[
https://issues.apache.org/jira/browse/RANGER-5725?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Abhishek Kumar updated RANGER-5725:
-----------------------------------
Description:
Remove the legacy Knox SSO authentication filter
({{{}RangerSSOAuthenticationFilter{}}}) from Ranger Admin.
JWT authentication is now handled by {{RangerJwtAuthFilter}} /
{{RangerJwtAuthWrapper}} (RANGER-3739) using the shared {{ranger-authn}}
framework and {{Authorization: Bearer}} headers.
Cookie-based Knox SSO redirect logic in the SSO filter is redundant,
inconsistently maintained, and causes operational bugs.
h4. Known operational bug
{{getJwtProperties()}} treats {{null}} public key as "SSO disabled" but does
not handle an empty string ({{{}<value></value>{}}}), which is the default in
{{{}ranger-admin-site.xml{}}}. When {{ranger.sso.enabled=true}} with an empty
public key, JWT property loading fails silently and breaks unrelated auth flows
(e.g., header-authenticated user provisioning into {{{}x_portal_user{}}}).
was:
Remove the legacy Knox SSO authentication filter
({{{}RangerSSOAuthenticationFilter{}}}) from Ranger Admin.
JWT authentication is now handled by {{RangerJwtAuthFilter}} /
{{RangerJwtAuthWrapper}} (RANGER-3739) using the shared {{ranger-authn}}
framework and {{Authorization: Bearer}} headers.
Cookie-based Knox SSO redirect logic in the SSO filter is redundant,
inconsistently maintained, and causes operational bugs.
## Known operational bug
{{getJwtProperties()}} treats {{null}} public key as "SSO disabled" but does
not handle an empty string ({{{}<value></value>{}}}), which is the default in
{{{}ranger-admin-site.xml{}}}. When {{ranger.sso.enabled=true}} with an empty
public key, JWT property loading fails silently and breaks unrelated auth flows
(e.g., header-authenticated user provisioning into {{{}x_portal_user{}}}).
> Remove legacy RangerSSOAuthenticationFilter and Knox cookie-based SSO auth
> path
> -------------------------------------------------------------------------------
>
> Key: RANGER-5725
> URL: https://issues.apache.org/jira/browse/RANGER-5725
> Project: Ranger
> Issue Type: Improvement
> Components: Ranger
> Reporter: Abhishek Kumar
> Priority: Major
>
> Remove the legacy Knox SSO authentication filter
> ({{{}RangerSSOAuthenticationFilter{}}}) from Ranger Admin.
> JWT authentication is now handled by {{RangerJwtAuthFilter}} /
> {{RangerJwtAuthWrapper}} (RANGER-3739) using the shared {{ranger-authn}}
> framework and {{Authorization: Bearer}} headers.
> Cookie-based Knox SSO redirect logic in the SSO filter is redundant,
> inconsistently maintained, and causes operational bugs.
> h4. Known operational bug
> {{getJwtProperties()}} treats {{null}} public key as "SSO disabled" but does
> not handle an empty string ({{{}<value></value>{}}}), which is the default in
> {{{}ranger-admin-site.xml{}}}. When {{ranger.sso.enabled=true}} with an empty
> public key, JWT property loading fails silently and breaks unrelated auth
> flows (e.g., header-authenticated user provisioning into
> {{{}x_portal_user{}}}).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
