AMBARI-13417. Add Ranger Audit tab to Ranger Smart config. (jaimin)

ambari-server/src/main/resources/common-services/RANGER/0.4.0/configuration/ranger-env.xml

@@ -193,28 +193,6 @@
     </value-attributes>
   </property>
 
-  <property>
-    <name>ranger-kafka-plugin-enabled</name>
-    <value>No</value>
-    <display-name>Kafka Ranger Plugin</display-name>
-    <description>Enable Kafka Ranger plugin</description>
-    <value-attributes>
-      <overridable>false</overridable>
-      <type>value-list</type>
-      <entries>
-        <entry>
-          <value>Yes</value>
-          <label>Enabled</label>
-        </entry>
-        <entry>
-          <value>No</value>
-          <label>Disabled</label>
-        </entry>
-      </entries>
-      <selection-cardinality>1</selection-cardinality>
-    </value-attributes>
-  </property>
-
   <property>
     <name>ranger-knox-plugin-enabled</name>
     <value>No</value>
@@ -236,27 +214,4 @@
       <selection-cardinality>1</selection-cardinality>
     </value-attributes>
   </property>
-
-  <property>
-    <name>ranger-yarn-plugin-enabled</name>
-    <value>No</value>
-    <display-name>YARN Ranger Plugin</display-name>
-    <description>Enable YARN Ranger plugin</description>
-    <value-attributes>
-      <overridable>false</overridable>
-      <type>value-list</type>
-      <entries>
-        <entry>
-          <value>Yes</value>
-          <label>Enabled</label>
-        </entry>
-        <entry>
-          <value>No</value>
-          <label>Disabled</label>
-        </entry>
-      </entries>
-      <selection-cardinality>1</selection-cardinality>
-    </value-attributes>
-  </property>
-
 </configuration>

ambari-server/src/main/resources/stacks/HDP/2.2/services/stack_advisor.py

@@ -389,11 +389,11 @@ class HDP22StackAdvisor(HDP21StackAdvisor):
 
 
     # Recommend Ranger Hive authorization as per Ranger Hive plugin property
-    if "ranger-env" in services["configurations"] and "ranger-hive-plugin-properties" in services["configurations"] and \
+    if "ranger-env" in services["configurations"] and "hive-env" in services["configurations"] and \
         "ranger-hive-plugin-enabled" in services["configurations"]["ranger-env"]["properties"]:
-      putHiveRangerPluginProperty = self.putProperty(configurations, "ranger-hive-plugin-properties", services)
       rangerEnvHivePluginProperty = services["configurations"]["ranger-env"]["properties"]["ranger-hive-plugin-enabled"]
-      putHiveRangerPluginProperty("ranger-hive-plugin-enabled", rangerEnvHivePluginProperty)
+      if (rangerEnvHivePluginProperty.lower() == "yes"):
+        putHiveEnvProperty("hive_security_authorization", "RANGER")
 
     # Security
     if ("configurations" not in services) or ("hive-env" not in services["configurations"]) or \
@@ -403,6 +403,18 @@ class HDP22StackAdvisor(HDP21StackAdvisor):
       putHiveEnvProperty("hive_security_authorization", "None")
     else:
       putHiveEnvProperty("hive_security_authorization", services["configurations"]["hive-env"]["properties"]["hive_security_authorization"])
+
+
+    # Recommend Ranger Hive authorization as per Ranger Hive plugin property
+    if "ranger-env" in services["configurations"] and "hive-env" in services["configurations"] and \
+        "ranger-hive-plugin-enabled" in services["configurations"]["ranger-env"]["properties"]:
+      rangerEnvHivePluginProperty = services["configurations"]["ranger-env"]["properties"]["ranger-hive-plugin-enabled"]
+      rangerEnvHiveAuthProperty = services["configurations"]["hive-env"]["properties"]["hive_security_authorization"]
+      if (rangerEnvHivePluginProperty.lower() == "yes"):
+        putHiveEnvProperty("hive_security_authorization", "Ranger")
+      elif (rangerEnvHiveAuthProperty.lower() == "ranger"):
+        putHiveEnvProperty("hive_security_authorization", "None")
+
     # hive_security_authorization == 'none'
     # this property is unrelated to Kerberos
     if str(configurations["hive-env"]["properties"]["hive_security_authorization"]).lower() == "none":

ambari-server/src/main/resources/stacks/HDP/2.3/services/RANGER/configuration/ranger-admin-site.xml

@@ -162,8 +162,8 @@
 
   <property>
     <name>ranger.audit.solr.urls</name>
-    <value>http://solr_host:6083/solr/ranger_audits</value>
-    <description>Solr url for audit</description>
+    <value></value>
+    <description>Solr url for audit. Example: http://solr_host:6083/solr/ranger_audits</description>
   </property>
 
   <property>
@@ -418,7 +418,7 @@
 
   <property>
     <name>ranger.audit.solr.zookeepers</name>
-    <value>NONE</value>
+    <value></value>
     <description>Solr Zookeeper string</description>
   </property> 
 
@@ -430,7 +430,7 @@
 
   <property>
     <name>ranger.audit.solr.password</name>
-    <value>NONE</value>
+    <value></value>
     <property-type>PASSWORD</property-type>
     <description>Solr password</description>
   </property> 

ambari-server/src/main/resources/stacks/HDP/2.3/services/RANGER/configuration/ranger-env.xml

@@ -95,5 +95,144 @@
     </depends-on>
   </property>
 
+  <property>
+    <name>ranger-yarn-plugin-enabled</name>
+    <value>No</value>
+    <display-name>YARN Ranger Plugin</display-name>
+    <description>Enable YARN Ranger plugin</description>
+    <value-attributes>
+      <overridable>false</overridable>
+      <type>value-list</type>
+      <entries>
+        <entry>
+          <value>Yes</value>
+          <label>Enabled</label>
+        </entry>
+        <entry>
+          <value>No</value>
+          <label>Disabled</label>
+        </entry>
+      </entries>
+      <selection-cardinality>1</selection-cardinality>
+    </value-attributes>
+  </property>
+
+  <property>
+    <name>ranger-kafka-plugin-enabled</name>
+    <value>No</value>
+    <display-name>Kafka Ranger Plugin</display-name>
+    <description>Enable Kafka Ranger plugin</description>
+    <value-attributes>
+      <overridable>false</overridable>
+      <type>value-list</type>
+      <entries>
+        <entry>
+          <value>Yes</value>
+          <label>Enabled</label>
+        </entry>
+        <entry>
+          <value>No</value>
+          <label>Disabled</label>
+        </entry>
+      </entries>
+      <selection-cardinality>1</selection-cardinality>
+    </value-attributes>
+  </property>
+
+  <property>
+    <name>xasecure.audit.destination.db</name>
+    <value>false</value>
+    <display-name>Audit to DB</display-name>
+    <description>Enable Audit to DB for all ranger supported services. This property is overridable at service level</description>
+    <value-attributes>
+      <overridable>false</overridable>
+      <type>value-list</type>
+      <entries>
+        <entry>
+          <value>true</value>
+          <label>Enabled</label>
+        </entry>
+        <entry>
+          <value>false</value>
+          <label>Disabled</label>
+        </entry>
+      </entries>
+      <selection-cardinality>1</selection-cardinality>
+    </value-attributes>
+  </property>
+
+  <property>
+    <name>xasecure.audit.destination.solr</name>
+    <value>false</value>
+    <display-name>Audit to Solr</display-name>
+    <description>Enable Audit to Solr for all ranger supported services. This property is overridable at service level</description>
+    <value-attributes>
+      <overridable>false</overridable>
+      <type>value-list</type>
+      <entries>
+        <entry>
+          <value>true</value>
+          <label>Enabled</label>
+        </entry>
+        <entry>
+          <value>false</value>
+          <label>Disabled</label>
+        </entry>
+      </entries>
+      <selection-cardinality>1</selection-cardinality>
+    </value-attributes>
+  </property>
+
+  <property>
+    <name>is_solrCloud_enabled</name>
+    <display-name>SolrCloud</display-name>
+    <description>SolrCloud uses zookeeper for distributed search and indexing</description>
+    <value>false</value>
+    <value-attributes>
+      <type>value-list</type>
+      <overridable>false</overridable>
+      <entries>
+        <entry>
+          <value>true</value>
+          <label>Enabled</label>
+        </entry>
+        <entry>
+          <value>false</value>
+          <label>Disabled</label>
+        </entry>
+      </entries>
+      <selection-cardinality>1</selection-cardinality>
+      <empty-value-valid>true</empty-value-valid>
+    </value-attributes>
+  </property>
+
+  <property>
+    <name>xasecure.audit.destination.hdfs</name>
+    <value>false</value>
+    <display-name>Audit to HDFS</display-name>
+    <description>Enable Audit to HDFS for all ranger supported services. This property is overridable at service level</description>
+    <value-attributes>
+      <overridable>false</overridable>
+      <type>value-list</type>
+      <entries>
+        <entry>
+          <value>true</value>
+          <label>Enabled</label>
+        </entry>
+        <entry>
+          <value>false</value>
+          <label>Disabled</label>
+        </entry>
+      </entries>
+      <selection-cardinality>1</selection-cardinality>
+    </value-attributes>
+  </property>
+
+  <property>
+    <name>xasecure.audit.destination.hdfs.dir</name>
+    <value>hdfs://localhost:8020/ranger/audit</value>
+    <display-name>Destination HDFS Directory</display-name>
+    <description>HDFS folder to write audit to, make sure all service user has required permissions. This property is overridable at service level</description>
+  </property>
 
 </configuration>

ambari-server/src/main/resources/stacks/HDP/2.3/services/RANGER/configuration/ranger-ugsync-site.xml

@@ -119,13 +119,13 @@
   <property>
     <name>ranger.usersync.unix.group.file</name>
     <display-name>Group File</display-name>
-    <value></value>
+    <value>/etc/group</value>
   </property>
 
   <property>
     <name>ranger.usersync.unix.password.file</name>
     <display-name>Password File</display-name>
-    <value></value>
+    <value>/etc/passwd</value>
   </property>
 
   <property>

ambari-server/src/main/resources/stacks/HDP/2.3/services/RANGER/themes/theme_version_2.json

@@ -263,6 +263,80 @@
                 }
               ]
             }
+          },
+          {
+            "name": "ranger_audit_settings",
+            "display-name": "Ranger Audit",
+            "layout": {
+              "tab-columns": "2",
+              "tab-rows": "2",
+              "sections": [
+                {
+                  "name": "section-ranger-audit-db",
+                  "display-name": "Audit to DB",
+                  "row-index": "0",
+                  "column-index": "0",
+                  "row-span": "1",
+                  "column-span": "2",
+                  "section-columns": "2",
+                  "section-rows": "1",
+                  "subsections": [
+                    {
+                      "name": "subsection-ranger-audit-db-row1-col1",
+                      "row-index": "0",
+                      "column-index": "0",
+                      "row-span": "1",
+                      "column-span": "1"
+                    },
+                    {
+                      "name": "subsection-ranger-audit-db-row1-col2",
+                      "row-index": "0",
+                      "column-index": "1",
+                      "row-span": "1",
+                      "column-span": "1"
+                    }
+                  ]
+                },
+                {
+                  "name": "section-ranger-audit-solr",
+                  "display-name": "Audit to Solr",
+                  "row-index": "1",
+                  "column-index": "0",
+                  "row-span": "1",
+                  "column-span": "1",
+                  "section-columns": "1",
+                  "section-rows": "1",
+                  "subsections": [
+                    {
+                      "name": "subsection-ranger-solr-row2-col1",
+                      "row-index": "0",
+                      "column-index": "0",
+                      "row-span": "1",
+                      "column-span": "1"
+                    }
+                  ]
+                },
+                {
+                  "name": "section-ranger-audit-hdfs",
+                  "display-name": "Audit to HDFS",
+                  "row-index": "1",
+                  "column-index": "1",
+                  "row-span": "1",
+                  "column-span": "1",
+                  "section-columns": "1",
+                  "section-rows": "1",
+                  "subsections": [
+                    {
+                      "name": "subsection-ranger-hdfs-row2-col2",
+                      "row-index": "0",
+                      "column-index": "0",
+                      "row-span": "1",
+                      "column-span": "1"
+                    }
+                  ]
+                }
+              ]
+            }
           }
         ]
       }
@@ -929,6 +1003,164 @@
               }
             }
           ]
+        },
+        {
+          "config": "ranger-env/xasecure.audit.destination.db",
+          "subsection-name": "subsection-ranger-audit-db-row1-col1"
+        },
+        {
+          "config": "admin-properties/audit_db_user",
+          "subsection-name": "subsection-ranger-audit-db-row1-col1"
+        },
+        {
+          "config": "admin-properties/audit_db_name",
+          "subsection-name": "subsection-ranger-audit-db-row1-col2"
+        },
+        {
+          "config": "admin-properties/audit_db_password",
+          "subsection-name": "subsection-ranger-audit-db-row1-col2"
+        },
+        {
+          "config": "ranger-env/xasecure.audit.destination.solr",
+          "subsection-name": "subsection-ranger-solr-row2-col1"
+        },
+        {
+          "config": "ranger-env/is_solrCloud_enabled",
+          "subsection-name": "subsection-ranger-solr-row2-col1",
+          "depends-on": [
+            {
+              "configs":[
+                "ranger-env/xasecure.audit.destination.solr"
+              ],
+              "if": "${ranger-env/xasecure.audit.destination.solr}",
+              "then": {
+                "property_value_attributes": {
+                  "visible": true
+                }
+              },
+              "else": {
+                "property_value_attributes": {
+                  "visible": false
+                }
+              }
+            }
+          ]
+        },
+        {
+          "config": "ranger-admin-site/ranger.audit.solr.urls",
+          "subsection-name": "subsection-ranger-solr-row2-col1",
+          "depends-on": [
+            {
+              "configs":[
+                "ranger-env/is_solrCloud_enabled",
+                "ranger-env/xasecure.audit.destination.solr"
+              ],
+              "if": "${ranger-env/is_solrCloud_enabled} === false && ${ranger-env/xasecure.audit.destination.solr}",
+              "then": {
+                "property_value_attributes": {
+                  "visible": true
+                }
+              },
+              "else": {
+                "property_value_attributes": {
+                  "visible": false
+                }
+              }
+            }
+          ]
+        },
+        {
+          "config": "ranger-admin-site/ranger.audit.solr.zookeepers",
+          "subsection-name": "subsection-ranger-solr-row2-col1",
+          "depends-on": [
+            {
+              "configs":[
+                "ranger-env/is_solrCloud_enabled",
+                "ranger-env/xasecure.audit.destination.solr"
+              ],
+              "if": "${ranger-env/is_solrCloud_enabled} && ${ranger-env/xasecure.audit.destination.solr}",
+              "then": {
+                "property_value_attributes": {
+                  "visible": true
+                }
+              },
+              "else": {
+                "property_value_attributes": {
+                  "visible": false
+                }
+              }
+            }
+          ]
+        },
+        {
+          "config": "ranger-admin-site/ranger.audit.solr.username",
+          "subsection-name": "subsection-ranger-solr-row2-col1",
+          "depends-on": [
+            {
+              "configs":[
+                "ranger-env/xasecure.audit.destination.solr"
+              ],
+              "if": "${ranger-env/xasecure.audit.destination.solr}",
+              "then": {
+                "property_value_attributes": {
+                  "visible": true
+                }
+              },
+              "else": {
+                "property_value_attributes": {
+                  "visible": false
+                }
+              }
+            }
+          ]
+        },
+        {
+          "config": "ranger-admin-site/ranger.audit.solr.password",
+          "subsection-name": "subsection-ranger-solr-row2-col1",
+          "depends-on": [
+            {
+              "configs":[
+                "ranger-env/xasecure.audit.destination.solr"
+              ],
+              "if": "${ranger-env/xasecure.audit.destination.solr}",
+              "then": {
+                "property_value_attributes": {
+                  "visible": true
+                }
+              },
+              "else": {
+                "property_value_attributes": {
+                  "visible": false
+                }
+              }
+            }
+          ]
+        },
+        {
+          "config": "ranger-env/xasecure.audit.destination.hdfs",
+          "subsection-name": "subsection-ranger-hdfs-row2-col2"
+        },
+        {
+          "config": "ranger-env/xasecure.audit.destination.hdfs.dir",
+          "subsection-name": "subsection-ranger-hdfs-row2-col2",
+          "depends-on": [
+            {
+              "configs":[
+                "ranger-env/xasecure.audit.destination.hdfs"
+              ],
+              "if": "${ranger-env/xasecure.audit.destination.hdfs}",
+              "then": {
+                "property_value_attributes": {
+                  "visible": true
+                }
+              },
+              "else": {
+                "property_value_attributes": {
+                  "visible": false
+                }
+              }
+            }
+          ]
         }
       ]
     },
@@ -1226,6 +1458,78 @@
         "widget": {
           "type": "toggle"
         }
+      },
+      {
+        "config": "ranger-env/xasecure.audit.destination.db",
+        "widget": {
+          "type": "toggle"
+        }
+      },
+      {
+        "config": "admin-properties/audit_db_user",
+        "widget": {
+          "type": "text-field"
+        }
+      },
+      {
+        "config": "admin-properties/audit_db_name",
+        "widget": {
+          "type": "text-field"
+        }
+      },
+      {
+        "config": "admin-properties/audit_db_password",
+        "widget": {
+          "type": "password"
+        }
+      },
+      {
+        "config": "ranger-env/xasecure.audit.destination.solr",
+        "widget": {
+          "type": "toggle"
+        }
+      },
+      {
+        "config": "ranger-env/is_solrCloud_enabled",
+        "widget": {
+          "type": "toggle"
+        }
+      },
+      {
+        "config": "ranger-admin-site/ranger.audit.solr.urls",
+        "widget": {
+          "type": "text-field"
+        }
+      },
+      {
+        "config": "ranger-admin-site/ranger.audit.solr.zookeepers",
+        "widget": {
+          "type": "text-field"
+        }
+      },
+      {
+        "config": "ranger-admin-site/ranger.audit.solr.username",
+        "widget": {
+          "type": "text-field"
+        }
+      },
+      {
+        "config": "ranger-admin-site/ranger.audit.solr.password",
+        "widget": {
+          "type": "password"
+        }
+      },
+      {
+        "config": "ranger-env/xasecure.audit.destination.hdfs",
+        "widget": {
+          "type": "toggle"
+        }
+      },
+      {
+        "config": "ranger-env/xasecure.audit.destination.hdfs.dir",
+        "widget": {
+          "type": "text-field"
+        }
       }
     ]
   }

ambari-web/app/views/common/configs/service_config_layout_tab_view.js

@@ -124,9 +124,19 @@ App.ServiceConfigLayoutTabView = Em.View.extend(App.ConfigOverridable, {
         // Filter config condition depending on the value of another config
         var conditionalConfigs = (_configCondition.get('configs')||[]).filterProperty('fileName', config.get('filename')).filterProperty('configName', config.get('name'));
         // Filter config condition depending on the service existence or service state
-        var serviceConfigCondition = ((_configCondition.get('configName') === config.get('name')) &&  (_configCondition.get('fileName') === config.get('filename')) &&  (_configCondition.get('resource') === 'service'));
-        var conditions = conditionalConfigs.concat(serviceConfigCondition);
-        return ((conditions && conditions.length));
+        var serviceConfigConditionFlag = ((_configCondition.get('configName') === config.get('name')) &&  (_configCondition.get('fileName') === config.get('filename')) &&  (_configCondition.get('resource') === 'service'));
+        var conditions;
+
+        if (serviceConfigConditionFlag) {
+          var configCondition = {
+            configName: _configCondition.get('configName'),
+            fileName: _configCondition.get('fileName')
+          };
+          conditions = conditionalConfigs.concat(configCondition)
+        } else {
+          conditions = conditionalConfigs;
+        }
+        return (conditions && conditions.length);
       }, this);
 
       if (configConditions && configConditions.length) {

ambari-web/app/views/common/configs/widgets/config_widget_view.js

@@ -379,6 +379,8 @@ App.ConfigWidgetView = Em.View.extend(App.SupportsDependentConfigs, App.WidgetPo
     var configConditions = this.get('config.configConditions');
     if (configConditions && configConditions.length) {
       this.configValueObserver();
+
+      //Add Observer to configCondition that depends on another config value
       var isConditionConfigDependent =  configConditions.filterProperty('resource', 'config').length;
       if (isConditionConfigDependent) {
         this.addObserver('config.value', this, this.configValueObserver);
@@ -400,22 +402,34 @@ App.ConfigWidgetView = Em.View.extend(App.SupportsDependentConfigs, App.WidgetPo
     configConditions.forEach(function(configCondition){
       var ifStatement =  configCondition.get("if");
       if (configCondition.get("resource") === 'config') {
-        var splitIfCondition = ifStatement.split('===');
-        var ifCondition =  splitIfCondition[0];
-        var result = splitIfCondition[1] || "true";
-        var parseIfConditionVal = ifCondition;
-        var regex = /\$\{.*?\}/g;
-        var configStrings = ifCondition.match(regex);
-        configStrings.forEach(function(_configString){
-          var configObject = _configString.substring(2, _configString.length-1).split("/");
-          var config = serviceConfigs.filterProperty('filename',configObject[0] + '.xml').findProperty('name', configObject[1]);
-          if (config) {
-            var configValue = config.get('value');
-            parseIfConditionVal = parseIfConditionVal.replace(_configString, configValue);
+        // Split `if` statement if it has logical operators
+        var ifStatementRegex = /(&&|\|\|)/;
+        var IfConditions = ifStatement.split(ifStatementRegex);
+        var allConditionResult = [];
+        IfConditions.forEach(function(_condition){
+          var condition = _condition.trim();
+          if (condition === '&&' || condition === '||') {
+            allConditionResult.push(_condition);
+          }  else {
+            var splitIfCondition = condition.split('===');
+            var ifCondition = splitIfCondition[0];
+            var result = splitIfCondition[1] || "true";
+            var parseIfConditionVal = ifCondition;
+            var regex = /\$\{.*?\}/g;
+            var configStrings = ifCondition.match(regex);
+            configStrings.forEach(function (_configString) {
+              var configObject = _configString.substring(2, _configString.length - 1).split("/");
+              var config = serviceConfigs.filterProperty('filename', configObject[0] + '.xml').findProperty('name', configObject[1]);
+              if (config) {
+                var configValue = config.get('value');
+                parseIfConditionVal = parseIfConditionVal.replace(_configString, configValue);
+              }
+            }, this);
+            var conditionResult = window.eval(JSON.stringify(parseIfConditionVal.trim())) === result.trim();
+            allConditionResult.push(conditionResult);
           }
         }, this);
-
-        isConditionTrue =  window.eval(JSON.stringify(parseIfConditionVal.trim())) === result.trim();
+        isConditionTrue = window.eval(allConditionResult.join(''));
         this.changeConfigAttribute(configCondition, isConditionTrue);
       } else if (configCondition.get("resource") === 'service') {
         var service = App.Service.find().findProperty('serviceName', ifStatement);