Apache Ranger Plugins Common

<dependency>
  <groupId>org.apache.ranger</groupId>
  <artifactId>ranger-plugins-common</artifactId>
  <version>2.7.0</version>
</dependency>

import org.apache.ranger.plugin.service.RangerBasePlugin;
import org.apache.ranger.admin.client.RangerAdminClient;
import org.apache.ranger.plugin.policyengine.RangerAccessRequest;
import org.apache.ranger.plugin.policyengine.RangerAccessRequestImpl;
import org.apache.ranger.plugin.policyengine.RangerAccessResourceImpl;
import org.apache.ranger.plugin.policyengine.RangerAccessResult;
import org.apache.ranger.plugin.model.RangerPolicy;
import org.apache.ranger.plugin.model.RangerServiceDef;

import org.apache.ranger.plugin.service.RangerBasePlugin;
import org.apache.ranger.plugin.policyengine.RangerAccessRequestImpl;
import org.apache.ranger.plugin.policyengine.RangerAccessResourceImpl;

// Initialize plugin
RangerBasePlugin plugin = new RangerBasePlugin("hdfs", "MyHDFSPlugin");
plugin.init();

// Create access request
RangerAccessResourceImpl resource = new RangerAccessResourceImpl();
resource.setValue("path", "/user/data/file.txt");

RangerAccessRequestImpl request = new RangerAccessRequestImpl();
request.setResource(resource);
request.setAccessType("read");
request.setUser("alice");

// Evaluate access
RangerAccessResult result = plugin.isAccessAllowed(request);
if (result.getIsAllowed()) {
    System.out.println("Access granted");
} else {
    System.out.println("Access denied: " + result.getReason());
}

// Note: Auditing is handled automatically during access evaluation
// Access results contain audit information processed by the plugin's audit providers

public class RangerBasePlugin {
    public RangerBasePlugin(String serviceType, String appId);
    public RangerBasePlugin(String serviceType, String serviceName, String appId);
    public RangerBasePlugin(RangerPluginConfig pluginConfig);
    public void init();
    public RangerAccessResult isAccessAllowed(RangerAccessRequest request);
    public Collection<RangerAccessResult> isAccessAllowed(Collection<RangerAccessRequest> requests, RangerAccessResultProcessor resultProcessor);
    public RangerAccessResult evalDataMaskPolicies(RangerAccessRequest request, RangerAccessResultProcessor resultProcessor);
    public RangerAccessResult evalRowFilterPolicies(RangerAccessRequest request, RangerAccessResultProcessor resultProcessor);
    public RangerResourceACLs getResourceACLs(RangerAccessRequest request);
    public void refreshPoliciesAndTags();
}

public interface RangerPolicyEngine {
    RangerAccessResult evaluatePolicies(RangerAccessRequest request, int policyType, RangerAccessResultProcessor resultProcessor);
    Collection<RangerAccessResult> evaluatePolicies(Collection<RangerAccessRequest> requests, int policyType, RangerAccessResultProcessor resultProcessor);
    RangerResourceACLs getResourceACLs(RangerAccessRequest request);
}

public class RangerPolicyEngineImpl implements RangerPolicyEngine {
    public RangerPolicyEngineImpl(ServicePolicies servicePolicies, RangerPluginContext pluginContext, RangerRoles roles);
}

public interface RangerAdminClient {
    void init(String serviceName, String appId, String configPropertyPrefix, Configuration config);
    ServicePolicies getServicePoliciesIfUpdated(long lastKnownVersion, long lastActivationTimeInMillis) throws Exception;
    RangerRoles getRolesIfUpdated(long lastKnownRoleVersion, long lastActivationTimeInMills) throws Exception;
    void grantAccess(GrantRevokeRequest request) throws Exception;
    void revokeAccess(GrantRevokeRequest request) throws Exception;
}

public class RangerAdminRESTClient extends AbstractRangerAdminClient {
    public void init(String serviceName, String appId, String propertyPrefix, Configuration config);
}

public class RangerPolicy extends RangerBaseModelObject {
    public static final int POLICY_TYPE_ACCESS = 0;
    public static final int POLICY_TYPE_DATAMASK = 1;
    public static final int POLICY_TYPE_ROWFILTER = 2;
    
    public String getService();
    public String getName();
    public Integer getPolicyType();
    public Map<String, RangerPolicyResource> getResources();
    public List<RangerPolicyItem> getPolicyItems();
}

public class RangerServiceDef extends RangerBaseModelObject {
    public String getName();
    public List<RangerResourceDef> getResources();
    public List<RangerAccessTypeDef> getAccessTypes();
}

public interface RangerContextEnricher {
    void init();
    void enrich(RangerAccessRequest request);
}

public abstract class RangerAbstractContextEnricher implements RangerContextEnricher {
    // Base implementation with common functionality
}

public class RangerTagEnricher extends RangerAbstractContextEnricher {
    // Tag-based context enrichment
}

public interface RangerResourceMatcher {
    void init();
    boolean isMatch(RangerAccessResource resource, Map<String, Object> evalContext);
    boolean isCompleteMatch(RangerAccessResource resource, Map<String, Object> evalContext);
}

public class RangerDefaultResourceMatcher extends RangerAbstractResourceMatcher {
    // Default wildcard-based matching
}

public class RangerPathResourceMatcher extends RangerAbstractResourceMatcher {
    // Path-specific matching with hierarchy support
}

public class SecureClientLogin {
    public static Subject loginUserFromKeytab(String user, String path) throws IOException;
    public static Subject loginUserWithPassword(String user, String password) throws IOException;
    public static boolean isKerberosCredentialExists(String principal, String keytabPath);
}

public interface RangerAccessRequest {
    RangerAccessResource getResource();
    String getAccessType();
    String getUser();
    Set<String> getUserGroups();
    Set<String> getUserRoles();
    Date getAccessTime();
    String getClientIPAddress();
    Map<String, Object> getContext();
}

public class RangerAccessRequestImpl implements RangerAccessRequest {
    public RangerAccessRequestImpl();
    public RangerAccessRequestImpl(RangerAccessResource resource, String accessType, String user, Set<String> userGroups, Set<String> userRoles);
}

public interface RangerAccessResource {
    String getOwnerUser();
    boolean exists(String name);
    String getValue(String name);
    String[] getValues(String name);
    Set<String> getKeys();
    Map<String, Object> getAsMap();
}

public class RangerAccessResult {
    public String getServiceName();
    public RangerAccessRequest getAccessRequest();
    public boolean getIsAllowed();
    public boolean getIsAudited();
    public long getPolicyId();
    public String getReason();
}

public class RangerPluginConfig extends RangerConfiguration {
    public RangerPluginConfig(String serviceType, String serviceName, String appId, String clusterName, String clusterType, PolicyRefresher policyRefresher);
    public String getServiceType();
    public String getServiceName();
    public String getAppId();
}

public class ServicePolicies {
    public String getServiceName();
    public Long getPolicyVersion();
    public List<RangerPolicy> getPolicies();
    public RangerServiceDef getServiceDef();
}

public class GrantRevokeRequest {
    public String getGrantor();
    public Map<String, String> getResource();
    public Set<String> getUsers();
    public Set<String> getGroups();
    public Set<String> getAccessTypes();
    public Boolean getIsRecursive();
}

public class GrantRevokeRoleRequest {
    // Role-based grant/revoke operations
}