResource vXResource = new VXResource(); vXResource.setAssetId(12345L); XXPortalUser portalUser = new XXPortalUser(); portalUser.setId(id); portalUser.setLoginId("12121"); RangerContextHolder.getSecurityContext().getUserSession().setXXPortalUser(portalUser); XXUserDao xxUserDao = Mockito.mock(XXUserDao.class); XXPortalUserDao userDao = Mockito.mock(XXPortalUserDao.class); XXUser xxUser = new XXUser(); XXAsset xxAsset = new XXAsset(); List<XXResource> lst = new ArrayList<XXResource>(); XXResourceDao xxResourceDao = Mockito.mock(XXResourceDao.class); XXAssetDao xxAssetDao = Mockito.mock(XXAssetDao.class); Mockito.when(daoManager.getXXPortalUser()).thenReturn(userDao); Mockito.when(userDao.getById(Mockito.anyLong())).thenReturn(portalUser); Mockito.when(daoManager.getXXUser()).thenReturn(xxUserDao); Mockito.when(xxUserDao.findByUserName(Mockito.anyString())).thenReturn(xxUser); Mockito.when(daoManager.getXXResource()).thenReturn(xxResourceDao); Mockito.when(xxResourceDao.findByAssetIdAndResourceStatus(Mockito.anyLong(),Mockito.anyInt())).thenReturn(lst); Mockito.when(daoManager.getXXAsset()).thenReturn(xxAssetDao); Mockito.when(xxAssetDao.getById(Mockito.anyLong())).thenReturn(xxAsset); VXResponse resp = rangerBizUtil.hasPermission(vXResource, AppConstants.XA_PERM_TYPE_UNKNOWN); Mockito.verify(daoManager).getXXPortalUser(); Mockito.verify(userDao).getById(Mockito.anyLong()); Mockito.verify(daoManager).getXXUser(); Mockito.verify(xxUserDao).findByUserName(Mockito.anyString()); Assert.assertNotNull(resp); Assert.assertEquals(VXResponse.STATUS_ERROR, resp.getStatusCode()); Assert.assertEquals("Permission Denied !", resp.getMsgDesc()); }
@Test public void testHasPermission_isAdmin(){ VXResource vXResource = new VXResource(); vXResource.setName(resourceName); vXResource.setAssetId(id); UserSessionBase currentUserSession = ContextUtil.getCurrentUserSession(); currentUserSession.setUserAdmin(true); VXResponse resp = rangerBizUtil.hasPermission(vXResource, AppConstants.XA_PERM_TYPE_UNKNOWN); Assert.assertNotNull(resp); Assert.assertEquals(VXResponse.STATUS_SUCCESS, resp.getStatusCode()); }