{
  "serviceName":"hivedev",

  "serviceDef":{
    "name":"hive",
    "id":3,
    "resources":[
      {"name":"database","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive Database","description":"Hive Database"},
      {"name":"global","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Global","description":"Global"},
      {"name":"url","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"URL","description":"URL"},
      {"name":"hiveservice","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive Service","description":"Hive Service"},
      {"name":"table","level":2,"parent":"database","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive Table","description":"Hive Table"},
      {"name":"udf","level":2,"parent":"database","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive UDF","description":"Hive UDF"},
      {"name":"column","level":3,"parent":"table","mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Hive Column","description":"Hive Column"}
    ],
    "accessTypes":[
      {"name":"select","label":"Select"},
      {"name":"update","label":"Update"},
      {"name":"create","label":"Create"},
      {"name":"drop","label":"Drop"},
      {"name":"alter","label":"Alter"},
      {"name":"index","label":"Index"},
      {"name":"lock","label":"Lock"},
      {"name":"all","label":"All",
        "impliedGrants": [
          "select",
          "update",
          "create",
          "drop",
          "alter",
          "index",
          "lock"
        ]
      }
    ]
  },

  "serviceConfig": {
    "ranger.plugin.audit.filters": "[ {'accessResult': 'DENIED', 'isAudited': true}, {'resources':{'database':{'values':['temp']},'table':{'values':['tempdata']},'column':{'values':['*']}},'isAudited' : false}, {'resources':{'database':{'values':['sys']},'table':{'values':['dump']}},'users':['user2'],'isAudited': false }, {'actions':['METADATA OPERATION'], 'isAudited': false}, {'users':['superuser1'],'groups':['supergroup1'], 'isAudited': false} ]"
 },

"policies": [
    {"id":1,"name":"db=*:table=*,column=*","isEnabled":true,"isAuditEnabled":true,"policyType":0,
      "resources":{"database":{"values":["*"]},"table":{"values":["*"]},"column":{"values":["*"]}},
      "policyItems":[
        {"accesses":[{"type":"select","isAllowed":true}],"users":["hive", "user1", "user2", "superuser1"],"groups":["supergroup1"],"delegateAdmin":false}
      ]
    }
  ],
  "tagPolicyInfo": {

    "serviceName":"tagdev",
    "serviceDef": {
      "name": "tag",
      "id": 100,
      "resources": [
        {
          "itemId": 1,
          "name": "tag",
          "type": "string",
          "level": 1,
          "parent": "",
          "mandatory": true,
          "lookupSupported": true,
          "recursiveSupported": false,
          "excludesSupported": false,
          "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
          "matcherOptions": {
            "wildCard": true,
            "ignoreCase": false
          },
          "validationRegEx": "",
          "validationMessage": "",
          "uiHint": "",
          "label": "TAG",
          "description": "TAG"
        }
      ],
      "accessTypes": [
        {
          "itemId": 1,
          "name": "hive:select",
          "label": "hive:select"
        },
        {
          "itemId": 2,
          "name": "hive:update",
          "label": "hive:update"
        },
        {
          "itemId": 3,
          "name": "hive:create",
          "label": "hive:create"
        }
      ,
        {
          "itemId": 4,
          "name": "hive:grant",
          "label": "hive:grant"
        }
      ,
        {
          "itemId": 5,
          "name": "hive:drop",
          "label": "hive:drop"
        }
      ,
        {
          "itemId": 6,
          "name": "hive:alter",
          "label": "hive:alter"
        },
        {
          "itemId": 7,
          "name": "hive:index",
          "label": "hive:index"
        },
        {
          "itemId": 8,
          "name": "hive:lock",
          "label": "hive:lock"
        },
        {
          "itemId": 9,
          "name": "hive:all",
          "label": "hive:all",
          "impliedGrants":
          [
            "hive:select",
            "hive:update",
            "hive:create",
            "hive:grant",
            "hive:drop",
            "hive:alter",
            "hive:index",
            "hive:lock"
          ]
        }
      ],
      "contextEnrichers": [],
      "policyConditions": []
    },

    "serviceConfig": {
      "ranger.plugin.audit.filters": "[ {'resources':{'tag':{'values':['NO_AUDIT']}},'isAudited': false}, {'resources':{'tag':{'values':['SYS_DATA']}},'users':['user1'],'isAudited': false}, {'resources':{'tag':{'values':['HIPPA']}},'users':['user1'], 'isAudited': true} ]"
    },

    "tagPolicies":[
      {"id":1001,"name":"DEFAULT","isEnabled":true,"isAuditEnabled":true,
        "resources":{"tag":{"values":["DEFAULT"],"isRecursive":false}},
        "policyItems":[{"accesses":[{"type":"hive:select","isAllowed":true}],"users":["hive", "user1"],"groups":[],"delegateAdmin":false}]
      },
      {"id":1002,"name":"HIPPA","isEnabled":true,"isAuditEnabled":true,
        "resources":{"tag":{"values":["HIPPA"],"isRecursive":false}},
        "policyItems":[{"accesses":[{"type":"hive:select","isAllowed":true}],"users":["hive", "user1","user2"],"groups":[],"delegateAdmin":false}]
      }
    ]
  },

  "tests": [
    {"name":"cmd -> select * from temp.tempdata, discard access audit for user1 to table -> temp.tempdata",
      "request":{
        "resource":{"elements":{"database":"temp","table":"tempdata", "column": "*"}},
        "accessType":"select","user":"user1","userGroups":["user1"],"requestData":"select * from temp.tempdata"
      },
      "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
    },
    {"name":"cmd -> use temp, discard access audit for user1 to database -> temp" ,
      "request":{
        "resource":{"elements":{"database":"temp"},
          "accessType":"_any","user":"user1","userGroups":["user1"],"requestData":"use temp"
        },
        "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
      }
    },
    {"name":"cmd -> select * from sys.dump, discard access audit for user2 to table -> sys.dump",
      "request":{
        "resource":{"elements":{"database":"sys","table":"dump"}},
        "accessType":"select","user":"user2","userGroups":[],"requestData":"select * from sys.dump"
      },
      "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
    },
    {"name":"cmd -> select * from hr.emp, discard access audit for superuser1 for access to table -> hr.emp",
      "request":{
        "resource":{"elements":{"database":"hr"}},
        "accessType":"select","user":"superuser1","userGroups":[],"requestData":"select * from hr.emp"
      },
      "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
    },
    {"name":"cmd -> select * from hr.emp, discard access audit for supergroup1 to table -> hr.emp",
      "request":{
        "resource":{"elements":{"database":"hr","table":"emp"}},
        "accessType":"select","user":"","userGroups":["supergroup1"],"requestData":"select * from hr.emp"
      },
      "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
    },
    {"name":"cmd -> select * from hr.emp;', Audit access for user4 to table hr.emp",
      "request":{
        "resource":{"elements":{"database":"hr","table":"emp"}},
        "accessType":"select","user":"user4","userGroups":[],"requestData":"select * from hr.emp"
      },
      "result":{"isAudited":true,"isAllowed":false,"policyId":-1}
    },
    {"name":"cmd -> select * from sys.scheduled_queries, discard access audit for hive operation = METADATA OPERATION",
      "request":{
        "resource":{"elements":{"database":"sys","table":"scheduled_queries"}},
        "accessType":"select","user":"hive","userGroups":[],"requestData":"select * from sys.scheduled_queries","action": "METADATA OPERATION"
      },
      "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
    },

    {"name":"cmd -> select name from medical.data, Audit access of resources with TAG = HIPPA",
      "request":{
        "resource":{"elements":{"database":"medical", "table":"data", "column":"name"}},
        "accessType":"select","user":"user2","userGroups":[],"requestData":"select name from medical.data for user1",
        "context": {"TAGS": "[{\"type\":\"HIPPA\"}]"}
      },
      "result":{"isAudited":true,"isAllowed":true,"policyId":-1}
    },

    {"name":"cmd -> select name from temp.data, discard  access audit of resources with TAG = NO_AUDIT",
      "request":{
        "resource":{"elements":{"database":"temp", "table":"data", "column":"name"}},
        "accessType":"select","user":"user1","userGroups":[],"requestData":"select name from temp.data for user1",
        "context": {"TAGS": "[{\"type\":\"NO_AUDIT\"}]"}
      },
      "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
    },

    {"name":"cmd -> select name from sysdb.data, discard access audit of resources with TAG = SYS_DATA",
      "request":{
        "resource":{"elements":{"database":"sysdb", "table":"data", "column":"name"}},
        "accessType":"select","user":"user1","userGroups":[],"requestData":"select name from sysdb.data for user1",
        "context": {"TAGS": "[{\"type\":\"SYS_DATA\"}]"}
      },
      "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
    },

    {"name":"cmd -> use sysdb, discard access audit of resource with TAG = SYS_DATA",
      "request":{
        "resource":{"elements":{"database":"sysdb"}},
        "accessType":"_any","user":"user1","userGroups":[],"requestData":"use sysdb",
        "context": {"TAGS": "[{\"type\":\"SYS_DATA\"}]"}
      },
      "result":{"isAudited":false,"isAllowed":true,"policyId":-1}
    }
  ]
}