You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "kumaab (via GitHub)" <gi...@apache.org> on 2026/04/24 00:55:22 UTC
[PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
kumaab opened a new pull request, #928:
URL: https://github.com/apache/ranger/pull/928
## What changes were proposed in this pull request?
Introduce a module `authz-remote` as a minimal java client to connect with PDP Server, using `authz-api`.
- Support Kerberos Authn for now, later extend it to JWT as well.
- Add TLS support, tested via unit tests.
## How was this patch tested?
Tested the client from `ranger-pdp` container in docker using kerberos authn, the client is able to make successful calls to PDP server.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3165153567
##########
ranger-examples/sample-client/src/main/java/org/apache/ranger/examples/pdpclient/RemoteAuthzClient.java:
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.ranger.examples.pdpclient;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthorizerFactory;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAccessInfo;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerResourceInfo;
+import org.apache.ranger.authz.model.RangerUserInfo;
+
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.Properties;
+import java.util.Set;
+
+public final class RemoteAuthzClient {
+ private static final String DEFAULT_PROPERTIES_RESOURCE = "/tmp/ranger-authz-remote-test.properties";
+
+ private static final String PROP_TEST_REQUEST_ID = "ranger.authz.remote.test.requestId";
+ private static final String PROP_TEST_EXPECT_DECISION = "ranger.authz.remote.test.expect.decision";
+ private static final String PROP_TEST_USER_NAME = "ranger.authz.remote.test.user.name";
+ private static final String PROP_TEST_USER_GROUPS = "ranger.authz.remote.test.user.groups";
+ private static final String PROP_TEST_USER_ROLES = "ranger.authz.remote.test.user.roles";
+ private static final String PROP_TEST_ACCESS_ACTION = "ranger.authz.remote.test.access.action";
+ private static final String PROP_TEST_ACCESS_PERMISSIONS = "ranger.authz.remote.test.access.permissions";
+ private static final String PROP_TEST_RESOURCE_NAME = "ranger.authz.remote.test.resource.name";
+ private static final String PROP_TEST_RESOURCE_SUBRESOURCES = "ranger.authz.remote.test.resource.subResources";
+ private static final String PROP_TEST_CONTEXT_SERVICE_TYPE = "ranger.authz.remote.test.context.serviceType";
+ private static final String PROP_TEST_CONTEXT_SERVICE_NAME = "ranger.authz.remote.test.context.serviceName";
+ private static final String PROP_TEST_CONTEXT_CLIENT_IP = "ranger.authz.remote.test.context.clientIpAddress";
+
+ private RemoteAuthzClient() {
+ }
+
+ public static void main(String[] args) throws Exception {
+ String propertiesLocation = args != null && args.length > 0 ? args[0] : "classpath:" + DEFAULT_PROPERTIES_RESOURCE;
+ Properties properties = loadProperties(propertiesLocation);
+
+ System.out.println("Loaded properties from: " + propertiesLocation);
+
+ RangerAuthzResult result = run(properties);
Review Comment:
Reading a request from JSON file makes more sense, it allows requests for other services to be tested as well. updated the PR, thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on PR #928:
URL: https://github.com/apache/ranger/pull/928#issuecomment-4339988380
> @kumaab - this PR will be ready once support for JWT authentication is added (using configurations `ranger.authz.remote.auth.type=jwt`, and other properties to read JWT from file/env/cred-file).
Support for jwt has been added with 2 options: env/file. cred-file option introduced more dependencies (hadoop) and hence has been dropped.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3165142958
##########
authz-remote/src/conf/ranger-authz-remote.properties:
##########
@@ -0,0 +1,31 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ranger.authorizer.impl.class=org.apache.ranger.authz.remote.RangerRemoteAuthorizer
+ranger.authz.remote.pdp.url=http://localhost:6500
+ranger.authz.remote.pdp.connect.timeout.ms=5000
+ranger.authz.remote.pdp.read.timeout.ms=30000
+
+# ranger.authz.remote.auth.type=kerberos|jwt
Review Comment:
updated, thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "mneethiraj (via GitHub)" <gi...@apache.org>.
mneethiraj commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3140829409
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthorizer.java:
##########
@@ -0,0 +1,109 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+
+import java.util.Properties;
+
+import static org.apache.ranger.authz.api.RangerAuthzApiErrorCode.INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_CLIENT_CLOSE_FAILED;
+
+public class RangerRemoteAuthorizer extends RangerAuthorizer {
+ private final RangerRemoteAuthzConfig config;
+
+ private volatile RangerPdpClient client;
+
+ public RangerRemoteAuthorizer(Properties properties) {
+ super(properties);
+
+ this.config = new RangerRemoteAuthzConfig(properties);
+ }
+
+ @Override
+ public void init() throws RangerAuthzException {
+ this.client = new RangerPdpClient(config);
+ }
+
+ @Override
+ public void close() throws RangerAuthzException {
+ RangerPdpClient client = this.client;
+
+ this.client = null;
+
+ if (client != null) {
+ try {
+ client.close();
+ } catch (Exception e) {
+ throw new RangerAuthzException(REMOTE_CLIENT_CLOSE_FAILED, e, e.getMessage() != null ? e.getMessage() : e.getClass().getName());
+ }
+ }
+ }
+
+ @Override
+ public RangerAuthzResult authorize(RangerAuthzRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().authorize(request);
+ }
+
+ @Override
+ public RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().authorize(request);
+ }
+
+ @Override
+ public RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().getResourcePermissions(request);
+ }
+
+ @Override
+ protected void validateAccessContext(RangerAccessContext context) throws RangerAuthzException {
+ super.validateAccessContext(context);
+
+ if (StringUtils.isBlank(context.getServiceName()) || StringUtils.isBlank(context.getServiceType())) {
Review Comment:
"||" => "&&"
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3165155455
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -0,0 +1,278 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.http.HttpEntity;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.config.Registry;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.util.EntityUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+import org.apache.ranger.authz.remote.authn.RangerRemoteJwtProvider;
+import org.apache.ranger.authz.remote.authn.RangerRemoteKerberosContext;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+
+import java.io.Closeable;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.Map;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.JWT;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.KERBEROS;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.FAILED_TO_DESERIALIZE_RESPONSE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.FAILED_TO_SERIALIZE_REQUEST;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_CALL_UNSUCCESSFUL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.TLS_CONFIGURATION_FAILED;
+
+class RangerPdpClient implements Closeable {
+ private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+
+ private static final String PATH_AUTHORIZE = "/authorize";
+ private static final String PATH_AUTHORIZE_MULTI = "/authorizeMulti";
+ private static final String PATH_RESOURCE_PERMISSIONS = "/permissions";
+ private static final String HEADER_AUTHORIZATION = "Authorization";
Review Comment:
It makes sense to move these JWT specific details to its own class - updated. thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "mneethiraj (via GitHub)" <gi...@apache.org>.
mneethiraj commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3140247987
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -82,52 +88,64 @@ class RangerPdpClient implements Closeable {
RangerAuthzResult authorize(RangerAuthzRequest request) throws RangerAuthzException {
String endpoint = config.getEndpointUrl(PATH_AUTHORIZE);
- String payload = RangerRemoteJson.writeAuthzRequest(request);
- String response = post(endpoint, payload);
- return RangerRemoteJson.readAuthzResult(response, endpoint);
+ return post(endpoint, request, RangerAuthzResult.class);
}
RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws RangerAuthzException {
String endpoint = config.getEndpointUrl(PATH_AUTHORIZE_MULTI);
- String payload = RangerRemoteJson.writeMultiAuthzRequest(request);
- String response = post(endpoint, payload);
- return RangerRemoteJson.readMultiAuthzResult(response, endpoint);
+ return post(endpoint, request, RangerMultiAuthzResult.class);
}
RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) throws RangerAuthzException {
String endpoint = config.getEndpointUrl(PATH_RESOURCE_PERMISSIONS);
- String payload = RangerRemoteJson.writeResourcePermissionsRequest(request);
- String response = post(endpoint, payload);
- return RangerRemoteJson.readResourcePermissions(response, endpoint);
+ return post(endpoint, request, RangerResourcePermissions.class);
}
- private String post(String endpoint, String payload) throws RangerAuthzException {
+ private <T> T post(String endpoint, Object payload, Class<T> responseType) throws RangerAuthzException {
+ final String requestBody;
+
+ try {
+ requestBody = OBJECT_MAPPER.writeValueAsString(payload);
+ } catch (IOException e) {
+ throw new RangerAuthzException(REMOTE_RESPONSE_INVALID, e, "request-body");
Review Comment:
REMOTE_RESPONSE_INVALID => FAILED_TO_SERIALIZE_REQUEST
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -82,52 +88,64 @@ class RangerPdpClient implements Closeable {
RangerAuthzResult authorize(RangerAuthzRequest request) throws RangerAuthzException {
String endpoint = config.getEndpointUrl(PATH_AUTHORIZE);
- String payload = RangerRemoteJson.writeAuthzRequest(request);
- String response = post(endpoint, payload);
- return RangerRemoteJson.readAuthzResult(response, endpoint);
+ return post(endpoint, request, RangerAuthzResult.class);
}
RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws RangerAuthzException {
String endpoint = config.getEndpointUrl(PATH_AUTHORIZE_MULTI);
- String payload = RangerRemoteJson.writeMultiAuthzRequest(request);
- String response = post(endpoint, payload);
- return RangerRemoteJson.readMultiAuthzResult(response, endpoint);
+ return post(endpoint, request, RangerMultiAuthzResult.class);
}
RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) throws RangerAuthzException {
String endpoint = config.getEndpointUrl(PATH_RESOURCE_PERMISSIONS);
- String payload = RangerRemoteJson.writeResourcePermissionsRequest(request);
- String response = post(endpoint, payload);
- return RangerRemoteJson.readResourcePermissions(response, endpoint);
+ return post(endpoint, request, RangerResourcePermissions.class);
}
- private String post(String endpoint, String payload) throws RangerAuthzException {
+ private <T> T post(String endpoint, Object payload, Class<T> responseType) throws RangerAuthzException {
+ final String requestBody;
+
+ try {
+ requestBody = OBJECT_MAPPER.writeValueAsString(payload);
+ } catch (IOException e) {
+ throw new RangerAuthzException(REMOTE_RESPONSE_INVALID, e, "request-body");
+ }
+
HttpPost request = new HttpPost(endpoint);
try {
request.setHeader("Content-Type", ContentType.APPLICATION_JSON.getMimeType());
request.setHeader("Accept", ContentType.APPLICATION_JSON.getMimeType());
- request.setEntity(new StringEntity(payload, ContentType.APPLICATION_JSON));
+ request.setEntity(new StringEntity(requestBody, ContentType.APPLICATION_JSON));
for (Map.Entry<String, String> header : config.getHeaders().entrySet()) {
request.setHeader(header.getKey(), header.getValue());
}
+ String responseBody;
+
if (authType == KERBEROS) {
- return kerberosContext.doAs((PrivilegedExceptionAction<String>) () -> execute(request, endpoint));
+ responseBody = kerberosContext.doAs((PrivilegedExceptionAction<String>) () -> execute(request, endpoint));
+ } else {
+ responseBody = execute(request, endpoint);
}
- return execute(request, endpoint);
+ try {
+ return OBJECT_MAPPER.readValue(responseBody, responseType);
+ } catch (IOException e) {
+ throw new RangerAuthzException(REMOTE_RESPONSE_INVALID, e, endpoint);
Review Comment:
REMOTE_RESPONSE_INVALID => FAILED_TO_DESERIALIZE_RESPONSE
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthorizer.java:
##########
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+
+import java.util.Properties;
+
+import static org.apache.ranger.authz.api.RangerAuthzApiErrorCode.INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+
+public class RangerRemoteAuthorizer extends RangerAuthorizer {
+ private final RangerRemoteAuthzConfig config;
+
+ private volatile RangerPdpClient client;
+
+ public RangerRemoteAuthorizer(Properties properties) {
+ super(properties);
+
+ this.config = new RangerRemoteAuthzConfig(properties);
+ }
+
+ @Override
+ public void init() throws RangerAuthzException {
+ config.getPdpUrl();
Review Comment:
Are lines 52, 53, 54 necessary?
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthorizer.java:
##########
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+
+import java.util.Properties;
+
+import static org.apache.ranger.authz.api.RangerAuthzApiErrorCode.INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+
+public class RangerRemoteAuthorizer extends RangerAuthorizer {
+ private final RangerRemoteAuthzConfig config;
+
+ private volatile RangerPdpClient client;
+
+ public RangerRemoteAuthorizer(Properties properties) {
+ super(properties);
+
+ this.config = new RangerRemoteAuthzConfig(properties);
+ }
+
+ @Override
+ public void init() throws RangerAuthzException {
+ config.getPdpUrl();
+ config.getConnectTimeoutMs();
+ config.getReadTimeoutMs();
+
+ this.client = new RangerPdpClient(config);
+ }
+
+ @Override
+ public void close() throws RangerAuthzException {
+ RangerPdpClient client = this.client;
+
+ this.client = null;
+
+ if (client != null) {
+ try {
+ client.close();
+ } catch (Exception e) {
+ throw new RangerAuthzException(REMOTE_REQUEST_FAILED, e, RangerRemoteAuthzConfig.PROP_REMOTE_URL);
Review Comment:
REMOTE_REQUEST_FAILED here? Consider using a new error code.
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthorizer.java:
##########
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+
+import java.util.Properties;
+
+import static org.apache.ranger.authz.api.RangerAuthzApiErrorCode.INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+
+public class RangerRemoteAuthorizer extends RangerAuthorizer {
+ private final RangerRemoteAuthzConfig config;
+
+ private volatile RangerPdpClient client;
+
+ public RangerRemoteAuthorizer(Properties properties) {
+ super(properties);
+
+ this.config = new RangerRemoteAuthzConfig(properties);
+ }
+
+ @Override
+ public void init() throws RangerAuthzException {
+ config.getPdpUrl();
+ config.getConnectTimeoutMs();
+ config.getReadTimeoutMs();
+
+ this.client = new RangerPdpClient(config);
+ }
+
+ @Override
+ public void close() throws RangerAuthzException {
+ RangerPdpClient client = this.client;
+
+ this.client = null;
+
+ if (client != null) {
+ try {
+ client.close();
+ } catch (Exception e) {
+ throw new RangerAuthzException(REMOTE_REQUEST_FAILED, e, RangerRemoteAuthzConfig.PROP_REMOTE_URL);
+ }
+ }
+ }
+
+ @Override
+ public RangerAuthzResult authorize(RangerAuthzRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().authorize(request);
+ }
+
+ @Override
+ public RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().authorize(request);
+ }
+
+ @Override
+ public RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().getResourcePermissions(request);
+ }
+
+ @Override
+ protected void validateAccessContext(RangerAccessContext context) throws RangerAuthzException {
+ super.validateAccessContext(context);
+
+ String serviceName = context.getServiceName();
+ String serviceType = context.getServiceType();
+
+ if (StringUtils.isBlank(serviceName)) {
+ if (StringUtils.isBlank(serviceType)) {
+ throw new RangerAuthzException(INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY);
+ }
+
+ serviceName = config.getDefaultServiceNameForServiceType(serviceType);
Review Comment:
lines 107 to 123 are unnecessary at the client side; the client should either know the service name or rely on the service name configured at the PDP server side for the given service type. Please remove corresponding methods and fields as well, like:
- `RangerRemoteAuthzConfig.getDefaultServiceNameForServiceType()`
- `RangerRemoteAuthzConfig.getServiceTypeForService()`
- `RangerRemoteAuthzConfig.PROP_PREFIX_SERVICE`
- `RangerRemoteAuthzConfig.PROP_PREFIX_SERVICE_TYPE`
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzConfig.java:
##########
@@ -58,9 +59,26 @@ public class RangerRemoteAuthzConfig {
private static final String DEFAULT_STORE_TYPE = "PKCS12";
private final Properties properties;
+ private final Map<String, String> headers;
public RangerRemoteAuthzConfig(Properties properties) {
this.properties = properties != null ? properties : new Properties();
+ Map<String, String> ret = new LinkedHashMap<>();
+
+ for (String propName : this.properties.stringPropertyNames()) {
Review Comment:
Consider replacing this for loop with use of streams.
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzConfig.java:
##########
@@ -58,9 +59,26 @@ public class RangerRemoteAuthzConfig {
private static final String DEFAULT_STORE_TYPE = "PKCS12";
private final Properties properties;
+ private final Map<String, String> headers;
public RangerRemoteAuthzConfig(Properties properties) {
this.properties = properties != null ? properties : new Properties();
+ Map<String, String> ret = new LinkedHashMap<>();
Review Comment:
ret => headers
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -0,0 +1,267 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.http.HttpEntity;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.config.Registry;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.util.EntityUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+import org.apache.ranger.authz.remote.authn.RangerRemoteKerberosContext;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+
+import java.io.Closeable;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.Map;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.KERBEROS;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_CALL_UNSUCCESSFUL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_RESPONSE_INVALID;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.TLS_CONFIGURATION_FAILED;
+
+class RangerPdpClient implements Closeable {
+ private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+
+ private static final String PATH_AUTHORIZE = "/authorize";
+ private static final String PATH_AUTHORIZE_MULTI = "/authorizeMulti";
+ private static final String PATH_RESOURCE_PERMISSIONS = "/permissions";
+
+ private final RangerRemoteAuthzConfig config;
+ private final CloseableHttpClient httpClient;
+ private final RangerRemoteAuthType authType;
+ private final RangerRemoteKerberosContext kerberosContext;
+
+ RangerPdpClient(RangerRemoteAuthzConfig config) throws RangerAuthzException {
+ this.config = config;
+ this.authType = config.getAuthType();
+ this.kerberosContext = authType == KERBEROS ? RangerRemoteKerberosContext.create(config) : null;
+ this.httpClient = createHttpClient(config, kerberosContext);
+ }
+
+ RangerAuthzResult authorize(RangerAuthzRequest request) throws RangerAuthzException {
+ String endpoint = config.getEndpointUrl(PATH_AUTHORIZE);
+
+ return post(endpoint, request, RangerAuthzResult.class);
+ }
+
+ RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws RangerAuthzException {
+ String endpoint = config.getEndpointUrl(PATH_AUTHORIZE_MULTI);
Review Comment:
Consider caching API endpoints in the constructor , to avoid repeated lookup in each call.
```
private final String apiEndPointAuthorize;
private final String apiEndpointMultiAuthorize;
private final String apiEndpointResourcePermissions;
// constructor
{
...
this.apiEndPointAuthorize = config.getEndpointUrl(PATH_AUTHORIZE);
this.apiEndpointMultiAuthorize = config.getEndpointUrl(PATH_AUTHORIZE_MULTI);;
this.apiEndpointResourcePermissions = config.getEndpointUrl(PATH_RESOURCE_PERMISSIONS);;
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3175735653
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -0,0 +1,274 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.http.HttpEntity;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.config.Registry;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.util.EntityUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+import org.apache.ranger.authz.remote.authn.RangerRemoteJwtProvider;
+import org.apache.ranger.authz.remote.authn.RangerRemoteKerberosContext;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+
+import java.io.Closeable;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.Map;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.JWT;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.KERBEROS;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.FAILED_TO_DESERIALIZE_RESPONSE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.FAILED_TO_SERIALIZE_REQUEST;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_CALL_UNSUCCESSFUL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.TLS_CONFIGURATION_FAILED;
+
+class RangerPdpClient implements Closeable {
+ private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+
+ private static final String PATH_AUTHORIZE = "/authorize";
+ private static final String PATH_AUTHORIZE_MULTI = "/authorizeMulti";
+ private static final String PATH_RESOURCE_PERMISSIONS = "/permissions";
+
+ private final RangerRemoteAuthzConfig config;
+ private final CloseableHttpClient httpClient;
+ private final RangerRemoteAuthType authType;
Review Comment:
Sure, updated!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3175725046
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzErrorCode.java:
##########
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.ranger.authz.api.RangerAuthzErrorCode;
+
+public enum RangerRemoteAuthzErrorCode implements RangerAuthzErrorCode {
+ MISSING_PDP_URL(500, "00-001", "missing property {0}"),
+ INVALID_PROPERTY_VALUE(500, "00-002", "invalid value for property {0}: {1}"),
+ REMOTE_REQUEST_FAILED(500, "00-003", "failed to call Ranger PDP endpoint {0}"),
+ REMOTE_CALL_UNSUCCESSFUL(502, "00-004", "Ranger PDP endpoint {0} returned HTTP {1}: {2}"),
+ MISSING_AUTH_CONFIG(500, "00-005", "missing property {0}"),
Review Comment:
Sure.
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzErrorCode.java:
##########
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.ranger.authz.api.RangerAuthzErrorCode;
+
+public enum RangerRemoteAuthzErrorCode implements RangerAuthzErrorCode {
+ MISSING_PDP_URL(500, "00-001", "missing property {0}"),
+ INVALID_PROPERTY_VALUE(500, "00-002", "invalid value for property {0}: {1}"),
+ REMOTE_REQUEST_FAILED(500, "00-003", "failed to call Ranger PDP endpoint {0}"),
+ REMOTE_CALL_UNSUCCESSFUL(502, "00-004", "Ranger PDP endpoint {0} returned HTTP {1}: {2}"),
+ MISSING_AUTH_CONFIG(500, "00-005", "missing property {0}"),
+ UNSUPPORTED_AUTH_TYPE(500, "00-006", "unsupported auth type {0}"),
Review Comment:
Sure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3140626441
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthorizer.java:
##########
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+
+import java.util.Properties;
+
+import static org.apache.ranger.authz.api.RangerAuthzApiErrorCode.INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+
+public class RangerRemoteAuthorizer extends RangerAuthorizer {
+ private final RangerRemoteAuthzConfig config;
+
+ private volatile RangerPdpClient client;
+
+ public RangerRemoteAuthorizer(Properties properties) {
+ super(properties);
+
+ this.config = new RangerRemoteAuthzConfig(properties);
+ }
+
+ @Override
+ public void init() throws RangerAuthzException {
+ config.getPdpUrl();
+ config.getConnectTimeoutMs();
+ config.getReadTimeoutMs();
+
+ this.client = new RangerPdpClient(config);
+ }
+
+ @Override
+ public void close() throws RangerAuthzException {
+ RangerPdpClient client = this.client;
+
+ this.client = null;
+
+ if (client != null) {
+ try {
+ client.close();
+ } catch (Exception e) {
+ throw new RangerAuthzException(REMOTE_REQUEST_FAILED, e, RangerRemoteAuthzConfig.PROP_REMOTE_URL);
+ }
+ }
+ }
+
+ @Override
+ public RangerAuthzResult authorize(RangerAuthzRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().authorize(request);
+ }
+
+ @Override
+ public RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().authorize(request);
+ }
+
+ @Override
+ public RangerResourcePermissions getResourcePermissions(RangerResourcePermissionsRequest request) throws RangerAuthzException {
+ validateRequest(request);
+
+ return getClient().getResourcePermissions(request);
+ }
+
+ @Override
+ protected void validateAccessContext(RangerAccessContext context) throws RangerAuthzException {
+ super.validateAccessContext(context);
+
+ String serviceName = context.getServiceName();
+ String serviceType = context.getServiceType();
+
+ if (StringUtils.isBlank(serviceName)) {
+ if (StringUtils.isBlank(serviceType)) {
+ throw new RangerAuthzException(INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY);
+ }
+
+ serviceName = config.getDefaultServiceNameForServiceType(serviceType);
Review Comment:
I see, updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "mneethiraj (via GitHub)" <gi...@apache.org>.
mneethiraj commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3158494904
##########
authz-remote/src/conf/ranger-authz-remote.properties:
##########
@@ -0,0 +1,31 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ranger.authorizer.impl.class=org.apache.ranger.authz.remote.RangerRemoteAuthorizer
+ranger.authz.remote.pdp.url=http://localhost:6500
+ranger.authz.remote.pdp.connect.timeout.ms=5000
+ranger.authz.remote.pdp.read.timeout.ms=30000
+
+# ranger.authz.remote.auth.type=kerberos|jwt
Review Comment:
`none` is a valid value as well, right??
##########
ranger-examples/sample-client/src/main/resources/ranger-authz-remote-authn-jwt.properties:
##########
@@ -0,0 +1,30 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+ranger.authorizer.impl.class=org.apache.ranger.authz.remote.RangerRemoteAuthorizer
+ranger.authz.remote.pdp.url=http://localhost:6500
+ranger.authz.remote.pdp.connect.timeout.ms=5000
+ranger.authz.remote.pdp.read.timeout.ms=30000
+
+# ranger.authz.remote.auth.type=kerberos|jwt
Review Comment:
Since this files is specifically for jwt authn, I suggest removing all other authn properties.
##########
ranger-examples/sample-client/src/main/resources/ranger-authz-remote-authn-kerberos.properties:
##########
@@ -0,0 +1,30 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+ranger.authorizer.impl.class=org.apache.ranger.authz.remote.RangerRemoteAuthorizer
+ranger.authz.remote.pdp.url=http://localhost:6500
+ranger.authz.remote.pdp.connect.timeout.ms=5000
+ranger.authz.remote.pdp.read.timeout.ms=30000
+
+# ranger.authz.remote.auth.type=kerberos|jwt
+ranger.authz.remote.authn.type=kerberos
+ranger.authz.remote.authn.kerberos.principal=
+ranger.authz.remote.authn.kerberos.keytab=
+
+# ranger.authz.remote.authn.jwt.source=env|file|cred
Review Comment:
Since this file is specifically for kerberos authn, I suggest removing other authn properties.
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -0,0 +1,278 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.http.HttpEntity;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.config.Registry;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.util.EntityUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+import org.apache.ranger.authz.remote.authn.RangerRemoteJwtProvider;
+import org.apache.ranger.authz.remote.authn.RangerRemoteKerberosContext;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+
+import java.io.Closeable;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.Map;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.JWT;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.KERBEROS;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.FAILED_TO_DESERIALIZE_RESPONSE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.FAILED_TO_SERIALIZE_REQUEST;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_CALL_UNSUCCESSFUL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.TLS_CONFIGURATION_FAILED;
+
+class RangerPdpClient implements Closeable {
+ private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+
+ private static final String PATH_AUTHORIZE = "/authorize";
+ private static final String PATH_AUTHORIZE_MULTI = "/authorizeMulti";
+ private static final String PATH_RESOURCE_PERMISSIONS = "/permissions";
+ private static final String HEADER_AUTHORIZATION = "Authorization";
Review Comment:
Move authentication type details (like `HEADER_AUTHORIZATION`, `JWT_HEADER_PREFIX`) to authN provider implementation class, and call a method like
`authnProvider.setAuthNHeader(request)` from here.
##########
ranger-examples/sample-client/src/main/java/org/apache/ranger/examples/pdpclient/RemoteAuthzClient.java:
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.ranger.examples.pdpclient;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthorizerFactory;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAccessInfo;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerResourceInfo;
+import org.apache.ranger.authz.model.RangerUserInfo;
+
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.Properties;
+import java.util.Set;
+
+public final class RemoteAuthzClient {
+ private static final String DEFAULT_PROPERTIES_RESOURCE = "/tmp/ranger-authz-remote-test.properties";
+
+ private static final String PROP_TEST_REQUEST_ID = "ranger.authz.remote.test.requestId";
+ private static final String PROP_TEST_EXPECT_DECISION = "ranger.authz.remote.test.expect.decision";
+ private static final String PROP_TEST_USER_NAME = "ranger.authz.remote.test.user.name";
+ private static final String PROP_TEST_USER_GROUPS = "ranger.authz.remote.test.user.groups";
+ private static final String PROP_TEST_USER_ROLES = "ranger.authz.remote.test.user.roles";
+ private static final String PROP_TEST_ACCESS_ACTION = "ranger.authz.remote.test.access.action";
+ private static final String PROP_TEST_ACCESS_PERMISSIONS = "ranger.authz.remote.test.access.permissions";
+ private static final String PROP_TEST_RESOURCE_NAME = "ranger.authz.remote.test.resource.name";
+ private static final String PROP_TEST_RESOURCE_SUBRESOURCES = "ranger.authz.remote.test.resource.subResources";
+ private static final String PROP_TEST_CONTEXT_SERVICE_TYPE = "ranger.authz.remote.test.context.serviceType";
+ private static final String PROP_TEST_CONTEXT_SERVICE_NAME = "ranger.authz.remote.test.context.serviceName";
+ private static final String PROP_TEST_CONTEXT_CLIENT_IP = "ranger.authz.remote.test.context.clientIpAddress";
+
+ private RemoteAuthzClient() {
+ }
+
+ public static void main(String[] args) throws Exception {
+ String propertiesLocation = args != null && args.length > 0 ? args[0] : "classpath:" + DEFAULT_PROPERTIES_RESOURCE;
+ Properties properties = loadProperties(propertiesLocation);
+
+ System.out.println("Loaded properties from: " + propertiesLocation);
+
+ RangerAuthzResult result = run(properties);
+
+ System.out.println("Decision: " + result.getDecision());
+ System.out.println("Result : " + result);
+
+ String expectedDecision = StringUtils.trimToNull(properties.getProperty(PROP_TEST_EXPECT_DECISION));
+
+ if (expectedDecision != null && !expectedDecision.equalsIgnoreCase(String.valueOf(result.getDecision()))) {
+ throw new IllegalStateException("Expected decision " + expectedDecision + " but got " + result.getDecision());
+ }
+ }
+
+ static RangerAuthzResult run(Properties properties) throws Exception {
+ RangerAuthorizer authorizer = RangerAuthorizerFactory.createAuthorizer(properties);
+
+ try {
+ authorizer.init();
+
+ RangerAuthzRequest request = buildRequest(properties);
+
+ System.out.println("Request : " + request);
+
+ return authorizer.authorize(request);
+ } finally {
+ authorizer.close();
+ }
+ }
+
+ static Properties loadProperties(String location) throws Exception {
+ Properties properties = new Properties();
+
+ try (InputStream input = openInputStream(location)) {
+ properties.load(input);
+ }
+
+ return properties;
+ }
+
+ private static InputStream openInputStream(String location) throws Exception {
+ String effectiveLocation = StringUtils.defaultIfBlank(location, "classpath:" + DEFAULT_PROPERTIES_RESOURCE);
Review Comment:
Defaulting to `DEFAULT_PROPERTIES_RESOURCE` is already done by the caller, at line 59. Remove the duplicate code from here.
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/authn/RangerRemoteJwtProvider.java:
##########
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote.authn;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.remote.RangerRemoteAuthzConfig;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.MISSING_AUTH_CONFIG;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+
+public class RangerRemoteJwtProvider {
+ private static final String SOURCE_ENV = "env";
+ private static final String SOURCE_FILE = "file";
+
+ private final String source;
+ private final String envVar;
+ private final String filePath;
+
+ private long fileLastModified;
+ private volatile String jwt;
+
+ private RangerRemoteJwtProvider(String source, String envVar, String filePath) {
+ this.source = source;
+ this.envVar = envVar;
+ this.filePath = filePath;
+ }
+
+ public static RangerRemoteJwtProvider create(RangerRemoteAuthzConfig config) throws RangerAuthzException {
+ String source = config.getJwtSource().trim().toLowerCase();
+
+ switch (source) {
+ case SOURCE_ENV:
+ return new RangerRemoteJwtProvider(source, config.getJwtEnvVar(), null);
+
+ case SOURCE_FILE:
+ return new RangerRemoteJwtProvider(source, null, config.getJwtFile());
+
+ default:
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, RangerRemoteAuthzConfig.PROP_REMOTE_AUTH_JWT_SOURCE, source);
+ }
+ }
+
+ public String getJwt() throws RangerAuthzException {
+ switch (source) {
+ case SOURCE_ENV:
+ jwt = System.getenv(envVar);
+ break;
+
+ case SOURCE_FILE:
+ refreshJwtFromFile();
+ break;
+
+ default:
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, RangerRemoteAuthzConfig.PROP_REMOTE_AUTH_JWT_SOURCE, source);
+ }
+
+ if (StringUtils.isBlank(jwt)) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, getSourcePropertyName());
+ }
+
+ return jwt.trim();
Review Comment:
`jwt` could be null in following cases:
- env variable is not found
- file is not present or not readable
In such cases, avoid NPE by checking for null and raising an exception.
##########
ranger-examples/sample-client/src/main/resources/ranger-authz-remote-authn-jwt.properties:
##########
@@ -0,0 +1,30 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+ranger.authorizer.impl.class=org.apache.ranger.authz.remote.RangerRemoteAuthorizer
+ranger.authz.remote.pdp.url=http://localhost:6500
+ranger.authz.remote.pdp.connect.timeout.ms=5000
+ranger.authz.remote.pdp.read.timeout.ms=30000
+
+# ranger.authz.remote.auth.type=kerberos|jwt
+ranger.authz.remote.authn.type=jwt
+ranger.authz.remote.authn.kerberos.principal=
+ranger.authz.remote.authn.kerberos.keytab=
+
+# ranger.authz.remote.authn.jwt.source=env|file|cred
Review Comment:
`cred` is not a valid value.
##########
ranger-examples/sample-client/src/main/java/org/apache/ranger/examples/pdpclient/RemoteAuthzClient.java:
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.ranger.examples.pdpclient;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthorizerFactory;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAccessInfo;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerResourceInfo;
+import org.apache.ranger.authz.model.RangerUserInfo;
+
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.Properties;
+import java.util.Set;
+
+public final class RemoteAuthzClient {
+ private static final String DEFAULT_PROPERTIES_RESOURCE = "/tmp/ranger-authz-remote-test.properties";
Review Comment:
Instead of `/tmp/`, I suggest to load either from current directory or classpath.
##########
ranger-examples/sample-client/src/main/java/org/apache/ranger/examples/pdpclient/RemoteAuthzClient.java:
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.ranger.examples.pdpclient;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthorizerFactory;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAccessInfo;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerResourceInfo;
+import org.apache.ranger.authz.model.RangerUserInfo;
+
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.Properties;
+import java.util.Set;
+
+public final class RemoteAuthzClient {
+ private static final String DEFAULT_PROPERTIES_RESOURCE = "/tmp/ranger-authz-remote-test.properties";
+
+ private static final String PROP_TEST_REQUEST_ID = "ranger.authz.remote.test.requestId";
+ private static final String PROP_TEST_EXPECT_DECISION = "ranger.authz.remote.test.expect.decision";
+ private static final String PROP_TEST_USER_NAME = "ranger.authz.remote.test.user.name";
+ private static final String PROP_TEST_USER_GROUPS = "ranger.authz.remote.test.user.groups";
+ private static final String PROP_TEST_USER_ROLES = "ranger.authz.remote.test.user.roles";
+ private static final String PROP_TEST_ACCESS_ACTION = "ranger.authz.remote.test.access.action";
+ private static final String PROP_TEST_ACCESS_PERMISSIONS = "ranger.authz.remote.test.access.permissions";
+ private static final String PROP_TEST_RESOURCE_NAME = "ranger.authz.remote.test.resource.name";
+ private static final String PROP_TEST_RESOURCE_SUBRESOURCES = "ranger.authz.remote.test.resource.subResources";
+ private static final String PROP_TEST_CONTEXT_SERVICE_TYPE = "ranger.authz.remote.test.context.serviceType";
+ private static final String PROP_TEST_CONTEXT_SERVICE_NAME = "ranger.authz.remote.test.context.serviceName";
+ private static final String PROP_TEST_CONTEXT_CLIENT_IP = "ranger.authz.remote.test.context.clientIpAddress";
+
+ private RemoteAuthzClient() {
+ }
+
+ public static void main(String[] args) throws Exception {
+ String propertiesLocation = args != null && args.length > 0 ? args[0] : "classpath:" + DEFAULT_PROPERTIES_RESOURCE;
+ Properties properties = loadProperties(propertiesLocation);
+
+ System.out.println("Loaded properties from: " + propertiesLocation);
+
+ RangerAuthzResult result = run(properties);
Review Comment:
Instead of reading request details from properties file, I suggest reading request.json file location as a command-line argument. And simply print the result, instead of validating for an expected result.
```
if (args == null || args.length < 1) {
// throw exception with appropriate usage message
}
String requestJson = readFile(args[0]);
String properties = loadProperties(args.length > 1 ? args[1] : DEFAULT_PROPERTIES_RESOURCE);
RangerAuthorizer authorizer = RangerAuthorizerFactory.createAuthorizer(properties);
authorizer.init();
RangerAuthzRequest request = OBJECT_MAPPER.readValue(requestJson, RangerAuthzRequest.class);
RangerAuthzResult result = authorizer.authorize(request);
System.println(OBJECT_MAPPER.writeValue(result));
...
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "mneethiraj (via GitHub)" <gi...@apache.org>.
mneethiraj commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3175444379
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzConfig.java:
##########
@@ -0,0 +1,299 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+
+import java.util.AbstractMap;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Properties;
+import java.util.stream.Collectors;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.MISSING_AUTH_CONFIG;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.MISSING_PDP_URL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.UNSUPPORTED_AUTH_TYPE;
+
+public class RangerRemoteAuthzConfig {
+ public static final String PROP_REMOTE_URL = "ranger.authz.remote.pdp.url";
+ public static final String PROP_REMOTE_CONNECT_TIMEOUT_MS = "ranger.authz.remote.pdp.connect.timeout.ms";
+ public static final String PROP_REMOTE_READ_TIMEOUT_MS = "ranger.authz.remote.pdp.read.timeout.ms";
+ public static final String PROP_REMOTE_HEADER_PREFIX = "ranger.authz.remote.header.";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_FILE = "ranger.authz.remote.ssl.keystore.file";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_PASSWORD = "ranger.authz.remote.ssl.keystore.password";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_TYPE = "ranger.authz.remote.ssl.keystore.type";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_FILE = "ranger.authz.remote.ssl.truststore.file";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_PASSWORD = "ranger.authz.remote.ssl.truststore.password";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_TYPE = "ranger.authz.remote.ssl.truststore.type";
+ public static final String PROP_REMOTE_SSL_DISABLE_HOSTNAME_VERIFICATION = "ranger.authz.remote.ssl.disable.hostname.verification";
+ public static final String PROP_REMOTE_AUTH_TYPE = "ranger.authz.remote.authn.type";
+ public static final String PROP_REMOTE_AUTH_JWT_SOURCE = "ranger.authz.remote.authn.jwt.source";
+ public static final String PROP_REMOTE_AUTH_JWT_ENV = "ranger.authz.remote.authn.jwt.env";
+ public static final String PROP_REMOTE_AUTH_JWT_FILE = "ranger.authz.remote.authn.jwt.file";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL = "ranger.authz.remote.authn.kerberos.principal";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_KEYTAB = "ranger.authz.remote.authn.kerberos.keytab";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_DEBUG = "ranger.authz.remote.authn.kerberos.debug";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_CONTEXT_NAME = "ranger.authz.remote.authn.kerberos.jaas.context.name";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_LOGIN_MODULE = "ranger.authz.remote.authn.kerberos.jaas.login.module";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_STORE_KEY = "ranger.authz.remote.authn.kerberos.jaas.store.key";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_IS_INITIATOR = "ranger.authz.remote.authn.kerberos.jaas.is.initiator";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_DO_NOT_PROMPT = "ranger.authz.remote.authn.kerberos.jaas.do.not.prompt";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_USE_TICKET_CACHE = "ranger.authz.remote.authn.kerberos.jaas.use.ticket.cache";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_REFRESH_KRB5_CONFIG = "ranger.authz.remote.authn.kerberos.jaas.refresh.krb5.config";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_SPNEGO_STRIP_PORT = "ranger.authz.remote.authn.kerberos.spnego.strip.port";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_SPNEGO_USE_CANONICAL_HOST = "ranger.authz.remote.authn.kerberos.spnego.use.canonical.hostname";
+
+ private static final String AUTHZ_PATH_PREFIX = "/authz/v1";
+
+ private static final int DEFAULT_CONNECT_TIMEOUT_MS = 5_000;
+ private static final int DEFAULT_READ_TIMEOUT_MS = 30_000;
+ private static final String DEFAULT_STORE_TYPE = "PKCS12";
+ private static final String DEFAULT_KERBEROS_JAAS_CONTEXT_NAME = "RangerRemoteClientKerberos";
+ private static final String DEFAULT_KERBEROS_JAAS_LOGIN_MODULE = "com.sun.security.auth.module.Krb5LoginModule";
+
+ private final Properties properties;
+ private final Map<String, String> headers;
+
+ public RangerRemoteAuthzConfig(Properties properties) {
+ this.properties = properties != null ? properties : new Properties();
+
+ this.headers = Collections.unmodifiableMap(
+ this.properties.stringPropertyNames().stream()
+ .filter(propName -> propName.startsWith(PROP_REMOTE_HEADER_PREFIX))
+ .map(propName -> new AbstractMap.SimpleEntry<>(
+ propName.substring(PROP_REMOTE_HEADER_PREFIX.length()),
+ this.properties.getProperty(propName)))
+ .filter(e -> StringUtils.isNotBlank(e.getKey()) && StringUtils.isNotBlank(e.getValue()))
+ .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue, (a, b) -> a, LinkedHashMap::new)));
+ }
+
+ public String getPdpUrl() throws RangerAuthzException {
+ String value = normalizeBaseUrl(properties.getProperty(PROP_REMOTE_URL));
+
+ if (StringUtils.isBlank(value)) {
+ throw new RangerAuthzException(MISSING_PDP_URL, PROP_REMOTE_URL);
+ }
+
+ return value;
+ }
+
+ public String getEndpointUrl(String path) throws RangerAuthzException {
+ String baseUrl = getPdpUrl();
+
+ if (baseUrl.endsWith(AUTHZ_PATH_PREFIX)) {
+ return baseUrl + path;
+ }
+
+ return baseUrl + AUTHZ_PATH_PREFIX + path;
+ }
+
+ public int getConnectTimeoutMs() throws RangerAuthzException {
+ return getIntProperty(PROP_REMOTE_CONNECT_TIMEOUT_MS, DEFAULT_CONNECT_TIMEOUT_MS);
+ }
+
+ public int getReadTimeoutMs() throws RangerAuthzException {
+ return getIntProperty(PROP_REMOTE_READ_TIMEOUT_MS, DEFAULT_READ_TIMEOUT_MS);
+ }
+
+ public RangerRemoteAuthType getAuthType() throws RangerAuthzException {
+ String value = StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_AUTH_TYPE), RangerRemoteAuthType.HEADER.name());
+
+ try {
+ return RangerRemoteAuthType.valueOf(value.trim().toUpperCase());
+ } catch (IllegalArgumentException e) {
+ throw new RangerAuthzException(UNSUPPORTED_AUTH_TYPE, e, value);
+ }
+ }
+
+ public String getJwtSource() throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(PROP_REMOTE_AUTH_JWT_SOURCE));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, PROP_REMOTE_AUTH_JWT_SOURCE);
+ }
+
+ return ret;
+ }
+
+ public String getJwtEnvVar() throws RangerAuthzException {
+ return getRequiredProperty(PROP_REMOTE_AUTH_JWT_ENV);
+ }
+
+ public String getJwtFile() throws RangerAuthzException {
+ return getRequiredProperty(PROP_REMOTE_AUTH_JWT_FILE);
+ }
+
+ public String getKerberosPrincipal() throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL);
+ }
+
+ return ret;
+ }
+
+ public String getKerberosKeytab() throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_KEYTAB));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, PROP_REMOTE_AUTH_KERBEROS_KEYTAB);
+ }
+
+ return ret;
+ }
+
+ public boolean isKerberosDebugEnabled() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_DEBUG, false);
+ }
+
+ public String getKerberosJaasContextName() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_CONTEXT_NAME), DEFAULT_KERBEROS_JAAS_CONTEXT_NAME).trim();
+ }
+
+ public String getKerberosJaasLoginModuleClass() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_LOGIN_MODULE), DEFAULT_KERBEROS_JAAS_LOGIN_MODULE).trim();
+ }
+
+ public boolean isKerberosJaasStoreKey() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_STORE_KEY, true);
+ }
+
+ public boolean isKerberosJaasIsInitiator() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_IS_INITIATOR, true);
+ }
+
+ public boolean isKerberosJaasDoNotPrompt() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_DO_NOT_PROMPT, true);
+ }
+
+ public boolean isKerberosJaasUseTicketCache() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_USE_TICKET_CACHE, false);
+ }
+
+ public boolean isKerberosJaasRefreshKrb5Config() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_REFRESH_KRB5_CONFIG, true);
+ }
+
+ public boolean isKerberosSpnegoStripPort() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_SPNEGO_STRIP_PORT, true);
+ }
+
+ public boolean isKerberosSpnegoUseCanonicalHostname() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_SPNEGO_USE_CANONICAL_HOST, true);
+ }
+
+ public String getSslKeyStoreFile() {
+ return trimToNull(properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_FILE));
+ }
+
+ public String getSslKeyStorePassword() {
+ return properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_PASSWORD);
+ }
+
+ public String getSslKeyStoreType() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_TYPE), DEFAULT_STORE_TYPE).trim();
+ }
+
+ public String getSslTrustStoreFile() {
+ return trimToNull(properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_FILE));
+ }
+
+ public String getSslTrustStorePassword() {
+ return properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_PASSWORD);
+ }
+
+ public String getSslTrustStoreType() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_TYPE), DEFAULT_STORE_TYPE).trim();
+ }
+
+ public boolean isHostnameVerificationDisabled() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_SSL_DISABLE_HOSTNAME_VERIFICATION, false);
+ }
+
+ public Map<String, String> getHeaders() {
+ return headers;
+ }
+
+ private boolean getBooleanProperty(String propertyName, boolean defaultValue) throws RangerAuthzException {
+ String propertyValue = properties.getProperty(propertyName);
+
+ if (StringUtils.isBlank(propertyValue)) {
+ return defaultValue;
+ }
+
+ if ("true".equalsIgnoreCase(propertyValue.trim())) {
+ return true;
+ }
+
+ if ("false".equalsIgnoreCase(propertyValue.trim())) {
+ return false;
+ }
+
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, propertyName, propertyValue);
+ }
+
+ private int getIntProperty(String propertyName, int defaultValue) throws RangerAuthzException {
+ String propertyValue = properties.getProperty(propertyName);
+
+ if (StringUtils.isBlank(propertyValue)) {
+ return defaultValue;
+ }
+
+ try {
+ int ret = Integer.parseInt(propertyValue.trim());
+
+ if (ret < 0) {
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, propertyName, propertyValue);
+ }
+
+ return ret;
+ } catch (NumberFormatException e) {
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, e, propertyName, propertyValue);
+ }
+ }
+
+ private String getRequiredProperty(String propertyName) throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(propertyName));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, propertyName);
+ }
+
+ return ret;
+ }
+
+ private static String normalizeBaseUrl(String url) {
+ String ret = StringUtils.trimToEmpty(url);
+
+ while (ret.endsWith("/")) {
+ ret = ret.substring(0, ret.length() - 1);
+ }
+
+ return ret;
+ }
+
+ private static String trimToNull(String value) {
Review Comment:
Consider replacing this method with the callers directly calling `StringUtils.trimToNull`
##########
ranger-examples/sample-client/src/main/resources/request.json:
##########
@@ -0,0 +1,22 @@
+{
+ "requestId": "hive-access-request",
+ "user": {
+ "name": "hive",
+ "groups": [
+ "public"
Review Comment:
everyone is implicitly part of `public` group. Please remove line 6 to avoid unnecessary confusion.
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -0,0 +1,274 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.http.HttpEntity;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.config.Registry;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.util.EntityUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+import org.apache.ranger.authz.remote.authn.RangerRemoteJwtProvider;
+import org.apache.ranger.authz.remote.authn.RangerRemoteKerberosContext;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+
+import java.io.Closeable;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.Map;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.JWT;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.KERBEROS;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.FAILED_TO_DESERIALIZE_RESPONSE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.FAILED_TO_SERIALIZE_REQUEST;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_CALL_UNSUCCESSFUL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.TLS_CONFIGURATION_FAILED;
+
+class RangerPdpClient implements Closeable {
+ private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+
+ private static final String PATH_AUTHORIZE = "/authorize";
+ private static final String PATH_AUTHORIZE_MULTI = "/authorizeMulti";
+ private static final String PATH_RESOURCE_PERMISSIONS = "/permissions";
+
+ private final RangerRemoteAuthzConfig config;
+ private final CloseableHttpClient httpClient;
+ private final RangerRemoteAuthType authType;
Review Comment:
`authType` doesn't need to be a field; `jwtProvider` and `kerberosContext` are initialized in the constructor based on `authType` value. Use value of `jwtProvider` and `kerberosContext` to determine the path later, in `post()`:
```
if (jwtProvider != null) {
jwtProvider.setAuthnHeader(request);
}
if (kerberosContext != null) {
responseBody = kerberosContext.doAs((PrivilegedExceptionAction<String>) () -> execute(request, endpoint));
} else {
responseBody = execute(request, endpoint);
}
```
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzErrorCode.java:
##########
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.ranger.authz.api.RangerAuthzErrorCode;
+
+public enum RangerRemoteAuthzErrorCode implements RangerAuthzErrorCode {
+ MISSING_PDP_URL(500, "00-001", "missing property {0}"),
+ INVALID_PROPERTY_VALUE(500, "00-002", "invalid value for property {0}: {1}"),
+ REMOTE_REQUEST_FAILED(500, "00-003", "failed to call Ranger PDP endpoint {0}"),
+ REMOTE_CALL_UNSUCCESSFUL(502, "00-004", "Ranger PDP endpoint {0} returned HTTP {1}: {2}"),
+ MISSING_AUTH_CONFIG(500, "00-005", "missing property {0}"),
Review Comment:
`MISSING_PDP_URL` and `MISSING_AUTH_CONFIG` have the same error message. Consider replacing both with: `MISSING_MANDATORY_CONFIGURATION`.
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzErrorCode.java:
##########
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.ranger.authz.api.RangerAuthzErrorCode;
+
+public enum RangerRemoteAuthzErrorCode implements RangerAuthzErrorCode {
+ MISSING_PDP_URL(500, "00-001", "missing property {0}"),
+ INVALID_PROPERTY_VALUE(500, "00-002", "invalid value for property {0}: {1}"),
+ REMOTE_REQUEST_FAILED(500, "00-003", "failed to call Ranger PDP endpoint {0}"),
+ REMOTE_CALL_UNSUCCESSFUL(502, "00-004", "Ranger PDP endpoint {0} returned HTTP {1}: {2}"),
+ MISSING_AUTH_CONFIG(500, "00-005", "missing property {0}"),
+ UNSUPPORTED_AUTH_TYPE(500, "00-006", "unsupported auth type {0}"),
Review Comment:
`auth` => `authentication` to make it clear that this is not about authorization.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3175734975
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzConfig.java:
##########
@@ -0,0 +1,299 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+
+import java.util.AbstractMap;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Properties;
+import java.util.stream.Collectors;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.MISSING_AUTH_CONFIG;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.MISSING_PDP_URL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.UNSUPPORTED_AUTH_TYPE;
+
+public class RangerRemoteAuthzConfig {
+ public static final String PROP_REMOTE_URL = "ranger.authz.remote.pdp.url";
+ public static final String PROP_REMOTE_CONNECT_TIMEOUT_MS = "ranger.authz.remote.pdp.connect.timeout.ms";
+ public static final String PROP_REMOTE_READ_TIMEOUT_MS = "ranger.authz.remote.pdp.read.timeout.ms";
+ public static final String PROP_REMOTE_HEADER_PREFIX = "ranger.authz.remote.header.";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_FILE = "ranger.authz.remote.ssl.keystore.file";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_PASSWORD = "ranger.authz.remote.ssl.keystore.password";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_TYPE = "ranger.authz.remote.ssl.keystore.type";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_FILE = "ranger.authz.remote.ssl.truststore.file";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_PASSWORD = "ranger.authz.remote.ssl.truststore.password";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_TYPE = "ranger.authz.remote.ssl.truststore.type";
+ public static final String PROP_REMOTE_SSL_DISABLE_HOSTNAME_VERIFICATION = "ranger.authz.remote.ssl.disable.hostname.verification";
+ public static final String PROP_REMOTE_AUTH_TYPE = "ranger.authz.remote.authn.type";
+ public static final String PROP_REMOTE_AUTH_JWT_SOURCE = "ranger.authz.remote.authn.jwt.source";
+ public static final String PROP_REMOTE_AUTH_JWT_ENV = "ranger.authz.remote.authn.jwt.env";
+ public static final String PROP_REMOTE_AUTH_JWT_FILE = "ranger.authz.remote.authn.jwt.file";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL = "ranger.authz.remote.authn.kerberos.principal";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_KEYTAB = "ranger.authz.remote.authn.kerberos.keytab";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_DEBUG = "ranger.authz.remote.authn.kerberos.debug";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_CONTEXT_NAME = "ranger.authz.remote.authn.kerberos.jaas.context.name";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_LOGIN_MODULE = "ranger.authz.remote.authn.kerberos.jaas.login.module";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_STORE_KEY = "ranger.authz.remote.authn.kerberos.jaas.store.key";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_IS_INITIATOR = "ranger.authz.remote.authn.kerberos.jaas.is.initiator";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_DO_NOT_PROMPT = "ranger.authz.remote.authn.kerberos.jaas.do.not.prompt";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_USE_TICKET_CACHE = "ranger.authz.remote.authn.kerberos.jaas.use.ticket.cache";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_JAAS_REFRESH_KRB5_CONFIG = "ranger.authz.remote.authn.kerberos.jaas.refresh.krb5.config";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_SPNEGO_STRIP_PORT = "ranger.authz.remote.authn.kerberos.spnego.strip.port";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_SPNEGO_USE_CANONICAL_HOST = "ranger.authz.remote.authn.kerberos.spnego.use.canonical.hostname";
+
+ private static final String AUTHZ_PATH_PREFIX = "/authz/v1";
+
+ private static final int DEFAULT_CONNECT_TIMEOUT_MS = 5_000;
+ private static final int DEFAULT_READ_TIMEOUT_MS = 30_000;
+ private static final String DEFAULT_STORE_TYPE = "PKCS12";
+ private static final String DEFAULT_KERBEROS_JAAS_CONTEXT_NAME = "RangerRemoteClientKerberos";
+ private static final String DEFAULT_KERBEROS_JAAS_LOGIN_MODULE = "com.sun.security.auth.module.Krb5LoginModule";
+
+ private final Properties properties;
+ private final Map<String, String> headers;
+
+ public RangerRemoteAuthzConfig(Properties properties) {
+ this.properties = properties != null ? properties : new Properties();
+
+ this.headers = Collections.unmodifiableMap(
+ this.properties.stringPropertyNames().stream()
+ .filter(propName -> propName.startsWith(PROP_REMOTE_HEADER_PREFIX))
+ .map(propName -> new AbstractMap.SimpleEntry<>(
+ propName.substring(PROP_REMOTE_HEADER_PREFIX.length()),
+ this.properties.getProperty(propName)))
+ .filter(e -> StringUtils.isNotBlank(e.getKey()) && StringUtils.isNotBlank(e.getValue()))
+ .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue, (a, b) -> a, LinkedHashMap::new)));
+ }
+
+ public String getPdpUrl() throws RangerAuthzException {
+ String value = normalizeBaseUrl(properties.getProperty(PROP_REMOTE_URL));
+
+ if (StringUtils.isBlank(value)) {
+ throw new RangerAuthzException(MISSING_PDP_URL, PROP_REMOTE_URL);
+ }
+
+ return value;
+ }
+
+ public String getEndpointUrl(String path) throws RangerAuthzException {
+ String baseUrl = getPdpUrl();
+
+ if (baseUrl.endsWith(AUTHZ_PATH_PREFIX)) {
+ return baseUrl + path;
+ }
+
+ return baseUrl + AUTHZ_PATH_PREFIX + path;
+ }
+
+ public int getConnectTimeoutMs() throws RangerAuthzException {
+ return getIntProperty(PROP_REMOTE_CONNECT_TIMEOUT_MS, DEFAULT_CONNECT_TIMEOUT_MS);
+ }
+
+ public int getReadTimeoutMs() throws RangerAuthzException {
+ return getIntProperty(PROP_REMOTE_READ_TIMEOUT_MS, DEFAULT_READ_TIMEOUT_MS);
+ }
+
+ public RangerRemoteAuthType getAuthType() throws RangerAuthzException {
+ String value = StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_AUTH_TYPE), RangerRemoteAuthType.HEADER.name());
+
+ try {
+ return RangerRemoteAuthType.valueOf(value.trim().toUpperCase());
+ } catch (IllegalArgumentException e) {
+ throw new RangerAuthzException(UNSUPPORTED_AUTH_TYPE, e, value);
+ }
+ }
+
+ public String getJwtSource() throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(PROP_REMOTE_AUTH_JWT_SOURCE));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, PROP_REMOTE_AUTH_JWT_SOURCE);
+ }
+
+ return ret;
+ }
+
+ public String getJwtEnvVar() throws RangerAuthzException {
+ return getRequiredProperty(PROP_REMOTE_AUTH_JWT_ENV);
+ }
+
+ public String getJwtFile() throws RangerAuthzException {
+ return getRequiredProperty(PROP_REMOTE_AUTH_JWT_FILE);
+ }
+
+ public String getKerberosPrincipal() throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL);
+ }
+
+ return ret;
+ }
+
+ public String getKerberosKeytab() throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_KEYTAB));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, PROP_REMOTE_AUTH_KERBEROS_KEYTAB);
+ }
+
+ return ret;
+ }
+
+ public boolean isKerberosDebugEnabled() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_DEBUG, false);
+ }
+
+ public String getKerberosJaasContextName() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_CONTEXT_NAME), DEFAULT_KERBEROS_JAAS_CONTEXT_NAME).trim();
+ }
+
+ public String getKerberosJaasLoginModuleClass() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_LOGIN_MODULE), DEFAULT_KERBEROS_JAAS_LOGIN_MODULE).trim();
+ }
+
+ public boolean isKerberosJaasStoreKey() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_STORE_KEY, true);
+ }
+
+ public boolean isKerberosJaasIsInitiator() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_IS_INITIATOR, true);
+ }
+
+ public boolean isKerberosJaasDoNotPrompt() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_DO_NOT_PROMPT, true);
+ }
+
+ public boolean isKerberosJaasUseTicketCache() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_USE_TICKET_CACHE, false);
+ }
+
+ public boolean isKerberosJaasRefreshKrb5Config() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_JAAS_REFRESH_KRB5_CONFIG, true);
+ }
+
+ public boolean isKerberosSpnegoStripPort() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_SPNEGO_STRIP_PORT, true);
+ }
+
+ public boolean isKerberosSpnegoUseCanonicalHostname() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_SPNEGO_USE_CANONICAL_HOST, true);
+ }
+
+ public String getSslKeyStoreFile() {
+ return trimToNull(properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_FILE));
+ }
+
+ public String getSslKeyStorePassword() {
+ return properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_PASSWORD);
+ }
+
+ public String getSslKeyStoreType() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_TYPE), DEFAULT_STORE_TYPE).trim();
+ }
+
+ public String getSslTrustStoreFile() {
+ return trimToNull(properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_FILE));
+ }
+
+ public String getSslTrustStorePassword() {
+ return properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_PASSWORD);
+ }
+
+ public String getSslTrustStoreType() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_TYPE), DEFAULT_STORE_TYPE).trim();
+ }
+
+ public boolean isHostnameVerificationDisabled() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_SSL_DISABLE_HOSTNAME_VERIFICATION, false);
+ }
+
+ public Map<String, String> getHeaders() {
+ return headers;
+ }
+
+ private boolean getBooleanProperty(String propertyName, boolean defaultValue) throws RangerAuthzException {
+ String propertyValue = properties.getProperty(propertyName);
+
+ if (StringUtils.isBlank(propertyValue)) {
+ return defaultValue;
+ }
+
+ if ("true".equalsIgnoreCase(propertyValue.trim())) {
+ return true;
+ }
+
+ if ("false".equalsIgnoreCase(propertyValue.trim())) {
+ return false;
+ }
+
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, propertyName, propertyValue);
+ }
+
+ private int getIntProperty(String propertyName, int defaultValue) throws RangerAuthzException {
+ String propertyValue = properties.getProperty(propertyName);
+
+ if (StringUtils.isBlank(propertyValue)) {
+ return defaultValue;
+ }
+
+ try {
+ int ret = Integer.parseInt(propertyValue.trim());
+
+ if (ret < 0) {
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, propertyName, propertyValue);
+ }
+
+ return ret;
+ } catch (NumberFormatException e) {
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, e, propertyName, propertyValue);
+ }
+ }
+
+ private String getRequiredProperty(String propertyName) throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(propertyName));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, propertyName);
+ }
+
+ return ret;
+ }
+
+ private static String normalizeBaseUrl(String url) {
+ String ret = StringUtils.trimToEmpty(url);
+
+ while (ret.endsWith("/")) {
+ ret = ret.substring(0, ret.length() - 1);
+ }
+
+ return ret;
+ }
+
+ private static String trimToNull(String value) {
Review Comment:
missed it!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "mneethiraj (via GitHub)" <gi...@apache.org>.
mneethiraj commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3135630081
##########
authz-remote/src/conf/ranger-authz-remote.properties:
##########
@@ -0,0 +1,24 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ranger.authorizer.impl.class=org.apache.ranger.authz.remote.RangerRemoteAuthorizer
+ranger.authz.remote.url=https://localhost:6500
Review Comment:
Prefix all PDP server related configurations with `pd`, like:
`ranger.authz.remote.url` => `ranger.authz.remote.pdp.url`
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -0,0 +1,234 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.http.HttpEntity;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.config.Registry;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.util.EntityUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+import org.apache.ranger.authz.remote.authn.RangerRemoteKerberosContext;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+
+import java.io.Closeable;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.Map;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.KERBEROS;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_CALL_UNSUCCESSFUL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.TLS_CONFIGURATION_FAILED;
+
+class RangerPdpClient implements Closeable {
+ private static final String PATH_AUTHORIZE = "/authorize";
+ private static final String PATH_AUTHORIZE_MULTI = "/authorizeMulti";
+ private static final String PATH_RESOURCE_PERMISSIONS = "/permissions";
+
+ private final RangerRemoteAuthzConfig config;
+ private final CloseableHttpClient httpClient;
+ private final RangerRemoteAuthType authType;
+ private final RangerRemoteKerberosContext kerberosContext;
+
+ RangerPdpClient(RangerRemoteAuthzConfig config) throws RangerAuthzException {
+ this.config = config;
+ this.authType = config.getAuthType();
+ this.kerberosContext = authType == KERBEROS ? RangerRemoteKerberosContext.create(config) : null;
+ this.httpClient = createHttpClient(config, kerberosContext);
+ }
+
+ RangerAuthzResult authorize(RangerAuthzRequest request) throws RangerAuthzException {
+ String endpoint = config.getEndpointUrl(PATH_AUTHORIZE);
+ String payload = RangerRemoteJson.writeAuthzRequest(request);
+ String response = post(endpoint, payload);
Review Comment:
Consider having `post()` method perform serialization of the request and deserialization of the response, eliminating calls to `RangerRemoteJson`:
```
...
RangerAuthzResult ret = post(endpoint, request, RangerAuthzResult.class);
return ret;
}
public <T> T post(String path, Object payload, Class<T> responseType) throws RangerAuthzException {
String requestBody = objectMapper.writeValueAsString(payload);
...
return objectMapper.readValue(responseJson, valueType);
}
```
##########
authz-remote/src/conf/ranger-authz-remote.properties:
##########
@@ -0,0 +1,24 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ranger.authorizer.impl.class=org.apache.ranger.authz.remote.RangerRemoteAuthorizer
Review Comment:
`ranger.authorizer.impl.class` configuration doesn't seem to be used. Please review and remove.
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthzConfig.java:
##########
@@ -0,0 +1,234 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.MISSING_AUTH_CONFIG;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.MISSING_PDP_URL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.UNSUPPORTED_AUTH_TYPE;
+
+public class RangerRemoteAuthzConfig {
+ public static final String PROP_REMOTE_URL = "ranger.authz.remote.url";
+ public static final String PROP_REMOTE_CONNECT_TIMEOUT_MS = "ranger.authz.remote.connect.timeout.ms";
+ public static final String PROP_REMOTE_READ_TIMEOUT_MS = "ranger.authz.remote.read.timeout.ms";
+ public static final String PROP_REMOTE_HEADER_PREFIX = "ranger.authz.remote.header.";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_FILE = "ranger.authz.remote.ssl.keystore.file";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_PASSWORD = "ranger.authz.remote.ssl.keystore.password";
+ public static final String PROP_REMOTE_SSL_KEYSTORE_TYPE = "ranger.authz.remote.ssl.keystore.type";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_FILE = "ranger.authz.remote.ssl.truststore.file";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_PASSWORD = "ranger.authz.remote.ssl.truststore.password";
+ public static final String PROP_REMOTE_SSL_TRUSTSTORE_TYPE = "ranger.authz.remote.ssl.truststore.type";
+ public static final String PROP_REMOTE_SSL_DISABLE_HOSTNAME_VERIFICATION = "ranger.authz.remote.ssl.disable.hostname.verification";
+ public static final String PROP_REMOTE_AUTH_TYPE = "ranger.authz.remote.auth.type";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL = "ranger.authz.remote.auth.kerberos.principal";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_KEYTAB = "ranger.authz.remote.auth.kerberos.keytab";
+ public static final String PROP_REMOTE_AUTH_KERBEROS_DEBUG = "ranger.authz.remote.auth.kerberos.debug";
+
+ public static final String PROP_PREFIX_SERVICE = "ranger.authz.service.";
+ public static final String PROP_PREFIX_SERVICE_TYPE = "ranger.authz.servicetype.";
+
+ private static final String AUTHZ_PATH_PREFIX = "/authz/v1";
+
+ private static final int DEFAULT_CONNECT_TIMEOUT_MS = 5_000;
+ private static final int DEFAULT_READ_TIMEOUT_MS = 30_000;
+ private static final String DEFAULT_STORE_TYPE = "PKCS12";
+
+ private final Properties properties;
+
+ public RangerRemoteAuthzConfig(Properties properties) {
+ this.properties = properties != null ? properties : new Properties();
+ }
+
+ public String getPdpUrl() throws RangerAuthzException {
+ String value = normalizeBaseUrl(properties.getProperty(PROP_REMOTE_URL));
+
+ if (StringUtils.isBlank(value)) {
+ throw new RangerAuthzException(MISSING_PDP_URL, PROP_REMOTE_URL);
+ }
+
+ return value;
+ }
+
+ public String getEndpointUrl(String path) throws RangerAuthzException {
+ String baseUrl = getPdpUrl();
+
+ if (baseUrl.endsWith(AUTHZ_PATH_PREFIX)) {
+ return baseUrl + path;
+ }
+
+ return baseUrl + AUTHZ_PATH_PREFIX + path;
+ }
+
+ public int getConnectTimeoutMs() throws RangerAuthzException {
+ return getIntProperty(PROP_REMOTE_CONNECT_TIMEOUT_MS, DEFAULT_CONNECT_TIMEOUT_MS);
+ }
+
+ public int getReadTimeoutMs() throws RangerAuthzException {
+ return getIntProperty(PROP_REMOTE_READ_TIMEOUT_MS, DEFAULT_READ_TIMEOUT_MS);
+ }
+
+ public RangerRemoteAuthType getAuthType() throws RangerAuthzException {
+ String value = StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_AUTH_TYPE), RangerRemoteAuthType.NONE.name());
+
+ try {
+ return RangerRemoteAuthType.valueOf(value.trim().toUpperCase());
+ } catch (IllegalArgumentException e) {
+ throw new RangerAuthzException(UNSUPPORTED_AUTH_TYPE, e, value);
+ }
+ }
+
+ public String getKerberosPrincipal() throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, PROP_REMOTE_AUTH_KERBEROS_PRINCIPAL);
+ }
+
+ return ret;
+ }
+
+ public String getKerberosKeytab() throws RangerAuthzException {
+ String ret = trimToNull(properties.getProperty(PROP_REMOTE_AUTH_KERBEROS_KEYTAB));
+
+ if (ret == null) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, PROP_REMOTE_AUTH_KERBEROS_KEYTAB);
+ }
+
+ return ret;
+ }
+
+ public boolean isKerberosDebugEnabled() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_AUTH_KERBEROS_DEBUG, false);
+ }
+
+ public String getSslKeyStoreFile() {
+ return trimToNull(properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_FILE));
+ }
+
+ public String getSslKeyStorePassword() {
+ return properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_PASSWORD);
+ }
+
+ public String getSslKeyStoreType() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_SSL_KEYSTORE_TYPE), DEFAULT_STORE_TYPE).trim();
+ }
+
+ public String getSslTrustStoreFile() {
+ return trimToNull(properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_FILE));
+ }
+
+ public String getSslTrustStorePassword() {
+ return properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_PASSWORD);
+ }
+
+ public String getSslTrustStoreType() {
+ return StringUtils.defaultIfBlank(properties.getProperty(PROP_REMOTE_SSL_TRUSTSTORE_TYPE), DEFAULT_STORE_TYPE).trim();
+ }
+
+ public boolean isHostnameVerificationDisabled() throws RangerAuthzException {
+ return getBooleanProperty(PROP_REMOTE_SSL_DISABLE_HOSTNAME_VERIFICATION, false);
+ }
+
+ public Map<String, String> getHeaders() {
Review Comment:
Consider caching `headers` in the constructor, given this method is called in every call to `RangerPdpClient.post()`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3140644675
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerPdpClient.java:
##########
@@ -0,0 +1,267 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.http.HttpEntity;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.config.Registry;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.DefaultHostnameVerifier;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.ssl.SSLContextBuilder;
+import org.apache.http.util.EntityUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+import org.apache.ranger.authz.remote.authn.RangerRemoteKerberosContext;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+
+import java.io.Closeable;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.KeyStore;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.Map;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthType.KERBEROS;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_CALL_UNSUCCESSFUL;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_RESPONSE_INVALID;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.TLS_CONFIGURATION_FAILED;
+
+class RangerPdpClient implements Closeable {
+ private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+
+ private static final String PATH_AUTHORIZE = "/authorize";
+ private static final String PATH_AUTHORIZE_MULTI = "/authorizeMulti";
+ private static final String PATH_RESOURCE_PERMISSIONS = "/permissions";
+
+ private final RangerRemoteAuthzConfig config;
+ private final CloseableHttpClient httpClient;
+ private final RangerRemoteAuthType authType;
+ private final RangerRemoteKerberosContext kerberosContext;
+
+ RangerPdpClient(RangerRemoteAuthzConfig config) throws RangerAuthzException {
+ this.config = config;
+ this.authType = config.getAuthType();
+ this.kerberosContext = authType == KERBEROS ? RangerRemoteKerberosContext.create(config) : null;
+ this.httpClient = createHttpClient(config, kerberosContext);
+ }
+
+ RangerAuthzResult authorize(RangerAuthzRequest request) throws RangerAuthzException {
+ String endpoint = config.getEndpointUrl(PATH_AUTHORIZE);
+
+ return post(endpoint, request, RangerAuthzResult.class);
+ }
+
+ RangerMultiAuthzResult authorize(RangerMultiAuthzRequest request) throws RangerAuthzException {
+ String endpoint = config.getEndpointUrl(PATH_AUTHORIZE_MULTI);
Review Comment:
sure, updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "mneethiraj (via GitHub)" <gi...@apache.org>.
mneethiraj commented on PR #928:
URL: https://github.com/apache/ranger/pull/928#issuecomment-4317098109
@kumaab - this PR will be ready once support for JWT authentication is added (using configurations `ranger.authz.remote.auth.type=jwt`, and other properties to read JWT from file/env/cred-file).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3165151096
##########
ranger-examples/sample-client/src/main/java/org/apache/ranger/examples/pdpclient/RemoteAuthzClient.java:
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.ranger.examples.pdpclient;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthorizerFactory;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAccessInfo;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerResourceInfo;
+import org.apache.ranger.authz.model.RangerUserInfo;
+
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.Properties;
+import java.util.Set;
+
+public final class RemoteAuthzClient {
+ private static final String DEFAULT_PROPERTIES_RESOURCE = "/tmp/ranger-authz-remote-test.properties";
Review Comment:
Sure, updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3165147450
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/authn/RangerRemoteJwtProvider.java:
##########
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote.authn;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.remote.RangerRemoteAuthzConfig;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.MISSING_AUTH_CONFIG;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+
+public class RangerRemoteJwtProvider {
+ private static final String SOURCE_ENV = "env";
+ private static final String SOURCE_FILE = "file";
+
+ private final String source;
+ private final String envVar;
+ private final String filePath;
+
+ private long fileLastModified;
+ private volatile String jwt;
+
+ private RangerRemoteJwtProvider(String source, String envVar, String filePath) {
+ this.source = source;
+ this.envVar = envVar;
+ this.filePath = filePath;
+ }
+
+ public static RangerRemoteJwtProvider create(RangerRemoteAuthzConfig config) throws RangerAuthzException {
+ String source = config.getJwtSource().trim().toLowerCase();
+
+ switch (source) {
+ case SOURCE_ENV:
+ return new RangerRemoteJwtProvider(source, config.getJwtEnvVar(), null);
+
+ case SOURCE_FILE:
+ return new RangerRemoteJwtProvider(source, null, config.getJwtFile());
+
+ default:
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, RangerRemoteAuthzConfig.PROP_REMOTE_AUTH_JWT_SOURCE, source);
+ }
+ }
+
+ public String getJwt() throws RangerAuthzException {
+ switch (source) {
+ case SOURCE_ENV:
+ jwt = System.getenv(envVar);
+ break;
+
+ case SOURCE_FILE:
+ refreshJwtFromFile();
+ break;
+
+ default:
+ throw new RangerAuthzException(INVALID_PROPERTY_VALUE, RangerRemoteAuthzConfig.PROP_REMOTE_AUTH_JWT_SOURCE, source);
+ }
+
+ if (StringUtils.isBlank(jwt)) {
+ throw new RangerAuthzException(MISSING_AUTH_CONFIG, getSourcePropertyName());
+ }
+
+ return jwt.trim();
Review Comment:
`jwt` won't be null at line 86 as if check above: `StringUtils.isBlank(jwt)` will check for `null` and throw an exception
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "mneethiraj (via GitHub)" <gi...@apache.org>.
mneethiraj merged PR #928:
URL: https://github.com/apache/ranger/pull/928
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3140625169
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthorizer.java:
##########
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+
+import java.util.Properties;
+
+import static org.apache.ranger.authz.api.RangerAuthzApiErrorCode.INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+
+public class RangerRemoteAuthorizer extends RangerAuthorizer {
+ private final RangerRemoteAuthzConfig config;
+
+ private volatile RangerPdpClient client;
+
+ public RangerRemoteAuthorizer(Properties properties) {
+ super(properties);
+
+ this.config = new RangerRemoteAuthzConfig(properties);
+ }
+
+ @Override
+ public void init() throws RangerAuthzException {
+ config.getPdpUrl();
+ config.getConnectTimeoutMs();
+ config.getReadTimeoutMs();
+
+ this.client = new RangerPdpClient(config);
+ }
+
+ @Override
+ public void close() throws RangerAuthzException {
+ RangerPdpClient client = this.client;
+
+ this.client = null;
+
+ if (client != null) {
+ try {
+ client.close();
+ } catch (Exception e) {
+ throw new RangerAuthzException(REMOTE_REQUEST_FAILED, e, RangerRemoteAuthzConfig.PROP_REMOTE_URL);
Review Comment:
Added new error codes, thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins [ranger]
Posted by "kumaab (via GitHub)" <gi...@apache.org>.
kumaab commented on code in PR #928:
URL: https://github.com/apache/ranger/pull/928#discussion_r3140624240
##########
authz-remote/src/main/java/org/apache/ranger/authz/remote/RangerRemoteAuthorizer.java:
##########
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.authz.remote;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.ranger.authz.api.RangerAuthorizer;
+import org.apache.ranger.authz.api.RangerAuthzException;
+import org.apache.ranger.authz.model.RangerAccessContext;
+import org.apache.ranger.authz.model.RangerAuthzRequest;
+import org.apache.ranger.authz.model.RangerAuthzResult;
+import org.apache.ranger.authz.model.RangerMultiAuthzRequest;
+import org.apache.ranger.authz.model.RangerMultiAuthzResult;
+import org.apache.ranger.authz.model.RangerResourcePermissions;
+import org.apache.ranger.authz.model.RangerResourcePermissionsRequest;
+
+import java.util.Properties;
+
+import static org.apache.ranger.authz.api.RangerAuthzApiErrorCode.INVALID_REQUEST_SERVICE_NAME_OR_TYPE_MANDATORY;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.INVALID_PROPERTY_VALUE;
+import static org.apache.ranger.authz.remote.RangerRemoteAuthzErrorCode.REMOTE_REQUEST_FAILED;
+
+public class RangerRemoteAuthorizer extends RangerAuthorizer {
+ private final RangerRemoteAuthzConfig config;
+
+ private volatile RangerPdpClient client;
+
+ public RangerRemoteAuthorizer(Properties properties) {
+ super(properties);
+
+ this.config = new RangerRemoteAuthzConfig(properties);
+ }
+
+ @Override
+ public void init() throws RangerAuthzException {
+ config.getPdpUrl();
Review Comment:
No, removed them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ranger.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org