Ranger基本使用

Ranger是用来在Hadoop平台上进行监控，启用服务，以及全方位数据安全访问管理的安全框架。

目标

• 允许用户使用UI或者REST API对所有和安全相关的任务进行集中化管理
• 允许用户使用一个管理工具对操作Hadoop体系中的组件和工具的行为进行细粒度的授权
• 支持Hadoop体系中各个组件的授权认证标准
• 增强了对不同业务场景需求的授权方法支持，例如基于角色的授权或者基于属性的授权
• 支持对Hadoop组件所有涉及安全的审计行为的集中化管理

工作原理

Ranger的核心是web应用程序，也成为RangerAdmin模块，此模块由管理策略，审计日志和报告等三部分组成。

Java开发的Ranger工具类

import java.io.IOException;
import java.io.InputStream;
import java.util.Properties;

import com.alibaba.fastjson.JSONArray;
import com.alibaba.fastjson.JSONObject;
import com.fline.aic.db.util.HttpClientUtil;
import org.apache.commons.lang.StringUtils;

public class RangerUtil {
	private static String rangerUrl = "rangeUrl";
	private static String rangerUserName = "rangeUserName";
	private static String rangerPassword = "rangePassword";
	private static String hiveService="active_hive";
	
	
	static {
		Properties p = new Properties();
		InputStream fis = RangerUtil.class.getClassLoader()
				.getResourceAsStream("applicationContext.properties");
		if (fis == null) {
			
		} else {
			try {
				p.load(fis);
				fis.close();
			} catch (IOException e) {
				e.printStackTrace();
			}
		}
		
		rangerUrl=p.getProperty("multi.rangerUrl");
		rangerUserName=p.getProperty("multi.rangerUserName");
		rangerPassword=p.getProperty("multi.rangerPassword");
		hiveService=p.getProperty("multi.rangerHiveService");
		
		
	}

	/**
	 * 根据用户名获取信息
	 * @param userName
	 * @return
	 */
	public static String getUser(String userName) {
		String result = HttpClientUtil.doGet(rangerUrl+"service/xusers/users/userName/"+userName,rangerUserName,rangerPassword);
		return result;
	}

	/**
	 * 创建用户
	 * @param userName
	 * @param password
	 * @return
	 */
	public static String createUser(String userName,String password) {
		StringBuilder sb = new StringBuilder();
		
		sb.append("{");
		sb.append("\"name\":\""+userName+"\",");
		sb.append("\"password\":\""+password+"\",");
		sb.append("\"userRoleList\":[\"ROLE_USER\"]");
		sb.append("}");
		
		String result = HttpClientUtil.doPostJson(rangerUrl+"service/xusers/secure/users", sb.toString(),rangerUserName,rangerPassword);
		return result;
	}

	/**
	 * hive库的所有权授权给用户
	 * @param userName
	 * @param hivedb
	 * @return
	 * @throws IOException
	 */
	public static String createHivePolice(String userName,String hivedb) throws IOException {
		String policeName=hivedb+"_"+userName+"_owner";
		String policeDescription="Policy for "+hivedb+" - database, table, column";
		StringBuilder sb = new StringBuilder();

		sb.append("{");
		sb.append(" \"isEnabled\": true," +
				"    \"version\": 1," +
				"    \"service\": \""+hiveService+"\"," +
				"    \"name\": \""+policeName+"\"," +
				"    \"policyType\": 0," +
				"    \"policyPriority\": 0," +
				"    \"description\": \""+policeDescription+"\"," +
				"    \"isAuditEnabled\": true," +
				"    \"resources\": {" +
				"        \"database\": {" +
				"            \"values\": [" +
				"                \""+hivedb+"\"" +
				"            ]," +
				"            \"isExcludes\": false," +
				"            \"isRecursive\": false" +
				"        }," +
				"        \"column\": {" +
				"            \"values\": [" +
				"                \"*\"" +
				"            ]," +
				"            \"isExcludes\": false," +
				"            \"isRecursive\": false" +
				"        }," +
				"        \"table\": {" +
				"            \"values\": [" +
				"                \"*\"" +
				"            ]," +
				"            \"isExcludes\": false," +
				"            \"isRecursive\": false" +
				"        }" +
				"    }," +
				"    \"policyItems\": [" +
				"        {" +
				"            \"accesses\": [" +
				"                {" +
				"                    \"type\": \"select\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"update\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"create\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"drop\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"alter\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"index\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"lock\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"all\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"read\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"write\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"repladmin\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"serviceadmin\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"tempudfadmin\"," +
				"                    \"isAllowed\": true" +
				"                }" +
				"            ]," +
				"            \"users\": [" +
				"                \""+userName+"\"" +
				"            ]," +
				"            \"groups\": []," +
				"            \"conditions\": []," +
				"            \"delegateAdmin\": true" +
				"        }" +
				"    ]," +
				"    \"denyPolicyItems\": []," +
				"    \"allowExceptions\": []," +
				"    \"denyExceptions\": []," +
				"    \"dataMaskPolicyItems\": []," +
				"    \"rowFilterPolicyItems\": []," +
				"    \"options\": {}," +
				"    \"validitySchedules\": []," +
				"    \"policyLabels\": [" +
				"        \"\"" +
				"    ]");
		sb.append("}");
		String result = HttpClientUtil.doPostJson(rangerUrl+"service/plugins/policies", sb.toString(),rangerUserName,rangerPassword);
		return result;
	}

	/**
	 * 获取serviceName下的全部有效的策略
	 */
	public static String getAllPolicies(){
		String result = HttpClientUtil.doGet(rangerUrl+"service/plugins/policies/download/"+hiveService,rangerUserName,rangerPassword);
		return result;
	}


	/**
	 * 将某库中的某表的只读授权给用户
	 * @param userName
	 * @param hivedb
	 * @param tableName
	 * @return
	 * @throws IOException
	 */
	public static String updateAuthUserTable(String userName,String hivedb,String tableName) throws IOException {
		String policeName =hivedb+"_authorize_"+userName;

		String isExistPolice = getPoliciesByName(policeName);

		String result = "";

		if("Not found".equals(isExistPolice) || StringUtils.isEmpty(isExistPolice)){
			result = createAuthUserTable(userName,hivedb,tableName);
		}else{
			JSONObject obj = JSONObject.parseObject(isExistPolice);
			//Police ID
			long id = obj.getLong("id");

			JSONObject resources = obj.getJSONObject("resources");
			JSONObject table = resources.getJSONObject("table");

			JSONArray values = table.getJSONArray("values");

			//已经存在了该表的授权
			if(values.contains(tableName)){
				return isExistPolice;
			}else{
				values.add(tableName);
				table.put("values",values);

				result = updatePoliciesById(id,obj.toJSONString());
			}
		}
		return result;
	}

	/**
	 * 删除授权
	 * @param userName
	 * @param hivedb
	 * @param tableName
	 * @return
	 * @throws IOException
	 */
	public static String removeAuthUserTable(String userName,String hivedb,String tableName) throws IOException {
		String policeName =hivedb+"_authorize_"+userName;

		String isExistPolice = getPoliciesByName(policeName);

		String result = "";

		if(!"Not found".equals(isExistPolice) && StringUtils.isNotEmpty(isExistPolice)){
			JSONObject obj = JSONObject.parseObject(isExistPolice);
			//Police ID
			long id = obj.getLong("id");

			JSONObject resources = obj.getJSONObject("resources");
			JSONObject table = resources.getJSONObject("table");

			JSONArray values = table.getJSONArray("values");
			System.out.println("授权表==>"+values);
			//已经存在了该表的授权
			if(values.contains(tableName)){
				values.remove(tableName);
				//如果删除没有了其他表的授权则直接删除该规则
				if(values==null ||values.size()==0){
					System.out.println("执行删除操作");
					deletePoliciesById(id);
				}else {
					table.put("values", values);
					System.out.println("执行更新操作");
					result = updatePoliciesById(id, obj.toJSONString());
				}
			}
		}
		return result;
	}

	/**
	 * 将某库中的某表的只读授权给用户
	 * @param userName
	 * @param hivedb
	 * @param tableName
	 * @return
	 * @throws IOException
	 */
	public static String createAuthUserTable(String userName,String hivedb,String tableName) throws IOException {
		String policeName=hivedb+"_authorize_"+userName;
		String policeDescription="Policy for some tables in"+hivedb+" To "+userName;
		StringBuilder sb = new StringBuilder();

		sb.append("{");
		sb.append(" \"isEnabled\": true," +
				"    \"version\": 1," +
				"    \"service\": \""+hiveService+"\"," +
				"    \"name\": \""+policeName+"\"," +
				"    \"policyType\": 0," +
				"    \"policyPriority\": 0," +
				"    \"description\": \""+policeDescription+"\"," +
				"    \"isAuditEnabled\": true," +
				"    \"resources\": {" +
				"        \"database\": {" +
				"            \"values\": [" +
				"                \""+hivedb+"\"" +
				"            ]," +
				"            \"isExcludes\": false," +
				"            \"isRecursive\": false" +
				"        }," +
				"        \"column\": {" +
				"            \"values\": [" +
				"                \"*\"" +
				"            ]," +
				"            \"isExcludes\": false," +
				"            \"isRecursive\": false" +
				"        }," +
				"        \"table\": {" +
				"            \"values\": [" +
				"               \""+tableName+"\"" +
				"            ]," +
				"            \"isExcludes\": false," +
				"            \"isRecursive\": false" +
				"        }" +
				"    }," +
				"    \"policyItems\": [" +
				"        {" +
				"            \"accesses\": [" +
				"                {" +
				"                    \"type\": \"select\"," +
				"                    \"isAllowed\": true" +
				"                }," +
				"                {" +
				"                    \"type\": \"read\"," +
				"                    \"isAllowed\": true" +
				"                }" +
				"            ]," +
				"            \"users\": [" +
				"                \""+userName+"\"" +
				"            ]," +
				"            \"groups\": []," +
				"            \"conditions\": []," +
				"            \"delegateAdmin\": true" +
				"        }" +
				"    ]," +
				"    \"denyPolicyItems\": []," +
				"    \"allowExceptions\": []," +
				"    \"denyExceptions\": []," +
				"    \"dataMaskPolicyItems\": []," +
				"    \"rowFilterPolicyItems\": []," +
				"    \"options\": {}," +
				"    \"validitySchedules\": []," +
				"    \"policyLabels\": [" +
				"        \"\"" +
				"    ]");
		sb.append("}");
		String result = HttpClientUtil.doPostJson(rangerUrl+"service/plugins/policies", sb.toString(),rangerUserName,rangerPassword);
		return result;
	}

	/**
	 * 根据PoliciesName获取策略
	 * @param policeName
	 */
	public static String getPoliciesByName(String policeName){
		String result = HttpClientUtil.doGet(rangerUrl+"service/public/v2/api/service/"+hiveService+"/policy/"+policeName,rangerUserName,rangerPassword);
		return result;
	}


	/**
	 * 根据策略ID删除
	 * @param id
	 */
	public static String deletePoliciesById(long id){
		String result = HttpClientUtil.doDelete(rangerUrl+"service/public/v2/api/policy/"+id,rangerUserName,rangerPassword);
		return result;
	}

	/**
	 * 根据策略ID更新
	 * @param id
	 * @param jsonStr
	 */
	public static String updatePoliciesById(long id,String jsonStr){
		String result = HttpClientUtil.doPut(rangerUrl+"service/public/v2/api/policy/"+id,jsonStr,rangerUserName,rangerPassword);
		return result;
	}

}