{"id":16216,"date":"2025-03-21T09:49:51","date_gmt":"2025-03-21T01:49:51","guid":{"rendered":"https:\/\/nj.transwarp.cn:8180\/?p=16216"},"modified":"2025-07-17T17:27:06","modified_gmt":"2025-07-17T09:27:06","slug":"guardian-abac-%e7%ad%96%e7%95%a5%e4%bd%bf%e7%94%a8%e4%b9%8bip%e5%9c%b0%e5%9d%80%e9%bb%91%e5%90%8d%e5%8d%95","status":"publish","type":"post","link":"https:\/\/kbwp.transwarp.cn\/?p=16216","title":{"rendered":"Guardian ABAC\u7b56\u7565\u4f7f\u7528\u4e4bIP\u5730\u5740\u9ed1\u540d\u5355"},"content":{"rendered":"<h3>\u6982\u8981\u63cf\u8ff0<\/h3>\n<hr \/>\n<p><strong>ABAC\u7b80\u4ecb<\/strong><\/p>\n<p>ABAC\u5168\u540d\u662f Attribute Based Access Control\uff0c\u987e\u540d\u601d\u4e49\u662f\u6839\u636e\u4e00\u4e9b\u4e0a\u4e0b\u6587\u6807\u7b7e\u6765\u5728\u8fd0\u884c\u65f6\u5224\u65ad\u6743\u9650\u4fe1\u606f\uff0c\u7528\u6765\u63a7\u5236\u5bf9\u8d44\u6e90\u7684\u8bbf\u95ee\u3002<\/p>\n<p><strong>Guardian ABAC\u529f\u80fd\u4ecb\u7ecd<\/strong><\/p>\n<p>Guardian\u63d0\u4f9b\u4e86\u7b56\u7565(Policy)\u9875\u9762\u6765\u8bbe\u7f6eABAC\u6743\u9650\uff0c\u6bcf\u6761\u7b56\u7565\u5b9a\u4e49\u4e86\u4e00\u4e2a\u6743\u9650\u89c4\u5219\u3002<\/p>\n<p>Guardian\u76ee\u524d\u652f\u6301\u7684\u6807\u7b7e\u6709\u5982\u4e0b5\u79cd\uff0c\u65e5\u540e\u4f1a\u6269\u5c55\uff0c\u5305\u62ec\u652f\u6301\u7528\u6237\u81ea\u5b9a\u4e49\u6807\u7b7e\uff1a<\/p>\n<ol>\n<li>SourceIp\uff1a\u8bbf\u95ee\u670d\u52a1\u7684\u7528\u6237\u7684\u6e90\u5730\u5740ip<\/li>\n<li>UserName\uff1a\u8bbf\u95ee\u670d\u52a1\u7684\u7528\u6237\u7684\u7528\u6237\u540d<\/li>\n<li>GroupName\uff1a \u8bbf\u95ee\u670d\u52a1\u7684\u7528\u6237\u6240\u5c5e\u7684\u7ec4<\/li>\n<li>RoleName\uff1a \u8bbf\u95ee\u670d\u52a1\u7684\u7528\u6237\u6240\u5c5e\u7684\u89d2\u8272<\/li>\n<li>CurrentTime\uff1a \u8bbf\u95ee\u670d\u52a1\u7684\u65f6\u95f4<\/li>\n<\/ol>\n<p>Resource\uff1a \u8bbf\u95ee\u670d\u52a1\u7684\u8d44\u6e90\u540d\u5b57\uff0c\u4f8b\u5982\u5bf9\u4e8einceptor\u8868\uff0c\u8868\u793a\u65b9\u6cd5\u4e3adefault.alice_tbl\uff1b\u5bf9\u4e8ehdfs\u76ee\u5f55\u5219\u4e3a \/user\/alice\u7b49<\/p>\n<blockquote>\n<p>\u5c40\u9650\uff1a\u76ee\u524d\u652f\u6301ABAC\u7684\u63d2\u4ef6\u53ea\u6709Incpetor\/Argodb\u7684\u63d2\u4ef6\uff0c\u5176\u4ed6\u670d\u52a1\u7684\u63d2\u4ef6\u6b63\u5728\u5f00\u53d1\u4e2d<\/p>\n<\/blockquote>\n<h3>\u8be6\u7ec6\u8bf4\u660e<\/h3>\n<hr \/>\n<p><strong>\u6743\u9650<\/strong><\/p>\n<p>\u62e5\u6709PERM ADMIN\u6216\u8005SUPER ADMIN\u7cfb\u7edf\u89d2\u8272\u7684\u7528\u6237\u624d\u53ef\u4ee5\u64cd\u4f5c\u7b56\u7565\uff0c\u4f8b\u5982admin\u7528\u6237\u62e5\u6709SUPER-ADMIN\u7cfb\u7edf\u89d2\u8272\uff0c\u53ef\u4ee5\u64cd\u4f5c\u7b56\u7565\u3002\u53ef\u4ee5\u5230 \u9996\u9875-&gt;\u7cfb\u7edf\u8bbe\u7f6e-&gt;\u7cfb\u7edf\u6743\u9650 \u4e2d\u8bbe\u7f6e\u7528\u6237\u7684\u7cfb\u7edf\u89d2\u8272\u3002<\/p>\n<p><strong>\u914d\u7f6e<\/strong><\/p>\n<p>policy\u76f8\u5173\u7684\u914d\u7f6e\u5728\u7ec4\u4ef6\uff08\u5982Inceptor\uff09\u7684guardian-site.xml\u4e2d\uff1a<\/p>\n<ul>\n<li><code>guardian.abac.authorization.enabled<\/code>\uff0c\u7528\u6765\u63a7\u5236\u662f\u5426\u5f00\u542fABAC\u529f\u80fd\uff0ctrue\u8868\u793a\u5f00\u542f\uff0c\u9ed8\u8ba4false\u8868\u793a\u4e0d\u5f00\u542f<\/li>\n<li><code>guardian.client.cache.update.period<\/code>\uff0c\u7528\u6765\u63a7\u5236\u672c\u5730\u7b56\u7565\u7f13\u5b58\u66f4\u65b0\u7684\u9891\u7387(\u5355\u4f4d\u4e3a\u6beb\u79d2)\uff0c\u9ed8\u8ba4\u662f30\u79d2(30000\u6beb\u79d2)\u66f4\u65b0\u4e00\u6b21\u3002<\/li>\n<\/ul>\n<blockquote>\n<p>\u6ce8\uff1a\u4e3a\u4e86\u52a0\u5feb\u6743\u9650\u5224\u65ad\u901f\u5ea6\uff0c\u672c\u5730\u90fd\u4f1a\u7f13\u5b58\u7b56\u7565\u6570\u636e\u5e93\uff0c\u66f4\u65b0\u9891\u7387\u9ed8\u8ba4\u662f30s\uff0c\u4e5f\u5c31\u662f\u66f4\u65b0\u7b56\u7565\u4e4b\u540e\uff0c\u6700\u591a\u9700\u8981\u7b49\u5f8530s\uff0c\u7ec4\u4ef6\u7684\u7b56\u7565\u624d\u4f1a\u66f4\u65b0\u3002<\/p>\n<\/blockquote>\n<p>\u4ee5Guardian 3.2.6 \u7248\u672c\u4e3a\u4f8b\u4e3e\u4f8b\u8bf4\u660e\uff1a<\/p>\n<h4>1. \u4fee\u6539guardian\u53c2\u6570guardian.abac.authorization.enabled<\/h4>\n<p>\u4ecefalse\u4fee\u6539\u4e3atrue\uff0c\u7136\u540e\u914d\u7f6e\u670d\u52a1\uff0c\u91cd\u542fguardian<\/p>\n<div style=\"box-shadow: 1px 1px 10px rgba(0,0,0,0.1); padding: 1px; display: inline-block; width: auto; margin-bottom: 10px;\">\n  <img decoding=\"async\" src=\"\/wp-content\/uploads\/2025\/03\/image-1742521059421.png\" style=\"display: block;\"><\/div>\n<h4>2. Quark\u670d\u52a1\u5237\u65b0guardian\u63d2\u4ef6<\/h4>\n<div style=\"box-shadow: 1px 1px 10px rgba(0,0,0,0.1); padding: 1px; display: inline-block; width: auto; margin-bottom: 10px;\">\n  <img decoding=\"async\" src=\"\/wp-content\/uploads\/2025\/03\/image-1742521153512.png\" style=\"display: block;\"><\/div>\n<p>\u5237\u65b0\u5b8c\u6210\u4e4b\u540e\uff0c\u68c0\u67e5 <code>\/etc\/quark1\/conf\/guardian-site.xml<\/code> \u6587\u4ef6\u662f\u5426\u66f4\u65b0\u4e86\u914d\u7f6e:<\/p>\n<pre><code class=\"language-shell\">[root@kv1\/etc\/quark1\/conf]# grep abac guardian-site.xml -C 1\n<property>\n    <name>guardian.abac.authorization.enabled<\/name>\n    <value>true<\/value><\/code><\/pre>\n<h4>3. Guardian\u9875\u9762\u65b0\u589e\u7b56\u7565\u914d\u7f6e<\/h4>\n<p>\u8bf4\u660e\uff1a\u8be5policy\u662f\u4e00\u4e2aDENY\u7c7b\u578b\u7684Policy\uff0c\u552f\u4e00\u7684\u6761\u4ef6\u662f Sourceip \u662f 172.22.130.2\uff0c\u6574\u4e2apolicy\u7684\u542b\u4e49\u662f\uff0c\u5982\u679c\u8bf7\u6c42\u662f\u4ece172.22.130.2\u8fc7\u6765\u7684\uff0c\u90a3\u4e48\u8bbf\u95eeQuark1\u7684 <code>default.emp<\/code>\u8868 \u7684 <code>SELECT<\/code> \u64cd\u4f5c\u5c06\u4f1a\u88ab\u62d2\u7edd\u3002<\/p>\n<div style=\"box-shadow: 1px 1px 10px rgba(0,0,0,0.1); padding: 1px; display: inline-block; width: auto; margin-bottom: 10px;\">\n  <img decoding=\"async\" src=\"\/wp-content\/uploads\/2025\/03\/image-1742521270730.png\" style=\"display: block;\"><\/div>\n<h4>4. \u67e5\u8be2\u9a8c\u8bc1<\/h4>\n<p>\u6211\u4eec\u901a\u8fc7lkw\u8fd9\u4e2a\u7528\u6237\uff0c\u5728ip\u4e3a 172.22.130.2 \u7684windows \u7535\u8111\u4e0a\uff0c\u901a\u8fc7waterdrop\u67e5\u8be2 <code>SELECT * FROM default.emp;<\/code> \u67e5\u8be2\u5931\u8d25\uff0c\u62a5\u9519 <code>SQL \u9519\u8bef [20388] [42000]: COMPILE FAILED: Internal error HiveAccessControlException: [Error 20388] Permission denied: Principal [name=lkw, type=USER] does not have following privileges for operation QUERY [[SELECT] on Object [type=TABLE_OR_VIEW, name=default.emp]]<\/code><\/p>\n<div style=\"box-shadow: 1px 1px 10px rgba(0,0,0,0.1); padding: 1px; display: inline-block; width: auto; margin-bottom: 10px;\">\n  <img decoding=\"async\" src=\"\/wp-content\/uploads\/2025\/03\/image-1742521427455.png\" style=\"display: block;\"><\/div>\n<blockquote>\n<p><font color=red>\u9700\u8981\u6ce8\u610f\uff0c\u5982\u679c\u7528\u6237\u662f\u8be5\u8868\u7684owner\u6216\u8005\u8be5\u7528\u6237\u662fADMIN\u89d2\u8272\uff0c\u5219\u4ecd\u7136\u53ef\u4ee5\u8bbf\u95ee\u8868\u4e2d\u7684\u6570\u636e\u3002\u56e0\u4e3aowner\u6216\u8005admin\u662f\u63d0\u524d\u5224\u65ad\u7684\u3002\u53e6\u5916\u7b56\u7565\u5c42\u76ee\u524d\u662f\u5728\u539f\u59cb\u7684RBAC\u5c42\u4e4b\u524d\u7684\uff0c\u5982\u679cABAC\u6ca1\u6709\u8fd4\u56deALLOW\u6216\u8005DENY\u5373ABAC\u6ca1\u6709\u7b56\u7565\u53ef\u4ee5\u4f7f\u7528\uff0c\u6743\u9650\u5224\u65ad\u5c06\u4f1a\u9000\u5316\u5230RBAC\u5c42\u5224\u65ad\u3002<\/font><\/p>\n<\/blockquote>\n<h3>FAQ \u5982\u4f55\u901a\u8fc7quark-server.log\u65e5\u5fd7\u6392\u67e5\u7b56\u7565\u4fe1\u606f\uff1f<\/h3>\n<p>\u9700\u8981\u5f00\u542fserver\u7684DEBUG\u7ea7\u522b\u65e5\u5fd7\u624d\u80fd\u591f\u770b\u5230\uff0c\u5728\u9ad8\u7248\u672cquark\u4e0a\u53ef\u4ee5 <code>SET inceptor.log.level=debug;<\/code> server\u7ea7\u5f00\u542f \uff08<a href=\"https:\/\/kb.transwarp.cn\/posts\/12306\" title=\"\u53c2\u8003\u4fee\u6539quark\u65e5\u5fd7\u7ea7\u522b\u7684\u51e0\u79cd\u65b9\u5f0f\">\u53c2\u8003\u4fee\u6539quark\u65e5\u5fd7\u7ea7\u522b\u7684\u51e0\u79cd\u65b9\u5f0f<\/a>\uff09<\/p>\n<p>\u67e5\u8be2\u5173\u952e\u5b57\uff1a <code>tailf quark-server.log | grep -Ei &#039;(SourceIp=172.22.130.2|The evaluation result for statement|PolicyEngine)&#039;<\/code><\/p>\n<div style=\"box-shadow: 1px 1px 10px rgba(0,0,0,0.1); padding: 1px; display: inline-block; width: auto; margin-bottom: 10px;\">\n  <img decoding=\"async\" src=\"\/wp-content\/uploads\/2025\/03\/image-1742521682158.png\" style=\"display: block;\"><\/div>\n<p>\u672c\u5730\u7b56\u7565\u7684\u5237\u65b0\u65e5\u5fd7\uff0c\u4e00\u822c\u9ed8\u8ba4\u662f30\u79d2(30000\u6beb\u79d2)\u66f4\u65b0\u4e00\u6b21\uff0c\u6bcf\u6b21\u6d4b\u8bd5\u5efa\u8bae\u7b49\u7b56\u7565\u66f4\u65b0\u540e\u518d\u64cd\u4f5c\uff1a<\/p>\n<div style=\"box-shadow: 1px 1px 10px rgba(0,0,0,0.1); padding: 1px; display: inline-block; width: auto; margin-bottom: 10px;\">\n  <img decoding=\"async\" src=\"\/wp-content\/uploads\/2025\/03\/image-1742521748724.png\" style=\"display: block;\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981\u63cf\u8ff0 ABAC\u7b80\u4ecb ABAC\u5168\u540d\u662f Attribute Based Access Control\uff0c\u987e\u540d\u601d\u4e49 ..<\/p>\n<div class=\"clear-fix\"><\/div>\n<p><a href=\"https:\/\/kbwp.transwarp.cn\/?p=16216\" title=\"read more...\">Read more<\/a><\/p>\n","protected":false},"author":12,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16216","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"acf":[],"_links":{"self":[{"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/posts\/16216","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16216"}],"version-history":[{"count":3,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/posts\/16216\/revisions"}],"predecessor-version":[{"id":16907,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=\/wp\/v2\/posts\/16216\/revisions\/16907"}],"wp:attachment":[{"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16216"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16216"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kbwp.transwarp.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16216"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}