Repository navigation
RANGER-5863: update service-header to include service admin users and groups - #1347
mneethiraj wants to merge 3 commits into
Conversation
| String adminGroups = (String) result[6]; | ||
|
|
||
| if (StringUtils.isNotBlank(adminUsers)) { | ||
| svcHeader.setAdminUsers(Arrays.asList(adminUsers.split(","))); |
There was a problem hiding this comment.
Any logged-in user can now see who the admins are. getServiceHeaders keeps a header when hasAccess is true, and that lets any ROLE_USER read non-KMS service headers. Before this change, seeing a service's admin users and groups required config access. If this wider visibility is intended, the PR should say so. Otherwise the new fields should be gated.
There was a problem hiding this comment.
Good point @vyommani. I will introduce service configurations service.account.users and service.account.groups, to register service account identities. These identities will have following privileges:
- Download policy details of the service for the enforcement plugin, including policies, tags, roles, user-store, gds info
- Call PDP APIs to authorize access to resources in the service on behalf of other users
- Publish access audits for the service to audit-ingestor
There was a problem hiding this comment.
You concern about exposing value of couple of service configurations remains same though - it will not be identities of service admin users/groups but instead it will be the service account identities. If this is unacceptable, we will have to create a new permission to restrict access to these fields and explicitly assign this permission to users. Let me know.
There was a problem hiding this comment.
Thanks @mneethiraj . Service accounts can download policies, tags, roles, and the user-store, and call the PDP for other users, so I would not show those names to every ROLE_USER. service-headers is already returned to that caller, and service config is hidden from them. Could we fill these fields only when the caller can already read the service config, and leave them empty otherwise? That covers admin users without a new permission.
What changes were proposed in this pull request?
XXServiceDao. findServiceHeaders()to retrieve admin users and groups from service configurationHow was this patch tested?