[jira] [Created] (RANGER-5712) Enable unauthenticated plugin download in ranger-docker dev sandbox

["Ramachandran Krishnan (Jira)" <ji...@apache.org>]

Ramachandran Krishnan created RANGER-5712:
---------------------------------------------

             Summary: Enable unauthenticated plugin download in ranger-docker dev sandbox
                 Key: RANGER-5712
                 URL: https://issues.apache.org/jira/browse/RANGER-5712
             Project: Ranger
          Issue Type: Task
          Components: Ranger
    Affects Versions: 2.8.0
            Reporter: Ramachandran Krishnan
            Assignee: Ramachandran Krishnan
             Fix For: 3.0.0


Trino and Ozone plugins in the ranger-docker dev sandbox fail to download policies, roles, tags, and xusers from Ranger Admin with HTTP 400 ({{{}Unauthenticated access not allowed{}}}). HDFS/Hive work because they use Kerberos-backed secure download paths. The dev sandbox uses plain HTTP and does not configure plugin Kerberos auth on the Admin REST client, so downloads are rejected unless {{ranger.admin.allow.unauthenticated.download.access}} is enabled.



Problem

After RANGER-5635 (#1048), {{failUnauthenticatedDownloadIfNotAllowed()}} is enforced even when Hadoop security is not fully enabled. In ranger-docker:
 * Admin runs with {{policymgr_http_enabled=true}} and {{authentication_method=UNIX}}
 * Trino/Ozone plugins call non-secure download URLs (no SPNEGO/Kerberos on the plugin REST client)
 * Default {{ranger.admin.allow.unauthenticated.download.access=false}} in {{ranger-admin-default-site.xml}}

Affected endpoints:
 * {{/service/plugins/policies/download/}}
 * {{/service/roles/download/}}
 * {{/service/tags/download/}}
 * {{/service/xusers/download/}}

Symptom in Admin logs: {{Unauthenticated access not allowed}} → HTTP 400 in access logs.

This is a dev/docker configuration gap, not a plugin or REST bug. {{policy.download.auth.users}} on the service (e.g. trino, om) is not sufficient when unauthenticated download is disabled globally.
----
Root cause
 # RANGER-5635 tightened download auth checks (correct for production).
 # ranger-docker never wires {{ranger.admin.allow.unauthenticated.download.access}} into {{{}ranger-admin-site.xml{}}}.
 # Adding the property only to docker {{install.properties}} does not work today — {{setup.sh}} only updates keys that already exist in {{ranger-admin-site.xml}} (same pattern as {{{}FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION{}}}).

----
Proposed solution

Wire a new install property through Admin setup into {{{}ranger-admin-site.xml{}}}, and set it to {{true}} only in docker dev install files.

Install property (suggested name):
ranger_admin_allow_unauthenticated_download_access=true # docker dev only
ranger_admin_allow_unauthenticated_download_access=false # default everywhere else
Maps to site.xml:
 
{code:java}
ranger.admin.allow.unauthenticated.download.access{code}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)