| { |
| "serviceName":"hdfsdev", |
| |
| "serviceDef":{ |
| "name":"hdfs", |
| "id":1, |
| "resources":[ |
| {"name":"path","type":"path","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerPathResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Resource Path","description":"HDFS file or directory path"} |
| ], |
| "accessTypes":[ |
| {"name":"read","label":"Read"}, |
| {"name":"write","label":"Write"}, |
| {"name":"execute","label":"Execute"} |
| ], |
| "contextEnrichers": |
| [ |
| { |
| "itemId":1, |
| "name" : "GeolocationEnricher_format_long", |
| "enricher" : "org.apache.ranger.plugin.contextenricher.RangerFileBasedGeolocationProvider", |
| "enricherOptions" : { |
| "FilePath":"/etc/ranger/geo/geo_long.txt", "ForceRead":"false", "IPInDotFormat":"false" |
| ,"geolocation.meta.prefix": "FORMAT_LONG_" |
| } |
| }, |
| { |
| "itemId":2, |
| "name" : "GeolocationEnricher_format_dot", |
| "enricher" : "org.apache.ranger.plugin.contextenricher.RangerFileBasedGeolocationProvider", |
| "enricherOptions" : { |
| "FilePath":"/etc/ranger/geo/geo.txt", "ForceRead":"false", "IPInDotFormat":"true" |
| ,"geolocation.meta.prefix": "FORMAT_DOT_" |
| } |
| } |
| ], |
| "policyConditions": [ |
| { |
| "itemId":1, |
| "name":"ScriptConditionEvaluator", |
| "evaluator": "org.apache.ranger.plugin.conditionevaluator.RangerScriptConditionEvaluator", |
| "evaluatorOptions" : {"engineName":"JavaScript"}, |
| "label":"Script", |
| "description": "Script to execute" |
| } |
| ] |
| }, |
| |
| "policies":[ |
| {"id":1,"name":"audit-all-access under /finance/restricted/","isEnabled":true,"isAuditEnabled":true, |
| "resources":{"path":{"values":["/finance/restricted/"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[],"users":[],"groups":["public"],"delegateAdmin":false} |
| ] |
| } |
| , |
| {"id":2,"name":"allow-read-to-all under /public/","isEnabled":true,"isAuditEnabled":false, |
| "resources":{"path":{"values":["/public/*"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"execute","isAllowed":true}],"users":[],"groups":["public"],"delegateAdmin":false} |
| ] |
| } |
| , |
| {"id":3,"name":"allow-read-to-finance under /finance/restricted","isEnabled":true,"isAuditEnabled":true, |
| "resources":{"path":{"values":["/finance/restricted"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[{"type":"read","isAllowed":true}],"users":[],"groups":["finance"],"delegateAdmin":false, |
| "conditions":[{ |
| "type":"ScriptConditionEvaluator", |
| "values":["var country_code_format_long = ctx.getRequestContextAttribute('LOCATION_FORMAT_LONG_COUNTRY_CODE'); var country_code_format_dot = ctx.getRequestContextAttribute('LOCATION_FORMAT_DOT_COUNTRY_CODE');ctx.result = (!!country_code_format_long && !!country_code_format_dot && (country_code_format_long == country_code_format_dot));"] |
| }]} |
| ] |
| } |
| ], |
| |
| "tests":[ |
| {"name":"ALLOW 'read /finance/restricted/sales.db' for g=finance; valid clientIPAddress", |
| "request":{ |
| "resource":{"elements":{"path":"/finance/restricted/sales.db"}}, |
| "accessType":"read","user":"user1","userGroups":["finance"],"requestData":"read /finance/restricted/sales.db" |
| ,"remoteIPAddress":"255.255.255.255" |
| ,"forwardedAddresses":["1.0.32.1"] |
| }, |
| "result":{"isAudited":true,"isAllowed":true,"policyId":3} |
| } |
| , |
| {"name":"DENY 'read /finance/restricted/sales.db' for g=finance; invalid clientIPAddress", |
| "request":{ |
| "resource":{"elements":{"path":"/finance/restricted/sales.db"}}, |
| "accessType":"read","user":"user1","userGroups":["finance"],"requestData":"read /finance/restricted/sales.db", |
| "remoteIPAddress":"128.101.101.99" |
| }, |
| "result":{"isAudited":true,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"ALLOW 'read /finance/restricted/sales.db' for g=finance; no clientIPAddress", |
| "request":{ |
| "resource":{"elements":{"path":"/finance/restricted/sales.db"}}, |
| "accessType":"read","user":"user1","userGroups":["finance"],"requestData":"read /finance/restricted/sales.db" |
| }, |
| "result":{"isAudited":true,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"ALLOW 'read /finance/restricted/hr/payroll.db' for g=finance", |
| "request":{ |
| "resource":{"elements":{"path":"/finance/restricted/hr/payroll.db"}}, |
| "accessType":"read","user":"user1","userGroups":["finance"],"requestData":"read /finance/restricted/hr/payroll.db", |
| "remoteIPAddress":"128.101.101.101" |
| |
| }, |
| "result":{"isAudited":true,"isAllowed":true,"policyId":3} |
| } |
| , |
| {"name":"DENY 'read /operations/visitors.db' for g=finance", |
| "request":{ |
| "resource":{"elements":{"path":"/operations/visitors.db"}}, |
| "accessType":"read","user":"user1","userGroups":["finance"],"requestData":"read /operations/visitors.db", |
| "remoteIPAddress":"128.101.101.99" |
| }, |
| "result":{"isAudited":false,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"ALLOW 'read /public/technology/blogs.db' for g=finance", |
| "request":{ |
| "resource":{"elements":{"path":"/public/technology/blogs.db"}}, |
| "accessType":"read","user":"user1","userGroups":["finance"],"requestData":"read /public/technology/blogs.db" |
| }, |
| "result":{"isAudited":false,"isAllowed":true,"policyId":2} |
| } |
| , |
| |
| {"name":"DENY 'read /finance/restricted/sales.db' for g=hr", |
| "request":{ |
| "resource":{"elements":{"path":"/finance/restricted/sales.db"}}, |
| "accessType":"read","user":"user1","userGroups":["hr"],"requestData":"read /finance/restricted/sales.db" |
| }, |
| "result":{"isAudited":true,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"FALSE 'read /finance/restricted/hr/payroll.db' for g=hr", |
| "request":{ |
| "resource":{"elements":{"path":"/finance/restricted/hr/payroll.db"}}, |
| "accessType":"read","user":"user1","userGroups":["hr"],"requestData":"read /finance/restricted/hr/payroll.db" |
| }, |
| "result":{"isAudited":true,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"DENY 'read /operations/visitors.db' for g=hr", |
| "request":{ |
| "resource":{"elements":{"path":"/operations/visitors.db"}}, |
| "accessType":"read","user":"user1","userGroups":["hr"],"requestData":"read /operations/visitors.db" |
| }, |
| "result":{"isAudited":false,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"ALLOW 'read /public/technology/blogs.db' for g=hr", |
| "request":{ |
| "resource":{"elements":{"path":"/public/technology/blogs.db"}}, |
| "accessType":"read","user":"user1","userGroups":["hr"],"requestData":"read /public/technology/blogs.db" |
| }, |
| "result":{"isAudited":false,"isAllowed":true,"policyId":2} |
| } |
| , |
| |
| {"name":"DENY 'read /finance/restricted/sales.db' for u=user1", |
| "request":{ |
| "resource":{"elements":{"path":"/finance/restricted/sales.db"}}, |
| "accessType":"read","user":"user1","userGroups":[],"requestData":"read /finance/restricted/sales.db" |
| }, |
| "result":{"isAudited":true,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"DENY 'read /finance/restricted/hr/payroll.db' for u=user1", |
| "request":{ |
| "resource":{"elements":{"path":"/finance/restricted/hr/payroll.db"}}, |
| "accessType":"read","user":"user1","userGroups":[],"requestData":"read /finance/restricted/hr/payroll.db" |
| }, |
| "result":{"isAudited":true,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"DENY 'read /operations/visitors.db' for u=user1", |
| "request":{ |
| "resource":{"elements":{"path":"/operations/visitors.db"}}, |
| "accessType":"read","user":"user1","userGroups":[],"requestData":"read /operations/visitors.db" |
| }, |
| "result":{"isAudited":false,"isAllowed":false,"policyId":-1} |
| } |
| , |
| {"name":"ALLOW 'read /public/technology/blogs.db' for u=user1", |
| "request":{ |
| "resource":{"elements":{"path":"/public/technology/blogs.db"}}, |
| "accessType":"read","user":"user1","userGroups":[],"requestData":"read /public/technology/blogs.db" |
| }, |
| "result":{"isAudited":false,"isAllowed":true,"policyId":2} |
| } |
| , |
| {"name":"ALLOW 'read /public/technology' for u=user1", |
| "request":{ |
| "resource":{"elements":{"path":"/public/technology/blogs.db"}}, |
| "accessType":"read","user":"user1","userGroups":[],"requestData":"read /public/technology/blogs.db" |
| }, |
| "result":{"isAudited":false,"isAllowed":true,"policyId":2} |
| } |
| , |
| {"name":"ALLOW 'read /public/technology' for u=user1", |
| "request":{ |
| "resource":{"elements":{"path":"/public/technology/blogs.db"}}, |
| "accessType":"execute","user":"user1","userGroups":[],"requestData":"read /public/technology/blogs.db" |
| }, |
| "result":{"isAudited":false,"isAllowed":true,"policyId":2} |
| } |
| ] |
| } |
| |
