RANGER-5627: Support configuration-based super users and super groups in Ranger Admin

distro/src/main/assembly/admin-web.xml

@@ -633,4 +633,14 @@
       <directoryMode>0755</directoryMode>
     </fileSet>
   </fileSets>
+
+  <!-- Backward-compatible alias: Swagger UI historically loaded swagger.json -->
+  <files>
+    <file>
+      <source>${ranger.root}/docs/target/apidocs/ui/openapi.json</source>
+      <outputDirectory>ews/webapp/apidocs</outputDirectory>
+      <destName>swagger.json</destName>
+      <fileMode>544</fileMode>
+    </file>
+  </files>
 </assembly>

security-admin/scripts/ranger-admin-site-template.xml

@@ -248,4 +248,14 @@
 		<name>ranger.ldap.ad.url</name>
 		<value></value>
 	</property>
+	<property>
+		<name>ranger.admin.super.users</name>
+		<value></value>
+		<description>Comma-separated list of externally authenticated users granted full Ranger administrative privileges at login (system admin and key admin capabilities), independent of database roles. Empty or absent disables config-based super users.</description>
+	</property>
+	<property>
+		<name>ranger.admin.super.groups</name>
+		<value></value>
+		<description>Comma-separated list of groups whose members are granted full Ranger administrative privileges at login (system admin and key admin capabilities), independent of database roles. Group membership is resolved from the Ranger user store (usersync). Empty or absent disables config-based super groups.</description>
+	</property>
 </configuration>

security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java

@@ -33,6 +33,7 @@
 import org.apache.ranger.common.RESTErrorUtil;
 import org.apache.ranger.common.RangerCommonEnums;
 import org.apache.ranger.common.RangerConstants;
+import org.apache.ranger.common.RangerSuperUserConfig;
 import org.apache.ranger.common.StringUtil;
 import org.apache.ranger.common.UserSessionBase;
 import org.apache.ranger.db.RangerDaoManager;
@@ -110,6 +111,10 @@ public class RangerBizUtil {
     @Autowired
     UserMgr userMgr;
 
+    /** Used for config super-user group lookup in {@link #isUserRangerAdmin(String)}. */
+    @Autowired
+    XUserMgr xUserMgr;
+
     @Autowired
     XUserService xUserService;
 
@@ -1047,12 +1052,21 @@ public void hasKMSPermissions(String objType, String implClassName) {
         // TODO: As of now we are allowing SYS_ADMIN to create/update/read/delete all the
         // services including KMS
 
-        if ("Service-Def".equalsIgnoreCase(objType) && session.isUserAdmin() && EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClassName)) {
+        // Stock sys admin cannot manage KMS service-def; config super-users may
+        // (full admin + key-admin parity via ranger.admin.super.users/groups).
+        if ("Service-Def".equalsIgnoreCase(objType) && session.isUserAdmin() && !session.isConfigSuperUser()
+                && EmbeddedServiceDefsUtil.KMS_IMPL_CLASS_NAME.equals(implClassName)) {
             throw restErrorUtil.createRESTException("System Admin cannot create/update/delete KMS " + objType, MessageEnums.OPER_NO_PERMISSION);
         }
     }
 
     public boolean checkUserAccessible(VXUser vXUser) {
+        // Config super-user (ranger.admin.super.users/groups) bypasses the
+        // mutual admin/key-admin visibility restrictions below.
+        if (isConfigSuperUser()) {
+            return true;
+        }
+
         boolean            isAccessible = true;
         Collection<String> roleList     = userMgr.getRolesByLoginId(vXUser.getName());
 
@@ -1117,13 +1131,40 @@ public boolean isUserAllowedForGrantRevoke(RangerService rangerService, String u
         return isUserInConfigParameter(rangerService, ServiceREST.Allowed_User_List_For_Grant_Revoke, userName);
     }
 
+    /**
+     * True when {@code username} is a full Ranger admin: DB sys/admin role,
+     * config super-user ({@code ranger.admin.super.users/groups}), or the
+     * current session is an effective Ranger admin per
+     * {@link UserSessionBase#isEffectiveRangerAdmin()}.
+     */
     public boolean isUserRangerAdmin(String username) {
+        if (StringUtils.isBlank(username)) {
+            return false;
+        }
+
+        UserSessionBase userSession = ContextUtil.getCurrentUserSession();
+
+        // Effective Ranger admin on current session (DB sys admin or config super-user).
+        if (userSession != null
+                && username.equalsIgnoreCase(userSession.getLoginId())
+                && userSession.isEffectiveRangerAdmin()) {
+            return true;
+        }
+
+        // Config super-user when no session context (e.g. grantor checks).
+        if (RangerSuperUserConfig.isEnabled() && xUserMgr != null
+                && RangerSuperUserConfig.isSuperUser(username,
+                        xUserMgr.getSyncedGroupsForUser(username))) {
+            return true;
+        }
+
         boolean isAdmin = false;
 
         try {
             VXUser vxUser = xUserService.getXUserByUserName(username);
 
-            if (vxUser != null && (vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN) || vxUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN))) {
+            if (vxUser != null && (vxUser.getUserRoleList().contains(RangerConstants.ROLE_ADMIN)
+                    || vxUser.getUserRoleList().contains(RangerConstants.ROLE_SYS_ADMIN))) {
                 isAdmin = true;
             }
         } catch (Exception ex) {
@@ -1133,6 +1174,16 @@ public boolean isUserRangerAdmin(String username) {
         return isAdmin;
     }
 
+    /**
+     * True when the current session is a config super-user per
+     * {@code ranger.admin.super.users} / {@code ranger.admin.super.groups}.
+     */
+    public boolean isConfigSuperUser() {
+        UserSessionBase currentUserSession = ContextUtil.getCurrentUserSession();
+
+        return currentUserSession != null && currentUserSession.isConfigSuperUser();
+    }
+
     public boolean isUserServiceAdmin(RangerService rangerService, String userName) {
         boolean ret = isUserInConfigParameter(rangerService, ServiceDBStore.SERVICE_ADMIN_USERS, userName);
 

security-admin/src/main/java/org/apache/ranger/biz/RoleDBStore.java

@@ -25,7 +25,6 @@
 import org.apache.ranger.common.ContextUtil;
 import org.apache.ranger.common.MessageEnums;
 import org.apache.ranger.common.RESTErrorUtil;
-import org.apache.ranger.common.RangerConstants;
 import org.apache.ranger.common.RangerRoleCache;
 import org.apache.ranger.common.UserSessionBase;
 import org.apache.ranger.common.db.RangerTransactionSynchronizationAdapter;
@@ -314,24 +313,31 @@ public RangerRoleList getRolesForUser(SearchFilter filter, RangerRoleList ranger
         List<RangerRole> roles;
         UserSessionBase  userSession = ContextUtil.getCurrentUserSession();
 
-        if (userSession != null && userSession.getUserRoleList().size() == 1 && userSession.getUserRoleList().contains(RangerConstants.ROLE_USER) && userSession.getLoginId() != null) {
-            VXUser       loggedInVXUser = xUserService.getXUserByUserName(userSession.getLoginId());
-            List<XXRole> xxRoles        = daoMgr.getXXRole().findByUserId(loggedInVXUser.getId());
+        // Plain ROLE_USER only; config super-users see all roles.
+        if (userSession != null && userSession.isSingleRoleUserSession()
+                && userSession.getLoginId() != null) {
+            VXUser loggedInVXUser = xUserService.getXUserByUserName(userSession.getLoginId());
 
-            roles = new ArrayList<>();
+            if (loggedInVXUser != null) {
+                List<XXRole> xxRoles = daoMgr.getXXRole().findByUserId(loggedInVXUser.getId());
 
-            if (CollectionUtils.isNotEmpty(xxRoles)) {
-                for (XXRole xxRole : xxRoles) {
-                    roles.add(roleService.read(xxRole.getId()));
+                roles = new ArrayList<>();
+
+                if (CollectionUtils.isNotEmpty(xxRoles)) {
+                    for (XXRole xxRole : xxRoles) {
+                        roles.add(roleService.read(xxRole.getId()));
+                    }
                 }
-            }
 
-            if (predicateUtil != null && !filter.isEmpty()) {
-                List<RangerRole> copy = new ArrayList<>(roles);
+                if (predicateUtil != null && !filter.isEmpty()) {
+                    List<RangerRole> copy = new ArrayList<>(roles);
 
-                predicateUtil.applyFilter(copy, filter);
+                    predicateUtil.applyFilter(copy, filter);
 
-                roles = copy;
+                    roles = copy;
+                }
+            } else {
+                roles = getRoles(filter);
             }
         } else {
             roles = getRoles(filter);

security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java

@@ -29,11 +29,13 @@
 import org.apache.ranger.common.RESTErrorUtil;
 import org.apache.ranger.common.RangerCommonEnums;
 import org.apache.ranger.common.RangerConstants;
+import org.apache.ranger.common.RangerSuperUserConfig;
 import org.apache.ranger.common.SearchCriteria;
 import org.apache.ranger.common.StringUtil;
 import org.apache.ranger.common.UserSessionBase;
 import org.apache.ranger.db.RangerDaoManager;
 import org.apache.ranger.entity.XXAuthSession;
+import org.apache.ranger.entity.XXModuleDef;
 import org.apache.ranger.entity.XXPortalUser;
 import org.apache.ranger.entity.XXPortalUserRole;
 import org.apache.ranger.entity.XXUser;
@@ -219,7 +221,24 @@ public void resetUserModulePermission(UserSessionBase userSession) {
         XXUser xUser = daoManager.getXXUser().findByUserName(userSession.getLoginId());
 
         if (xUser != null) {
-            List<String>                         permissionList       = daoManager.getXXModuleDef().findAccessibleModulesByUserId(userSession.getUserId(), xUser.getId());
+            List<String> permissionList;
+
+            if (userSession.isEffectiveRangerAdmin() || userSession.isKeyAdmin()) {
+                List<XXModuleDef> allModules =
+                        daoManager.getXXModuleDef().getAll();
+                permissionList = new ArrayList<>();
+
+                if (CollectionUtils.isNotEmpty(allModules)) {
+                    for (XXModuleDef moduleDef : allModules) {
+                        permissionList.add(moduleDef.getModule());
+                    }
+                }
+            } else {
+                permissionList = daoManager.getXXModuleDef()
+                        .findAccessibleModulesByUserId(
+                                userSession.getUserId(), xUser.getId());
+            }
+
             CopyOnWriteArraySet<String>          userPermissions      = new CopyOnWriteArraySet<>(permissionList);
             UserSessionBase.RangerUserPermission rangerUserPermission = userSession.getRangerUserPermission();
 
@@ -556,6 +575,52 @@ private void setUserRoles(UserSessionBase userSession) {
             userSession.setUserAdmin(false);
         }
 
+        applyConfigSuperUserSessionFlags(userSession);
+
+        if (userSession.isConfigSuperUser()) {
+            strRoleList = RangerSuperUserConfig.mergeConfigSuperUserRoles(
+                    strRoleList, true);
+        }
+
         userSession.setUserRoleList(strRoleList);
     }
+
+    /**
+     * Applies config super-user session flags ({@code userAdmin}, {@code keyAdmin},
+     * {@code configSuperUser}) when login matches
+     * {@code ranger.admin.super.users} / super.groups.
+     */
+    private void applyConfigSuperUserSessionFlags(
+            final UserSessionBase userSession) {
+        if (userSession == null) {
+            return;
+        }
+
+        String loginId = userSession.getLoginId();
+
+        if (loginId == null) {
+            return;
+        }
+
+        if (!RangerSuperUserConfig.isEnabled()) {
+            userSession.setConfigSuperUser(false);
+            return;
+        }
+
+        Set<String> userGroups = xUserMgr.getSyncedGroupsForUser(loginId);
+
+        if (RangerSuperUserConfig.isSuperUser(loginId, userGroups)) {
+            userSession.setUserAdmin(true);
+            userSession.setKeyAdmin(true);
+            userSession.setAuditUserAdmin(false);
+            userSession.setAuditKeyAdmin(false);
+            userSession.setConfigSuperUser(true);
+
+            logger.info(
+                    "Granted full admin privileges via config for user {}",
+                    loginId);
+        } else {
+            userSession.setConfigSuperUser(false);
+        }
+    }
 }