Skip to content

RANGER-5759: Add Atlas notification-topic and post-notification privi… - #1219

Open
eoinmcdonnell113 wants to merge 1 commit into
apache:masterfrom
eoinmcdonnell113:RANGER-5759
Open

RANGER-5759: Add Atlas notification-topic and post-notification privi…#1219
eoinmcdonnell113 wants to merge 1 commit into
apache:masterfrom
eoinmcdonnell113:RANGER-5759

Conversation

@eoinmcdonnell113

Copy link
Copy Markdown
Contributor

…lege

What changes were proposed in this pull request?

RANGER-5759 adds topic-level authorization for posting Atlas notifications.

This change:

  • Adds the notification-topic resource to the Atlas service definition.
  • Adds the post-notification access type.
  • Authorizes Atlas notification POST requests using the requested topic name.
  • Adds lookup values for the ATLAS_HOOK and ATLAS_ENTITIES topics.
  • Adds the J10067 upgrade patch so existing Atlas service definitions receive the new resource and access type.
  • Adds and updates unit tests for the upgrade patch and Atlas authorization behavior.

Apache JIRA: https://issues.apache.org/jira/browse/RANGER-5759

How was this patch tested?

  • Added unit tests for PatchForAtlasNotificationTopic_J10067.
  • Added Atlas authorizer tests covering:
    • administrator access
    • access to an allowed notification topic
    • denial for an unauthorized notification topic
  • Validated through the Ranger CI build.
  • Validated the change on a canary cluster, including allowed and denied Atlas notification POST requests.

public static final String ACCESS_TYPE_ENTITY_UPDATE = "entity-update";
public static final String ACCESS_TYPE_ENTITY_DELETE = "entity-delete";
public static final String ACCESS_TYPE_POST_NOTIFICATION = "post-notification";
public static final String ACCESS_TYPE_SERVICE_NOTIFICATION_POST = "service-notification-post";

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How is ACCESS_TYPE_SERVICE_NOTIFICATION_POST different from ACCESS_TYPE_POST_NOTIFICATION? If they are not different, I suggest removing ACCESS_TYPE_SERVICE_NOTIFICATION_POST.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants