Skip to content

RANGER-5742: Inconsistent handling of service config fields by name v… #1152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vyommani wants to merge 1 commit into
base: master
Choose a base branch
from
+509 −25
Open

RANGER-5742: Inconsistent handling of service config fields by name v… #1152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 32 additions & 5 deletions security-admin/src/main/java/org/apache/ranger/biz/ServiceDBStore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,6 +233,7 @@ public class ServiceDBStore extends AbstractServiceStore {
public static final String RANGER_PLUGINS_CONFIG_CONF_PREFIX = "ranger.plugins.conf.";
public static final String HIDDEN_PASSWORD_STR = "*****";
public static final String CONFIG_KEY_PASSWORD = "password";
public static final String CONFIG_TYPE_PASSWORD = "password";
public static final String ACCESS_TYPE_DECRYPT_EEK = "decrypteek";
public static final String ACCESS_TYPE_GENERATE_EEK = "generateeek";
public static final String ACCESS_TYPE_GET_METADATA = "getmetadata";
Expand Down Expand Up @@ -983,6 +984,7 @@ public RangerService createService(RangerService service) throws Exception {

XXService xCreatedService = daoMgr.getXXService().getById(service.getId());
XXServiceConfigMapDao xConfMapDao = daoMgr.getXXServiceConfigMap();
Set<String> passwordConfigKeys = getPasswordConfigKeys(service.getType());

for (Entry<String, String> configMap : validConfigs.entrySet()) {
String configKey = configMap.getKey();
Expand All @@ -1005,7 +1007,7 @@ public RangerService createService(RangerService service) throws Exception {
}
}

if (StringUtils.equalsIgnoreCase(configKey, CONFIG_KEY_PASSWORD)) {
if (isPasswordConfigKey(passwordConfigKeys, configKey)) {
Joiner joiner = Joiner.on(",").skipNulls();
String iv = PasswordUtils.generateIvIfNeeded(CRYPT_ALGO);
String cryptConfigString = joiner.join(CRYPT_ALGO, ENCRYPT_KEY, SALT, ITERATION_COUNT, iv, configValue);
Expand Down Expand Up @@ -1160,11 +1162,12 @@ public RangerService updateService(RangerService service, Map<String, Object> op
}

XXService xUpdService = daoMgr.getXXService().getById(service.getId());
String oldPassword = null;
Set<String> passwordConfigKeys = getPasswordConfigKeys(service.getType());
Map<String, String> oldPasswordsByKey = new HashMap<>();

for (XXServiceConfigMap dbConfigMap : dbConfigMaps) {
if (StringUtils.equalsIgnoreCase(dbConfigMap.getConfigkey(), CONFIG_KEY_PASSWORD)) {
oldPassword = dbConfigMap.getConfigvalue();
if (isPasswordConfigKey(passwordConfigKeys, dbConfigMap.getConfigkey())) {
oldPasswordsByKey.put(StringUtils.lowerCase(dbConfigMap.getConfigkey()), dbConfigMap.getConfigvalue());
}

daoMgr.getXXServiceConfigMap().remove(dbConfigMap);
Expand Down Expand Up @@ -1193,7 +1196,9 @@ public RangerService updateService(RangerService service, Map<String, Object> op
}
}

if (StringUtils.equalsIgnoreCase(configKey, CONFIG_KEY_PASSWORD)) {
if (isPasswordConfigKey(passwordConfigKeys, configKey)) {
String oldPassword = oldPasswordsByKey.get(StringUtils.lowerCase(configKey));

if (StringUtils.equalsIgnoreCase(configValue, HIDDEN_PASSWORD_STR)) {
if (oldPassword != null && oldPassword.contains(",")) {
PasswordUtils util = PasswordUtils.build(oldPassword);
Expand Down Expand Up @@ -4245,6 +4250,28 @@ private static List<RangerPolicyDelta> compressDeltas(List<RangerPolicyDelta> de
return ret;
}

private Set<String> getPasswordConfigKeys(String serviceType) {
List<XXServiceConfigDef> svcConfDefList = serviceType != null ? daoMgr.getXXServiceConfigDef().findByServiceDefName(serviceType) : null;
return getPasswordConfigKeys(svcConfDefList);
}

public static Set<String> getPasswordConfigKeys(List<XXServiceConfigDef> svcConfDefList) {
Set<String> passwordConfigKeys = new HashSet<>();
passwordConfigKeys.add(StringUtils.lowerCase(CONFIG_KEY_PASSWORD));
if (svcConfDefList != null) {
for (XXServiceConfigDef svcConfDef : svcConfDefList) {
if (StringUtils.equalsIgnoreCase(svcConfDef.getType(), CONFIG_TYPE_PASSWORD) && svcConfDef.getName() != null) {
passwordConfigKeys.add(StringUtils.lowerCase(svcConfDef.getName()));
}
}
}
return passwordConfigKeys;
}

public static boolean isPasswordConfigKey(Set<String> passwordConfigKeys, String configKey) {
return configKey != null && passwordConfigKeys.contains(StringUtils.lowerCase(configKey));
}

private Map<String, String> validateRequiredConfigParams(RangerService service, Map<String, String> configs) {
LOG.debug("==> ServiceDBStore.validateRequiredConfigParams()");

Expand Down
61 changes: 41 additions & 20 deletions security-admin/src/main/java/org/apache/ranger/service/RangerServiceService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;

@Service
@Scope("singleton")
Expand Down Expand Up @@ -77,32 +78,51 @@ public List<RangerService> getAllServices() {
public Map<String, String> getConfigsWithDecryptedPassword(RangerService service) throws Exception {
Map<String, String> configs = service.getConfigs();

String pwd = configs.get(ServiceDBStore.CONFIG_KEY_PASSWORD);
if (!stringUtil.isEmpty(pwd) && ServiceDBStore.HIDDEN_PASSWORD_STR.equalsIgnoreCase(pwd)) {
XXServiceConfigMap pwdConfig = daoMgr.getXXServiceConfigMap().findByServiceAndConfigKey(service.getId(), ServiceDBStore.CONFIG_KEY_PASSWORD);

if (pwdConfig != null) {
String encryptedPwd = pwdConfig.getConfigvalue();
if (encryptedPwd.contains(",")) {
PasswordUtils util = PasswordUtils.build(encryptedPwd);
String freeTextPasswordMetaData = Joiner.on(",").skipNulls().join(util.getCryptAlgo(), new String(util.getEncryptKey()), new String(util.getSalt()), util.getIterationCount(), PasswordUtils.needsIv(util.getCryptAlgo()) ? util.getIvAsString() : null);
String decryptedPwd = PasswordUtils.decryptPassword(encryptedPwd);
if (StringUtils.equalsIgnoreCase(freeTextPasswordMetaData + "," + PasswordUtils.encryptPassword(freeTextPasswordMetaData + "," + decryptedPwd), encryptedPwd)) {
configs.put(ServiceDBStore.CONFIG_KEY_PASSWORD, encryptedPwd);
// XXX: method name is getConfigsWithDecryptedPassword, then why do we store the encryptedPwd?
}
} else {
String decryptedPwd = PasswordUtils.decryptPassword(encryptedPwd);
if (StringUtils.equalsIgnoreCase(PasswordUtils.encryptPassword(decryptedPwd), encryptedPwd)) {
configs.put(ServiceDBStore.CONFIG_KEY_PASSWORD, encryptedPwd);
// XXX: method name is getConfigsWithDecryptedPassword, then why do we store the encryptedPwd?
if (configs == null) {
return configs;
}

Set<String> passwordConfigKeys = getPasswordConfigKeysByServiceDefName(service.getType());
for (String configKey : new ArrayList<>(configs.keySet())) {
if (!ServiceDBStore.isPasswordConfigKey(passwordConfigKeys, configKey)) {
continue;
}

String pwd = configs.get(configKey);
if (!stringUtil.isEmpty(pwd) && ServiceDBStore.HIDDEN_PASSWORD_STR.equalsIgnoreCase(pwd)) {
XXServiceConfigMap pwdConfig = daoMgr.getXXServiceConfigMap().findByServiceAndConfigKey(service.getId(), configKey);

if (pwdConfig != null) {
String encryptedPwd = pwdConfig.getConfigvalue();
if (encryptedPwd.contains(",")) {
PasswordUtils util = PasswordUtils.build(encryptedPwd);
String freeTextPasswordMetaData = Joiner.on(",").skipNulls().join(util.getCryptAlgo(), new String(util.getEncryptKey()), new String(util.getSalt()), util.getIterationCount(), PasswordUtils.needsIv(util.getCryptAlgo()) ? util.getIvAsString() : null);
String decryptedPwd = PasswordUtils.decryptPassword(encryptedPwd);
if (StringUtils.equalsIgnoreCase(freeTextPasswordMetaData + "," + PasswordUtils.encryptPassword(freeTextPasswordMetaData + "," + decryptedPwd), encryptedPwd)) {
configs.put(configKey, encryptedPwd);
// XXX: method name is getConfigsWithDecryptedPassword, then why do we store the encryptedPwd?
}
} else {
String decryptedPwd = PasswordUtils.decryptPassword(encryptedPwd);
if (StringUtils.equalsIgnoreCase(PasswordUtils.encryptPassword(decryptedPwd), encryptedPwd)) {
configs.put(configKey, encryptedPwd);
// XXX: method name is getConfigsWithDecryptedPassword, then why do we store the encryptedPwd?
}
}
}
}
}
return configs;
}

private Set<String> getPasswordConfigKeysByServiceDefId(Long serviceDefId) {
return ServiceDBStore.getPasswordConfigKeys(serviceDefId != null ? daoMgr.getXXServiceConfigDef().findByServiceDefId(serviceDefId) : null);
}

private Set<String> getPasswordConfigKeysByServiceDefName(String serviceDefName) {
return ServiceDBStore.getPasswordConfigKeys(serviceDefName != null ? daoMgr.getXXServiceConfigDef().findByServiceDefName(serviceDefName) : null);
}

@Override
public RangerService postCreate(XXService xObj) {
XXServiceVersionInfo serviceVersionInfo = new XXServiceVersionInfo();
Expand Down Expand Up @@ -131,11 +151,12 @@ protected RangerService populateViewBean(XXService xService) {
RangerService vService = super.populateViewBean(xService);
HashMap<String, String> configs = new HashMap<>();
List<XXServiceConfigMap> svcConfigMapList = daoMgr.getXXServiceConfigMap().findByServiceId(xService.getId());
Set<String> passwordConfigKeys = getPasswordConfigKeysByServiceDefId(xService.getType());

for (XXServiceConfigMap svcConfMap : svcConfigMapList) {
String configValue = svcConfMap.getConfigvalue();

if (StringUtils.equalsIgnoreCase(svcConfMap.getConfigkey(), ServiceDBStore.CONFIG_KEY_PASSWORD)) {
if (ServiceDBStore.isPasswordConfigKey(passwordConfigKeys, svcConfMap.getConfigkey())) {
configValue = ServiceDBStore.HIDDEN_PASSWORD_STR;
}

Expand Down
Loading
Loading