@Test public void testApprovedWithNonDirectAccess() { final String systemResource = "/system"; final RequestAction action = RequestAction.WRITE; final String user = "admin"; final AuthorizationRequest request = new AuthorizationRequest.Builder() .resource(new MockResource(systemResource, systemResource)) .action(action) .identity(user) .resourceContext(new HashMap<>()) .accessAttempt(false) .anonymous(false) .build(); final RangerAccessResourceImpl resource = new RangerAccessResourceImpl(); resource.setValue(RangerNiFiAuthorizer.RANGER_NIFI_RESOURCE_NAME, systemResource); final RangerAccessRequestImpl expectedRangerRequest = new RangerAccessRequestImpl(); expectedRangerRequest.setResource(resource); expectedRangerRequest.setAction(request.getAction().name()); expectedRangerRequest.setAccessType(request.getAction().name()); expectedRangerRequest.setUser(request.getIdentity()); when(rangerBasePlugin.isAccessAllowed( argThat(new RangerAccessRequestMatcher(expectedRangerRequest)), eq(null)) ).thenReturn(allowedResult); final AuthorizationResult result = authorizer.authorize(request); assertEquals(AuthorizationResult.approved().getResult(), result.getResult()); }
@Override public AuthorizationResult authorize(final AuthorizationRequest request) throws AuthorizationAccessException { final String identity = request.getIdentity(); final String resourceIdentifier = request.getResource().getIdentifier(); if (StringUtils.isNotBlank(rangerAdminIdentity) && rangerAdminIdentity.equals(identity) && resourceIdentifier.equals(RESOURCES_RESOURCE)) { return AuthorizationResult.approved(); } final String clientIp; if (request.getUserContext() != null) { clientIp = request.getUserContext().get(UserContextKeys.CLIENT_ADDRESS.name()); } else { clientIp = null; } final RangerAccessResourceImpl resource = new RangerAccessResourceImpl(); resource.setValue(RANGER_NIFI_RESOURCE_NAME, resourceIdentifier); final RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(); rangerRequest.setResource(resource); rangerRequest.setAction(request.getAction().name()); rangerRequest.setAccessType(request.getAction().name()); rangerRequest.setUser(identity); rangerRequest.setAccessTime(new Date()); if (!StringUtils.isBlank(clientIp)) { rangerRequest.setClientIPAddress(clientIp); } final RangerAccessResultProcessor resultProcessor = request.isAccessAttempt() ? defaultAuditHandler : null; final RangerAccessResult result = nifiPlugin.isAccessAllowed(rangerRequest, resultProcessor); if (result != null && result.getIsAllowed()) { return AuthorizationResult.approved(); } else { final boolean doesPolicyExist = nifiPlugin.doesPolicyExist(request.getResource().getIdentifier()); if (doesPolicyExist) { final String reason = result == null ? null : result.getReason(); if (reason != null) { logger.debug(String.format("Unable to authorize %s due to %s", identity, reason)); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); } else { return AuthorizationResult.resourceNotFound(); } } }
RangerNiFiAuthorizer implements Authorizer { @Override public AuthorizationResult authorize(final AuthorizationRequest request) throws AuthorizationAccessException { final String identity = request.getIdentity(); final String resourceIdentifier = request.getResource().getIdentifier(); if (StringUtils.isNotBlank(rangerAdminIdentity) && rangerAdminIdentity.equals(identity) && resourceIdentifier.equals(RESOURCES_RESOURCE)) { return AuthorizationResult.approved(); } final String clientIp; if (request.getUserContext() != null) { clientIp = request.getUserContext().get(UserContextKeys.CLIENT_ADDRESS.name()); } else { clientIp = null; } final RangerAccessResourceImpl resource = new RangerAccessResourceImpl(); resource.setValue(RANGER_NIFI_RESOURCE_NAME, resourceIdentifier); final RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(); rangerRequest.setResource(resource); rangerRequest.setAction(request.getAction().name()); rangerRequest.setAccessType(request.getAction().name()); rangerRequest.setUser(identity); rangerRequest.setAccessTime(new Date()); if (!StringUtils.isBlank(clientIp)) { rangerRequest.setClientIPAddress(clientIp); } final RangerAccessResultProcessor resultProcessor = request.isAccessAttempt() ? defaultAuditHandler : null; final RangerAccessResult result = nifiPlugin.isAccessAllowed(rangerRequest, resultProcessor); if (result != null && result.getIsAllowed()) { return AuthorizationResult.approved(); } else { final boolean doesPolicyExist = nifiPlugin.doesPolicyExist(request.getResource().getIdentifier()); if (doesPolicyExist) { final String reason = result == null ? null : result.getReason(); if (reason != null) { logger.debug(String.format("Unable to authorize %s due to %s", identity, reason)); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); } else { return AuthorizationResult.resourceNotFound(); } } } }
RangerNiFiAuthorizer implements Authorizer { @Override public AuthorizationResult authorize(final AuthorizationRequest request) throws AuthorizationAccessException { final String identity = request.getIdentity(); final String resourceIdentifier = request.getResource().getIdentifier(); if (StringUtils.isNotBlank(rangerAdminIdentity) && rangerAdminIdentity.equals(identity) && resourceIdentifier.equals(RESOURCES_RESOURCE)) { return AuthorizationResult.approved(); } final String clientIp; if (request.getUserContext() != null) { clientIp = request.getUserContext().get(UserContextKeys.CLIENT_ADDRESS.name()); } else { clientIp = null; } final RangerAccessResourceImpl resource = new RangerAccessResourceImpl(); resource.setValue(RANGER_NIFI_RESOURCE_NAME, resourceIdentifier); final RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(); rangerRequest.setResource(resource); rangerRequest.setAction(request.getAction().name()); rangerRequest.setAccessType(request.getAction().name()); rangerRequest.setUser(identity); rangerRequest.setAccessTime(new Date()); if (!StringUtils.isBlank(clientIp)) { rangerRequest.setClientIPAddress(clientIp); } final RangerAccessResultProcessor resultProcessor = request.isAccessAttempt() ? defaultAuditHandler : null; final RangerAccessResult result = nifiPlugin.isAccessAllowed(rangerRequest, resultProcessor); if (result != null && result.getIsAllowed()) { return AuthorizationResult.approved(); } else { final boolean doesPolicyExist = nifiPlugin.doesPolicyExist(request.getResource().getIdentifier()); if (doesPolicyExist) { final String reason = result == null ? null : result.getReason(); if (reason != null) { logger.debug(String.format("Unable to authorize %s due to %s", identity, reason)); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); } else { return AuthorizationResult.resourceNotFound(); } } }  }
RangerNiFiAuthorizer implements Authorizer { @Override public AuthorizationResult authorize(final AuthorizationRequest request) throws AuthorizationAccessException { final String identity = request.getIdentity(); final String resourceIdentifier = request.getResource().getIdentifier(); if (StringUtils.isNotBlank(rangerAdminIdentity) && rangerAdminIdentity.equals(identity) && resourceIdentifier.equals(RESOURCES_RESOURCE)) { return AuthorizationResult.approved(); } final String clientIp; if (request.getUserContext() != null) { clientIp = request.getUserContext().get(UserContextKeys.CLIENT_ADDRESS.name()); } else { clientIp = null; } final RangerAccessResourceImpl resource = new RangerAccessResourceImpl(); resource.setValue(RANGER_NIFI_RESOURCE_NAME, resourceIdentifier); final RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(); rangerRequest.setResource(resource); rangerRequest.setAction(request.getAction().name()); rangerRequest.setAccessType(request.getAction().name()); rangerRequest.setUser(identity); rangerRequest.setAccessTime(new Date()); if (!StringUtils.isBlank(clientIp)) { rangerRequest.setClientIPAddress(clientIp); } final RangerAccessResultProcessor resultProcessor = request.isAccessAttempt() ? defaultAuditHandler : null; final RangerAccessResult result = nifiPlugin.isAccessAllowed(rangerRequest, resultProcessor); if (result != null && result.getIsAllowed()) { return AuthorizationResult.approved(); } else { final boolean doesPolicyExist = nifiPlugin.doesPolicyExist(request.getResource().getIdentifier()); if (doesPolicyExist) { final String reason = result == null ? null : result.getReason(); if (reason != null) { logger.debug(String.format("Unable to authorize %s due to %s", identity, reason)); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); } else { return AuthorizationResult.resourceNotFound(); } } }  @Override void initialize(AuthorizerInitializationContext initializationContext); @Override void onConfigured(AuthorizerConfigurationContext configurationContext); @Override AuthorizationResult authorize(final AuthorizationRequest request); @Override void preDestruction(); @AuthorizerContext void setNiFiProperties(final NiFiProperties properties); }
RangerNiFiAuthorizer implements Authorizer { @Override public AuthorizationResult authorize(final AuthorizationRequest request) throws AuthorizationAccessException { final String identity = request.getIdentity(); final String resourceIdentifier = request.getResource().getIdentifier(); if (StringUtils.isNotBlank(rangerAdminIdentity) && rangerAdminIdentity.equals(identity) && resourceIdentifier.equals(RESOURCES_RESOURCE)) { return AuthorizationResult.approved(); } final String clientIp; if (request.getUserContext() != null) { clientIp = request.getUserContext().get(UserContextKeys.CLIENT_ADDRESS.name()); } else { clientIp = null; } final RangerAccessResourceImpl resource = new RangerAccessResourceImpl(); resource.setValue(RANGER_NIFI_RESOURCE_NAME, resourceIdentifier); final RangerAccessRequestImpl rangerRequest = new RangerAccessRequestImpl(); rangerRequest.setResource(resource); rangerRequest.setAction(request.getAction().name()); rangerRequest.setAccessType(request.getAction().name()); rangerRequest.setUser(identity); rangerRequest.setAccessTime(new Date()); if (!StringUtils.isBlank(clientIp)) { rangerRequest.setClientIPAddress(clientIp); } final RangerAccessResultProcessor resultProcessor = request.isAccessAttempt() ? defaultAuditHandler : null; final RangerAccessResult result = nifiPlugin.isAccessAllowed(rangerRequest, resultProcessor); if (result != null && result.getIsAllowed()) { return AuthorizationResult.approved(); } else { final boolean doesPolicyExist = nifiPlugin.doesPolicyExist(request.getResource().getIdentifier()); if (doesPolicyExist) { final String reason = result == null ? null : result.getReason(); if (reason != null) { logger.debug(String.format("Unable to authorize %s due to %s", identity, reason)); } return AuthorizationResult.denied(request.getExplanationSupplier().get()); } else { return AuthorizationResult.resourceNotFound(); } } }  @Override void initialize(AuthorizerInitializationContext initializationContext); @Override void onConfigured(AuthorizerConfigurationContext configurationContext); @Override AuthorizationResult authorize(final AuthorizationRequest request); @Override void preDestruction(); @AuthorizerContext void setNiFiProperties(final NiFiProperties properties);  }