You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "Ramachandran Krishnan (Jira)" <ji...@apache.org> on 2026/07/30 04:04:00 UTC
[jira] [Updated] (RANGER-5712) Enable unauthenticated plugin download in ranger-docker dev sandbox
[ https://issues.apache.org/jira/browse/RANGER-5712?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ramachandran Krishnan updated RANGER-5712:
------------------------------------------
Description:
Trino and Ozone plugins in the ranger-docker dev sandbox fail to download policies, roles, tags, and xusers from Ranger Admin with HTTP 400 ({{{}Unauthenticated access not allowed{}}}). HDFS/Hive work because they use Kerberos-backed secure download paths. The dev sandbox uses plain HTTP and does not configure plugin Kerberos auth on the Admin REST client, so downloads are rejected unless {{ranger.admin.allow.unauthenticated.download.access}} is enabled.
Problem
After RANGER-5635 (#1048), {{failUnauthenticatedDownloadIfNotAllowed()}} is enforced even when Hadoop security is not fully enabled. In ranger-docker:
* Admin runs with {{policymgr_http_enabled=true}} and {{authentication_method=UNIX}}
* Trino/Ozone plugins call non-secure download URLs (no SPNEGO/Kerberos on the plugin REST client)
* Default {{ranger.admin.allow.unauthenticated.download.access=false}} in {{ranger-admin-default-site.xml}}
Affected endpoints:
* {{/service/plugins/policies/download/}}
* {{/service/roles/download/}}
* {{/service/tags/download/}}
* {{/service/xusers/download/}}
Symptom in Admin logs: {{Unauthenticated access not allowed}} → HTTP 400 in access logs.
This is a dev/docker configuration gap, not a plugin or REST bug. {{policy.download.auth.users}} on the service (e.g. trino, om) is not sufficient when unauthenticated download is disabled globally.
----
Root cause
# RANGER-5635 tightened download auth checks (correct for production).
# ranger-docker never wires {{ranger.admin.allow.unauthenticated.download.access}} into {{{}ranger-admin-site.xml{}}}.
# Adding the property only to docker {{install.properties}} does not work today — {{setup.sh}} only updates keys that already exist in {{ranger-admin-site.xml}} (same pattern as {{{}FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION{}}}).
----
Proposed solution:
# *update plugin configuration to include authentication information*
We should look at Ozone setup, to ensure that it has Kerberos configuration correctly. For Trino, we should update plugin configuration with username/password to authenticate with Ranger admin.
was:
Trino and Ozone plugins in the ranger-docker dev sandbox fail to download policies, roles, tags, and xusers from Ranger Admin with HTTP 400 ({{{}Unauthenticated access not allowed{}}}). HDFS/Hive work because they use Kerberos-backed secure download paths. The dev sandbox uses plain HTTP and does not configure plugin Kerberos auth on the Admin REST client, so downloads are rejected unless {{ranger.admin.allow.unauthenticated.download.access}} is enabled.
Problem
After RANGER-5635 (#1048), {{failUnauthenticatedDownloadIfNotAllowed()}} is enforced even when Hadoop security is not fully enabled. In ranger-docker:
* Admin runs with {{policymgr_http_enabled=true}} and {{authentication_method=UNIX}}
* Trino/Ozone plugins call non-secure download URLs (no SPNEGO/Kerberos on the plugin REST client)
* Default {{ranger.admin.allow.unauthenticated.download.access=false}} in {{ranger-admin-default-site.xml}}
Affected endpoints:
* {{/service/plugins/policies/download/}}
* {{/service/roles/download/}}
* {{/service/tags/download/}}
* {{/service/xusers/download/}}
Symptom in Admin logs: {{Unauthenticated access not allowed}} → HTTP 400 in access logs.
This is a dev/docker configuration gap, not a plugin or REST bug. {{policy.download.auth.users}} on the service (e.g. trino, om) is not sufficient when unauthenticated download is disabled globally.
----
Root cause
# RANGER-5635 tightened download auth checks (correct for production).
# ranger-docker never wires {{ranger.admin.allow.unauthenticated.download.access}} into {{{}ranger-admin-site.xml{}}}.
# Adding the property only to docker {{install.properties}} does not work today — {{setup.sh}} only updates keys that already exist in {{ranger-admin-site.xml}} (same pattern as {{{}FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION{}}}).
----
Proposed solution
Wire a new install property through Admin setup into {{{}ranger-admin-site.xml{}}}, and set it to {{true}} only in docker dev install files.
Install property (suggested name):
ranger_admin_allow_unauthenticated_download_access=true # docker dev only
ranger_admin_allow_unauthenticated_download_access=false # default everywhere else
Maps to site.xml:
{code:java}
ranger.admin.allow.unauthenticated.download.access{code}
> Enable unauthenticated plugin download in ranger-docker dev sandbox
> -------------------------------------------------------------------
>
> Key: RANGER-5712
> URL: https://issues.apache.org/jira/browse/RANGER-5712
> Project: Ranger
> Issue Type: Task
> Components: Ranger
> Affects Versions: 2.8.0
> Reporter: Ramachandran Krishnan
> Assignee: Ramachandran Krishnan
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Trino and Ozone plugins in the ranger-docker dev sandbox fail to download policies, roles, tags, and xusers from Ranger Admin with HTTP 400 ({{{}Unauthenticated access not allowed{}}}). HDFS/Hive work because they use Kerberos-backed secure download paths. The dev sandbox uses plain HTTP and does not configure plugin Kerberos auth on the Admin REST client, so downloads are rejected unless {{ranger.admin.allow.unauthenticated.download.access}} is enabled.
> Problem
> After RANGER-5635 (#1048), {{failUnauthenticatedDownloadIfNotAllowed()}} is enforced even when Hadoop security is not fully enabled. In ranger-docker:
> * Admin runs with {{policymgr_http_enabled=true}} and {{authentication_method=UNIX}}
> * Trino/Ozone plugins call non-secure download URLs (no SPNEGO/Kerberos on the plugin REST client)
> * Default {{ranger.admin.allow.unauthenticated.download.access=false}} in {{ranger-admin-default-site.xml}}
> Affected endpoints:
> * {{/service/plugins/policies/download/}}
> * {{/service/roles/download/}}
> * {{/service/tags/download/}}
> * {{/service/xusers/download/}}
> Symptom in Admin logs: {{Unauthenticated access not allowed}} → HTTP 400 in access logs.
> This is a dev/docker configuration gap, not a plugin or REST bug. {{policy.download.auth.users}} on the service (e.g. trino, om) is not sufficient when unauthenticated download is disabled globally.
> ----
> Root cause
> # RANGER-5635 tightened download auth checks (correct for production).
> # ranger-docker never wires {{ranger.admin.allow.unauthenticated.download.access}} into {{{}ranger-admin-site.xml{}}}.
> # Adding the property only to docker {{install.properties}} does not work today — {{setup.sh}} only updates keys that already exist in {{ranger-admin-site.xml}} (same pattern as {{{}FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION{}}}).
> ----
> Proposed solution:
> # *update plugin configuration to include authentication information*
> We should look at Ozone setup, to ensure that it has Kerberos configuration correctly. For Trino, we should update plugin configuration with username/password to authenticate with Ranger admin.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)