You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by vi...@apache.org on 2026/04/30 05:07:05 UTC
(ranger) branch master updated: RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM (#680)
This is an automated email from the ASF dual-hosted git repository.
vikaskr22 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/master by this push:
new deeb4328d RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM (#680)
deeb4328d is described below
commit deeb4328df1ac079611b85a4f55cf49bdcff85f1
Author: Chinmay Hegde <he...@gmail.com>
AuthorDate: Thu Apr 30 10:36:59 2026 +0530
RANGER-5333:Configurable Master key name for Ranger KMS DB with Luna HSM (#680)
* RANGER-5333:Configurable Master key for Luna HSM
# Conflicts:
# kms/src/main/java/org/apache/hadoop/crypto/key/RangerHSM.java
* RANGER-5333:Added default MK alias value to dbks-site.xml
* RANGER-5333: Resolved checkstyle error
---
kms/config/kms-webapp/dbks-site.xml | 6 ++++++
.../java/org/apache/hadoop/crypto/key/RangerHSM.java | 19 +++++++++++--------
2 files changed, 17 insertions(+), 8 deletions(-)
diff --git a/kms/config/kms-webapp/dbks-site.xml b/kms/config/kms-webapp/dbks-site.xml
index ef586a3db..c737c498e 100755
--- a/kms/config/kms-webapp/dbks-site.xml
+++ b/kms/config/kms-webapp/dbks-site.xml
@@ -405,6 +405,12 @@
<value>false</value>
<description></description>
</property>
+
+ <property>
+ <name>ranger.ks.hsm.masterkey.alias</name>
+ <value>RangerKMSKey</value>
+ <description>Custom alias for Luna HSM master key</description>
+ </property>
<property>
<name>ranger.ks.hsm.partition.name</name>
diff --git a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerHSM.java b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerHSM.java
index 4a4fc97a2..97a08aa84 100644
--- a/kms/src/main/java/org/apache/hadoop/crypto/key/RangerHSM.java
+++ b/kms/src/main/java/org/apache/hadoop/crypto/key/RangerHSM.java
@@ -48,11 +48,13 @@ public class RangerHSM implements RangerKMSMKI {
private static final String PARTITION_NAME = "ranger.ks.hsm.partition.name";
private static final String HSM_TYPE = "ranger.ks.hsm.type";
private static final String MK_KEY_SIZE = "ranger.kms.hsm.masterkey.size";
- private static final String ALIAS = "RangerKMSKey";
+ private static final String MK_ALIAS = "ranger.ks.hsm.masterkey.alias";
+ private static final String DEFAULT_MK_ALIAS = "RangerKMSKey";
private KeyStore myStore;
private String hsmKeystore;
- private int mkKeySize;
+ private String mkAlias;
+ private int mkKeySize;
public RangerHSM() {
}
@@ -65,6 +67,7 @@ public RangerHSM(Configuration conf) {
*/
String passwd = conf.get(PARTITION_PASSWORD);
String partitionName = conf.get(PARTITION_NAME);
+ this.mkAlias = conf.get(MK_ALIAS, DEFAULT_MK_ALIAS);
this.mkKeySize = conf.getInt(MK_KEY_SIZE, DEFAULT_MK_KEY_SIZE);
String errorMsg = StringUtils.EMPTY;
@@ -103,7 +106,7 @@ public boolean generateMasterKey(String password) throws Throwable {
boolean isMKGenerated = false;
- if (!this.myStore.containsAlias(ALIAS)) {
+ if (!this.myStore.containsAlias(mkAlias)) {
try {
logger.info("Generating AES Master Key for '{}' HSM Provider and keySize is {}", hsmKeystore, this.mkKeySize);
@@ -113,14 +116,14 @@ public boolean generateMasterKey(String password) throws Throwable {
SecretKey aesKey = keyGen.generateKey();
- myStore.setKeyEntry(ALIAS, aesKey, password.toCharArray(), (java.security.cert.Certificate[]) null);
+ myStore.setKeyEntry(mkAlias, aesKey, password.toCharArray(), (java.security.cert.Certificate[]) null);
isMKGenerated = true;
} catch (Exception e) {
logger.error("generateMasterKey : Exception during Ranger Master Key Generation - {}", e.getMessage());
}
} else {
- logger.info("Master key with alias - '{}' already exists!", ALIAS);
+ logger.info("Master key with alias - '{}' already exists!", mkAlias);
}
logger.debug("<== RangerHSM.generateMasterKey()");
@@ -136,12 +139,12 @@ public String getMasterKey(String password) throws Throwable {
try {
logger.debug("Searching for Ranger Master Key in Luna Keystore");
- boolean result = myStore.containsAlias(ALIAS);
+ boolean result = myStore.containsAlias(mkAlias);
if (result) {
logger.debug("Ranger Master Key is present in Keystore");
- SecretKey key = (SecretKey) myStore.getKey(ALIAS, password.toCharArray());
+ SecretKey key = (SecretKey) myStore.getKey(mkAlias, password.toCharArray());
return Base64.encode(key.getEncoded());
}
@@ -161,7 +164,7 @@ public boolean setExternalKeyAsMK(String password, byte[] key) {
try {
Key aesKey = new SecretKeySpec(key, MK_CIPHER);
- myStore.setKeyEntry(ALIAS, aesKey, password.toCharArray(), (java.security.cert.Certificate[]) null);
+ myStore.setKeyEntry(mkAlias, aesKey, password.toCharArray(), (java.security.cert.Certificate[]) null);
return true;
} catch (KeyStoreException e) {