[jira] [Created] (RANGER-5650) KMS plugin: package Jackson/Jersey audit client JARs in kms.xml for audit-server delivery

["Ramachandran Krishnan (Jira)" <ji...@apache.org>]

Ramachandran Krishnan created RANGER-5650:
---------------------------------------------

             Summary: KMS plugin: package Jackson/Jersey audit client JARs in kms.xml for audit-server delivery
                 Key: RANGER-5650
                 URL: https://issues.apache.org/jira/browse/RANGER-5650
             Project: Ranger
          Issue Type: Task
          Components: Ranger
            Reporter: Ramachandran Krishnan
            Assignee: Ramachandran Krishnan
             Fix For: 3.0.0


When KMS is configured to send audits to the audit-server / audit ingestor ({{{}xasecure.audit.destination.auditserver=true{}}}), audit batch POSTs fail unless {{ranger-kms-plugin-impl}} includes a self-contained Jackson + Jersey client stack. The KMS Ranger plugin runs behind {{RangerPluginClassLoader}} inside the KMS Tomcat WAR; it cannot rely on the WAR’s {{WEB-INF/lib}} classpath for audit REST.
h3. Problem

Without the fix, KMS plugin audits fail at runtime with errors such as:
 * {{LinkageError}} / {{NoClassDefFoundError: JsonUtilsV2}} ({{{}ObjectMapper{}}} loader constraint violation)
 * {{ClassCastException}} on {{WadlAutoDiscoverable}} / Jersey ServiceLoader SPI
 * {{MultiException}} / HK2 injection failures on audit REST client
 * KMS HTTP 500 on key operations after plugin-impl classpath is misaligned

Audits do not reach the ingestor → Kafka → Solr pipeline; Admin Audit → Access shows no new {{dev_kms}} events.


h3. Root cause
||Aspect||Detail||
|Deployment|Built-in / Docker KMS embeds the plugin in {{ews/webapp/WEB-INF/lib/ranger-kms-plugin-impl/}} (assembly: {{distro/src/main/assembly/kms.xml}})|
|Classloader|{{RangerPluginClassLoader}} isolates plugin-impl from parent WAR classloader|
|WAR|KMS WAR also ships Jersey/Jackson for KMS REST — duplication in both places is intentional|
|Standalone tarball|{{plugin-kms.xml}} → external {{enable-kms-plugin.sh}} path — out of scope for built-in KMS fix|
h3. Proposed fix

Update {{distro/src/main/assembly/kms.xml}} only — whitelist audit client dependencies in the {{ranger-kms-plugin-impl}} dependency set:

Add to plugin-impl:
 * Jackson: {{{}jackson-annotations{}}}, {{{}jackson-core{}}}, {{{}jackson-databind{}}}, {{{}jackson-jaxrs-base{}}}, {{{}jackson-jaxrs-json-provider{}}}, {{jackson-module-jaxb-annotations}}
 * JAX-RS / inject: {{{}jakarta.ws.rs-api{}}}, {{javax.inject}}
 * Jersey: {{{}jersey-client{}}}, {{{}jersey-common{}}}, {{{}jersey-entity-filtering{}}}, {{{}jersey-media-json-jackson{}}}, {{{}jersey-hk2{}}}, {{jersey-server}}
 * HK2: {{{}hk2-api{}}}, {{{}hk2-locator{}}}, {{{}hk2-utils{}}}, {{{}hk2{}}}, {{hk2-core}}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)