| { |
| "servicePolicies":{ |
| "serviceName":"hdfsdev", |
| "serviceId":1, |
| "policyVersion":1, |
| "serviceDef":{ |
| "name":"hdfs", |
| "id":1, |
| "resources":[ |
| {"name":"path","type":"path","level":1,"mandatory":true,"lookupSupported":true,"matcher":"org.apache.ranger.plugin.resourcematcher.RangerPathResourceMatcher","matcherOptions":{"wildCard":true, "ignoreCase":true},"label":"Resource Path","description":"HDFS file or directory path"} |
| ], |
| "accessTypes":[ |
| {"name":"read","label":"Read"}, |
| {"name":"write","label":"Write"}, |
| {"name":"execute","label":"Execute"} |
| ] |
| }, |
| |
| "policies":[ |
| {"id":1,"name":"entire file system","isEnabled":true,"isAuditEnabled":true, |
| "resources":{"path":{"values":["/*"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[],"users":[],"groups":["cluster-admins"],"delegateAdmin":true} |
| ] |
| } |
| , |
| {"id":11,"name":"/dept1 folder","isEnabled":true,"isAuditEnabled":false, |
| "resources":{"path":{"values":["/dept1/*"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"write","isAllowed":true},{"type":"execute","isAllowed":true}],"users":[],"groups":["dept1-admins"],"delegateAdmin":true}, |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"execute","isAllowed":true}],"users":[],"groups":["dept1-users"],"delegateAdmin":false} |
| ] |
| } |
| , |
| {"id":12,"name":"/dept1/wiki folder","isEnabled":true,"isAuditEnabled":false, |
| "resources":{"path":{"values":["/dept1/wiki/*"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"write","isAllowed":true},{"type":"execute","isAllowed":true}],"users":["dept1-webmaster"],"groups":[],"delegateAdmin":false} |
| ] |
| } |
| , |
| {"id":13,"name":"/dept1/review folder","isEnabled":true,"isAuditEnabled":false, |
| "resources":{"path":{"values":["/dept1/review/*"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"write","isAllowed":true},{"type":"execute","isAllowed":true}],"users":["dept1-manager"],"groups":[],"delegateAdmin":false} |
| ] |
| } |
| , |
| {"id":21,"name":"/dept2 folder","isEnabled":true,"isAuditEnabled":false, |
| "resources":{"path":{"values":["/dept2/*"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"write","isAllowed":true},{"type":"execute","isAllowed":true}],"users":[],"groups":["dept2-admins"],"delegateAdmin":true}, |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"execute","isAllowed":true}],"users":[],"groups":["dept2-users"],"delegateAdmin":false} |
| ] |
| } |
| , |
| {"id":22,"name":"/dept2/wiki folder","isEnabled":true,"isAuditEnabled":false, |
| "resources":{"path":{"values":["/dept2/wiki/*"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"write","isAllowed":true},{"type":"execute","isAllowed":true}],"users":["dept2-webmaster"],"groups":[],"delegateAdmin":false} |
| ] |
| } |
| , |
| {"id":23,"name":"/dept2/review folder","isEnabled":true,"isAuditEnabled":false, |
| "resources":{"path":{"values":["/dept2/review/*"],"isRecursive":true}}, |
| "policyItems":[ |
| {"accesses":[{"type":"read","isAllowed":true},{"type":"write","isAllowed":true},{"type":"execute","isAllowed":true}],"users":["dept2-manager"],"groups":[],"delegateAdmin":false} |
| ] |
| } |
| ] |
| }, |
| "tests":[ |
| {"name":"ALLOW '_admin access on any path' for g=cluster-admins", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"testuser","userGroups":["cluster-admins","users"],"accessType":"_admin", |
| "result":true |
| } |
| , |
| {"name":"DENY 'read access on any path' for g=cluster-admins", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"testuser","userGroups":["cluster-admins","users"],"accessType":"read", |
| "result":false |
| } |
| , |
| {"name":"DENY 'write access on any path' for g=cluster-admins", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"testuser","userGroups":["cluster-admins","users"],"accessType":"write", |
| "result":false |
| } |
| , |
| {"name":"DENY 'execute access on any path' for g=cluster-admins", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"testuser","userGroups":["cluster-admins","users"],"accessType":"execute", |
| "result":false |
| } |
| , |
| {"name":"DENY '_admin access on any path' for g=dept1-admins", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"testuser","userGroups":["dept1-admins","users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| {"name":"DENY '_admin access on any path' for u=dept1-webmaster", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"dept1-webmaster","userGroups":["users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| {"name":"DENY '_admin access on any path' for u=dept1-manager", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"dept1-manager","userGroups":["users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| {"name":"DENY '_admin access on any path' for g=dept2-admins", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"testuser","userGroups":["dept2-admins","users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| {"name":"DENY '_admin access on any path' for u=dept2-webmaster", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"dept2-webmaster","userGroups":["users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| {"name":"DENY '_admin access on any path' for u=dept2-manager", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"dept2-manager","userGroups":["users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| {"name":"DENY '_admin access on any path' for g=public", |
| "resources":{"path":{"values":["/dept1/*","/dept2/*","/dept3/*","/dept4/*"]}},"user":"testuser","userGroups":["public","users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| |
| {"name":"ALLOW '_admin access on path under /dept1' for g=dept1-admins", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept1-admins","users"],"accessType":"_admin", |
| "result":true |
| } |
| , |
| {"name":"ALLOW 'read access on path under /dept1' for g=dept1-admins", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept1-admins","users"],"accessType":"read", |
| "result":true |
| } |
| , |
| {"name":"ALLOW 'write access on path under /dept1' for g=dept1-admins", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept1-admins","users"],"accessType":"write", |
| "result":true |
| } |
| , |
| {"name":"ALLOW 'execute access on path under /dept1' for g=dept1-admins", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept1-admins","users"],"accessType":"execute", |
| "result":true |
| } |
| , |
| {"name":"ALLOW 'read access on path under /dept1' for g=dept1-users", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept1-users","users"],"accessType":"read", |
| "result":true |
| } |
| , |
| {"name":"DENY 'write access on path under /dept1' for g=dept1-users", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept1-users","users"],"accessType":"write", |
| "result":false |
| } |
| , |
| {"name":"ALLOW 'execute access on path under /dept1' for g=dept1-users", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept1-users","users"],"accessType":"execute", |
| "result":true |
| } |
| , |
| {"name":"DENY '_admin access on path under /dept1' for g=dept2-admins", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept2-admins","users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| {"name":"DENY '_admin access on path under /dept1' for g=dept2-users", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept2-users","users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| {"name":"DENY 'read access on path under /dept1' for g=dept2-users", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept2-users","users"],"accessType":"read", |
| "result":false |
| } |
| , |
| {"name":"DENY 'write access on path under /dept1' for g=dept2-users", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept2-users","users"],"accessType":"write", |
| "result":false |
| } |
| , |
| {"name":"DENY 'execute access on path under /dept1' for g=dept2-users", |
| "resources":{"path":{"values":["/dept1/wiki/*, /dept1/calender"]}},"user":"testuser","userGroups":["dept2-users","users"],"accessType":"execute", |
| "result":false |
| } |
| |
| , |
| {"name":"ALLOW '_admin access on path under /dept2' for g=dept2-admins", |
| "resources":{"path":{"values":["/dept2/wiki/*, /dept2/calender"]}},"user":"testuser","userGroups":["dept2-admins","users"],"accessType":"_admin", |
| "result":true |
| } |
| , |
| {"name":"DENY '_admin access on path under /dept2' for g=dept1-admins", |
| "resources":{"path":{"values":["/dept2/wiki/*, /dept2/calender"]}},"user":"testuser","userGroups":["dept1-admins","users"],"accessType":"_admin", |
| "result":false |
| } |
| , |
| |
| {"name":"7 '_admin allowed policies' for g=cluster-admins", |
| "user":"testuser","userGroups":["cluster-admins","users"],"accessType":"_admin","allowedPolicies":[1, 11, 12, 13, 21, 22, 23] |
| } |
| , |
| {"name":"3 '_admin allowed policies' for g=dept1-admins", |
| "user":"testuser","userGroups":["dept1-admins","users"],"accessType":"_admin","allowedPolicies":[11, 12, 13] |
| } |
| , |
| {"name":"3 '_admin allowed policies' for g=dept2-admins", |
| "user":"testuser","userGroups":["dept2-admins","users"],"accessType":"_admin","allowedPolicies":[21, 22, 23] |
| } |
| , |
| {"name":"0 '_admin allowed policies' for g=public", |
| "user":"testuser","userGroups":["public","users"],"accessType":"_admin","allowedPolicies":[] |
| } |
| ] |
| } |
| |
