You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by pr...@apache.org on 2026/05/26 12:34:59 UTC
(ranger) 01/02: RANGER-5603: Docker setup updated to use Solr 9.4.1
This is an automated email from the ASF dual-hosted git repository.
pradeepagrawal8184 pushed a commit to branch RANGER-5603_SOLR2
in repository https://gitbox.apache.org/repos/asf/ranger.git
commit 478c19389e88b2031b43207e59ae46c4a031ea68
Author: Madhan Neethiraj <ma...@apache.org>
AuthorDate: Mon May 25 01:11:18 2026 -0700
RANGER-5603: Docker setup updated to use Solr 9.4.1
---
.../plugin/util/RangerJersey2ClientBuilder.java | 5 +++--
dev-support/ranger-docker/.env | 2 +-
dev-support/ranger-docker/Dockerfile.ranger-solr | 3 ++-
dev-support/ranger-docker/docker-compose.ranger.yml | 2 +-
.../solr/ranger-solr-plugin-install.properties | 3 ++-
.../ranger-docker/scripts/solr/ranger-solr.sh | 15 +++++++++++----
.../ranger-docker/scripts/solr/solr-jaas.conf | 6 +++---
.../scripts/solr/solr-ranger_audits/solrconfig.xml | 12 ++++++------
.../ranger-docker/scripts/solr/solr-security.json | 4 ++--
distro/src/main/assembly/plugin-solr.xml | 20 ++++++--------------
.../solr/authorizer/RangerSolrAuthorizer.java | 9 +++++----
11 files changed, 42 insertions(+), 39 deletions(-)
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerJersey2ClientBuilder.java b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerJersey2ClientBuilder.java
index 714412c88..43800d87f 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerJersey2ClientBuilder.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/util/RangerJersey2ClientBuilder.java
@@ -30,6 +30,8 @@
import javax.ws.rs.client.Client;
import javax.ws.rs.client.ClientBuilder;
+import java.util.stream.Collectors;
+
/**
* Comprehensive Jersey client utility for Ranger components.
*
@@ -355,8 +357,7 @@ public static boolean validateAntiMoxyConfiguration(ClientConfig config) {
boolean jacksonRegistered = config.getClasses().contains(JacksonJaxbJsonProvider.class) || config.getInstances().stream().anyMatch(instance -> instance instanceof JacksonJaxbJsonProvider);
if (!jacksonRegistered) {
- LOG.error("CRITICAL: Jackson JSON provider is not registered! Default JSON processing may fail.");
- isValid = false;
+ LOG.error("CRITICAL: Jackson JSON provider is not registered! Default JSON processing may fail. Classes={}", config.getClasses().stream().map(Class::getCanonicalName).collect(Collectors.toList()));
}
if (isValid) {
diff --git a/dev-support/ranger-docker/.env b/dev-support/ranger-docker/.env
index 12d2777ec..144b698ab 100644
--- a/dev-support/ranger-docker/.env
+++ b/dev-support/ranger-docker/.env
@@ -54,7 +54,7 @@ TAGSYNC_VERSION=3.0.0-SNAPSHOT
PDP_VERSION=3.0.0-SNAPSHOT
# Solr Configuration
-SOLR_VERSION=8.11.3
+SOLR_VERSION=9.4.1
SOLR_PLUGIN_VERSION=3.0.0-SNAPSHOT
# Zookeeper Configuration
diff --git a/dev-support/ranger-docker/Dockerfile.ranger-solr b/dev-support/ranger-docker/Dockerfile.ranger-solr
index 2bb4fa824..8f2b92e41 100644
--- a/dev-support/ranger-docker/Dockerfile.ranger-solr
+++ b/dev-support/ranger-docker/Dockerfile.ranger-solr
@@ -39,7 +39,8 @@ RUN tar xvfz /home/ranger/dist/ranger-${SOLR_PLUGIN_VERSION}-solr-plugin.tar.gz
ln -s /opt/ranger/ranger-${SOLR_PLUGIN_VERSION}-solr-plugin /opt/ranger/ranger-solr-plugin && \
rm -f /home/ranger/dist/ranger-${SOLR_PLUGIN_VERSION}-solr-plugin.tar.gz && \
rm -f /opt/ranger/ranger-solr-plugin/install.properties && \
- chown -R solr:solr /opt/ranger
+ mkdir -p /var/solr/data /etc/ranger && \
+ chown -R solr:solr /opt/ranger /var/solr /etc/ranger
ENTRYPOINT [ "/opt/ranger/ranger-solr.sh" ]
CMD ["solr-foreground"]
diff --git a/dev-support/ranger-docker/docker-compose.ranger.yml b/dev-support/ranger-docker/docker-compose.ranger.yml
index e37469c10..3d643c04f 100644
--- a/dev-support/ranger-docker/docker-compose.ranger.yml
+++ b/dev-support/ranger-docker/docker-compose.ranger.yml
@@ -112,7 +112,7 @@ services:
- ./scripts/solr/solr-ranger_audits:/opt/solr/server/solr/configsets/ranger_audits/conf
- ./scripts/solr/ranger-solr-plugin-install.properties:/opt/ranger/ranger-solr-plugin/install.properties
- ./scripts/solr/core-site.xml:/opt/solr/server/resources/core-site.xml
- - ./scripts/solr/solr-jaas.conf:/opt/solr/server/etc/jaas.conf
+ - ./scripts/solr/solr-jaas.conf:/var/solr/data/jaas.conf
- ./scripts/solr/solr-security.json:/var/solr/data/security.json
- ./scripts/solr/ranger-solr.sh:/opt/ranger/ranger-solr.sh
- ./scripts/kdc/krb5.conf:/etc/krb5.conf
diff --git a/dev-support/ranger-docker/scripts/solr/ranger-solr-plugin-install.properties b/dev-support/ranger-docker/scripts/solr/ranger-solr-plugin-install.properties
index 2f8b69e43..34e6e56cc 100644
--- a/dev-support/ranger-docker/scripts/solr/ranger-solr-plugin-install.properties
+++ b/dev-support/ranger-docker/scripts/solr/ranger-solr-plugin-install.properties
@@ -19,6 +19,7 @@ COMPONENT_INSTALL_DIR_NAME=/opt/solr/server
UGI_INITIALIZE=true
UGI_LOGIN_TYPE=jaas
UGI_JAAS_APPCONFIG=Client
+POLICY_CACHE_FILE_PATH=/var/solr/data
XAAUDIT.SOLR.IS_ENABLED=true
XAAUDIT.SOLR.MAX_QUEUE_SIZE=1
@@ -57,7 +58,7 @@ XAAUDIT.JAAS.CLIENT.OPTION.USE_KEY_TAB=true
XAAUDIT.JAAS.CLIENT.OPTION.STORE_KEY=true
XAAUDIT.JAAS.CLIENT.OPTION.USE_TICKET_CACHE=true
XAAUDIT.JAAS.CLIENT.OPTION.SERVICE_NAME=solr
-XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/etc/keytabs/solr.keytab
+XAAUDIT.JAAS.CLIENT.OPTION.KEY_TAB=/var/solr/data/solr.keytab
XAAUDIT.JAAS.CLIENT.OPTION.PRINCIPAL=solr/ranger-solr.rangernw@EXAMPLE.COM
XAAUDIT.ELASTICSEARCH.ENABLE=false
diff --git a/dev-support/ranger-docker/scripts/solr/ranger-solr.sh b/dev-support/ranger-docker/scripts/solr/ranger-solr.sh
index 719e2bee1..fd504d524 100755
--- a/dev-support/ranger-docker/scripts/solr/ranger-solr.sh
+++ b/dev-support/ranger-docker/scripts/solr/ranger-solr.sh
@@ -26,10 +26,17 @@ then
${RANGER_SCRIPTS}/wait_for_keytab.sh solr.keytab
${RANGER_SCRIPTS}/wait_for_testusers_keytab.sh
- JAAS_CONFIG="-Djava.security.auth.login.config=/opt/solr/server/etc/jaas.conf"
+ if [ ! -e /var/solr/data/HTTP.keytab ]
+ then
+ cp /etc/keytabs/HTTP.keytab /var/solr/data/
+ cp /etc/keytabs/solr.keytab /var/solr/data/
+ chown solr:solr /var/solr/data/HTTP.keytab /var/solr/data/solr.keytab
+ fi
+
+ JAAS_CONFIG="-Djava.security.auth.login.config=/var/solr/data/jaas.conf"
JAAS_APPNAME="-Dsolr.kerberos.jaas.appname=Client"
KRB5_CONF="-Djava.security.krb5.conf=/etc/krb5.conf"
- KERBEROS_KEYTAB="-Dsolr.kerberos.keytab=/etc/keytabs/HTTP.keytab"
+ KERBEROS_KEYTAB="-Dsolr.kerberos.keytab=/var/solr/data/HTTP.keytab"
KERBEROS_PRINCIPAL="-Dsolr.kerberos.principal=HTTP/ranger-solr.rangernw@EXAMPLE.COM"
COOKIE_DOMAIN="-Dsolr.kerberos.cookie.domain=ranger-solr"
KERBEROS_NAME_RULES="-Dsolr.kerberos.name.rules=RULE:[2:\$1/\$2@\$0]([ndj]n/.*@EXAMPLE\.COM)s/.*/hdfs/\
@@ -38,7 +45,7 @@ RULE:[2:\$1/\$2@\$0](jhs/.*@EXAMPLE\.COM)s/.*/mapred/\
DEFAULT"
export SOLR_AUTHENTICATION_OPTS="${JAAS_CONFIG} ${JAAS_APPNAME} ${KRB5_CONF} ${KERBEROS_KEYTAB} ${KERBEROS_PRINCIPAL} ${COOKIE_DOMAIN} ${KERBEROS_NAME_RULES}"
- export SOLR_AUTH_TYPE=kerberos
+ export SOLR_MODULES=hadoop-auth
fi
if [ ! -e ${SOLR_INSTALL_DIR}/.setupDone ]
@@ -49,4 +56,4 @@ then
touch "${SOLR_INSTALL_DIR}"/.setupDone
fi
-su -p -c "export PATH=${PATH} && /opt/docker-solr/scripts/docker-entrypoint.sh $*" solr
+su -p -c "export PATH=${PATH} && /opt/solr/docker/scripts/docker-entrypoint.sh $*" solr
diff --git a/dev-support/ranger-docker/scripts/solr/solr-jaas.conf b/dev-support/ranger-docker/scripts/solr/solr-jaas.conf
index 586230b5e..2dd0ebe6c 100644
--- a/dev-support/ranger-docker/scripts/solr/solr-jaas.conf
+++ b/dev-support/ranger-docker/scripts/solr/solr-jaas.conf
@@ -1,7 +1,7 @@
SolrClient {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
- keyTab="/etc/keytabs/HTTP.keytab"
+ keyTab="/var/solr/data/HTTP.keytab"
storeKey=true
useTicketCache=false
principal="HTTP/ranger-solr.rangernw@EXAMPLE.COM";
@@ -10,7 +10,7 @@ SolrClient {
SolrServer {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
- keyTab="/etc/keytabs/HTTP.keytab"
+ keyTab="/var/solr/data/HTTP.keytab"
storeKey=true
useTicketCache=false
principal="HTTP/ranger-solr.rangernw@EXAMPLE.COM";
@@ -19,7 +19,7 @@ SolrServer {
Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
- keyTab="/etc/keytabs/solr.keytab"
+ keyTab="/var/solr/data/solr.keytab"
storeKey=true
useTicketCache=false
principal="solr/ranger-solr.rangernw@EXAMPLE.COM";
diff --git a/dev-support/ranger-docker/scripts/solr/solr-ranger_audits/solrconfig.xml b/dev-support/ranger-docker/scripts/solr/solr-ranger_audits/solrconfig.xml
index 33891833c..da9464ef9 100644
--- a/dev-support/ranger-docker/scripts/solr/solr-ranger_audits/solrconfig.xml
+++ b/dev-support/ranger-docker/scripts/solr/solr-ranger_audits/solrconfig.xml
@@ -417,7 +417,7 @@
to occupy. Note that when this option is specified, the size
and initialSize parameters are ignored.
-->
- <filterCache class="solr.FastLRUCache"
+ <filterCache class="solr.CaffeineCache"
size="512"
initialSize="512"
autowarmCount="0"/>
@@ -429,7 +429,7 @@
maxRamMB - the maximum amount of RAM (in MB) that this cache is allowed
to occupy
-->
- <queryResultCache class="solr.LRUCache"
+ <queryResultCache class="solr.CaffeineCache"
size="512"
initialSize="512"
autowarmCount="0"/>
@@ -439,14 +439,14 @@
document). Since Lucene internal document ids are transient,
this cache will not be autowarmed.
-->
- <documentCache class="solr.LRUCache"
+ <documentCache class="solr.CaffeineCache"
size="512"
initialSize="512"
autowarmCount="0"/>
<!-- custom cache currently used by block join -->
<cache name="perSegFilter"
- class="solr.search.LRUCache"
+ class="solr.search.CaffeineCache"
size="10"
initialSize="0"
autowarmCount="10"
@@ -458,7 +458,7 @@
even if not configured here.
-->
<!--
- <fieldValueCache class="solr.FastLRUCache"
+ <fieldValueCache class="solr.CaffeineCache"
size="512"
autowarmCount="128"
showItems="32" />
@@ -474,7 +474,7 @@
-->
<!--
<cache name="myUserCache"
- class="solr.LRUCache"
+ class="solr.CaffeineCache"
size="4096"
initialSize="1024"
autowarmCount="1024"
diff --git a/dev-support/ranger-docker/scripts/solr/solr-security.json b/dev-support/ranger-docker/scripts/solr/solr-security.json
index 6cf993156..ddcdb1eaa 100644
--- a/dev-support/ranger-docker/scripts/solr/solr-security.json
+++ b/dev-support/ranger-docker/scripts/solr/solr-security.json
@@ -1,8 +1,8 @@
{
"authentication": {
- "class": "solr.KerberosPlugin",
+ "class": "org.apache.solr.security.hadoop.KerberosPlugin",
"kerberos.principal": "HTTP/ranger-solr.rangernw@EXAMPLE.COM",
- "kerberos.keytab": "/etc/keytabs/HTTP.keytab",
+ "kerberos.keytab": "/var/solr/data/HTTP.keytab",
"kerberos.name.rules": "RULE:[2:$1@$0](.*@EXAMPLE.COM)s/@.*//\nRULE:[1:$1@$0](.*@EXAMPLE.COM)s/@.*//\nDEFAULT",
"kerberos.cookie.domain": "ranger-solr",
"cookie.domain": "ranger-solr",
diff --git a/distro/src/main/assembly/plugin-solr.xml b/distro/src/main/assembly/plugin-solr.xml
index 3203831d1..5209df4a9 100644
--- a/distro/src/main/assembly/plugin-solr.xml
+++ b/distro/src/main/assembly/plugin-solr.xml
@@ -53,17 +53,11 @@
<directoryMode>755</directoryMode>
<fileMode>644</fileMode>
<includes>
- <include>com.carrotsearch:hppc</include>
- <include>com.fasterxml.jackson.core:jackson-annotations:jar:${fasterxml.jackson.version}</include>
- <include>com.fasterxml.jackson.core:jackson-core:jar:${fasterxml.jackson.version}</include>
- <include>com.fasterxml.jackson.core:jackson-databind:jar:${fasterxml.jackson.version}</include>
<include>com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:${fasterxml.jackson.version}</include>
<include>com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:jar:${fasterxml.jackson.version}</include>
- <include>com.fasterxml.jackson.module:jackson-module-jaxb-annotations:jar:${fasterxml.jackson.version}</include>
<include>com.google.code.gson:gson</include>
<include>commons-collections:commons-collections</include>
<include>io.airlift:aircompressor:jar:${aircompressor.version}</include>
- <include>jakarta.ws.rs:jakarta.ws.rs-api</include>
<include>javax.inject:javax.inject</include>
<include>joda-time:joda-time</include>
<include>org.apache.hadoop.thirdparty:hadoop-shaded-guava:jar:${hadoop-shaded-guava.version}</include>
@@ -71,18 +65,16 @@
<include>org.apache.hadoop:hadoop-client-runtime:jar:${hadoop.version}</include>
<include>org.apache.httpcomponents:httpasyncclient:jar:${httpcomponents.httpasyncclient.version}</include>
<include>org.apache.httpcomponents:httpcore-nio:jar:${httpcomponents.httpcore.version}</include>
- <include>org.apache.lucene:lucene-core</include>
- <include>org.glassfish.hk2.external:jakarta.inject</include>
<include>org.glassfish.hk2:class-model</include>
<include>org.glassfish.hk2:hk2-api</include>
<include>org.glassfish.hk2:hk2-core</include>
- <include>org.glassfish.hk2:hk2-locator</include>
<include>org.glassfish.hk2:hk2-runlevel</include>
- <include>org.glassfish.hk2:hk2-utils</include>
- <include>org.glassfish.hk2:hk2</include>
- <include>org.glassfish.jersey.core:jersey-common</include>
- <include>org.glassfish.jersey.ext:jersey-entity-filtering</include>
- <include>org.glassfish.jersey.inject:jersey-hk2</include>
+ <include>org.graalvm.js:js:jar:${graalvm.version}</include>
+ <include>org.graalvm.js:js-scriptengine:jar:${graalvm.version}</include>
+ <include>org.graalvm.regex:regex:jar:${graalvm.version}</include>
+ <include>org.graalvm.sdk:graal-sdk:jar:${graalvm.version}</include>
+ <include>org.graalvm.truffle:truffle-api:jar:${graalvm.version}</include>
+ <include>com.ibm.icu:icu4j</include>
</includes>
</binaries>
</moduleSet>
diff --git a/plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java b/plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java
index 2206efedc..0c1e5fc71 100644
--- a/plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java
+++ b/plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java
@@ -164,10 +164,11 @@ public AuthorizationResponse authorize(AuthorizationContext context) {
// At the end will we iterate this list and invoke Ranger to check for privileges.
List<RangerAccessRequestImpl> rangerRequests = new ArrayList<>();
- // The following logic is taken from Sentry See in SentrySolrPluginImpl.java.
+ Object handler = context.getHandler();
- if (context.getHandler() instanceof PermissionNameProvider) {
- PermissionNameProvider.Name perm = ((PermissionNameProvider) context.getHandler()).getPermissionName(context);
+ // The following logic is taken from Sentry See in SentrySolrPluginImpl.java.
+ if (handler instanceof PermissionNameProvider) {
+ PermissionNameProvider.Name perm = ((PermissionNameProvider) handler).getPermissionName(context);
switch (perm) {
case READ_PERM:
@@ -251,7 +252,7 @@ public AuthorizationResponse authorize(AuthorizationContext context) {
}
}
} else {
- logger.warn("Request Handler: {} is not an instance of PermissionNameProvider and so we are not able to authenticate the request. Check SOLR-11623 for more information.", context.getHandler().getClass().getName());
+ logger.warn("Request Handler: {} is not an instance of PermissionNameProvider and so we are not able to authenticate the request. Check SOLR-11623 for more information.", handler == null ? null : handler.getClass().getName());
}
/*