# # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. See accompanying LICENSE file. # import os import sys import errno import logging import zipfile try: from StringIO import StringIO except ImportError: from io import StringIO try: from ConfigParser import ConfigParser except ImportError: from configparser import ConfigParser import subprocess import fileinput import zipfile import re import shutil from datetime import date import getpass import glob import pprint from subprocess import Popen,PIPE conf_dict={} """ ################################################ Helper routines ################################################ """ def log(msg,type): if type == 'info': logging.info(" %s",msg) if type == 'error': logging.error(" %s",msg) if type == 'debug': logging.debug(" %s",msg) if type == 'warning': logging.warning(" %s",msg) if type == 'exception': logging.exception(" %s",msg) def password_validation(password, userType): if password: if re.search("[\\\`'\"]",password): log("[E] "+userType+" user password contains one of the unsupported special characters like \" ' \ `","error") sys.exit(1) else: log("[I] "+userType+" user password validated","info") else: log("[E] Blank password is not allowed,please enter valid password.","error") sys.exit(1) def resolve_sym_link(path): path = os.path.realpath(path) base_dir = os.path.dirname(os.path.dirname(path)) return path, base_dir #prog = ["mysql", "-u", "ve", "--execute", 'insert into foo values ("snargle", 2)'] def getstatusoutput(cmd): """Return (status, output) of executing cmd in a shell.""" """This new implementation should work on all platforms.""" """pipe = subprocess.Popen(cmd, stdout=subprocess.PIPE, stdin=subprocess.PIPE, shell=True, universal_newlines=True) "output, err = pipe.communicate() "sts = pipe.returncode """ ret = subprocess.call(cmd, shell=True) print("------------------") print(" cmd: " + str(cmd)) #print " output: " + output print(" ret: " + str(ret)) print("------------------") return ret, ret #if sts is None: # log("sts is None!!!! Manually setting to -1. PLEASE CHECK!!!!!!!!!!!!!!","info") # sts = -1 #return sts, output def copy_files(source_dir,dest_dir): for dir_path, dir_names, file_names in os.walk(source_dir): for file_name in file_names: target_dir = dir_path.replace(source_dir, dest_dir, 1) if not os.path.exists(target_dir): os.mkdir(target_dir) src_file = os.path.join(dir_path, file_name) dest_file = os.path.join(target_dir, file_name) log("copying src: " + src_file + " dest: " + dest_file, "debug") shutil.copyfile(src_file, dest_file) def ModConfig(File, Variable, Setting): """ Modify Config file variable with new setting """ VarFound = False AlreadySet = False V=str(Variable) S=str(Setting) # use quotes if setting has spaces # if ' ' in S: S = '"%s"' % S for line in fileinput.input(File, inplace = 1): # process lines that look like config settings # if not line.lstrip(' ').startswith('#') and '=' in line: _infile_var = str(line.split('=')[0].rstrip(' ')) _infile_set = str(line.split('=')[1].lstrip(' ').rstrip()) # only change the first matching occurrence # if VarFound == False and _infile_var.rstrip(' ') == V: VarFound = True # don't change it if it is already set # if _infile_set.lstrip(' ') == S: AlreadySet = True else: line = "%s = %s\n" % (V, S) sys.stdout.write(line) # Append the variable if it wasn't found # if not VarFound: log( "Variable '%s' not found. Adding it to %s" % (V, File), "debug") with open(File, "a") as f: f.write("%s = %s\n" % (V, S)) elif AlreadySet == True: log( "Variable '%s' unchanged" % (V) , "debug") else: log( "Variable '%s' modified to '%s'" % (V, S) , "debug") return def mkdir_p(path): try: os.makedirs(path) except OSError as exc: if exc.errno == errno.EEXIST and os.path.isdir(path): pass else: raise def get_java_env(): JAVA_HOME = os.getenv('JAVA_HOME') if JAVA_HOME: return os.path.join(JAVA_HOME, 'bin', 'java') else: log('java and jar commands are not available. Please configure JAVA_HOME','exception') os.sys.exit(1) def get_class_path(paths): separator = ';' if sys.platform == 'win32' else ':'; return separator.join(paths) def get_jdk_options(): global conf_dict return [os.getenv('RANGER_PROPERTIES', ''),"-Dlogdir="+os.getenv("RANGER_LOG_DIR"),' -Dcatalina.base=' + conf_dict['EWS_ROOT'] ] """ ################################################ Ranger Policy Manager routines ################################################ """ def get_ranger_classpath(): global conf_dict EWS_ROOT = conf_dict['EWS_ROOT'] WEBAPP_ROOT = conf_dict['WEBAPP_ROOT'] cp = [ os.path.join(WEBAPP_ROOT, "WEB-INF", "classes", "conf"), os.path.join(EWS_ROOT,"lib","*"), EWS_ROOT, os.path.join(os.getenv('JAVA_HOME'), 'lib', '*')] class_path = get_class_path(cp) return class_path def populate_config_dict_from_env(): global config_dict conf_dict['RANGER_ADMIN_DB_HOST'] = os.getenv("RANGER_ADMIN_DB_HOST") conf_dict['RANGER_AUDIT_DB_HOST'] = os.getenv("RANGER_AUDIT_DB_HOST") #conf_dict['MYSQL_BIN'] = 'mysql.exe' #os.getenv("MYSQL_BIN") conf_dict['RANGER_DB_FLAVOR'] = os.getenv("RANGER_DB_FLAVOR") conf_dict['RANGER_AUDIT_DB_FLAVOR'] = os.getenv("RANGER_DB_FLAVOR") conf_dict['RANGER_ADMIN_DB_USERNAME'] = os.getenv("RANGER_ADMIN_DB_USERNAME") conf_dict['RANGER_ADMIN_DB_PASSWORD'] = os.getenv("RANGER_ADMIN_DB_PASSWORD") conf_dict['RANGER_ADMIN_DB_NAME'] = os.getenv("RANGER_ADMIN_DB_DBNAME") conf_dict['RANGER_AUDIT_DB_USERNAME'] = os.getenv("RANGER_AUDIT_DB_USERNAME") conf_dict['RANGER_AUDIT_DB_PASSWORD'] = os.getenv("RANGER_AUDIT_DB_PASSWORD") conf_dict['RANGER_AUDIT_DB_NAME'] = os.getenv("RANGER_AUDIT_DB_DBNAME") conf_dict['db_root_user'] = os.getenv("RANGER_DB_ROOT_USER") conf_dict['db_root_password'] = os.getenv("RANGER_ADMIN_DB_ROOT_PASSWORD") conf_dict['RANGER_ADMIN_DB_ROOT_PASSWORD'] = os.getenv("RANGER_ADMIN_DB_ROOT_PASSWORD") conf_dict['RANGER_AUDIT_DB_ROOT_PASSWORD'] = os.getenv("RANGER_AUDIT_DB_ROOT_PASSWORD") conf_dict['RANGER_ADMIN_HOME'] = os.getenv("RANGER_ADMIN_HOME") conf_dict['RANGER_AUTHENTICATION_METHOD'] = os.getenv("RANGER_AUTHENTICATION_METHOD") # LDAP Settings conf_dict['RANGER_LDAP_URL'] = os.getenv("RANGER_LDAP_URL") conf_dict['RANGER_LDAP_USERDNPATTERN'] = os.getenv("RANGER_LDAP_USERDNPATTERN") conf_dict['RANGER_LDAP_GROUPSEARCHBASE'] = os.getenv("RANGER_LDAP_GROUPSEARCHBASE") conf_dict['RANGER_LDAP_GROUPSEARCHFILTER'] = os.getenv("RANGER_LDAP_GROUPSEARCHFILTER") conf_dict['RANGER_ldap_GROUPROLEATTRIBUTE'] = os.getenv("RANGER_ldap_GROUPROLEATTRIBUTE") # AD Settings conf_dict['RANGER_LDAP_AD_DOMAIN'] = os.getenv("RANGER_LDAP_AD_DOMAIN") conf_dict['RANGER_LDAP_AD_URL'] = os.getenv("RANGER_LDAP_AD_URL") def populate_config_dict_from_file(): global config_dict RANGER_ADMIN_HOME = os.getenv("RANGER_ADMIN_HOME") read_config_file = open(os.path.join(RANGER_ADMIN_HOME,'bin','install_config.properties')) library_path = os.path.join(RANGER_ADMIN_HOME,"cred","lib","*") for each_line in read_config_file.read().split('\n') : if len(each_line) == 0 : continue # print 'each_line = ' + each_line key , value = each_line.strip().split("=",1) key = key.strip() if 'PASSWORD' in key: jceks_file_path = os.path.join(os.getenv('RANGER_HOME'), 'jceks','ranger_db.jceks') statuscode,value = call_keystore(library_path,key,'',jceks_file_path,'get') if statuscode == 1: value = '' value = value.strip() conf_dict[key] = value #if os.getenv("MYSQL_BIN") is not None: # conf_dict['MYSQL_BIN'] = os.getenv("MYSQL_BIN") #else: # os.sys.exit('Please set MYSQL_BIN variable in environment settings.') def init_variables(switch): global conf_dict if switch == 'service' : populate_config_dict_from_env() else: populate_config_dict_from_file() #INSTALL_DIR = os.path.join(conf_dict['RANGER_ADMIN_HOME'] , "app") INSTALL_DIR = conf_dict['RANGER_ADMIN_HOME'] EWS_ROOT = os.path.join(INSTALL_DIR , "ews") WEBAPP_ROOT = os.path.join(INSTALL_DIR , "ews" , "webapp") #if switch == "service": # war_file_path = os.path.join(conf_dict['RANGER_ADMIN_HOME'] , "war", "security-admin-web-*.war") # war_file_list = glob.glob(war_file_path) # conf_dict['war_file'] = war_file_list[0] conf_dict['EWS_ROOT'] = EWS_ROOT conf_dict['WEBAPP_ROOT']= WEBAPP_ROOT conf_dict['INSTALL_DIR']= INSTALL_DIR conf_dict['JAVA_BIN']= os.path.join(os.getenv("JAVA_HOME"),'bin','java.exe') conf_dict['DB_FLAVOR'] = os.getenv("RANGER_DB_FLAVOR") conf_dict['RANGER_DB_FLAVOR'] = os.getenv("RANGER_DB_FLAVOR") conf_dict['RANGER_AUDIT_DB_FLAVOR'] = os.getenv("RANGER_DB_FLAVOR") dir = os.path.join(os.getenv("RANGER_HOME"),"connector-jar") ews_dir = os.path.join(os.getenv("RANGER_ADMIN_HOME"),"ews","webapp","WEB-INF","lib") log(ews_dir,"info") if not os.path.exists(dir): os.makedirs(dir) layout_dir = os.path.dirname(os.getenv("HDP_LAYOUT")) files = os.listdir(layout_dir) if files: for filename in files: #log (filename,"info") if os.getenv("RANGER_DB_FLAVOR") == "MYSQL" or os.getenv("RANGER_AUDIT_DB_FLAVOR") == "MYSQL": f = re.match("^mysql-connector-java.*?.jar",filename) elif os.getenv("RANGER_DB_FLAVOR") == "ORACLE" or os.getenv("RANGER_AUDIT_DB_FLAVOR") == "ORACLE": f = re.match("^ojdbc.*?.jar",filename) elif os.getenv("RANGER_DB_FLAVOR") == "POSTGRES" or os.getenv("RANGER_AUDIT_DB_FLAVOR") == "POSTGRES": f = re.match("^postgresql-connector-jdbc.*?.jar",filename) elif os.getenv("RANGER_DB_FLAVOR") == "MSSQL" or os.getenv("RANGER_AUDIT_DB_FLAVOR") == "MSSQL": f = re.match("^sqljdbc.*?.jar",filename) if f: src = os.path.join(layout_dir,filename) shutil.copy2(src, dir) shutil.copy2(src, ews_dir) conf_dict['SQL_CONNECTOR_JAR'] = os.path.join(dir,filename) conf_dict['db_host']=os.getenv("RANGER_ADMIN_DB_HOST") + ":" + os.getenv("RANGER_ADMIN_DB_PORT") conf_dict['db_name']=os.getenv("RANGER_ADMIN_DB_DBNAME") conf_dict['db_user']=os.getenv("RANGER_ADMIN_DB_USERNAME") conf_dict['db_password']=os.getenv("RANGER_ADMIN_DB_PASSWORD") conf_dict['audit_db_name']=os.getenv("RANGER_AUDIT_DB_DBNAME") conf_dict['audit_db_user']=os.getenv("RANGER_AUDIT_DB_USERNAME") conf_dict['audit_db_password']=os.getenv("RANGER_AUDIT_DB_PASSWORD") conf_dict['RANGER_ADMIN_DB_PORT']=os.getenv("RANGER_ADMIN_DB_PORT") conf_dict['RANGER_AUDIT_DB_PORT']=os.getenv("RANGER_AUDIT_DB_PORT") db_dir = os.path.join(conf_dict['RANGER_ADMIN_HOME'] , "db") conf_dict['mysql_core_file']=os.path.join(db_dir,'mysql','xa_core_db.sql') conf_dict['mysql_audit_file']=os.path.join(db_dir,'mysql','xa_audit_db.sql') conf_dict['oracle_core_file']=os.path.join(db_dir,'oracle','xa_core_db_oracle.sql') conf_dict['oracle_audit_file']=os.path.join(db_dir,'oracle','xa_audit_db_oracle.sql') conf_dict['postgres_core_file']=os.path.join(db_dir,'postgres','xa_core_db_postgres.sql') conf_dict['postgres_audit_file']=os.path.join(db_dir,'postgres','xa_audit_db_postgres.sql') conf_dict['sqlserver_core_file']=os.path.join(db_dir,'sqlserver','xa_core_db_sqlserver.sql') conf_dict['sqlserver_audit_file']=os.path.join(db_dir,'sqlserver','xa_audit_db_sqlserver.sql') conf_dict['sqlanywhere_core_file']= os.path.join(db_dir,'sqlanywhere','xa_core_db_sqlanywhere.sql') conf_dict['sqlanywhere_audit_file']= os.path.join(db_dir, 'sqlanywhere','xa_audit_db_sqlanywhere.sql') #conf_dict['db_core_file'] = os.path.join(db_dir, "xa_core_db.sql") #conf_dict['db_create_user_file'] = os.path.join(db_dir, "create_dev_user.sql") #conf_dict['db_audit_file'] = os.path.join(db_dir, "xa_audit_db.sql") #conf_dict['db_asset_file'] = os.path.join(db_dir, "reset_asset.sql") #log("config is : " , "debug") #for x in conf_dict: # log(x + " : " + conf_dict[x], "debug") #TODO fix the base_dir part def setup_install_files(): global conf_dict EWS_ROOT = conf_dict['EWS_ROOT'] INSTALL_DIR = conf_dict['INSTALL_DIR'] WEBAPP_ROOT = conf_dict['WEBAPP_ROOT'] EWS_LIB_DIR = os.path.join(EWS_ROOT,"lib") #EWS_LOG_DIR = os.path.join(EWS_ROOT,"logs") RANGER_ADMIN_HOME = os.getenv("RANGER_ADMIN_HOME") log("Setting up installation files and directory", "debug") if not os.path.isdir(INSTALL_DIR): log("creating Install dir : " + INSTALL_DIR, "debug") os.makedirs(INSTALL_DIR) if not os.path.isdir(EWS_ROOT): log("creating EWS dir : " + EWS_ROOT, "debug") os.makedirs(EWS_ROOT) if not os.path.isdir(WEBAPP_ROOT): log("creating WEBAPP dir : " + WEBAPP_ROOT, "debug") os.makedirs(WEBAPP_ROOT) if not os.path.isdir(os.path.join(WEBAPP_ROOT,"WEB-INF","classes","conf")): log("creating conf dir : " + WEBAPP_ROOT, "debug") os.makedirs(os.path.join(WEBAPP_ROOT,"WEB-INF","classes","conf")) if not os.path.isdir(EWS_LIB_DIR): log("creating EWS_LIB_DIR dir : " + EWS_LIB_DIR, "debug") os.makedirs(EWS_LIB_DIR) #if not os.path.isdir(EWS_LOG_DIR): # log("creating EWS_LOG_DIR dir : " + EWS_LOG_DIR, "debug") # os.makedirs(EWS_LOG_DIR) #log("copying libraries ", "debug") #copy_files(os.path.join(RANGER_ADMIN_HOME,"ews","lib"), EWS_LIB_DIR) #log("copying xapolicymgr.properties file", "debug") #shutil.copyfile(os.path.join(RANGER_ADMIN_HOME,"ews","xapolicymgr.properties"), os.path.join(EWS_ROOT,"xapolicymgr.properties")) log("copying conf.dist/ to conf/", "debug") copy_files(os.path.join(WEBAPP_ROOT,"WEB-INF","classes","conf.dist"), os.path.join(WEBAPP_ROOT,"WEB-INF","classes","conf")) log(" Setting up installation files and directory DONE", "info"); pass def write_config_to_file(): global conf_dict RANGER_ADMIN_HOME = os.getenv("RANGER_ADMIN_HOME") library_path = os.path.join(RANGER_ADMIN_HOME, 'cred', 'lib','*') jceks_file_path = os.path.join(os.getenv("RANGER_HOME"), "jceks") if not os.path.isdir(jceks_file_path): mkdir_p(jceks_file_path) jceks_file_path = os.path.join(jceks_file_path,'ranger_db.jceks') file_path = os.path.dirname(os.path.realpath(__file__)) write_conf_to_file = os.path.join(file_path, "install_config.properties") open(write_conf_to_file,'wb') for key,value in conf_dict.items(): if 'PASSWORD' in key : #call_keystore(library_path,key,value,jceks_file_path,'create') value='' ModConfig(write_conf_to_file , key,value) def init_logfiles(): FORMAT = '%(asctime)-15s %(message)s' logging.basicConfig(format=FORMAT, level=logging.DEBUG) def sanity_check_configure_files(): global conf_dict log("Checking MYSQL executable and db files!!", 'debug') db_core_file = conf_dict['db_core_file'] db_create_user_file = conf_dict['db_create_user_file'] db_audit_file = conf_dict['db_audit_file'] db_asset_file = conf_dict['db_asset_file'] #if os.path.isfile(MYSQL_BIN): # log("MYSQL Client bin : " + MYSQL_BIN + " file found", 'info') #else: # os.sys.exit('MYSQL_BIN: ' + MYSQL_BIN + ' file does not exist') if os.path.isfile(db_core_file): log("DB core file " + db_core_file + " file found", 'info') else: log('db_core_file: ' + db_core_file + ' file does not exist','exception') os.sys.exit(1) if os.path.isfile(db_create_user_file): log("DB create user file " + db_create_user_file + " file found", 'info') else: log('db_create_user_file: ' + db_create_user_file + ' file does not exist','exception') os.sys.exit(1) if os.path.isfile(db_audit_file): log("DB audit file " + db_audit_file + " file found", 'info') else: log('db_audit_file: ' + db_audit_file + ' file does not exist','exception') os.sys.exit(1) if os.path.isfile(db_asset_file): log("DB asset file " + db_asset_file + " file found", 'info') else: log('db_asset_file: ' + db_asset_file + ' file does not exist','exception') os.sys.exit(1) def get_mysql_cmd(user, password, host): global conf_dict MYSQL_BIN = conf_dict["MYSQL_BIN"] cmdArr = [ MYSQL_BIN ,'-B' ,'--user=%s' %user, '--password=%s' %password, '--host=%s' %host , '--skip-column-names'] return cmdArr def create_mysql_user(db_name, db_user, db_password, db_host, db_root_password): global conf_dict cmdArr = [] MYSQL_BIN = conf_dict["MYSQL_BIN"] hosts_arr =["%", "localhost"] #check_mysql_password() ### From properties file log("\nCreating MySQL user "+db_user+" (using root priviledges)\n", 'debug') for host in hosts_arr: cmdArr = get_mysql_cmd('root', db_root_password, db_host) #subprocess.call(["mysql", "-u", username, "-p%s" % password, "-e", "SELECT @@hostname"] cmdArr.extend(["-e", "select count(*) from mysql.user where user='%s' and host='%s'" %(db_user, host)]) output = subprocess.check_output(cmdArr) if output.strip("\n\r") is "1": log( "\nMYSQL User already exists!\n", "debug") else: cmdArr = get_mysql_cmd('root', db_root_password, db_host) if db_password == "": #cmdStr = '"' + MYSQL_BIN + '"' + ' -B -u root --password='+db_root_password+' -h '+db_host+' -e \'create user "'+db_user+'"@"'+db_host+'";\'' cmdArr.extend(["-e", "create user %s@%s" %(db_user, host)]) else: cmdArr.extend(["-e", "create user '%s'@'%s' identified by '%s' " %(db_user, host, db_password)]) #cmdStr = '"' + MYSQL_BIN + '"' + ' -B -u root --password='+db_root_password+' -h '+db_host+' -e \'create user "'+db_user+'"@"'+db_host+'" identified by "'+db_password+'";\'' ret = subprocess.check_call(cmdArr) if ret == 0: #mysqlquery="GRANT ALL ON "+db_name+".* TO \'"+db_user+"'@'"+db_host+"' ;\ #grant all privileges on "+db_name+".* to '"+db_user+"'@'"+db_host+"' with grant option;\ #FLUSH PRIVILEGES;" cmdArr = get_mysql_cmd('root', db_root_password, db_host) cmdArr.extend(["-e", "GRANT ALL ON *.* TO '%s'@'%s'; grant all privileges on *.* to '%s'@'%s' with grant option; FLUSH PRIVILEGES" %(db_user,host,db_user,host)]) ret = subprocess.check_call(cmdArr) if ret == 0: log("\nCreating MySQL user '" + db_user + "' (using root priviledges for % hosts ) DONE\n", "info") else: log("\nCreating MySQL user '" + db_user + "' (using root priviledges) FAILED\n", "info") sys.exit(1) def check_mysql_password (): global conf_dict db_root_password = conf_dict["RANGER_ADMIN_DB_ROOT_PASSWORD"] MYSQL_HOST = conf_dict['MYSQL_HOST'] MYSQL_BIN = conf_dict['MYSQL_BIN'] log("Checking MYSQL root password : **** ","debug") cmdStr = "\""+MYSQL_BIN+"\""+" -u root --password="+db_root_password+" -h "+MYSQL_HOST+" -s -e \"select version();\"" status, output = getstatusoutput(cmdStr) print("Status: " + str(status)) print("output: " + str(output)) if status == 0: log("Checking MYSQL root password DONE", "info") else: log("COMMAND: mysql -u root --password=..... -h " + MYSQL_HOST + " : FAILED with error message:\n*********************************\n" + output + "\n*********************************\n", "exception") sys.exit(1) #def check_mysql_user_password(): # global conf_dict # db_user = conf_dict["RANGER_ADMIN_DB_USERNAME"] # db_password = conf_dict["RANGER_ADMIN_DB_PASSWORD"] # db_root_password = conf_dict["RANGER_ADMIN_DB_ROOT_PASSWORD"] # MYSQL_HOST = conf_dict['MYSQL_HOST'] # # db = MySQLdb.connect(host=MYSQL_HOST, user=db_user, passwd=db_password) # if db: # log("Checking MYSQL "+ db_user +" password DONE", "info") # else: # log("COMMAND: mysql -u " + db_user + " --password=..... -h " + MYSQL_HOST + " : FAILED with error message:\n*********************************\n" + {msg} + "\n*********************************\n", "exception") # #def check_mysql_audit_user_password(): # global conf_dict # audit_db = conf_dict["RANGER_AUDIT_DB_NAME"] # audit_db_user = conf_dict["RANGER_AUDIT_DB_USERNAME"] # audit_db_password = conf_dict["RANGER_AUDIT_DB_PASSWORD"] # MYSQL_HOST = conf_dict['MYSQL_HOST'] # # try: # db = MySQLdb.connect(host=MYSQL_HOST, user=audit_db_user, passwd=audit_db_password, db=audit_db) # except MySQLdb.Error, e: # exceptnMsg = "Error %d: %s" % (e.args[0], e.args[1]) # log("COMMAND: mysql -u " + audit_db_user + " --password=..... -h " + MYSQL_HOST + " : FAILED with error message:\n*********************************\n" + exceptnMsg + "\n*********************************\n", "exception") # sys.exit (1) # if db: # log("Checking Ranger Audit Table owner password DONE", "info") #def exec_sql_file(cursor, sql_file): # log( "[INFO] Executing SQL script file: " + sql_file, "debug") # statement = "" # for line in open(sql_file): # if re.match(r'--', line): # ignore sql comment lines # continue # if not re.search(r'[^-;]+;', line): # keep appending lines that don't end in ';' # statement = statement + line # else: # when you get a line ending in ';' then exec statement and reset for next statement # statement = statement + line # #print "\n\n[DEBUG] Executing SQL statement:\n%s" % (statement) # try: # cursor.execute(statement) # print cursor # except MySQLdb.Error, e: # log( "[WARN] MySQLError during execute statement \n\tArgs: " + str(e.args), "debug") # statement = "" def upgrade_db(): global config_dict db_user = conf_dict["RANGER_ADMIN_DB_USERNAME"] db_password = conf_dict["RANGER_ADMIN_DB_PASSWORD"] db_root_password = conf_dict["RANGER_ADMIN_DB_ROOT_PASSWORD"] db_name = conf_dict["RANGER_ADMIN_DB_NAME"] MYSQL_BIN = conf_dict['MYSQL_BIN'] MYSQL_HOST = conf_dict['RANGER_ADMIN_DB_HOST'] log("\nCreating Baseline DB upgrade ... \n", "debug") DBVERSION_CATALOG_CREATION = os.path.join(conf_dict['RANGER_DB_DIR'], 'create_dbversion_catalog.sql') PATCHES_PATH = os.path.join(conf_dict['RANGER_DB_DIR'], 'patches') if os.path.isfile(DBVERSION_CATALOG_CREATION): #import sql file proc = subprocess.Popen([MYSQL_BIN, "--user=%s" % db_user, "--host=%s" %MYSQL_HOST, "--password=%s" % db_password, db_name], stdin=subprocess.PIPE, stdout=subprocess.PIPE) out, err = proc.communicate(file(DBVERSION_CATALOG_CREATION).read()) log("\nBaseline DB upgraded successfully\n", "info") #first get all patches and then apply each patch files = os.listdir(PATCHES_PATH) # files: coming from os.listdir() sorted alphabetically, thus not numerically sorted_files = sorted(files, key=lambda x: str(x.split('.')[0])) for filename in sorted_files: currentPatch = PATCHES_PATH + "/"+filename if os.path.isfile(currentPatch): #apply_patches(cursor,currentPatch) proc = subprocess.Popen([MYSQL_BIN, "--user=%s" % db_user, "--host=%s" %MYSQL_HOST, "--password=%s" % db_password, db_name], stdin=subprocess.PIPE, stdout=subprocess.PIPE) out, err = proc.communicate(file(currentPatch).read()) log( "\nPatch applied: " + currentPatch +"\n", "debug") def verify_db (db_user, db_password, db_name, db_host): global conf_dict MYSQL_BIN = conf_dict['MYSQL_BIN'] log("\nVerifying Database: " + db_name+"\n","debug") cmdArr = get_mysql_cmd(db_user, db_password, db_host) cmdArr.extend(["-e", "show databases like '%s'" %(db_name)]) output = subprocess.check_output(cmdArr) if output.strip('\r\n') == db_name: return True else: return False def import_db (): global conf_dict db_user = conf_dict["RANGER_ADMIN_DB_USERNAME"] db_password = conf_dict["RANGER_ADMIN_DB_PASSWORD"] db_root_password = conf_dict["RANGER_ADMIN_DB_ROOT_PASSWORD"] db_name = conf_dict['RANGER_ADMIN_DB_NAME'] MYSQL_HOST = conf_dict['RANGER_ADMIN_DB_HOST'] db_core_file = conf_dict['db_core_file'] db_asset_file = conf_dict['db_asset_file'] MYSQL_BIN = conf_dict['MYSQL_BIN'] log ("\nImporting to Database: " + db_name,"debug"); if verify_db(db_user, db_password, db_name, MYSQL_HOST): log("\nDatabase "+db_name + " already exists. Ignoring import_db\n","info") else: log("\nDatabase does not exist. Creating databse : \n" + db_name,"info") cmdArr = get_mysql_cmd('root', db_root_password, MYSQL_HOST) cmdArr.extend(["-e", "create database %s" %(db_name)]) ret = subprocess.check_call(cmdArr) if ret != 0: log("\nDatabase creation failed!!\n","exception") sys.exit(1) ##execute each line from sql file to import DB if os.path.isfile(db_core_file): log("Importing database : " + db_name + " from file: " + db_core_file,"info") proc = subprocess.Popen([MYSQL_BIN, "--user=%s" % db_user, "--host=%s" %MYSQL_HOST, "--password=%s" % db_password, db_name], stdin=subprocess.PIPE, stdout=subprocess.PIPE) out, err = proc.communicate(file(db_core_file).read()) if (proc.returncode == 0): log("\nAdmin db file Imported successfully\n","info") else: log("\nAdmin db file Import failed!\n","info") sys.exit(1) else: log("\nImport sql file not found\n","exception") sys.exit(1) if os.path.isfile(db_asset_file): proc = subprocess.Popen([MYSQL_BIN, "--user=%s" % db_user, "--host=%s" %MYSQL_HOST, "--password=%s" % db_password, db_name], stdin=subprocess.PIPE, stdout=subprocess.PIPE) out, err = proc.communicate(file(db_asset_file).read()) if (proc.returncode == 0): log("\nAsset file Imported successfully\n","info") else: log("\nAsset file Import filed!\n","info") sys.exit(1) else: log("\nImport asset sql file not found\n","exception") sys.exit(1) #def extract_war(): # global conf_dict # war_file = conf_dict['war_file'] # WEBAPP_ROOT = conf_dict['WEBAPP_ROOT'] # # if os.path.isfile(war_file): # log("Extract War file " + war_file + " to " + WEBAPP_ROOT,"info") # else: # log(war_file + " file not found!","exception") # # if os.path.isdir(WEBAPP_ROOT): # with zipfile.ZipFile(war_file, "r") as z: # z.extractall(WEBAPP_ROOT) # log("Extract War file " + war_file + " to " + WEBAPP_ROOT + " DONE! ","info") # if os.path.isfile ( os.path.join(WEBAPP_ROOT, "WEB-INF", "logback.xml.prod")) : # shutil.copyfile(os.path.join(WEBAPP_ROOT, "WEB-INF", "logback.xml.prod"), os.path.join(WEBAPP_ROOT, "WEB-INF", "logback.xml")) # def copy_mysql_connector(): # log("Copying MYSQL Connector to "+app_home+"/WEB-INF/lib ","info") # shutil.copyfile(MYSQL_CONNECTOR_JAR, app_home+"/WEB-INF/lib/"+MYSQL_CONNECTOR_JAR) # if os.path.isfile(app_home+"/WEB-INF/lib/"+MYSQL_CONNECTOR_JAR): # log("Copying MYSQL Connector to app_home/WEB-INF/lib DONE","info"); # else: # log("Copying MYSQL Connector to "+app_home+"/WEB-INF/lib failed","exception") #Update Properties to File #1 -> propertyName 2 -> newPropertyValue 3 -> fileName def updatePropertyToFile(propertyName, newPropertyValue, fileName): replaceStr = propertyName +"="+ newPropertyValue log("replaceStr: " + replaceStr, "debug") successMsg = "property : " + propertyName + " not found!" for line in fileinput.input(fileName, inplace = 1): # Does a list of files, and writes redirects STDOUT to the file in question if line.replace(propertyName, replaceStr): successMsg = "File " + fileName + " Updated successfully : "+ propertyName log(successMsg, "info") pass def update_xapolicymgr_properties(): global conf_dict WEBAPP_ROOT = conf_dict['WEBAPP_ROOT'] xapolicymgr_properties = os.path.join(WEBAPP_ROOT, "WEB-INF", "classes", "conf", "ranger_webserver.properties") log("xapolicymgr_properties: " + xapolicymgr_properties, "debug") ModConfig(xapolicymgr_properties,"xa.webapp.dir", WEBAPP_ROOT.replace('\\','/' )) def updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file): ret = subprocess.call(['python', '%s\\update_property.py' %os.getenv("RANGER_ADMIN_HOME"), propertyName ,newPropertyValue ,to_file]) if ret == 0: log("Updated property for :"+to_file,"info") else: log("Update property failed for :"+to_file,"info") sys.exit(1) def update_properties(): global conf_dict sys_conf_dict={} RANGER_DB_FLAVOR = conf_dict["RANGER_DB_FLAVOR"] RANGER_AUDIT_DB_FLAVOR = conf_dict["RANGER_DB_FLAVOR"] MYSQL_HOST = conf_dict["RANGER_ADMIN_DB_HOST"] WEBAPP_ROOT = conf_dict["WEBAPP_ROOT"] db_user = conf_dict["RANGER_ADMIN_DB_USERNAME"] db_password = conf_dict["RANGER_ADMIN_DB_PASSWORD"] db_name = conf_dict["RANGER_ADMIN_DB_NAME"] RANGER_ADMIN_DB_PORT = conf_dict["RANGER_ADMIN_DB_PORT"] RANGER_AUDIT_DB_PORT = conf_dict["RANGER_AUDIT_DB_PORT"] audit_db_user = conf_dict["RANGER_AUDIT_DB_USERNAME"] audit_db_password = conf_dict["RANGER_AUDIT_DB_PASSWORD"] audit_db_name = conf_dict["RANGER_AUDIT_DB_NAME"] to_file_ranger = os.path.join(WEBAPP_ROOT, "WEB-INF", "classes", "conf", "ranger-admin-site.xml") newPropertyValue='' to_file_default = os.path.join(WEBAPP_ROOT, "WEB-INF", "classes", "conf", "ranger-admin-default-site.xml") if os.path.isfile(to_file_ranger): log("to_file_ranger: " + to_file_ranger + " file found", "info") else: log("to_file_ranger: " + to_file_ranger + " does not exists", "warning") if os.path.isfile(to_file_default): log("to_file_default: " + to_file_default + " file found", "info") else: log("to_file_default: " + to_file_default + " does not exists", "warning") log("SQL_HOST is : " + MYSQL_HOST,"debug") if RANGER_DB_FLAVOR == "MYSQL": propertyName="ranger.jpa.jdbc.url" newPropertyValue="jdbc:log4jdbc:mysql://%s:%s/%s" %(MYSQL_HOST ,RANGER_ADMIN_DB_PORT, db_name) updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.user" newPropertyValue=db_user updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.user" newPropertyValue=audit_db_user updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.url" newPropertyValue="jdbc:log4jdbc:mysql://%s:%s/%s" %(MYSQL_HOST, RANGER_AUDIT_DB_PORT, audit_db_name) updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.dialect" newPropertyValue="org.eclipse.persistence.platform.database.MySQLPlatform" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.audit.jdbc.dialect" newPropertyValue="org.eclipse.persistence.platform.database.MySQLPlatform" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.jdbc.driver" newPropertyValue="net.sf.log4jdbc.DriverSpy" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.driver" newPropertyValue="net.sf.log4jdbc.DriverSpy" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) elif RANGER_DB_FLAVOR == "ORACLE": propertyName="ranger.jpa.jdbc.url" #if MYSQL_HOST.count(":") == 2: if MYSQL_HOST.count(":") == 2 or MYSQL_HOST.count(":") == 0: #jdbc:oracle:thin:@[HOST][:PORT]:SID or #jdbc:oracle:thin:@GL cstring="jdbc:oracle:thin:@%s" %(MYSQL_HOST) else: #jdbc:oracle:thin:@//[HOST][:PORT]/SERVICE cstring="jdbc:oracle:thin:@//%s" %(MYSQL_HOST) newPropertyValue=cstring updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.user" newPropertyValue=db_user updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.user" newPropertyValue=audit_db_user updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.url" newPropertyValue=cstring updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.dialect" newPropertyValue="org.eclipse.persistence.platform.database.OraclePlatform" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.audit.jdbc.dialect" newPropertyValue="org.eclipse.persistence.platform.database.OraclePlatform" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.jdbc.driver" newPropertyValue="oracle.jdbc.OracleDriver" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.driver" newPropertyValue="oracle.jdbc.OracleDriver" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) elif RANGER_DB_FLAVOR == "POSTGRES": propertyName="ranger.jpa.jdbc.url" newPropertyValue="jdbc:postgresql://%s:%s/%s" %(MYSQL_HOST, RANGER_ADMIN_DB_PORT, db_name) updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.user" newPropertyValue=db_user updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.user" newPropertyValue=audit_db_user updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.url" newPropertyValue="jdbc:postgresql://%s:%s/%s" %(MYSQL_HOST, RANGER_AUDIT_DB_PORT, audit_db_name) updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.dialect" newPropertyValue="org.eclipse.persistence.platform.database.PostgreSQLPlatform" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.audit.jdbc.dialect" newPropertyValue="org.eclipse.persistence.platform.database.PostgreSQLPlatform" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.jdbc.driver" newPropertyValue="org.postgresql.Driver" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.driver" newPropertyValue="org.postgresql.Driver" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) elif RANGER_DB_FLAVOR == "MSSQL": propertyName="ranger.jpa.jdbc.url" newPropertyValue="jdbc:sqlserver://%s:%s;databaseName=%s" %(MYSQL_HOST, RANGER_ADMIN_DB_PORT, db_name) updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.user" newPropertyValue=db_user updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.user" newPropertyValue=audit_db_user updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.url" newPropertyValue="jdbc:sqlserver://%s:%s;databaseName=%s" % (MYSQL_HOST, RANGER_AUDIT_DB_PORT, audit_db_name) updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.dialect" newPropertyValue="org.eclipse.persistence.platform.database.SQLServerPlatform" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.audit.jdbc.dialect" newPropertyValue="org.eclipse.persistence.platform.database.SQLServerPlatform" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.jdbc.driver" newPropertyValue="com.microsoft.sqlserver.jdbc.SQLServerDriver" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.driver" newPropertyValue="com.microsoft.sqlserver.jdbc.SQLServerDriver" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) if (os.path.isfile(os.getenv("RANGER_ADMIN_CRED_KEYSTORE_FILE"))): propertyName="ranger.credential.provider.path" newPropertyValue=os.getenv("RANGER_ADMIN_CRED_KEYSTORE_FILE") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.jdbc.credential.alias" newPropertyValue="ranger.jpa.jdbc.password" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.credential.provider.path" newPropertyValue=os.getenv("RANGER_ADMIN_CRED_KEYSTORE_FILE") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.jdbc.password" newPropertyValue="_" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.credential.alias" newPropertyValue="ranger.jpa.audit.jdbc.password" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_default) propertyName="ranger.jpa.audit.jdbc.password" newPropertyValue="_" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) else: propertyName="ranger.jpa.jdbc.password" newPropertyValue=os.getenv("RANGER_ADMIN_DB_PASSWORD") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.jpa.audit.jdbc.password" newPropertyValue=os.getenv("RANGER_AUDIT_DB_PASSWORD") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) if os.getenv("RANGER_AUTHENTICATION_METHOD") == "LDAP": password_validation(os.getenv("RANGER_LDAP_BIND_PASSWORD"), "LDAP_BIND") propertyName="ranger.authentication.method" newPropertyValue=os.getenv("RANGER_AUTHENTICATION_METHOD") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.url" newPropertyValue=os.getenv("RANGER_LDAP_URL") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.user.dnpattern" newPropertyValue=os.getenv("RANGER_LDAP_USERDNPATTERN") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.group.searchbase" newPropertyValue=os.getenv("RANGER_LDAP_GROUPSEARCHBASE") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.group.searchfilter" newPropertyValue=os.getenv("RANGER_LDAP_GROUPSEARCHFILTER") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.group.roleattribute" newPropertyValue=os.getenv("RANGER_LDAP_GROUPROLEATTRIBUTE") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.base.dn" newPropertyValue=os.getenv("RANGER_LDAP_BASE_DN") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.bind.dn" newPropertyValue=os.getenv("RANGER_LDAP_BIND_DN") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.bind.password" newPropertyValue="_" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.referral" newPropertyValue=os.getenv("RANGER_LDAP_REFERRAL") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.user.searchfilter" newPropertyValue=os.getenv("RANGER_LDAP_USERSEARCHFILTER") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) elif os.getenv("RANGER_AUTHENTICATION_METHOD") == "ACTIVE_DIRECTORY": password_validation(os.getenv("RANGER_LDAP_AD_BIND_PASSWORD"), "AD_BIND") propertyName="ranger.authentication.method" newPropertyValue=os.getenv("RANGER_AUTHENTICATION_METHOD") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.ad.domain" newPropertyValue=os.getenv("RANGER_LDAP_AD_DOMAIN") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.ad.url" newPropertyValue=os.getenv("RANGER_LDAP_AD_URL") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.ad.base.dn" newPropertyValue=os.getenv("RANGER_LDAP_AD_BASE_DN") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.ad.bind.dn" newPropertyValue=os.getenv("RANGER_LDAP_AD_BIND_DN") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.ad.bind.password" newPropertyValue="_" updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.ad.referral" newPropertyValue=os.getenv("RANGER_LDAP_AD_REFERRAL") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) propertyName="ranger.ldap.ad.user.searchfilter" newPropertyValue=os.getenv("RANGER_LDAP_AD_USERSEARCHFILTER") updatePropertyToFilePy(propertyName ,newPropertyValue ,to_file_ranger) def setup_authentication(authentication_method, xmlPath): if authentication_method == "UNIX": # log("Setting up UNIX authentication for : " + xmlPath,"debug") # appContextPath = xmlPath + "/META-INF/security-applicationContext.xml" # beanSettingPath = xmlPath + "/META-INF/contextXML/unix_bean_settings.xml" # secSettingPath = xmlPath + "/META-INF/contextXML/unix_security_settings.xml" # ## Logic is to find UNIX_BEAN_SETTINGS_START,UNIX_SEC_SETTINGS_START from appContext xml file and append # ## the xml properties from unix bean settings file # if os.path.isfile(appContextPath) and os.path.isfile(unixSettingPath): # beanStrToBeAppended = open(beanSettingPath).read() # secStrToBeAppended = open(secSettingPath).read() # fileObj = open(appContextPath) # for line in fileObj.read().split(';\n'): # beanLineToAppend = line.match("UNIX_BEAN_SETTINGS_START") # beanLineToAppend.apend(beanStrToBeAppended) # secLineToAppend = line.match("UNIX_SEC_SETTINGS_START") # secLineToAppend.append(secStrToBeAppended) # # fileObj.close() # sys.exit(0); pass elif authentication_method == "LDAP": log("Setting up authentication for : " + xmlPath,"debug") log("Setting up "+authentication_method+" authentication for : " + xmlPath,"debug") appContextPath = os.path.join(xmlPath, "WEB-INF", "classes", "conf", "security-applicationContext.xml") beanSettingPath = os.path.join(xmlPath, "META-INF","contextXML","ldap_bean_settings.xml") secSettingPath = os.path.join(xmlPath , "META-INF","contextXML","ldap_security_settings.xml") ## Logic is to find LDAP_BEAN_SETTINGS_START,LDAP_SEC_SETTINGS_START from appContext xml file and append ## the xml properties from unix bean settings file if os.path.isfile(appContextPath) and os.path.isfile(beanSettingPath): beanStrToBeAppended = open(beanSettingPath).read() secStrToBeAppended = open(secSettingPath).read() fileObj = open(appContextPath) data = '' for line in fileObj.read().split('\n'): if ("LDAP_BEAN_SETTINGS_START") in line: line = line + '\n' + beanStrToBeAppended if ("LDAP_SEC_SETTINGS_START") in line: line = line + '\n' + secStrToBeAppended if data == '': data = line else: data = data + '\n' + line fileObj.close() fileObj = open(appContextPath,'w') fileObj.writelines(data) fileObj.close() elif authentication_method == "ACTIVE_DIRECTORY": log("Setting up "+authentication_method+" authentication for : " + xmlPath,"debug") appContextPath = os.path.join(xmlPath, "WEB-INF", "classes", "conf", "security-applicationContext.xml") beanSettingPath = os.path.join(xmlPath , "META-INF","contextXML","ad_bean_settings.xml") secSettingPath = os.path.join(xmlPath , "META-INF","contextXML","ad_security_settings.xml") ## Logic is to find AD_BEAN_SETTINGS_START,AD_SEC_SETTINGS_START from appContext xml file and append ## the xml properties from unix bean settings file if os.path.isfile(appContextPath) and os.path.isfile(beanSettingPath): beanStrToBeAppended = open(beanSettingPath).read() secStrToBeAppended = open(secSettingPath).read() fileObj = open(appContextPath) data = '' for line in fileObj.read().split('\n'): if ("AD_BEAN_SETTINGS_START") in line : line = line + '\n'+ beanStrToBeAppended if ("AD_SEC_SETTINGS_START") in line: line = line + '\n' + secStrToBeAppended if data == '': data = line else: data = data + '\n' + line fileObj.close() fileObj = open(appContextPath,'w') fileObj.writelines(data) fileObj.close() elif authentication_method == "NONE": log("Authentication Method: "+authentication_method+" authentication for : " + xmlPath,"debug") #pass # def do_authentication_setup(): global conf_dict webappRoot = conf_dict['WEBAPP_ROOT'] sys_conf_dict={} # ##Written new function to perform authentication setup for all cases authentication_method = conf_dict['RANGER_AUTHENTICATION_METHOD'] log("Starting setup based on user authentication method = " + authentication_method,"debug") setup_authentication(authentication_method, webappRoot) # ldap_file= os.path.join(webappRoot ,"WEB-INF","resources","xa_ldap.properties") ldap_file= os.path.join(webappRoot, "WEB-INF", "classes", "conf", "xa_ldap.properties") if os.path.isfile(ldap_file): log(ldap_file + " file found", "info") else: log(ldap_file + " does not exists", "warning") """ config = StringIO.StringIO() config.write('[LDAP_AD_CONF]\n') config.write(open(ldap_file).read()) config.seek(0, os.SEEK_SET) ##Now parse using configparser cObj = ConfigParser.ConfigParser() cObj.optionxform = str cObj.readfp(config) options = cObj.options('LDAP_AD_CONF') for option in options: value = cObj.get('LDAP_AD_CONF', option) sys_conf_dict[option] = value cObj.set("LDAP_AD_CONF",option, value) log("LDAP file : "+ ldap_file + " file found", "info") """ if authentication_method == "LDAP": log("Loading LDAP attributes and properties", "debug"); newPropertyValue='' ########## propertyName="xa_ldap_url" newPropertyValue=conf_dict['RANGER_LDAP_URL'] # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) ########### propertyName="xa_ldap_userDNpattern" newPropertyValue=conf_dict['RANGER_LDAP_USERDNPATTERN'] # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) ########### propertyName="xa_ldap_groupSearchBase" newPropertyValue=conf_dict['RANGER_LDAP_GROUPSEARCHBASE'] # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) ########### propertyName="xa_ldap_groupSearchFilter" newPropertyValue=conf_dict['RANGER_LDAP_GROUPSEARCHFILTER'] # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) ########### propertyName="xa_ldap_groupRoleAttribute" newPropertyValue=conf_dict['RANGER_ldap_GROUPROLEATTRIBUTE'] # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) ########### propertyName="authentication_method" newPropertyValue=authentication_method # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) else: log( "LDAP file: "+ ldap_file +" does not exists","exception") if authentication_method == "ACTIVE_DIRECTORY": log("[I] Loading ACTIVE DIRECTORY attributes and properties", "debug") newPropertyValue='' ldap_file= os.path.join(webappRoot, "WEB-INF", "classes", "conf", "xa_ldap.properties") if os.path.isfile(ldap_file): log("LDAP file : "+ ldap_file + " file found", "info") propertyName="xa_ldap_ad_url" newPropertyValue=conf_dict['RANGER_LDAP_AD_URL'] # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) ########### propertyName="xa_ldap_ad_domain" newPropertyValue=conf_dict['RANGER_LDAP_AD_DOMAIN'] # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) ########### propertyName="authentication_method" newPropertyValue=authentication_method # cObj.set('LDAP_AD_CONF',propertyName,newPropertyValue) ModConfig(ldap_file,propertyName,newPropertyValue) else: log(ldap_file + " does not exists", "exception") # with open(ldap_file, 'wb') as configfile: # cObj.write(configfile) # # #if authentication_method == "UNIX": # ## I think it is not needed for Windows # ##do_unixauth_setup # log("Finished setup based on user authentication method=authentication_method", "info") #pass def setup_audit_user_db(): global conf_dict MYSQL_BIN = conf_dict['MYSQL_BIN'] MYSQL_HOST = conf_dict['RANGER_AUDIT_DB_HOST'] db_root_password = conf_dict["RANGER_AUDIT_DB_ROOT_PASSWORD"] audit_db_user = conf_dict["RANGER_AUDIT_DB_USERNAME"] audit_db_password = conf_dict["RANGER_AUDIT_DB_PASSWORD"] audit_db_name = conf_dict['RANGER_AUDIT_DB_NAME'] db_audit_file = conf_dict['db_audit_file'] #check_mysql_audit_user_password() log("\n--------- Creating mysql audit user --------- \n","info") create_mysql_user(audit_db_name, audit_db_user, audit_db_password, MYSQL_HOST, db_root_password) log("\n--------- Creating mysql audit user DONE----- \n","info") log("\n--------- Importing Audit Database ---------\n","info") # Verify if audit db is present if verify_db(audit_db_user, audit_db_password, audit_db_name, MYSQL_HOST): log("\nDatabase "+audit_db_name + " already exists. Ignoring import_db\n","info") else: log("\nCreating Database " + audit_db_name, "info") # Create audit db is not present cmdArr = get_mysql_cmd('root', db_root_password, MYSQL_HOST) cmdArr.extend(["-e", "create database %s" %(audit_db_name)]) ret = subprocess.check_call(cmdArr) if ret != 0: log("Database creation failed!!","error") sys.exit(1) else: log("Creating database "+audit_db_name+" succeeded", "info") # Check if audit table exists AUDIT_TABLE="xa_access_audit" log("Verifying table "+AUDIT_TABLE+" in audit database "+audit_db_name, "debug") cmdArr = get_mysql_cmd(audit_db_user, audit_db_password, MYSQL_HOST) cmdArr.extend([audit_db_name, "-e", "show tables like '%s'" %(AUDIT_TABLE)]) output = subprocess.check_output(cmdArr) if output.strip('\r\n') != AUDIT_TABLE: # Import audit table log("\nImporting Audit Database file: " + db_audit_file,"debug") if os.path.isfile(db_audit_file): proc = subprocess.Popen([MYSQL_BIN, "--user=%s" % audit_db_user, "--host=%s" %MYSQL_HOST, "--password=%s" % audit_db_password, audit_db_name], stdin=subprocess.PIPE, stdout=subprocess.PIPE) out, err = proc.communicate(file(db_audit_file).read()) if (proc.returncode == 0): log("\nAudit file Imported successfully\n","info") else: log("\nAudit file Import failed!\n","info") sys.exit(1) else: log("\nAudit file not found!\n","info") else: log("\nTable "+AUDIT_TABLE+" already exists in audit database "+audit_db_name +"\n","info") log("\n--------- Importing Audit Database DONE-----\n","info") def setup_admin_db_user(): global conf_dict MYSQL_HOST = conf_dict['RANGER_ADMIN_DB_HOST'] db_user = conf_dict["RANGER_ADMIN_DB_USERNAME"] db_password = conf_dict["RANGER_ADMIN_DB_PASSWORD"] db_root_password = conf_dict["RANGER_ADMIN_DB_ROOT_PASSWORD"] db_name = conf_dict['RANGER_ADMIN_DB_NAME'] log("--------- Creating mysql user --------- ","info") create_mysql_user(db_name, db_user, db_password, MYSQL_HOST, db_root_password) #log("--------- Creating mysql user DONE----- ","info") #log("--------- Importing Admin Database --------- ","info") import_db() #log("--------- Importing Admin Database DONE----- ","info") #log("--------- Applying patches --------------- ","info") upgrade_db() #log("--------- Applying patches DONE----------- ","info") ## Ranger Functions Ends here -------------------- def call_keystore(libpath,aliasKey,aliasValue , filepath,getorcreate): finalLibPath = libpath.replace('\\','/').replace('//','/') finalFilePath = 'jceks://file/'+filepath.replace('\\','/').replace('//','/') if getorcreate == 'create': commandtorun = ['java', '-cp', finalLibPath, 'org.apache.ranger.credentialapi.buildks' ,'create', aliasKey, '-value', aliasValue, '-provider',finalFilePath] p = Popen(commandtorun,stdin=PIPE, stdout=PIPE, stderr=PIPE) output, error = p.communicate() statuscode = p.returncode return statuscode elif getorcreate == 'get': commandtorun = ['java', '-cp', finalLibPath, 'org.apache.ranger.credentialapi.buildks' ,'get', aliasKey, '-provider',finalFilePath] p = Popen(commandtorun,stdin=PIPE, stdout=PIPE, stderr=PIPE) output, error = p.communicate() statuscode = p.returncode return statuscode, output else: print('proper command not received for input need get or create') # Entry point to script using --service def run_setup(cmd): init_logfiles() log("--------- Running Ranger PolicyManager Install Script ---------","debug") #parse_config_file() init_variables("service") setup_install_files() write_config_to_file() #extract_war() update_properties() #do_authentication_setup() return # Entry point to script using --configure def configure(): init_logfiles() log("--------- Running Ranger PolicyManager Configure Script --------- ","info") #parse_config_file() init_variables("configure") sanity_check_configure_files() #log(" --------- Importing DB --------- ","info") # copy_mysql_connector() #log(" --------- Creatin Audit DB --------- ","info") setup_admin_db_user() setup_audit_user_db()