[RANGER-3502] Make GET zone APIs accessible to authorized users only

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0, 2.3.0
• Component/s: Ranger
• Assignee: Kishor Gollapalliwar
• Reporter: Abhishek
• Created: 29/Oct/21 13:40
• Updated: 21/Aug/23 11:41
• Resolved: 08/Dec/21 00:52

Description

Currently get zones API returns all zones even for users who are not authorized to zone modules. Restrict this API to only users who are authorized to zone module.

Steps to reproduce:

1. Create a internal user name, test_user1
2. Remove the permission on Security Zone module for a user
3. Login as test_user1 user to Ranger Admin, user should not be able to see Security Zone tab
4. Access the API using curl

curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones"

curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/{ID}"

curl -ikv -u test_user1:pass@123 -X GET -H "Accept:application/json" -H "Content-Type:application/json" "https://<RANGER_ADMIN_HOST>:6182/service/zones/zones/name/{ZONE_NAME}"