| { |
| "serviceName":"hdfsdev", |
| "serviceDef":{ |
| "name":"hdfs", |
| "id":1, |
| "resources":[ |
| {"name":"path","type":"path","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerPathResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Resource Path","description":"HDFS file or directory path"} |
| ], |
| "options": { |
| "enableDenyAndExceptionsInPolicies":"true" |
| }, |
| "accessTypes":[ |
| {"name":"read","label":"Read"}, |
| {"name":"write","label":"Write"}, |
| {"name":"execute","label":"Execute"} |
| ] |
| }, |
| "policies":[ |
| { |
| "id": 99, |
| "name": "/resource: allow: groups=public", |
| "isEnabled": true, |
| "isAuditEnabled": true, |
| "resources": { |
| "path": { "values": [ "/resource" ], "isRecursive": true } |
| }, |
| "policyItems": [ |
| { |
| "accesses":[ |
| {"type":"read"}, |
| {"type": "execute" }, |
| {"type":"write"} |
| ], |
| "groups" : ["public"] |
| } |
| ] |
| }, |
| { |
| "id": 1, |
| "name": "/resource: allow: users=super; deny: user=user", |
| "isEnabled": true, |
| "isAuditEnabled": true, |
| "resources": { |
| "path": { "values": [ "/resource" ], "isRecursive": true } |
| }, |
| "policyPriority":1, |
| "validitySchedules": [ |
| { |
| "startTime": "2018/01/12 14:32:00", |
| "endTime": "2020/02/13 12:16:00", |
| "recurrences": [ |
| { |
| "schedule": { |
| "minute": "0,10,20,30,40,50", |
| "hour": "*", |
| "dayOfMonth": "*", |
| "dayOfWeek": "5,7", |
| "month": "*", |
| "year": "2018" |
| }, |
| "interval": { |
| "minutes": 4 |
| } |
| } |
| ] |
| } |
| ], |
| "policyItems": [ |
| { |
| "accesses":[ |
| {"type":"read"}, |
| {"type":"write"} |
| ], |
| "users":["super"] |
| } |
| ], |
| "allowExceptions":[ ], |
| "denyPolicyItems": [ |
| { |
| "accesses": [ |
| { "type": "read" }, |
| { "type": "execute" }, |
| { "type": "write" } |
| ], |
| "users": [ "user"] |
| } |
| ], |
| "denyExceptions":[ ] |
| }, |
| { |
| "id": 2, |
| "name": "/unaudited-resource: allow: users=super deny: user=user", |
| "isEnabled": true, |
| "isAuditEnabled": false, |
| "resources": { |
| "path": { "values": [ "/unaudited-resource" ], "isRecursive": true } |
| }, |
| "validitySchedules": [], |
| "policyItems": [ |
| { |
| "accesses":[ |
| {"type":"read" }, |
| {"type":"write" } |
| ], |
| "users":["super"] |
| } |
| ], |
| "allowExceptions":[ ], |
| "denyPolicyItems": [ |
| { |
| "accesses": [ |
| { "type": "read" }, |
| { "type": "execute" }, |
| { "type": "write" } |
| ], |
| "users": [ "user" ] |
| } |
| ], |
| "denyExceptions":[ ] |
| } |
| ], |
| |
| "tagPolicyInfo": { |
| "serviceName":"tagdev", |
| "serviceDef": { |
| "name": "tag", |
| "id": 100, |
| "resources": [ |
| { "name": "tag", "type": "string", "level": 1, "mandatory": true, "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher", "matcherOptions": { "wildCard": false, "ignoreCase": false }, "label": "TAG", "description": "TAG" } |
| ], |
| "accessTypes": [ |
| { "name": "hdfs:read", "label": "hdfs:Read" }, |
| { "name": "hdfs:write", "label": "hdfs:Write" }, |
| { "name": "hdfs:execute", "label": "hdfs:Execute" } |
| ], |
| "contextEnrichers": [ ], |
| "policyConditions": [ ] |
| }, |
| "tagPolicies":[ |
| { |
| "id":101, |
| "name":"PII", |
| "isEnabled":true, |
| "isAuditEnabled":true, |
| "resources":{"tag":{"values":["PII"],"isRecursive":false}}, |
| "policyItems":[ |
| { |
| "accesses":[ |
| {"type":"hdfs:read", "isAllowed":true}, |
| {"type":"hdfs:write", "isAllowed":true} |
| ], |
| "users":["super"] |
| } |
| ], |
| "allowExceptions":[ ], |
| "denyPolicyItems":[ |
| { |
| "accesses":[ |
| {"type":"hdfs:read" }, |
| {"type":"hdfs:write" } |
| ], |
| "users":["user"] |
| } |
| ], |
| "denyExceptions":[ ], |
| "policyPriority":1, |
| "validitySchedules": [ |
| { |
| "startTime": "2018/01/12 14:32:00", |
| "endTime": "2020/02/13 12:16:00", |
| "recurrences": [ |
| { |
| "schedule": { |
| "minute": "0,10,20,30,40,50", |
| "hour": "*", |
| "dayOfMonth": "*", |
| "dayOfWeek": "5,7", |
| "month": "*", |
| "year": "2018" |
| }, |
| "interval": { |
| "minutes": 5 |
| } |
| } |
| ] |
| } |
| ] |
| }, |
| { |
| "id":102, |
| "name":"Unaudited-TAG", |
| "isEnabled":true, |
| "isAuditEnabled":false, |
| "resources":{"tag":{"values":["Unaudited-TAG"],"isRecursive":false}}, |
| "validitySchedules": [], |
| "policyItems":[ |
| { |
| "accesses":[ |
| {"type":"hdfs:read" }, |
| {"type":"hdfs:write" } |
| ], |
| "users":["super"] |
| } |
| ], |
| "allowExceptions":[ ], |
| "denyPolicyItems":[ |
| { |
| "accesses":[ |
| {"type":"hdfs:read" }, |
| {"type":"hdfs:write" } |
| ], |
| "users":["user"] |
| } |
| ], |
| "denyExceptions":[ ] |
| } |
| ] |
| }, |
| "tests":[ |
| { |
| "name": "ALLOW 'read /resource' for u=user no tag temporarily", |
| "request": { |
| "resource": { |
| "elements": { |
| "path": "/resource" |
| } |
| }, |
| "accessType": "read", |
| "user": "user", |
| "userGroups": [], |
| "requestData": "read /resource for u=user no tag temporarily", |
| "context": { |
| "TAGS": "[{\"type\":\"PII\",\"options\":{\"TAG_VALIDITY_PERIODS\":\"[{\\\"startTime\\\":\\\"2018/01/12 14:32:00\\\",\\\"endTime\\\":\\\"2020/02/13 12:16:00\\\",\\\"recurrences\\\":[{\\\"schedule\\\":{\\\"minute\\\":\\\"0,10,20,30,40,50\\\",\\\"hour\\\":\\\"*\\\",\\\"dayOfMonth\\\":\\\"*\\\",\\\"dayOfWeek\\\":\\\"5,7\\\",\\\"month\\\":\\\"*\\\",\\\"year\\\":\\\"2018\\\"},\\\"interval\\\":{\\\"days\\\":0,\\\"hours\\\":0,\\\"minutes\\\":4}}]}]\"}}]" |
| }, |
| "accessTime": "20180127-10:06:00.000-0800" |
| }, |
| "result": {"isAudited": true, "isAllowed": true, "policyId": 99} |
| }, |
| { |
| "name": "DENY 'read /resource' for u=user tag temporarily", |
| "request": { |
| "resource": { |
| "elements": { |
| "path": "/resource" |
| } |
| }, |
| "accessType": "read", |
| "user": "user", |
| "userGroups": [], |
| "requestData": "read /resource for u=user tag temporarily", |
| "context": { |
| "TAGS": "[{\"type\":\"PII\",\"options\":{\"TAG_VALIDITY_PERIODS\":\"[{\\\"startTime\\\":\\\"2018/01/12 14:32:00\\\",\\\"endTime\\\":\\\"2020/02/13 12:16:00\\\",\\\"recurrences\\\":[{\\\"schedule\\\":{\\\"minute\\\":\\\"0,10,20,30,40,50\\\",\\\"hour\\\":\\\"*\\\",\\\"dayOfMonth\\\":\\\"*\\\",\\\"dayOfWeek\\\":\\\"5,7\\\",\\\"month\\\":\\\"*\\\",\\\"year\\\":\\\"2018\\\"},\\\"interval\\\":{\\\"days\\\":0,\\\"hours\\\":0,\\\"minutes\\\":7}}]}]\"}}]" |
| }, |
| "accessTime": "20180127-10:05:00.000-0800" |
| }, |
| "result": {"isAudited": true, "isAllowed": false, "policyId": 101} |
| }, |
| { |
| "name": "ALLOW 'read /resource' for u=user temporarily", |
| "request": { |
| "resource": { |
| "elements": { |
| "path": "/resource" |
| } |
| }, |
| "accessType": "read", |
| "user": "user", |
| "userGroups": [], |
| "requestData": "read /resource temporarily", |
| "accessTime": "20180127-10:06:00.000-0800" |
| }, |
| "result": {"isAudited": true, "isAllowed": true, "policyId": 99} |
| }, |
| { |
| "name": "DENY 'read /resource' for u=user temporarily", |
| "request": { |
| "resource": { |
| "elements": { |
| "path": "/resource" |
| } |
| }, |
| "accessType": "read", |
| "user": "user", |
| "userGroups": [], |
| "requestData": "read /resource temporarily", |
| "accessTime": "20180127-10:03:00.000-0800" |
| }, |
| "result": {"isAudited": true, "isAllowed": false, "policyId": 1} |
| }, |
| { |
| "name": "DENY 'read /resource' for u=user", |
| "request": { |
| "resource": { "elements": { "path": "/resource" } }, |
| "accessType": "read", |
| "user": "user", |
| "userGroups": [ ], |
| "requestData": "read /resource for u=user", |
| "accessTime": "20180127-10:03:00.000-0800", |
| "context": { |
| "TAGS": "[{\"type\":\"PII\"}]" |
| } |
| }, |
| "result": { "isAudited": true, "isAllowed": false, "policyId": 101 } |
| }, |
| { |
| "name": "ALLOW 'read /resource' for u=super", |
| "request": { |
| "resource": { "elements": { "path": "/resource" } }, |
| "accessType": "read", |
| "user": "super", |
| "userGroups": [ ], |
| "requestData": "read /resource for u=super", |
| "accessTime": "20180127-10:03:00.000-0800", |
| "context": { |
| "TAGS": "[{\"type\":\"PII\"}]" |
| } |
| }, |
| "result": { "isAudited": true, "isAllowed": true, "policyId": 101 } |
| } |
| , |
| { |
| "name": "ALLOW 'read /resource' for u=super", |
| "request": { |
| "resource": { "elements": { "path": "/resource" } }, |
| "accessType": "read", |
| "user": "super", |
| "userGroups": [ ], |
| "requestData": "read /resource for u=super", |
| "accessTime": "20180127-10:03:00.000-0800" |
| |
| }, |
| "result": { "isAudited": true, "isAllowed": true, "policyId": 1 } |
| }, |
| { |
| "name": "ALLOW 'read /resource' for u=any", |
| "request": { |
| "resource": { "elements": { "path": "/resource" } }, |
| "accessType": "read", |
| "user": "any", |
| "userGroups": [ ], |
| "requestData": "read /resource for u=any" |
| }, |
| "result": { "isAudited": true, "isAllowed": true, "policyId": 99 } |
| } |
| |
| ] |
| } |
