Fix access logs issue with Evaluator API

atlanhq · Jan 19, 2024 · 410d384 · 410d384
1 parent d6239fb
commit 410d384
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 30 deletions.
diff --git a/repository/src/main/java/org/apache/atlas/authorizer/AccessResult.java b/repository/src/main/java/org/apache/atlas/authorizer/AccessResult.java
@@ -1,11 +1,8 @@
 package org.apache.atlas.authorizer;
 
-import org.apache.atlas.authorize.AtlasAccessRequest;
-
 public class AccessResult {
     private boolean isAllowed = false;
     private String policyId = "-1";
-    protected AtlasAccessRequest atlasAccessRequest;
 
     public boolean isAllowed() {
         return isAllowed;
@@ -22,12 +19,4 @@ public String getPolicyId() {
     public void setPolicyId(String policyId) {
         this.policyId = policyId;
     }
-
-    public AtlasAccessRequest getAtlasAccessRequest() {
-        return atlasAccessRequest;
-    }
-
-    public void setAtlasAccessRequest(AtlasAccessRequest atlasAccessRequest) {
-        this.atlasAccessRequest = atlasAccessRequest;
-    }
 }
diff --git a/repository/src/main/java/org/apache/atlas/authorizer/AuthorizerUtils.java b/repository/src/main/java/org/apache/atlas/authorizer/AuthorizerUtils.java
@@ -90,8 +90,7 @@ public static void verifyEntityCreateAccess(AtlasEntity entity, AtlasPrivilege a
         try {
             if (AtlasPrivilege.ENTITY_CREATE == action) {
                 AccessResult result = EntityAuthorizer.isAccessAllowedInMemory(entity, action.getType());
-                result.setAtlasAccessRequest(request);
-                auditHandler.processResult(result);
+                auditHandler.processResult(result, request);
 
                 if (!result.isAllowed()){
                     String message = action.getType() + ":" + entity.getTypeName() + ":" + entity.getAttributes().get(QUALIFIED_NAME);
@@ -119,8 +118,7 @@ public static void verifyAccess(AtlasEntityHeader entityHeader, AtlasPrivilege a
 
         try {
             AccessResult result = EntityAuthorizer.isAccessAllowed(entityHeader.getGuid(), action.getType());
-            result.setAtlasAccessRequest(request);
-            auditHandler.processResult(result);
+            auditHandler.processResult(result, request);
 
             if (!result.isAllowed()) {
                 throw new AtlasBaseException(AtlasErrorCode.UNAUTHORIZED_ACCESS, userName, action + ":" + entityHeader.getGuid());
@@ -148,8 +146,7 @@ public static void verifyAccessForEvaluator(AtlasEntityHeader entityHeader, Atla
             String entityQNAme = (String) entityHeader.getAttribute(QUALIFIED_NAME);
 
             AccessResult result = EntityAuthorizer.isAccessAllowedEvaluator(entityHeader.getTypeName(), entityQNAme, action.getType());
-            result.setAtlasAccessRequest(request);
-            auditHandler.processResult(result);
+            auditHandler.processResult(result, request);
 
             if (!result.isAllowed()) {
                 throw new AtlasBaseException(AtlasErrorCode.UNAUTHORIZED_ACCESS, userName, action + ":" + entityHeader.getTypeName() + ":" + entityQNAme);
@@ -180,8 +177,7 @@ public static void verifyRelationshipAccess(AtlasPrivilege action, String relati
 
         try {
             AccessResult result = RelationshipAuthorizer.isRelationshipAccessAllowed(action.getType(), endOneEntity, endTwoEntity);
-            result.setAtlasAccessRequest(request);
-            auditHandler.processResult(result);
+            auditHandler.processResult(result, request);
 
             if (!result.isAllowed()) {
                 throw new AtlasBaseException(AtlasErrorCode.UNAUTHORIZED_ACCESS, RequestContext.getCurrentUser(), action + "|" + endOneEntity.getGuid() + "|" + endTwoEntity.getGuid());
@@ -211,8 +207,7 @@ public static void verifyRelationshipCreateAccess(AtlasPrivilege action, String
 
         try {
             AccessResult result = RelationshipAuthorizer.isAccessAllowedInMemory(action.getType(), relationshipType, endOneEntity, endTwoEntity);
-            result.setAtlasAccessRequest(request);
-            auditHandler.processResult(result);
+            auditHandler.processResult(result, request);
 
             if (!result.isAllowed()) {
                 throw new AtlasBaseException(AtlasErrorCode.UNAUTHORIZED_ACCESS, RequestContext.getCurrentUser(),

diff --git a/repository/src/main/java/org/apache/atlas/authorizer/NewAtlasAuditHandler.java b/repository/src/main/java/org/apache/atlas/authorizer/NewAtlasAuditHandler.java
@@ -84,7 +84,6 @@ class NewAtlasAuditHandler {
     private final String                       resourcePath;
     private final String                       resourceType;
     private         long                       sequenceNumber = 0;
-    private         AtomicInteger              counter =  new AtomicInteger(0);
 
     public NewAtlasAuditHandler(AtlasEntityAccessRequest request, RangerServiceDef serviceDef) {
         Collection<AtlasClassification> classifications    = request.getEntityClassifications();
@@ -152,9 +151,9 @@ public NewAtlasAuditHandler(AtlasRelationshipAccessRequest request, RangerServic
         resourcePath = rangerResource.getAsString();
     }
 
-    public void processResult(AccessResult result) {
+    public void processResult(AccessResult result, AtlasAccessRequest request) {
 
-        AuthzAuditEvent auditEvent = getAuthzEvents(result);
+        AuthzAuditEvent auditEvent = getAuthzEvents(result, request);
 
         if (auditEvent != null) {
             // audit event might have list of entity-types and classification-types; overwrite with the values in original request
@@ -218,19 +217,15 @@ private void populateDefaults(AuthzAuditEvent auditEvent) {
     private String generateNextAuditEventId() {
         final String ret;
 
-        int nextId = counter.getAndIncrement();
-
-        ret = RequestContext.get().getTraceId() + "-" + nextId;
+        ret = RequestContext.get().getTraceId() + "-" + System.currentTimeMillis();
 
 
         return ret;
     }
 
-    public AuthzAuditEvent getAuthzEvents(AccessResult result) {
+    public AuthzAuditEvent getAuthzEvents(AccessResult result, AtlasAccessRequest request) {
         AuthzAuditEvent ret = null;
 
-        AtlasAccessRequest request = result != null ? result.getAtlasAccessRequest() : null;
-
         if(request != null) {
             ret = new AuthzAuditEvent();