Repository navigation
Conversation
Add server-side validation for constraint policies (policy type 4) in RangerPolicyValidator: - a constraint policy can have only constraintPolicyItems; other policy types cannot have constraintPolicyItems - the service-def must define constraintDefs - each item's constraint must be defined in the service-def - item access types must be within constraintDef.accessTypes, when set - mandatory parameters must be present, unknown parameters are rejected, and values must match the parameter type (string, int, bool, enum) - policy resources must match the resource hierarchy of each constraint used by the policy, including additional resources Add error codes 3057-3066 and TestRangerPolicyValidatorConstraints.
… removal of constraintDefs in use - add table x_policy_ref_constraint (policy_id, service_def_id, constraint_name), DB patch 080 for all supported databases - PolicyRefUpdater records the constraints used by a policy, and removes them on policy update and delete - updateServiceDef() rejects removing or renaming a constraintDef that is used by policies - include constraintPolicyItems in PolicyRefUpdater.getAllPolicyItems(), so that users, groups, roles and access types of constraint policies get ref entries, renamed principals are updated in constraint policies, and purgeEmptyPolicies() doesn't delete constraint policies - remove deleted users and groups from constraint policy items
…udit log, export and role download - delegated-admin checks use the access types and delegate-admin users of constraint policy items; earlier, delegated admins could not read, create or update constraint policies - record changes to constraintPolicyItems in the admin audit (transaction log) - include roles of constraint policy items when deciding whether plugins need a role download - CSV/Excel export: write one row per constraint policy item, with policy type "Constraints" and a new "Constraint" column with the constraint name and parameters - service-def validation: resources of a constraintDef must form a valid resource hierarchy (error code 2033)
…m(), getPolicyItems() can be immutable
…ast one resource A constraint-def without resources is ignored by the policy engine (RANGER-5842), so reject it when a service-def is created or updated (error code 2034).
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.