You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by sanket shelar <sa...@gmail.com> on 2023/09/20 06:05:18 UTC
Review Request 74613: RANGER-3346: Ranger Solr Plugin sends audits with PKI auth instead of Kerberos
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/74613/
-----------------------------------------------------------
Review request for ranger, dinesh akhand, Kishor Gollapalliwar, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
Bugs: RANGER-3346
https://issues.apache.org/jira/browse/RANGER-3346
Repository: ranger
Description
-------
SolrAuditDestination class connects to Solr by building client with HttpClientUtil (from SolrJ library).
It's fine except in case of Solr Ranger Plugin. The Solr server uses the SolrJ lib as well for communication among its nodes and sets static/global configuration inside the HttpClientUtil which makes the SolrAuditDestination class's client to misbehave as sending the audits request with a header which forces the authentication to PKI. Prior to Solr 8.8 it leaded to only warning level Exceptions but after this version this will cause failure when sending audits.
Relevant Solr JIRA about changing the implementation of HttpClientUtil class:
https://issues.apache.org/jira/browse/SOLR-15388
Diffs
-----
agents-audit/src/main/java/org/apache/ranger/audit/destination/SolrAuditDestination.java f2e96bf9b
agents-audit/src/main/java/org/apache/ranger/audit/provider/AuditProviderFactory.java 598659bf4
agents-audit/src/main/java/org/apache/ranger/audit/utils/SolrAppUtil.java 5cb8b1be1
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java f1eb08e4e
Diff: https://reviews.apache.org/r/74613/diff/1/
Testing
-------
tested for solr plugins
Thanks,
sanket shelar
Re: Review Request 74613: RANGER-3346: Ranger Solr Plugin sends audits with PKI auth instead of Kerberos
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/74613/#review227227
-----------------------------------------------------------
Ship it!
Ship It!
- Madhan Neethiraj
On Feb. 6, 2025, 11:51 a.m., sanket shelar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/74613/
> -----------------------------------------------------------
>
> (Updated Feb. 6, 2025, 11:51 a.m.)
>
>
> Review request for ranger, dinesh akhand, Dineshkumar Yadav, Kishor Gollapalliwar, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-3346
> https://issues.apache.org/jira/browse/RANGER-3346
>
>
> Repository: ranger
>
>
> Description
> -------
>
> SolrAuditDestination class connects to Solr by building client with HttpClientUtil (from SolrJ library).
> It's fine except in case of Solr Ranger Plugin. The Solr server uses the SolrJ lib as well for communication among its nodes and sets static/global configuration inside the HttpClientUtil which makes the SolrAuditDestination class's client to misbehave as sending the audits request with a header which forces the authentication to PKI. Prior to Solr 8.8 it leaded to only warning level Exceptions but after this version this will cause failure when sending audits.
>
> Relevant Solr JIRA about changing the implementation of HttpClientUtil class:
> https://issues.apache.org/jira/browse/SOLR-15388
>
>
> Diffs
> -----
>
> agents-audit/src/main/java/org/apache/ranger/audit/destination/SolrAuditDestination.java 4be6002e3
> agents-audit/src/main/java/org/apache/ranger/audit/utils/SolrAppUtil.java 83612bde7
>
>
> Diff: https://reviews.apache.org/r/74613/diff/3/
>
>
> Testing
> -------
>
> tested for solr plugins
>
>
> Thanks,
>
> sanket shelar
>
>
Re: Review Request 74613: RANGER-3346: Ranger Solr Plugin sends audits with PKI auth instead of Kerberos
Posted by sanket shelar <sa...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/74613/
-----------------------------------------------------------
(Updated Feb. 6, 2025, 11:51 a.m.)
Review request for ranger, dinesh akhand, Dineshkumar Yadav, Kishor Gollapalliwar, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
Bugs: RANGER-3346
https://issues.apache.org/jira/browse/RANGER-3346
Repository: ranger
Description
-------
SolrAuditDestination class connects to Solr by building client with HttpClientUtil (from SolrJ library).
It's fine except in case of Solr Ranger Plugin. The Solr server uses the SolrJ lib as well for communication among its nodes and sets static/global configuration inside the HttpClientUtil which makes the SolrAuditDestination class's client to misbehave as sending the audits request with a header which forces the authentication to PKI. Prior to Solr 8.8 it leaded to only warning level Exceptions but after this version this will cause failure when sending audits.
Relevant Solr JIRA about changing the implementation of HttpClientUtil class:
https://issues.apache.org/jira/browse/SOLR-15388
Diffs (updated)
-----
agents-audit/src/main/java/org/apache/ranger/audit/destination/SolrAuditDestination.java 4be6002e3
agents-audit/src/main/java/org/apache/ranger/audit/utils/SolrAppUtil.java 83612bde7
Diff: https://reviews.apache.org/r/74613/diff/3/
Changes: https://reviews.apache.org/r/74613/diff/2-3/
Testing
-------
tested for solr plugins
Thanks,
sanket shelar
Re: Review Request 74613: RANGER-3346: Ranger Solr Plugin sends audits with PKI auth instead of Kerberos
Posted by Madhan Neethiraj <ma...@apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/74613/#review227217
-----------------------------------------------------------
agents-audit/src/main/java/org/apache/ranger/audit/destination/SolrAuditDestination.java
Line 82 (original), 86 (patched)
<https://reviews.apache.org/r/74613/#comment315454>
Instead of 'isSolrPlugin' parameter, I suggest using MiscUtil.getApplicationType() to determine if Solr plugin is the context. With this approach, the changes can be isolated to only SolrAuditDestination and SolrAppUtil classes i.e. changes in following classes can be avoided:
- AuditProviderFactory
- RangerBasePlugin
- Madhan Neethiraj
On Feb. 4, 2025, 10:18 a.m., sanket shelar wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/74613/
> -----------------------------------------------------------
>
> (Updated Feb. 4, 2025, 10:18 a.m.)
>
>
> Review request for ranger, dinesh akhand, Dineshkumar Yadav, Kishor Gollapalliwar, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
>
>
> Bugs: RANGER-3346
> https://issues.apache.org/jira/browse/RANGER-3346
>
>
> Repository: ranger
>
>
> Description
> -------
>
> SolrAuditDestination class connects to Solr by building client with HttpClientUtil (from SolrJ library).
> It's fine except in case of Solr Ranger Plugin. The Solr server uses the SolrJ lib as well for communication among its nodes and sets static/global configuration inside the HttpClientUtil which makes the SolrAuditDestination class's client to misbehave as sending the audits request with a header which forces the authentication to PKI. Prior to Solr 8.8 it leaded to only warning level Exceptions but after this version this will cause failure when sending audits.
>
> Relevant Solr JIRA about changing the implementation of HttpClientUtil class:
> https://issues.apache.org/jira/browse/SOLR-15388
>
>
> Diffs
> -----
>
> agents-audit/src/main/java/org/apache/ranger/audit/destination/SolrAuditDestination.java 4be6002e3
> agents-audit/src/main/java/org/apache/ranger/audit/provider/AuditProviderFactory.java 619c94c37
> agents-audit/src/main/java/org/apache/ranger/audit/utils/SolrAppUtil.java 83612bde7
> agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java 495ce3b83
>
>
> Diff: https://reviews.apache.org/r/74613/diff/2/
>
>
> Testing
> -------
>
> tested for solr plugins
>
>
> Thanks,
>
> sanket shelar
>
>
Re: Review Request 74613: RANGER-3346: Ranger Solr Plugin sends audits with PKI auth instead of Kerberos
Posted by sanket shelar <sa...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/74613/
-----------------------------------------------------------
(Updated Feb. 4, 2025, 10:18 a.m.)
Review request for ranger, dinesh akhand, Dineshkumar Yadav, Kishor Gollapalliwar, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
Bugs: RANGER-3346
https://issues.apache.org/jira/browse/RANGER-3346
Repository: ranger
Description
-------
SolrAuditDestination class connects to Solr by building client with HttpClientUtil (from SolrJ library).
It's fine except in case of Solr Ranger Plugin. The Solr server uses the SolrJ lib as well for communication among its nodes and sets static/global configuration inside the HttpClientUtil which makes the SolrAuditDestination class's client to misbehave as sending the audits request with a header which forces the authentication to PKI. Prior to Solr 8.8 it leaded to only warning level Exceptions but after this version this will cause failure when sending audits.
Relevant Solr JIRA about changing the implementation of HttpClientUtil class:
https://issues.apache.org/jira/browse/SOLR-15388
Diffs
-----
agents-audit/src/main/java/org/apache/ranger/audit/destination/SolrAuditDestination.java 4be6002e3
agents-audit/src/main/java/org/apache/ranger/audit/provider/AuditProviderFactory.java 619c94c37
agents-audit/src/main/java/org/apache/ranger/audit/utils/SolrAppUtil.java 83612bde7
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java 495ce3b83
Diff: https://reviews.apache.org/r/74613/diff/2/
Testing
-------
tested for solr plugins
Thanks,
sanket shelar
Re: Review Request 74613: RANGER-3346: Ranger Solr Plugin sends audits with PKI auth instead of Kerberos
Posted by sanket shelar <sa...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/74613/
-----------------------------------------------------------
(Updated Feb. 4, 2025, 10:17 a.m.)
Review request for ranger, dinesh akhand, Dineshkumar Yadav, Kishor Gollapalliwar, Abhay Kulkarni, Madhan Neethiraj, Pradeep Agrawal, Ramesh Mani, Sailaja Polavarapu, and Velmurugan Periasamy.
Bugs: RANGER-3346
https://issues.apache.org/jira/browse/RANGER-3346
Repository: ranger
Description
-------
SolrAuditDestination class connects to Solr by building client with HttpClientUtil (from SolrJ library).
It's fine except in case of Solr Ranger Plugin. The Solr server uses the SolrJ lib as well for communication among its nodes and sets static/global configuration inside the HttpClientUtil which makes the SolrAuditDestination class's client to misbehave as sending the audits request with a header which forces the authentication to PKI. Prior to Solr 8.8 it leaded to only warning level Exceptions but after this version this will cause failure when sending audits.
Relevant Solr JIRA about changing the implementation of HttpClientUtil class:
https://issues.apache.org/jira/browse/SOLR-15388
Diffs (updated)
-----
agents-audit/src/main/java/org/apache/ranger/audit/destination/SolrAuditDestination.java 4be6002e3
agents-audit/src/main/java/org/apache/ranger/audit/provider/AuditProviderFactory.java 619c94c37
agents-audit/src/main/java/org/apache/ranger/audit/utils/SolrAppUtil.java 83612bde7
agents-common/src/main/java/org/apache/ranger/plugin/service/RangerBasePlugin.java 495ce3b83
Diff: https://reviews.apache.org/r/74613/diff/2/
Changes: https://reviews.apache.org/r/74613/diff/1-2/
Testing
-------
tested for solr plugins
Thanks,
sanket shelar