From cbf41521a0d1b763cf44d84b1fbd1b485301830c Mon Sep 17 00:00:00 2001 From: Madhan Neethiraj Date: Mon, 27 Jan 2025 17:08:48 -0800 Subject: [PATCH 1/4] RANGER-5116: updated Ranger plugin to support configurations to initialize UserGroupInfomation (#518) --- .../plugin/service/RangerBasePlugin.java | 55 +++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java b/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java index 066dba1aaa..495ce3b838 100644 --- a/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java +++ b/agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java @@ -22,10 +22,12 @@ import org.apache.commons.collections.CollectionUtils; import org.apache.commons.collections.MapUtils; import org.apache.commons.lang.StringUtils; +import org.apache.hadoop.security.UserGroupInformation; import org.apache.ranger.admin.client.RangerAdminClient; import org.apache.ranger.admin.client.RangerAdminRESTClient; import org.apache.ranger.audit.provider.AuditHandler; import org.apache.ranger.audit.provider.AuditProviderFactory; +import org.apache.ranger.audit.provider.MiscUtil; import org.apache.ranger.audit.provider.StandAloneAuditProviderFactory; import org.apache.ranger.authorization.hadoop.config.RangerAuditConfig; import org.apache.ranger.authorization.hadoop.config.RangerPluginConfig; @@ -70,6 +72,7 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import java.io.IOException; import java.util.ArrayList; import java.util.Arrays; import java.util.Collection; @@ -135,6 +138,58 @@ public RangerBasePlugin(RangerPluginConfig pluginConfig) { setIsFallbackSupported(pluginConfig.getBoolean(pluginConfig.getPropertyPrefix() + ".is.fallback.supported", false)); setServiceAdmins(serviceAdmins); + String ugiPrefix = pluginConfig.getPropertyPrefix() + ".ugi"; + boolean initUgi = pluginConfig.getBoolean(ugiPrefix + ".initialize", false); + + if (initUgi) { + String ugiLoginType = pluginConfig.get(ugiPrefix + ".login.type"); + + if (StringUtils.equalsIgnoreCase(ugiLoginType, "keytab")) { + String principal = pluginConfig.get(ugiPrefix + ".keytab.principal"); + String keytab = pluginConfig.get(ugiPrefix + ".keytab.file"); + + if (StringUtils.isNotBlank(principal) && StringUtils.isNotBlank(keytab)) { + LOG.info("UGI login: principal={}, keytab={}", principal, keytab); + + try { + UserGroupInformation.loginUserFromKeytab(principal, keytab); + } catch (IOException excp) { + LOG.error("UGI login: failed", excp); + + throw new RuntimeException(excp); + } + } else { + String msg = String.format("UGI login: invalid configuration: %s=%s, %s=%s", ugiPrefix + ".keytab.principal", principal, ugiPrefix + ".keytab.file", keytab); + + LOG.error(msg); + + throw new RuntimeException(msg); + } + } else if (StringUtils.equalsIgnoreCase(ugiLoginType, "jaas")) { + String jaasAppConfig = pluginConfig.get(ugiPrefix + ".jaas.appconfig"); + + if (StringUtils.isNotBlank(jaasAppConfig)) { + LOG.info("UGI login: jaasAppConfig={}", jaasAppConfig); + + try { + MiscUtil.setUGIFromJAASConfig(jaasAppConfig); + } catch (Exception excp) { + LOG.error("UGI login: jaasAppConfig={} failed", jaasAppConfig, excp); + + throw new RuntimeException(excp); + } + } else { + String msg = String.format("UGI login: invalid configuration: %s=%s", ugiPrefix + ".jaas.appconfig", jaasAppConfig); + + LOG.error(msg); + + throw new RuntimeException(msg); + } + } else { + LOG.warn("UGI login: invalid configuration {}={}", ugiPrefix + ".login.type", ugiLoginType); + } + } + RangerRequestScriptEvaluator.init(pluginConfig); this.dedupStrings = pluginConfig.getBoolean(pluginConfig.getPropertyPrefix() + ".dedup.strings", true); From 94072cf191e4d3547321c14ecddc3b17d199ce4e Mon Sep 17 00:00:00 2001 From: Mahesh Bandal Date: Thu, 16 Jan 2025 15:58:40 +0530 Subject: [PATCH 2/4] RANGER-5097: Fix setOwnerUser function to ensure the Hive default {owner} policy works correctly --- .../hive/authorizer/RangerHiveAuthorizer.java | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java index 38b8381a56..8ff5a42192 100644 --- a/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java +++ b/hive-agent/src/main/java/org/apache/ranger/authorization/hive/authorizer/RangerHiveAuthorizer.java @@ -172,14 +172,16 @@ public RangerHiveAuthorizer(HiveMetastoreClientFactory metastoreClientFactory, H static void setOwnerUser(RangerHiveResource resource, HivePrivilegeObject hiveObj, IMetaStoreClient metaStoreClient, Map objOwners) { if (hiveObj != null) { String objName = null; - String owner = null; + String owner = hiveObj.getOwnerName(); // resource.setOwnerUser(hiveObj.getOwnerName()); switch (hiveObj.getType()) { case DATABASE: try { objName = hiveObj.getDbname(); - owner = objOwners != null ? objOwners.get(objName) : null; + if (StringUtils.isBlank(owner) && objOwners != null) { + owner = objOwners.get(objName); + } if (StringUtils.isBlank(owner)) { Database database = metaStoreClient != null ? metaStoreClient.getDatabase(hiveObj.getDbname()) : null; @@ -199,7 +201,9 @@ static void setOwnerUser(RangerHiveResource resource, HivePrivilegeObject hiveOb case COLUMN: try { objName = hiveObj.getDbname() + "." + hiveObj.getObjectName(); - owner = objOwners != null ? objOwners.get(objName) : null; + if (StringUtils.isBlank(owner) && objOwners != null) { + owner = objOwners.get(objName); + } if (StringUtils.isBlank(owner)) { Table table = metaStoreClient != null ? metaStoreClient.getTable(hiveObj.getDbname(), hiveObj.getObjectName()) : null; From a90a77e1ce12a0f7193533e846c504caea293d21 Mon Sep 17 00:00:00 2001 From: "Dhaval.Rajpara" Date: Fri, 31 Jan 2025 10:54:27 +0530 Subject: [PATCH 3/4] RANGER-5109 : addendum patch for Upgrade Swagger-UI to the latest 5.18.2 due to DOMPurify CVE --- docs/src/site/resources/index.js | 41 +++++++++++++++++++++++--------- 1 file changed, 30 insertions(+), 11 deletions(-) diff --git a/docs/src/site/resources/index.js b/docs/src/site/resources/index.js index bb876f28d7..40a3700564 100644 --- a/docs/src/site/resources/index.js +++ b/docs/src/site/resources/index.js @@ -18,6 +18,24 @@ var gatewayUrl; var apiBaseUrl = "/service"; +const rangerLogo = ` + + + + + + + + + + + + + + + + + `; window.onload = function() { const ui = SwaggerUIBundle({ @@ -45,17 +63,18 @@ window.onload = function() { docExpansion: 'none' }) window.ui = ui; - setLogo() - if(document.getElementById("swagger-ui").getElementsByClassName("float-right").length > 0) { - document.getElementById("swagger-ui").getElementsByClassName("float-right")[0].querySelector("a").remove() - } - -} - -function setLogo() { - if( document.getElementById("swagger-ui").getElementsByClassName("topbar-wrapper").length > 0){ - document.getElementById("swagger-ui").getElementsByClassName("topbar-wrapper")[0].getElementsByTagName("img")[0].src = gatewayUrl + "/images/ranger_logo.png"; - } + // Poll the DOM until the Swagger UI logo is rendered, then set the custom logo + const interval = setInterval(() => { + const topbarWrapper = document.getElementById("swagger-ui").querySelector('div.topbar-wrapper > a.link'); // Find the logo element + if (topbarWrapper) { + topbarWrapper.innerHTML = ''; + topbarWrapper.innerHTML= rangerLogo; + if(document.getElementById("swagger-ui").getElementsByClassName("float-right").length > 0) { + document.getElementById("swagger-ui").getElementsByClassName("float-right")[0].querySelector("a").remove() + } + clearInterval(interval); // Stop polling once the logo is set + } + }, 100);// Check every 100ms } function getSwaggerBaseUrl(url) { From 852d89486e739349dc2c958d46c2df19a3e3326a Mon Sep 17 00:00:00 2001 From: Dineshkumar Yadav Date: Tue, 4 Feb 2025 11:33:50 +0530 Subject: [PATCH 4/4] RANGER-5124 : The policy and tag active time are not in sync with the last update and policy download --- .../java/org/apache/ranger/biz/AssetMgr.java | 72 ++++++++++++++----- 1 file changed, 54 insertions(+), 18 deletions(-) diff --git a/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java index 4d55598883..ec39448f3b 100644 --- a/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java +++ b/security-admin/src/main/java/org/apache/ranger/biz/AssetMgr.java @@ -1051,28 +1051,64 @@ private void createOrUpdatePluginInfo(final RangerPluginInfo pluginInfo, int ent final Runnable commitWork; if (httpCode == HttpServletResponse.SC_NOT_MODIFIED) { - if (!pluginActivityAuditLogNotModified) { + RangerPluginInfo dbObj = null; + Long pluginActivationTime = null; + Long dbLastActivationTime = null; + + if (StringUtils.isNotBlank(pluginInfo.getServiceName())) { + XXPluginInfo xObj = rangerDaoManager.getXXPluginInfo().find(pluginInfo.getServiceName(), pluginInfo.getHostName(), pluginInfo.getAppType()); + if (xObj != null) { + dbObj = pluginInfoService.populateViewObject(xObj); + } + } + + // Create or update PluginInfo record after transaction is completed. If it is created in-line here + // then the TransactionManager will roll-back the changes because the HTTP return code is + // HttpServletResponse.SC_NOT_MODIFIED + + switch (entityType) { + case RangerPluginInfo.ENTITY_TYPE_POLICIES: + isTagVersionResetNeeded = rangerDaoManager.getXXService().findAssociatedTagService(pluginInfo.getServiceName()) == null; + + pluginActivationTime = pluginInfo.getPolicyActivationTime(); + dbLastActivationTime = dbObj != null ? dbObj.getPolicyActivationTime() : null; + break; + case RangerPluginInfo.ENTITY_TYPE_TAGS: + isTagVersionResetNeeded = false; + + pluginActivationTime = pluginInfo.getTagActivationTime(); + dbLastActivationTime = dbObj != null ? dbObj.getTagActivationTime() : null; + break; + case RangerPluginInfo.ENTITY_TYPE_ROLES: + isTagVersionResetNeeded = false; + + pluginActivationTime = pluginInfo.getRoleActivationTime(); + dbLastActivationTime = dbObj != null ? dbObj.getRoleActivationTime() : null; + break; + case RangerPluginInfo.ENTITY_TYPE_USERSTORE: + isTagVersionResetNeeded = false; + + pluginActivationTime = pluginInfo.getUserStoreActivationTime(); + dbLastActivationTime = dbObj != null ? dbObj.getUserStoreActivationTime() : null; + break; + case RangerPluginInfo.ENTITY_TYPE_GDS: + isTagVersionResetNeeded = false; + + pluginActivationTime = pluginInfo.getGdsActivationTime(); + dbLastActivationTime = dbObj != null ? dbObj.getGdsActivationTime() : null; + break; + default: + isTagVersionResetNeeded = false; + break; + } + + boolean isLastActivationTimeUpdateNeeded = pluginActivationTime != null && pluginActivationTime > 0 && (dbLastActivationTime == null || !dbLastActivationTime.equals(pluginActivationTime)); + + if (!pluginActivityAuditLogNotModified && !isLastActivationTimeUpdateNeeded) { logger.debug("Not logging HttpServletResponse. SC_NOT_MODIFIED. To enable, set configuration: {}=true", PROP_PLUGIN_ACTIVITY_AUDIT_NOT_MODIFIED); commitWork = null; } else { - // Create or update PluginInfo record after transaction is completed. If it is created in-line here - // then the TransactionManager will roll-back the changes because the HTTP return code is - // HttpServletResponse.SC_NOT_MODIFIED - - switch (entityType) { - case RangerPluginInfo.ENTITY_TYPE_POLICIES: - isTagVersionResetNeeded = rangerDaoManager.getXXService().findAssociatedTagService(pluginInfo.getServiceName()) == null; - break; - case RangerPluginInfo.ENTITY_TYPE_TAGS: - case RangerPluginInfo.ENTITY_TYPE_ROLES: - case RangerPluginInfo.ENTITY_TYPE_USERSTORE: - case RangerPluginInfo.ENTITY_TYPE_GDS: - default: - isTagVersionResetNeeded = false; - break; - } - commitWork = () -> doCreateOrUpdateXXPluginInfo(pluginInfo, entityType, isTagVersionResetNeeded, clusterName); } } else if (httpCode == HttpServletResponse.SC_NOT_FOUND) {