Merge pull request #3612 from atlanhq/plt-2622-upgrade-zk

PLT-2622 : Upgrade zookepeer to 3.5.5 from 3.4.6 to fix zookeper-jute unavailable during build

auth-agents-common/src/main/java/org/apache/atlas/plugin/conditionevaluator/AtlanHasAnyRole.java

@@ -0,0 +1,76 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.atlas.plugin.conditionevaluator;
+
+import org.apache.atlas.plugin.policyengine.RangerAccessRequest;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import java.util.HashSet;
+import java.util.Objects;
+import java.util.Set;
+
+public class AtlanHasAnyRole extends RangerAbstractConditionEvaluator {
+    private static final Log LOG = LogFactory.getLog(AtlanHasAnyRole.class);
+
+    protected Set<String> excludedRoles = new HashSet<>();
+
+    @Override
+    public void init() {
+        if (LOG.isDebugEnabled()) {
+            LOG.debug("==> AtlanHasAnyRole.init(" + condition + ")");
+        }
+
+        super.init();
+
+        if (condition != null ) {
+            for (String value : condition.getValues()) {
+                excludedRoles.add(value.trim());
+            }
+        }
+
+        if (LOG.isDebugEnabled()) {
+            LOG.debug("<== AtlanHasAnyRole.init(" + condition + ")");
+        }
+    }
+
+    @Override
+    public boolean isMatched(RangerAccessRequest request) {
+        if (LOG.isDebugEnabled()) {
+            LOG.debug("==> AtlanHasAnyRole.isMatched(" + condition + ")");
+        }
+
+        boolean ret = false;
+
+        RangerAccessRequest	readOnlyRequest = request.getReadOnlyCopy();
+        Set<String> currentRoles = ((Set<String>) readOnlyRequest.getContext().get("token:ROLES"));
+
+        if (CollectionUtils.isNotEmpty(currentRoles)) {
+            ret = !excludedRoles.stream().anyMatch(excludedRole -> currentRoles.stream().anyMatch(x -> Objects.equals(x, excludedRole)));
+        }
+
+        if (LOG.isDebugEnabled()) {
+            LOG.debug("<== AtlanHasAnyRole.isMatched(" + condition + "): " + ret);
+        }
+
+        return ret;
+    }
+}

auth-agents-common/src/main/java/org/apache/atlas/plugin/policyevaluator/RangerCustomConditionEvaluator.java

@@ -51,7 +51,7 @@ public List<RangerConditionEvaluator> getRangerPolicyConditionEvaluator(RangerPo
 
             RangerPerfTracer perf = null;
 
-            long policyId = policy.getId();
+            String policyId = policy.getGuid();
 
             if(RangerPerfTracer.isPerfTraceEnabled(PERF_POLICY_INIT_LOG)) {
                 perf = RangerPerfTracer.getPerfTracer(PERF_POLICY_INIT_LOG, "RangerCustomConditionEvaluator.init(policyId=" + policyId + ")");

auth-agents-common/src/main/java/org/apache/atlas/plugin/policyevaluator/RangerDefaultPolicyEvaluator.java

@@ -1389,7 +1389,7 @@ private boolean matchPolicyCustomConditions(RangerAccessRequest request) {
 						conditionType = ((RangerAbstractConditionEvaluator)conditionEvaluator).getPolicyItemCondition().getType();
 					}
 
-					perf = RangerPerfTracer.getPerfTracer(PERF_POLICYCONDITION_REQUEST_LOG, "RangerConditionEvaluator.matchPolicyCustomConditions(policyId=" + getId() +  ",policyConditionType=" + conditionType + ")");
+					perf = RangerPerfTracer.getPerfTracer(PERF_POLICYCONDITION_REQUEST_LOG, "RangerConditionEvaluator.matchPolicyCustomConditions(policyId=" + getGuid() +  ",policyConditionType=" + conditionType + ")");
 				}
 
 				boolean conditionEvalResult = conditionEvaluator.isMatched(request);

auth-agents-common/src/main/java/org/apache/atlas/policytransformer/CachePolicyTransformerImpl.java

@@ -26,6 +26,7 @@
 import org.apache.atlas.model.discovery.AtlasSearchResult;
 import org.apache.atlas.model.discovery.IndexSearchParams;
 import org.apache.atlas.model.instance.AtlasEntityHeader;
+import org.apache.atlas.model.instance.AtlasStruct;
 import org.apache.atlas.plugin.util.ServicePolicies;
 import org.apache.atlas.plugin.model.RangerPolicy;
 import org.apache.atlas.plugin.model.RangerPolicy.RangerDataMaskPolicyItem;
@@ -426,13 +427,13 @@ private List<RangerPolicyItemCondition> getPolicyConditions(AtlasEntityHeader at
             return null;
         }
 
-        List<HashMap<String, Object>> conditions = (List<HashMap<String, Object>>) atlasPolicy.getAttribute("policyConditions");
+        List<AtlasStruct> conditions = (List<AtlasStruct>) atlasPolicy.getAttribute("policyConditions");
 
-        for (HashMap<String, Object> condition : conditions) {
+        for (AtlasStruct condition : conditions) {
             RangerPolicyItemCondition rangerCondition = new RangerPolicyItemCondition();
 
-            rangerCondition.setType((String) condition.get("policyConditionType"));
-            rangerCondition.setValues((List<String>) condition.get("policyConditionValues"));
+            rangerCondition.setType((String) condition.getAttribute("policyConditionType"));
+            rangerCondition.setValues((List<String>) condition.getAttribute("policyConditionValues"));
 
             ret.add(rangerCondition);
         }

auth-agents-common/src/main/resources/service-defs/atlas-servicedef-atlas.json

@@ -503,5 +503,13 @@
 	],
 	"options": {
 		"enableDenyAndExceptionsInPolicies": "true"
-	}
+	},
+	"policyConditions": [
+		{
+			"itemId": 1,
+			"name": "excludeRoles",
+			"evaluator": "org.apache.atlas.plugin.conditionevaluator.AtlanHasAnyRole",
+			"description": "Roles to exclude for given policy"
+		}
+	]
 }

pom.xml

@@ -775,7 +775,7 @@
         <testng.version>6.9.4</testng.version>
         <tinkerpop.version>3.5.1</tinkerpop.version>
         <woodstox-core.version>5.0.3</woodstox-core.version>
-        <zookeeper.version>3.4.6</zookeeper.version>
+        <zookeeper.version>3.5.5</zookeeper.version>
         <redis.client.version>3.20.1</redis.client.version>
         <micrometer.version>1.11.1</micrometer.version>
         <netty4.version>4.1.61.Final</netty4.version>

repository/src/main/java/org/apache/atlas/repository/graph/GraphHelper.java

@@ -1967,6 +1967,31 @@ public static Iterator<AtlasVertex> getActiveChildrenVertices(AtlasVertex vertex
         return getActiveVertices(vertex, childrenEdgeLabel, AtlasEdgeDirection.OUT);
     }
 
+    /**
+     * Get all the active edges
+     * @param vertex entity vertex
+     * @param childrenEdgeLabel Edge label of children
+     * @return Iterator of children edges
+     */
+    public static Iterator<AtlasEdge> getActiveEdges(AtlasVertex vertex, String childrenEdgeLabel, AtlasEdgeDirection direction) throws AtlasBaseException {
+        AtlasPerfMetrics.MetricRecorder metricRecorder = RequestContext.get().startMetricRecord("GraphHelper.getActiveEdges");
+
+        try {
+            return vertex.query()
+                    .direction(direction)
+                    .label(childrenEdgeLabel)
+                    .has(STATE_PROPERTY_KEY, ACTIVE_STATE_VALUE)
+                    .edges()
+                    .iterator();
+        } catch (Exception e) {
+            LOG.error("Error while getting active edges of vertex for edge label " + childrenEdgeLabel, e);
+            throw new AtlasBaseException(AtlasErrorCode.INTERNAL_ERROR, e);
+        }
+        finally {
+            RequestContext.get().endMetricRecord(metricRecorder);
+        }
+    }
+
     public static Iterator<AtlasVertex> getActiveVertices(AtlasVertex vertex, String childrenEdgeLabel, AtlasEdgeDirection direction) throws AtlasBaseException {
         AtlasPerfMetrics.MetricRecorder metricRecorder = RequestContext.get().startMetricRecord("CategoryPreProcessor.getEdges");
 
@@ -1985,7 +2010,6 @@ public static Iterator<AtlasVertex> getActiveVertices(AtlasVertex vertex, String
             RequestContext.get().endMetricRecord(metricRecorder);
         }
     }
-
     public static Iterator<AtlasVertex> getAllChildrenVertices(AtlasVertex vertex, String childrenEdgeLabel) throws AtlasBaseException {
         return getAllVertices(vertex, childrenEdgeLabel, AtlasEdgeDirection.OUT);
     }

repository/src/main/java/org/apache/atlas/repository/store/graph/v1/DeleteHandlerV1.java

@@ -1452,7 +1452,7 @@ private boolean skipClassificationTaskCreation(String classificationId) throws A
     }
 
 
-    public void removeHasLineageOnDelete(Collection<AtlasVertex> vertices) {
+    public void removeHasLineageOnDelete(Collection<AtlasVertex> vertices) throws AtlasBaseException {
         AtlasPerfMetrics.MetricRecorder metricRecorder = RequestContext.get().startMetricRecord("removeHasLineageOnDelete");
 
         for (AtlasVertex vertexToBeDeleted : vertices) {
@@ -1482,7 +1482,7 @@ public void removeHasLineageOnDelete(Collection<AtlasVertex> vertices) {
     }
 
 
-    public void resetHasLineageOnInputOutputDelete(Collection<AtlasEdge> removedEdges, AtlasVertex deletedVertex) {
+    public void resetHasLineageOnInputOutputDelete(Collection<AtlasEdge> removedEdges, AtlasVertex deletedVertex) throws AtlasBaseException {
         AtlasPerfMetrics.MetricRecorder metricRecorder = RequestContext.get().startMetricRecord("resetHasLineageOnInputOutputDelete");
 
         for (AtlasEdge atlasEdge : removedEdges) {
@@ -1499,12 +1499,13 @@ public void resetHasLineageOnInputOutputDelete(Collection<AtlasEdge> removedEdge
             if (getStatus(processVertex) == ACTIVE && !processVertex.equals(deletedVertex)) {
                 String edgeLabel = isOutputEdge ? PROCESS_OUTPUTS : PROCESS_INPUTS;
 
-                Iterator<AtlasEdge> edgeIterator = processVertex.getEdges(AtlasEdgeDirection.BOTH, edgeLabel).iterator();
+                Iterator<AtlasEdge> edgeIterator = GraphHelper.getActiveEdges(processVertex, edgeLabel, AtlasEdgeDirection.BOTH);
+
                 boolean activeEdgeFound = false;
 
                 while (edgeIterator.hasNext()) {
                     AtlasEdge edge = edgeIterator.next();
-                    if (getStatus(edge) == ACTIVE && !removedEdges.contains(edge)) {
+                    if (!removedEdges.contains(edge)) {
                         AtlasVertex relatedAssetVertex = edge.getInVertex();
 
                         if (getStatus(relatedAssetVertex) == ACTIVE) {
@@ -1519,7 +1520,7 @@ public void resetHasLineageOnInputOutputDelete(Collection<AtlasEdge> removedEdge
 
                     String oppositeEdgeLabel = isOutputEdge ? PROCESS_INPUTS : PROCESS_OUTPUTS;
 
-                    Iterator<AtlasEdge> processEdgeIterator = processVertex.getEdges(AtlasEdgeDirection.BOTH, oppositeEdgeLabel).iterator();
+                    Iterator<AtlasEdge> processEdgeIterator = GraphHelper.getActiveEdges(processVertex, oppositeEdgeLabel, AtlasEdgeDirection.BOTH);
 
                     while (processEdgeIterator.hasNext()) {
                         AtlasEdge edge = processEdgeIterator.next();