RANGER-5858: Authz API: return constraints in the authorization result

authz-api/src/main/java/org/apache/ranger/authz/model/RangerAuthzResult.java

@@ -24,6 +24,7 @@
 import com.fasterxml.jackson.annotation.JsonInclude;
 
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 
@@ -121,6 +122,7 @@ public static class PermissionResult {
         private AccessResult            access;
         private DataMaskResult          dataMask;
         private RowFilterResult         rowFilter;
+        private List<ConstraintResult>  constraints;
         private Map<String, Object>     additionalInfo;
         private Map<String, ResultInfo> subResources;
 
@@ -143,6 +145,7 @@ public PermissionResult(String permission, ResultInfo result, Map<String, Result
                 this.access         = result.getAccess();
                 this.dataMask       = result.getDataMask();
                 this.rowFilter      = result.getRowFilter();
+                this.constraints    = result.getConstraints();
                 this.additionalInfo = result.getAdditionalInfo();
             }
         }
@@ -180,6 +183,14 @@ public void setRowFilter(RowFilterResult rowFilter) {
             this.rowFilter = rowFilter;
         }
 
+        public List<ConstraintResult> getConstraints() {
+            return constraints;
+        }
+
+        public void setConstraints(List<ConstraintResult> constraints) {
+            this.constraints = constraints;
+        }
+
         public Map<String, Object> getAdditionalInfo() {
             return additionalInfo;
         }
@@ -212,7 +223,7 @@ public void addSubResourceResult(String resourceName, ResultInfo result) {
 
         @Override
         public int hashCode() {
-            return Objects.hash(permission, access, dataMask, rowFilter, additionalInfo, subResources);
+            return Objects.hash(permission, access, dataMask, rowFilter, constraints, additionalInfo, subResources);
         }
 
         @Override
@@ -229,6 +240,7 @@ public boolean equals(Object o) {
                     Objects.equals(access, that.access) &&
                     Objects.equals(dataMask, that.dataMask) &&
                     Objects.equals(rowFilter, that.rowFilter) &&
+                    Objects.equals(constraints, that.constraints) &&
                     Objects.equals(additionalInfo, that.additionalInfo) &&
                     Objects.equals(subResources, that.subResources);
         }
@@ -240,6 +252,7 @@ public String toString() {
                     ", access=" + access +
                     ", dataMask=" + dataMask +
                     ", rowFilter=" + rowFilter +
+                    ", constraints=" + constraints +
                     ", additionalInfo=" + additionalInfo +
                     ", subResources=" + subResources +
                     '}';
@@ -250,10 +263,11 @@ public String toString() {
     @JsonInclude(JsonInclude.Include.NON_EMPTY)
     @JsonIgnoreProperties(ignoreUnknown = true)
     public static class ResultInfo {
-        private AccessResult        access;
-        private DataMaskResult      dataMask;
-        private RowFilterResult     rowFilter;
-        private Map<String, Object> additionalInfo;
+        private AccessResult           access;
+        private DataMaskResult         dataMask;
+        private RowFilterResult        rowFilter;
+        private List<ConstraintResult> constraints;
+        private Map<String, Object>    additionalInfo;
 
         public ResultInfo() {
         }
@@ -289,6 +303,14 @@ public void setRowFilter(RowFilterResult rowFilter) {
             this.rowFilter = rowFilter;
         }
 
+        public List<ConstraintResult> getConstraints() {
+            return constraints;
+        }
+
+        public void setConstraints(List<ConstraintResult> constraints) {
+            this.constraints = constraints;
+        }
+
         public Map<String, Object> getAdditionalInfo() {
             return additionalInfo;
         }
@@ -299,7 +321,7 @@ public void setAdditionalInfo(Map<String, Object> additionalInfo) {
 
         @Override
         public int hashCode() {
-            return Objects.hash(access, dataMask, rowFilter, additionalInfo);
+            return Objects.hash(access, dataMask, rowFilter, constraints, additionalInfo);
         }
 
         @Override
@@ -315,6 +337,7 @@ public boolean equals(Object o) {
             return Objects.equals(access, that.access) &&
                     Objects.equals(dataMask, that.dataMask) &&
                     Objects.equals(rowFilter, that.rowFilter) &&
+                    Objects.equals(constraints, that.constraints) &&
                     Objects.equals(additionalInfo, that.additionalInfo);
         }
 
@@ -324,6 +347,7 @@ public String toString() {
                     "access=" + access +
                     ", dataMask=" + dataMask +
                     ", rowFilter=" + rowFilter +
+                    ", constraints=" + constraints +
                     ", additionalInfo=" + additionalInfo +
                     '}';
         }
@@ -518,6 +542,89 @@ public String toString() {
         }
     }
 
+    @JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
+    @JsonInclude(JsonInclude.Include.NON_EMPTY)
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public static class ConstraintResult {
+        private String              name;
+        private Map<String, Object> parameters;
+        private PolicyInfo          policy;
+        private Integer             policyPriority;
+
+        public ConstraintResult() {
+        }
+
+        public ConstraintResult(String name, Map<String, Object> parameters, PolicyInfo policy, Integer policyPriority) {
+            this.name           = name;
+            this.parameters     = parameters;
+            this.policy         = policy;
+            this.policyPriority = policyPriority;
+        }
+
+        public String getName() {
+            return name;
+        }
+
+        public void setName(String name) {
+            this.name = name;
+        }
+
+        public Map<String, Object> getParameters() {
+            return parameters;
+        }
+
+        public void setParameters(Map<String, Object> parameters) {
+            this.parameters = parameters;
+        }
+
+        public PolicyInfo getPolicy() {
+            return policy;
+        }
+
+        public void setPolicy(PolicyInfo policy) {
+            this.policy = policy;
+        }
+
+        public Integer getPolicyPriority() {
+            return policyPriority;
+        }
+
+        public void setPolicyPriority(Integer policyPriority) {
+            this.policyPriority = policyPriority;
+        }
+
+        @Override
+        public int hashCode() {
+            return Objects.hash(name, parameters, policy, policyPriority);
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) {
+                return true;
+            } else if (o == null || getClass() != o.getClass()) {
+                return false;
+            }
+
+            ConstraintResult that = (ConstraintResult) o;
+
+            return Objects.equals(name, that.name) &&
+                    Objects.equals(parameters, that.parameters) &&
+                    Objects.equals(policy, that.policy) &&
+                    Objects.equals(policyPriority, that.policyPriority);
+        }
+
+        @Override
+        public String toString() {
+            return "ConstraintResult{" +
+                    "name='" + name + '\'' +
+                    ", parameters=" + parameters +
+                    ", policy=" + policy +
+                    ", policyPriority=" + policyPriority +
+                    '}';
+        }
+    }
+
     @JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY)
     @JsonInclude(JsonInclude.Include.NON_EMPTY)
     @JsonIgnoreProperties(ignoreUnknown = true)

authz-api/src/test/java/org/apache/ranger/authz/model/TestRangerAuthzResult.java

@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.model;
+
+import org.apache.ranger.authz.model.RangerAuthzResult.AccessDecision;
+import org.apache.ranger.authz.model.RangerAuthzResult.AccessResult;
+import org.apache.ranger.authz.model.RangerAuthzResult.ConstraintResult;
+import org.apache.ranger.authz.model.RangerAuthzResult.PermissionResult;
+import org.apache.ranger.authz.model.RangerAuthzResult.PolicyInfo;
+import org.apache.ranger.authz.model.RangerAuthzResult.ResultInfo;
+import org.junit.jupiter.api.Test;
+
+import java.util.Collections;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+public class TestRangerAuthzResult {
+    @Test
+    public void testPermissionResultCopiesConstraintsFromResultInfo() {
+        List<ConstraintResult> constraints = Collections.singletonList(requireApproval(21L));
+        ResultInfo             resultInfo  = new ResultInfo(new AccessResult(AccessDecision.ALLOW, new PolicyInfo(12L, 3L)), null, null, null);
+
+        resultInfo.setConstraints(constraints);
+
+        PermissionResult permResult = new PermissionResult("execute", resultInfo);
+
+        assertEquals(constraints, permResult.getConstraints());
+        assertEquals(AccessDecision.ALLOW, permResult.getAccess().getDecision());
+    }
+
+    @Test
+    public void testConstraintsInEqualsAndHashCode() {
+        ResultInfo withConstraint    = new ResultInfo(new AccessResult(AccessDecision.ALLOW, null), null, null, null);
+        ResultInfo withoutConstraint = new ResultInfo(new AccessResult(AccessDecision.ALLOW, null), null, null, null);
+
+        withConstraint.setConstraints(Collections.singletonList(requireApproval(21L)));
+
+        assertNotEquals(withConstraint, withoutConstraint);
+
+        withoutConstraint.setConstraints(Collections.singletonList(requireApproval(21L)));
+
+        assertEquals(withConstraint, withoutConstraint);
+        assertEquals(withConstraint.hashCode(), withoutConstraint.hashCode());
+
+        PermissionResult perm1 = new PermissionResult("execute", withConstraint);
+        PermissionResult perm2 = new PermissionResult("execute", withoutConstraint);
+
+        assertEquals(perm1, perm2);
+
+        perm2.setConstraints(Collections.singletonList(requireApproval(22L)));
+
+        assertNotEquals(perm1, perm2);
+    }
+
+    @Test
+    public void testConstraintResult() {
+        ConstraintResult constraint = requireApproval(21L);
+
+        assertEquals("requireApproval", constraint.getName());
+        assertEquals("finance-approvers", constraint.getParameters().get("approver"));
+        assertEquals(new PolicyInfo(21L, 1L), constraint.getPolicy());
+        assertEquals(Integer.valueOf(0), constraint.getPolicyPriority());
+        assertEquals(requireApproval(21L), constraint);
+        assertNotEquals(requireApproval(22L), constraint);
+        assertTrue(constraint.toString().contains("requireApproval"));
+    }
+
+    private static ConstraintResult requireApproval(Long policyId) {
+        return new ConstraintResult("requireApproval", Collections.singletonMap("approver", "finance-approvers"), new PolicyInfo(policyId, 1L), 0);
+    }
+}

authz-embedded/src/main/java/org/apache/ranger/authz/embedded/RangerAuthzPlugin.java

@@ -20,6 +20,7 @@
 package org.apache.ranger.authz.embedded;
 
 import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.ranger.authorization.hadoop.config.RangerPluginConfig;
 import org.apache.ranger.authz.api.RangerAuthzApiErrorCode;
@@ -30,6 +31,7 @@
 import org.apache.ranger.authz.model.RangerAuthzResult;
 import org.apache.ranger.authz.model.RangerAuthzResult.AccessDecision;
 import org.apache.ranger.authz.model.RangerAuthzResult.AccessResult;
+import org.apache.ranger.authz.model.RangerAuthzResult.ConstraintResult;
 import org.apache.ranger.authz.model.RangerAuthzResult.DataMaskResult;
 import org.apache.ranger.authz.model.RangerAuthzResult.PermissionResult;
 import org.apache.ranger.authz.model.RangerAuthzResult.PolicyInfo;
@@ -47,15 +49,18 @@
 import org.apache.ranger.plugin.policyengine.RangerAccessResource;
 import org.apache.ranger.plugin.policyengine.RangerAccessResourceImpl;
 import org.apache.ranger.plugin.policyengine.RangerAccessResult;
+import org.apache.ranger.plugin.policyengine.RangerConstraintResult;
 import org.apache.ranger.plugin.policyengine.RangerResourceACLs;
 import org.apache.ranger.plugin.service.RangerBasePlugin;
 import org.apache.ranger.plugin.util.RangerAccessRequestUtil;
 import org.apache.ranger.plugin.util.ServicePolicies;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Properties;
@@ -133,6 +138,7 @@ public RangerAuthzResult authorize(RangerAuthzRequest request, RangerAuthzAuditH
             if (permResult.getAccess().getDecision() == AccessDecision.DENY) {
                 permResult.setDataMask(null);
                 permResult.setRowFilter(null);
+                permResult.setConstraints(null);
             }
 
             ret.getPermissions().put(permission, permResult);
@@ -308,6 +314,30 @@ private ResultInfo toPermissionResult(RangerAccessResult result) {
             ret.setRowFilter(new RowFilterResult(result.getFilterExpr(), ret.getAccess().getPolicy()));
         }
 
+        ret.setConstraints(toConstraintResults(result));
+
+        return ret;
+    }
+
+    // Constraints are returned only for an allowed access, ordered by RangerConstraintResult.CONSTRAINT_RESULT_COMPARATOR
+    static List<ConstraintResult> toConstraintResults(RangerAccessResult result) {
+        List<ConstraintResult> ret = null;
+
+        if (result != null && result.getIsAccessDetermined() && result.getIsAllowed() && CollectionUtils.isNotEmpty(result.getConstraints())) {
+            List<RangerConstraintResult> constraints = new ArrayList<>(result.getConstraints());
+
+            constraints.sort(RangerConstraintResult.CONSTRAINT_RESULT_COMPARATOR);
+
+            ret = new ArrayList<>(constraints.size());
+
+            for (RangerConstraintResult constraint : constraints) {
+                Map<String, Object> parameters = MapUtils.isEmpty(constraint.getParameters()) ? null : new HashMap<>(constraint.getParameters());
+                PolicyInfo          policy     = new PolicyInfo(constraint.getPolicyId(), constraint.getPolicyVersion());
+
+                ret.add(new ConstraintResult(constraint.getConstraintName(), parameters, policy, constraint.getPolicyPriority()));
+            }
+        }
+
         return ret;
     }