[RANGER-324] Phase-II - REST, Store: validation of policy/service/service-def

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.5.0
• Assignee: Alok Lal
• Reporter: Alok Lal
• Created: 23/Mar/15 04:54
• Updated: 19/May/15 07:32

Description

Policy/Service/ServiceDef validation should be added during create/update/delete operation. Here are some of the validations to add:

• values are provided for all mandatory fields (names, resources, etc)
• values are valid (for example: based on validationRegEx in the resource def, enum values, no duplicate names for service-def/service/policy-within-a-service)
• ensure that user has permissions to create/update/view policy/service/service-def
• check for conflicting/overlapping policies

Issue Links

• is a clone of: RANGER-278 REST, Store: validation of policy/service/service-def

Sub-Tasks

• Policy validation: Prevent creation/update of policies for the same resource: Resolved
• Policy validation: only users with admin role should be able to create excludes policies: Resolved
• Policy validation: Creation of hive UDF policy fails: Resolved
• Policy validation: resource uniqueness: store resource signature of a policy in database for faster check: Resolved
• Policy validation: Assign generated name to a policy if one isn't specified before policy validation logic: Resolved
• Service def: Resource or Config list that is empty or contains duplicates: Resolved
• Service-def validation: Detect and flag illegal resource hierarchies: Resolved
• Policy validation: policy resource conflict signature check should be intra-service: Resolved
• Policy validation: resource hierarchies check does not work with single-node hierarchies as in HDFS: Resolved
• Policy Validation: If resource levels are not valid for any hierarchy then checks about missing mandatory levels should be skipped.: Resolved
• Service validation: validate the data values sent in for parameters.: Open
• Policy validation: validate policy information about conditions against condition definition: Open
• All validations: validate that version of entity matches its current version to avoid loosing changes due to stale update.: Open
• Service def: deletion: deny deletion if def is referenced elsewhere.: Open
• Service: deletion: deny deletion if def is referenced elsewhere.: Open
• Validation: validate context enhancers details in policies and service def: Open
• Turning on new validation rules on an existing system/policies could cause problems. We need a way to mitigate those possible problems.: Open
• Policy validation: resource uniqueness: to guard against someone editing the resource value directly, we should auto-heal the hash signatures of resources that are used for uniqueness check: Open
• REST API should return all of the the failure reasons contained in exception thrown by validation: Open