Skip to content

Commit 9ab0069

Browse files
ramackriramkcursoragent
authored
RANGER-5645: Add audit-ingestor service-user allowlist for Docker plugins (#1017)
* RANGER-5645: Add audit-ingestor service-user allowlist for Docker plugins Ship per-repo allowed.users and auth_to_local rules so plugins using the audit-server destination are authorized after Kerberos SPNEGO (fixes HTTP 403). Align create-ranger-services.py with policy.download.auth.users for Ozone, Atlas, Kudu, and NiFi. Add troubleshooting README for ingestor 403 errors. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Fix auth_to_local description; drop README files from PR Consolidate auth_to_local property description (JWT note + plugin rules). Revert audit-server/scripts/README.md and remove troubleshooting README. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: List auth_to_local rules in Default rules provided format Match original site XML description style with one bullet per RULE line. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Limit scope to Docker services listed in Jira Remove dev_atlas, dev_kudu, and dev_nifi from ingestor allowlist, auth_to_local rules, and create-ranger-services.py (not in Docker stack). Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Add dev_elasticsearch for Docker OpenSearch stack Create Policy Manager repo for the elasticsearch service type pointing at ranger-opensearch.rangernw:9200 with opensearch download auth users, and add matching ingestor allowlist plus auth_to_local rule. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Add dev_tag service and fix auth_to_local description Create dev_tag in create-ranger-services.py (matches Policy Manager). Add dev_tag ingestor allowlist (rangertagsync) and auth_to_local rule. Use CDATA so description shows <repo> instead of XML entities. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Add atlas/kudu/nifi; remove OpenSearch elasticsearch entries Match Policy Manager repos (dev_atlas, dev_kudu, dev_nifi). Drop dev_elasticsearch allowlist, auth_to_local rules, and create-service entry. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Address PR review feedback on allowlist and Docker services Remove redundant auth_to_local plugin rules covered by DEFAULT, restrict Ozone to om-only, and drop tag/atlas/kudu/nifi from create-ranger-services.py per Docker stack scope. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Fix date-bound tag policy engine tests after 2026-06-15 RESTRICTED-FINAL deny-exception uses isAccessedBefore(activation_date); fixture dates were 2026/06/15 so TestPolicyEngine_hiveForTag_filebased failed on/after that day (unrelated to ingestor allowlist changes). Use 2099/12/31 in tag test fixtures so CI stays stable. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Run TestPolicyEngine sub-tests sequentially for CI stability parallelStream() on a shared RangerPolicyEngine caused intermittent failures (e.g. hdfs_resourcespec {USER} path policy) under CI load. Co-authored-by: Cursor <cursoragent@cursor.com> * RANGER-5645: Address review feedback on allowlist scope and test changes - Remove dev_tag, dev_atlas, dev_kudu, dev_nifi allowlist entries (not applicable to Docker audit-ingestor scope per review) - Revert agents-common test fixture and TestPolicyEngine changes; tag date updates belong in separate RANGER-5647 PR - Restore parallelStream() in TestPolicyEngine per review Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: ramk <ramk@cloudera.com> Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 5be05d8 commit 9ab0069

2 files changed

Lines changed: 55 additions & 11 deletions

File tree

‎audit-server/audit-ingestor/src/main/resources/conf/ranger-audit-ingestor-site.xml‎

Lines changed: 52 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -185,19 +185,61 @@
185185
<property>
186186
<name>ranger.audit.ingestor.service.dev_hdfs.allowed.users</name>
187187
<value>hdfs</value>
188-
<description>Comma-separated list of allowed users that can send audits for dev_hdfs service</description>
188+
<description>Allowed users for dev_hdfs (Policy Manager service name; from policy.download.auth.users)</description>
189+
</property>
190+
191+
<property>
192+
<name>ranger.audit.ingestor.service.dev_yarn.allowed.users</name>
193+
<value>yarn</value>
194+
<description>Allowed users for dev_yarn (YARN RM/NM)</description>
189195
</property>
190196

191197
<property>
192198
<name>ranger.audit.ingestor.service.dev_hive.allowed.users</name>
193199
<value>hive</value>
194-
<description>Comma-separated list of allowed users that can send audits for dev_hive service.</description>
200+
<description>Allowed users for dev_hive (HiveServer2 + Metastore)</description>
195201
</property>
196202

197203
<property>
198204
<name>ranger.audit.ingestor.service.dev_hbase.allowed.users</name>
199205
<value>hbase</value>
200-
<description>Comma-separated list of allowed users that can send audits for dev_hbase service.</description>
206+
<description>Allowed users for dev_hbase (HBase Master + RegionServer)</description>
207+
</property>
208+
209+
<property>
210+
<name>ranger.audit.ingestor.service.dev_kafka.allowed.users</name>
211+
<value>kafka</value>
212+
<description>Allowed users for dev_kafka</description>
213+
</property>
214+
215+
<property>
216+
<name>ranger.audit.ingestor.service.dev_knox.allowed.users</name>
217+
<value>knox</value>
218+
<description>Allowed users for dev_knox</description>
219+
</property>
220+
221+
<property>
222+
<name>ranger.audit.ingestor.service.dev_kms.allowed.users</name>
223+
<value>rangerkms</value>
224+
<description>Allowed users for dev_kms</description>
225+
</property>
226+
227+
<property>
228+
<name>ranger.audit.ingestor.service.dev_trino.allowed.users</name>
229+
<value>trino</value>
230+
<description>Allowed users for dev_trino</description>
231+
</property>
232+
233+
<property>
234+
<name>ranger.audit.ingestor.service.dev_ozone.allowed.users</name>
235+
<value>om</value>
236+
<description>Allowed users for dev_ozone (Ozone Manager; Ranger plugin runs on OM only)</description>
237+
</property>
238+
239+
<property>
240+
<name>ranger.audit.ingestor.service.dev_solr.allowed.users</name>
241+
<value>solr</value>
242+
<description>Allowed users for dev_solr (Solr plugin)</description>
201243
</property>
202244

203245
<!-- AUTH_TO_LOCAL RULES FOR KERBEROS PRINCIPAL MAPPING -->
@@ -210,20 +252,22 @@
210252
RULE:[1:$1@$0](.*@.*)s/@.*//
211253
DEFAULT
212254
</value>
213-
<description>
255+
<description><![CDATA[
214256
Kerberos auth_to_local rules for mapping authenticated principals to service names.
215-
Uses Hadoop KerberosName syntax to convert full Kerberos principals to short usernames.
257+
Uses Hadoop KerberosName syntax to convert full Kerberos principals to short usernames
258+
checked against ranger.audit.ingestor.service.<repo>.allowed.users (Policy Manager
259+
policy.download.auth.users).
216260
217261
IMPORTANT: These rules only apply to Kerberos/SPNEGO authentication. JWT and basic auth
218262
usernames are already in short form and pass through unchanged.
219263
220264
Default rules provided:
221-
- RULE:[2:$1/$2@$0]([ndj]n/.*@.*|hdfs/.*@.*)s/.*/hdfs/ # nn,dn,jn,hdfs/* -> hdfs
222-
- RULE:[2:$1/$2@$0]([rn]m/.*@.*|yarn/.*@.*)s/.*/yarn/ # rm,nm,yarn/* -> yarn
265+
- RULE:[2:$1/$2@$0]([ndj]n/.*@.*|hdfs/.*@.*)s/.*/hdfs/ # nn,dn,jn,hdfs/* -> hdfs (dev_hdfs)
266+
- RULE:[2:$1/$2@$0]([rn]m/.*@.*|yarn/.*@.*)s/.*/yarn/ # rm,nm,yarn/* -> yarn (dev_yarn)
223267
- RULE:[2:$1/$2@$0](jhs/.*@.*)s/.*/mapred/ # jhs/* -> mapred
224268
- RULE:[1:$1@$0](.*@.*)s/@.*// # user@REALM -> user
225269
- DEFAULT
226-
</description>
270+
]]></description>
227271
</property>
228272

229273

‎dev-support/ranger-docker/scripts/admin/create-ranger-services.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -129,9 +129,9 @@ def service_not_exists(service):
129129
'configs': {'username': 'hdfs', 'password': 'hdfs',
130130
'ozone.om.http-address': 'http://om:9874',
131131
'hadoop.security.authentication': 'simple',
132-
'policy.download.auth.users': 'ozone',
133-
'tag.download.auth.users': 'ozone',
134-
'userstore.download.auth.users': 'ozone',
132+
'policy.download.auth.users': 'om',
133+
'tag.download.auth.users': 'om',
134+
'userstore.download.auth.users': 'om',
135135
'ranger.plugin.ozone.policy.refresh.synchronous':'true'}})
136136

137137
solr = RangerService({'name': 'dev_solr', 'type': 'solr',

0 commit comments

Comments
 (0)