APACHE RANGER 调研----4 .ranger rest api 分析

1.官方文档

官方针对

Service Definition APIs          Service APIs      Policy APIs  提供专门的api， 对应ranger 源码中的PublicAPIsv2

https://cwiki.apache.org/confluence/display/RANGER/REST+APIs+for+Service+Definition%2C+Service+and+Policy+Management

2.HivePlugin 对应的api 说明：

RangerHiveAuthorizerFactory 对应hive 中的auth2 授权

具体实现RangerHIveAuthorizer --> RangerBasePlugin --> createAdminClient 这个和ranger web 通信，这里会调用ranger 里面的api

主要调用的api 如下：

(1) getServicePoliciesIfUpdated  调用/service/plugins/policies/download 获取hive 对应服务的所有策略， 例如这里用到hivedev 名

 具体调用

(2)grantAccess 和 revokeAccess  具体可以看RangerAdminRESTClient 代码

问题： 在正常安装的时候能够获取getServicePoliciesIfUpdated   结果， 但是授权和回收的时候调用异常，因为api 需要用户名和密码(因为ranger 服务端抽取了session

的用户，判断是否是admin 的用户

3.API 测试

由于public 对应的api 进行了授权的控制， 需要 client.addFilter(new HTTPBasicAuthFilter("admin", "admin"));

在PublicAPIsv2 中 有 @PreAuthorize("hasRole('ROLE_SYS_ADMIN')")

具体代码

 package truck.opensource.HiveApi.src.main.java.com.bfd.hiveapi.test;

import com.google.gson.Gson;
import com.sun.jersey.api.client.Client;
import com.sun.jersey.api.client.ClientResponse;
import com.sun.jersey.api.client.WebResource;
import com.sun.jersey.api.client.filter.HTTPBasicAuthFilter;
import org.apache.commons.httpclient.HttpClient;
import org.apache.commons.httpclient.HttpStatus;
import org.apache.commons.httpclient.UsernamePasswordCredentials;
import org.apache.commons.httpclient.auth.AuthScope;
import org.apache.commons.httpclient.auth.BasicScheme;
import org.apache.commons.httpclient.methods.GetMethod;
import org.apache.commons.net.util.Base64;
import org.apache.ranger.admin.client.RangerAdminRESTClient;
import org.apache.ranger.admin.client.datatype.RESTResponse;
import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.util.RangerRESTUtils;
import org.apache.ranger.plugin.util.ServicePolicies;

import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

/**
 * Created by wenting on 12/2/16.
 */
public class TestRangerAddPolicy {
    private static final String EXPECTED_MIME_TYPE = "application/json";

    public static void testGetPolicy() {
        String url = "http://172.24.5.149:6080/service/public/v2/api/service/hivedev/policy/bfd_hz_for_self";
        Client client = null;
        ClientResponse response = null;
        try {
            client = Client.create();
            client.addFilter(new HTTPBasicAuthFilter("admin", "admin"));
            WebResource webResource = client.resource(url);
            response = webResource.accept(EXPECTED_MIME_TYPE).get(ClientResponse.class);
            if(response.getStatus() == 200) {
                String jsonString = response.getEntity(String.class);
                System.out.println(jsonString);
            }
        } finally {
            if(response != null) {
                response.close();
            }
            if(client != null) {
                client.destroy();
            }
        }
    }

    public static void testDownload() {

        String url = "http://172.24.5.149:6080/service/plugins/policies/download/hivedev";

        ClientResponse response = null;
        Client client = null;
        try {
            client = Client.create();
            WebResource webResource = client.resource(url)
                    .queryParam(RangerRESTUtils.REST_PARAM_LAST_KNOWN_POLICY_VERSION, Long.toString(68))
                    .queryParam(RangerRESTUtils.REST_PARAM_PLUGIN_ID, "aaa");
            response = webResource.accept(RangerRESTUtils.REST_MIME_TYPE_JSON).get(ClientResponse.class);

            if (response != null && response.getStatus() == 200) {
                ServicePolicies ret = response.getEntity(ServicePolicies.class);
                System.out.println(ret);
            } else if (response != null && response.getStatus() == 304) {
                // no change
                System.out.println("aaaaaaaaa");
            } else {
                RESTResponse resp = RESTResponse.fromClientResponse(response);
            }
        } finally {
            if(response != null) {
                response.close();
            }
            if(client != null) {
                client.destroy();
            }
        }
    }

    private static RangerPolicy policy() {
        RangerPolicy rangerPolicy = new RangerPolicy();
        rangerPolicy.setService("hivedev");
        rangerPolicy.setName("restApi");
        rangerPolicy.setIsAuditEnabled(true);

        Map resources = new HashMap<>();

        RangerPolicy.RangerPolicyResource rangerPolicyResource = new RangerPolicy.RangerPolicyResource();
        rangerPolicyResource.setIsExcludes(false);
        rangerPolicyResource.setIsRecursive(false);
        rangerPolicyResource.setValue("*");

        resources.put("database", rangerPolicyResource);
        resources.put("table", rangerPolicyResource);
        resources.put("column", rangerPolicyResource);

        List policyItems = new ArrayList<>();

        RangerPolicy.RangerPolicyItem rangerPolicyItem = new RangerPolicy.RangerPolicyItem();
        List users = new ArrayList<>();
        users.add("dongshen");
        rangerPolicyItem.setUsers(users);

        List rangerPolicyItemAccesses = new ArrayList<>();
        RangerPolicy.RangerPolicyItemAccess rangerPolicyItemAccess = new RangerPolicy.RangerPolicyItemAccess();
        rangerPolicyItemAccess.setType("select");
        rangerPolicyItemAccess.setIsAllowed(Boolean.TRUE);
        rangerPolicyItemAccesses.add(rangerPolicyItemAccess);

        rangerPolicyItem.setAccesses(rangerPolicyItemAccesses);

        policyItems.add(rangerPolicyItem);

        rangerPolicy.setPolicyItems(policyItems);
        rangerPolicy.setResources(resources);
        return rangerPolicy;
    }
    public static void testCreatePolicy() {

        String url = "http://172.24.5.149:6080/service/public/v2/api/policy";

        ClientResponse response = null;
        Client client = null;
        try {
            client = Client.create();
            client.addFilter(new HTTPBasicAuthFilter("admin", "admin"));

            WebResource webResource = client.resource(url);


            Gson gson = new Gson();

            response = webResource.accept(RangerRESTUtils.REST_EXPECTED_MIME_TYPE)
                    .type(RangerRESTUtils.REST_EXPECTED_MIME_TYPE)
                    .post(ClientResponse.class, gson.toJson(policy()));

            if (response != null && response.getStatus() == 200) {
                RangerPolicy ret = response.getEntity(RangerPolicy.class);
                System.out.println(ret);
            } else {
                System.out.println(response.getStatus());
            }
        } finally {
            if(response != null) {
                response.close();
            }
            if(client != null) {
                client.destroy();
            }
        }

    }

    public static void testUpdatePolicy() {

        String url = "http://172.24.5.149:6080/service/public/v2/api/policy/29";

        RangerPolicy rangerPolicy = policy();
        rangerPolicy.getPolicyItems().get(0).getUsers().add("wenting");


        ClientResponse response = null;
        Client client = null;
        try {
            client = Client.create();
            client.addFilter(new HTTPBasicAuthFilter("admin", "admin"));

            WebResource webResource = client.resource(url);


            Gson gson = new Gson();

            response = webResource.accept(RangerRESTUtils.REST_EXPECTED_MIME_TYPE)
                    .type(RangerRESTUtils.REST_EXPECTED_MIME_TYPE)
                    .put(ClientResponse.class, gson.toJson(rangerPolicy));

            if (response != null && response.getStatus() == 200) {
                RangerPolicy ret = response.getEntity(RangerPolicy.class);
                System.out.print(ret.getId());
                System.out.println(ret);
            } else {
                System.out.println(response.getStatus());
            }
        } finally {
            if(response != null) {
                response.close();
            }
            if(client != null) {
                client.destroy();
            }
        }
    }

    public static void testDeletepolicy() {
        String url = "http://172.24.5.149:6080/service/public/v2/api/policy/29";


        ClientResponse response = null;
        Client client = null;
        try {
            client = Client.create();
            client.addFilter(new HTTPBasicAuthFilter("admin", "admin"));

            WebResource webResource = client.resource(url);

            webResource.accept(RangerRESTUtils.REST_EXPECTED_MIME_TYPE).delete();

        } finally {
            if(response != null) {
                response.close();
            }
            if(client != null) {
                client.destroy();
            }
        }
    }

    public static void main(String[] args) throws Throwable {
        //testGetPolicy();
        //testDownload();
        testCreatePolicy();
        //testUpdatePolicy();
        //testDeletepolicy();
    }
}

需要添加的pom 文件依赖

     
            mysql
            mysql-connector-java
            5.1.39
        

        
            com.google.code.gson
            gson
            2.2.4
        

        
            org.apache.ranger
            ranger-hive-plugin-shim
            system
            /home/wenting/truck/opensource/HiveApi/src/main/libs/ranger-hive-plugin-shim-0.5.3.jar
            0.5.3
        

        
            org.apache.ranger
            ranger-plugin-classloader
            system
            /home/wenting/truck/opensource/HiveApi/src/main/libs/ranger-plugin-classloader-0.5.3.jar
            0.5.3
        

        
            org.apache.ranger
            ranger-hive-plugin
            system
            /home/wenting/truck/opensource/HiveApi/src/main/libs/ranger-hive-plugin-0.5.3.jar
            0.5.3
        

        
            org.apache.ranger
            ranger-plugins-common
            system
            /home/wenting/truck/opensource/HiveApi/src/main/libs/ranger-plugins-common-0.5.3.jar
            0.5.3
        

        
            org.apache.ranger
            ranger-plugins-audit
            system
            /home/wenting/truck/opensource/HiveApi/src/main/libs/ranger-plugins-audit-0.5.3.jar
            0.5.3
        

        
            org.apache.ranger
            ranger-plugins-cred
            system
            /home/wenting/truck/opensource/HiveApi/src/main/libs/ranger-plugins-cred-0.5.3.jar
            0.5.3