agents-common/src/test/resources/policyengine/test_policyengine_priority.json

{
  "serviceName":"kmsdev",

  "serviceDef":{
    "name":"kms",
    "id":1,
    "resources":[
      {"name":"key","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"KMS key","description":"KMS key"}
    ],
    "accessTypes":[
      {"name":"read","label":"Read"},
      {"name":"create","label":"Create"},
      {"name":"delete","label":"Delete"}
    ],
    "contextEnrichers": [ ],
    "policyConditions": [ ]
  },

  "policies":[
    {"id":1,"name":"allow-all to power-users","isEnabled":true,"isAuditEnabled":true,
     "policyPriority":1,
     "resources":{"key":{"values":["*"]}},
     "policyItems":[
       {"accesses":[{"type":"read","isAllowed":true},{"type":"create", "isAllowed":true}, {"type":"delete","isAllowed":true}],"users":[],"groups":["power-users"],"delegateAdmin":false}
     ],
      "denyPolicyItems":[
        {"accesses":[{"type":"read","isAllowed":true},{"type":"create", "isAllowed":true}, {"type":"delete","isAllowed":true}],"users":["nobody"],"groups":[],"delegateAdmin":false}
      ]
    }
    ,
    {"id":2,"name":"only hbase can read hbase; denyAllElse","isEnabled":true,"isAuditEnabled":true,
      "resources":{"key":{"values":["hbase"],"isRecursive":true}},
      "policyItems":[
        {"accesses":[{"type":"read","isAllowed":true}],"users":["hbase"],"groups":[],"delegateAdmin":false}
      ],
      "isDenyAllElse": true
    }
  ],

  "tests":[
    {"name":"ALLOW 'read hbase' for user=admin1, group=power-users",
     "request":{
      "resource":{"elements":{"key":"hbase"}},
      "accessType":"read","user":"admin1","userGroups":["power-users"],"requestData":"read hbase, user=admin1, group=power-users"
     },
     "result":{"isAudited":true,"isAllowed":true,"policyId":1}
    }
    ,
    {"name":"ALLOW 'create hbase' for user=admin1, group=power-users",
      "request":{
        "resource":{"elements":{"key":"hbase"}},
        "accessType":"create","user":"admin1","userGroups":["power-users"],"requestData":"read hbase, user=admin1, group=power-users"
      },
      "result":{"isAudited":true,"isAllowed":true,"policyId":1}
    }
    ,
    {"name":"ALLOW 'read hbase' for user=hbase",
      "request":{
        "resource":{"elements":{"key":"hbase"}},
        "accessType":"read","user":"hbase","requestData":"read hbase, user=hbase"
      },
      "result":{"isAudited":true,"isAllowed":true,"policyId":2}
    }
    ,
    {"name":"DENY 'delete hbase' for user=hbase",
      "request":{
        "resource":{"elements":{"key":"hbase"}},
        "accessType":"delete","user":"hbase","requestData":"delete hbase, user=hbase"
      },
      "result":{"isAudited":true,"isAllowed":false,"policyId":2}
    }
    ,
    {"name":"DENY 'read hbase' for user=kafka",
      "request":{
        "resource":{"elements":{"key":"hbase"}},
        "accessType":"read","user":"kafka","requestData":"read hbase, user=kafka"
      },
      "result":{"isAudited":true,"isAllowed":false,"policyId":2}
    }
  ]
}