Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stag] Domain policies in Persona #2559

Merged
merged 19 commits into from
Dec 1, 2023
Merged

[stag] Domain policies in Persona #2559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
e45c184
Merge pull request #2519 from atlanhq/es-field-limit
ektavarma10 Nov 27, 2023
0590a7c
Merge pull request #2505 from atlanhq/fixDuplicateAssignedEntitiesPLT305
checkaayush Nov 27, 2023
7b777e9
Domain policies for Persona
nikhilbonte21 Nov 30, 2023
837f6e7
Add to build image
nikhilbonte21 Nov 30, 2023
04366d0
Revert maven
nikhilbonte21 Nov 30, 2023
a01ab39
Revisit PErsona transformer
nikhilbonte21 Nov 30, 2023
32911a4
Update maven add to build
nikhilbonte21 Nov 30, 2023
fab17a8
Transformer: limit sub domain permissions
nikhilbonte21 Nov 30, 2023
81833a1
Persona alias for product and sub-domain reads
nikhilbonte21 Nov 30, 2023
c5cb4b5
Update policy_cache_transformer_persona.json
mehtaanshul Nov 30, 2023
1f0561e
Update policy_cache_transformer_persona.json
mehtaanshul Nov 30, 2023
0578ffe
Fix alias for Product and Sub-domain read
nikhilbonte21 Nov 30, 2023
551b8fc
Fix alias for Product and Sub-domain read
nikhilbonte21 Nov 30, 2023
aba3796
Update policy_cache_transformer_persona.json
mehtaanshul Dec 1, 2023
f06ef54
Update policy_cache_transformer_persona.json
mehtaanshul Dec 1, 2023
96894ea
Fix Persona alias for Doamin reads
nikhilbonte21 Dec 1, 2023
36e92e2
Fix Asset linking to Product permission
nikhilbonte21 Dec 1, 2023
047a46b
Fix linking asset with Product create permission
nikhilbonte21 Dec 1, 2023
4bf6e5f
Update maven.yml
nikhilbonte21 Dec 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
247 changes: 246 additions & 1 deletion addons/static/templates/policy_cache_transformer_persona.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -372,6 +372,251 @@
]
}
],

"persona-domain-read": [
{
"policyType": "ACCESS",
"policyResourceCategory": "ENTITY",
"resources": [
"entity:{entity}",
"entity:{entity}/*",
"entity-type:DataDomain",
"entity-type:DataProduct",
"entity-classification:*"
],
"actions": ["entity-read"]
}
],
"persona-domain-update": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}",
"entity-type:DataDomain",
"entity-classification:*"
],
"actions": ["entity-update"]
},
{
"policyResourceCategory": "RELATIONSHIP",
"policyType": "ACCESS",
"description": "Link/unlink any DataDomain, DataProduct OR DataContract to this Domain",

"resources": [
"relationship-type:*",

"end-one-entity-type:DataDomain",
"end-two-entity-type:DataProduct",
"end-one-entity-classification:*",
"end-one-entity:{entity}",
"end-one-entity:{entity}/*",

"end-two-entity-type:DataDomain",
"end-two-entity-type:DataProduct",
"end-two-entity-classification:*",
"end-two-entity:*"
],
"actions": ["add-relationship", "update-relationship", "remove-relationship"]
},
{
"policyResourceCategory": "RELATIONSHIP",
"policyType": "ACCESS",
"description": "Link/unlink any DataDomain, DataProduct OR DataContract to this Domain",
"resources": [
"relationship-type:*",

"end-one-entity-type:DataDomain",
"end-one-entity-type:DataProduct",
"end-one-entity-classification:*",
"end-one-entity:*",

"end-two-entity-type:DataDomain",
"end-two-entity-type:DataProduct",
"end-two-entity-classification:*",
"end-two-entity:{entity}",
"end-two-entity:{entity}/*"
],
"actions": ["add-relationship", "update-relationship", "remove-relationship"]
}
],


"persona-domain-sub-domain-read": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}/*domain/*",
"entity-type:DataDomain",
"entity-classification:*"
],
"actions": ["entity-read"]
}
],
"persona-domain-sub-domain-create": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}/*domain/*",
"entity-type:DataDomain",
"entity-classification:*"
],
"actions": ["entity-create"]
},
{
"policyResourceCategory": "RELATIONSHIP",
"policyType": "ACCESS",
"description": "Link/unlink this DataProduct to any parent Domain",
"resources": [
"relationship-type:*",

"end-one-entity:{entity}/*",
"end-one-entity:{entity}",
"end-one-entity-type:DataDomain",
"end-one-entity-classification:*",

"end-two-entity:{entity}/*",
"end-one-entity:{entity}",
"end-two-entity-type:DataDomain",
"end-two-entity-classification:*"
],
"actions": ["add-relationship", "update-relationship", "remove-relationship"]
}
],
"persona-domain-sub-domain-update": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}/*domain/*",
"entity-type:DataDomain",
"entity-classification:*"
],
"actions": ["entity-update"]
}
],
"persona-domain-sub-domain-delete": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}/*domain/*",
"entity-type:DataDomain",
"entity-classification:*"
],
"actions": ["entity-delete"]
}
],

"persona-domain-product-read": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}/*product/*",
"entity-type:DataProduct",
"entity-classification:*"
],
"actions": ["entity-read"]
}
],
"persona-domain-product-create": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}/*product/*",
"entity-type:DataProduct",
"entity-classification:*"
],
"actions": ["entity-create"]
},
{
"policyResourceCategory": "RELATIONSHIP",
"policyType": "ACCESS",
"description": "Link/unlink this DataProduct to any parent Domain",
"resources": [
"relationship-type:*",

"end-one-entity:{entity}/*",
"end-one-entity:{entity}",
"end-one-entity-type:DataDomain",
"end-one-entity-classification:*",

"end-two-entity:{entity}/*",
"end-two-entity-type:DataProduct",
"end-two-entity-classification:*"
],
"actions": ["add-relationship", "update-relationship", "remove-relationship"]
},
{
"policyResourceCategory": "RELATIONSHIP",
"policyType": "ACCESS",
"description": "Link/unlink any Asset to this DataProduct",

"resources": [
"relationship-type:*",

"end-one-entity-type:Asset",
"end-one-entity-classification:*",
"end-one-entity:*",

"end-two-entity-type:DataProduct",
"end-two-entity-classification:*",
"end-two-entity:{entity}/*product/*"
],

"actions": ["add-relationship", "update-relationship", "remove-relationship"]
}
],
"persona-domain-product-update": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}/*product/*",
"entity-type:DataProduct",
"entity-classification:*"
],
"actions": ["entity-update"]
},
{
"policyResourceCategory": "RELATIONSHIP",
"policyType": "ACCESS",
"description": "Link/unlink any Asset to this DataProduct",

"resources": [
"relationship-type:*",

"end-one-entity-type:Asset",
"end-one-entity-classification:*",
"end-one-entity:*",

"end-two-entity-type:DataProduct",
"end-two-entity-classification:*",
"end-two-entity:{entity}/*product/*"
],

"actions": ["add-relationship", "update-relationship", "remove-relationship"]
}
],
"persona-domain-product-delete": [
{
"policyResourceCategory": "ENTITY",
"policyType": "ACCESS",
"resources": [
"entity:{entity}/*product/*",
"entity-type:DataProduct",
"entity-classification:*"
],
"actions": ["entity-delete"]
}
],



"select": [
{
"policyType": "ACCESS",
Expand All @@ -384,4 +629,4 @@
"actions": ["select"]
}
]
}
}
2 changes: 1 addition & 1 deletion repository/src/main/java/org/apache/atlas/glossary/GlossaryTermUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,8 @@ public void processTermAssignments(AtlasGlossaryTerm glossaryTerm, Collection<At
if (CollectionUtils.isNotEmpty(assignedEntities) && assignedEntities.contains(objectId)) {
if (DEBUG_ENABLED) {
LOG.debug("Skipping already assigned entity {}", objectId);
continue;
}
continue;
}

if (DEBUG_ENABLED) {
Expand Down
27 changes: 27 additions & 0 deletions repository/src/main/java/org/apache/atlas/repository/store/aliasstore/ESAliasStore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,11 @@
import static org.apache.atlas.repository.Constants.QUALIFIED_NAME;
import static org.apache.atlas.repository.Constants.TRAIT_NAMES_PROPERTY_KEY;
import static org.apache.atlas.repository.Constants.VERTEX_INDEX_NAME;
import static org.apache.atlas.repository.util.AccessControlUtils.ACCESS_READ_PERSONA_DOMAIN;
import static org.apache.atlas.repository.util.AccessControlUtils.ACCESS_READ_PERSONA_METADATA;
import static org.apache.atlas.repository.util.AccessControlUtils.ACCESS_READ_PERSONA_GLOSSARY;
import static org.apache.atlas.repository.util.AccessControlUtils.ACCESS_READ_PERSONA_PRODUCT;
import static org.apache.atlas.repository.util.AccessControlUtils.ACCESS_READ_PERSONA_SUB_DOMAIN;
import static org.apache.atlas.repository.util.AccessControlUtils.getConnectionQualifiedNameFromPolicyAssets;
import static org.apache.atlas.repository.util.AccessControlUtils.getESAliasName;
import static org.apache.atlas.repository.util.AccessControlUtils.getIsAllowPolicy;
Expand Down Expand Up @@ -201,6 +204,30 @@ private void personaPolicyToESDslClauses(List<AtlasEntity> policies,
terms.add(glossaryQName);
allowClauseList.add(mapOf("wildcard", mapOf(QUALIFIED_NAME, "*@" + glossaryQName)));
}
} else if (getPolicyActions(policy).contains(ACCESS_READ_PERSONA_DOMAIN)) {

for (String asset : assets) {
terms.add(asset);
allowClauseList.add(mapOf("wildcard", mapOf(QUALIFIED_NAME, asset + "/*")));
}

} else if (getPolicyActions(policy).contains(ACCESS_READ_PERSONA_SUB_DOMAIN)) {
for (String asset : assets) {
//terms.add(asset);
List<Map<String, Object>> mustMap = new ArrayList<>();
mustMap.add(mapOf("wildcard", mapOf(QUALIFIED_NAME, asset + "/*domain/*")));
mustMap.add(mapOf("term", mapOf("__typeName.keyword", "DataDomain")));
allowClauseList.add(mapOf("bool", mapOf("must", mustMap)));
}

} else if (getPolicyActions(policy).contains(ACCESS_READ_PERSONA_PRODUCT)) {
for (String asset : assets) {
//terms.add(asset);
List<Map<String, Object>> mustMap = new ArrayList<>();
mustMap.add(mapOf("wildcard", mapOf(QUALIFIED_NAME, asset + "/*product/*")));
mustMap.add(mapOf("term", mapOf("__typeName.keyword", "DataProduct")));
allowClauseList.add(mapOf("bool", mapOf("must", mustMap)));
}
}
}

Expand Down
16 changes: 12 additions & 4 deletions .../java/org/apache/atlas/repository/store/graph/v2/preprocessor/AuthPolicyPreProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,8 +120,12 @@ private void processCreatePolicy(AtlasStruct entity) throws AtlasBaseException {
AtlasEntityWithExtInfo parent = getAccessControlEntity(policy);
AtlasEntity parentEntity = parent.getEntity();

validator.validate(policy, null, parentEntity, CREATE);
validateConnectionAdmin(policy);
String policySubCategory = getPolicySubCategory(policy);

if (!POLICY_SUB_CATEGORY_DOMAIN.equals(policySubCategory)) {
validator.validate(policy, null, parentEntity, CREATE);
validateConnectionAdmin(policy);
}

policy.setAttribute(QUALIFIED_NAME, String.format("%s/%s", getEntityQualifiedName(parentEntity), getUUID()));

Expand Down Expand Up @@ -174,8 +178,12 @@ private void processUpdatePolicy(AtlasStruct entity, AtlasVertex vertex) throws
AtlasEntityWithExtInfo parent = getAccessControlEntity(policy);
AtlasEntity parentEntity = parent.getEntity();

validator.validate(policy, existingPolicy, parentEntity, UPDATE);
validateConnectionAdmin(policy);
String policySubCategory = getPolicySubCategory(policy);

if (!POLICY_SUB_CATEGORY_DOMAIN.equals(policySubCategory)) {
validator.validate(policy, existingPolicy, parentEntity, UPDATE);
validateConnectionAdmin(policy);
}

String qName = getEntityQualifiedName(existingPolicy);
policy.setAttribute(QUALIFIED_NAME, qName);
Expand Down
4 changes: 4 additions & 0 deletions repository/src/main/java/org/apache/atlas/repository/util/AccessControlUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,9 @@ public final class AccessControlUtils {
public static final String ACCESS_READ_PURPOSE_METADATA = "entity-read";
public static final String ACCESS_READ_PERSONA_METADATA = "persona-asset-read";
public static final String ACCESS_READ_PERSONA_GLOSSARY = "persona-glossary-read";
public static final String ACCESS_READ_PERSONA_DOMAIN = "persona-domain-read";
public static final String ACCESS_READ_PERSONA_SUB_DOMAIN = "persona-domain-sub-domain-read";
public static final String ACCESS_READ_PERSONA_PRODUCT = "persona-domain-product-read";

public static final String POLICY_CATEGORY_PERSONA = "persona";
public static final String POLICY_CATEGORY_PURPOSE = "purpose";
Expand All @@ -108,6 +111,7 @@ public final class AccessControlUtils {

public static final String POLICY_SUB_CATEGORY_METADATA = "metadata";
public static final String POLICY_SUB_CATEGORY_GLOSSARY = "glossary";
public static final String POLICY_SUB_CATEGORY_DOMAIN = "domain";
public static final String POLICY_SUB_CATEGORY_DATA = "data";

public static final String RESOURCES_ENTITY = "entity:";
Expand Down
Loading