[
https://issues.apache.org/jira/browse/RANGER-5740?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Pradeep Agrawal updated RANGER-5740:
------------------------------------
Description:
h2. Problem statement
The Ranger Elasticsearch plugin resolves the caller identity used for
authorization checks from client-supplied request data instead of from
Elasticsearch’s authenticated security context.
For REST and transport requests, the plugin should use the identity established
by Elasticsearch X-Pack Security after authentication. Relying on unverified
client input can produce inconsistent authorization behavior between REST and
transport paths and may allow requests to be evaluated under an identity that
Elasticsearch has not verified.
This misalignment also means non-system requests without a verified
authenticated user may not be handled consistently across plugin entry points.
----
h2. Background
The Elasticsearch plugin integrates with Ranger to enforce index-level access
policies. Authorization decisions depend on the resolved caller identity being
the same identity Elasticsearch has authenticated for the request.
Other Ranger plugins typically rely on the underlying platform’s authenticated
principal. The Elasticsearch plugin should follow the same pattern by using
X-Pack {{SecurityContext}} rather than parsing credentials from incoming HTTP
headers.
----
h2. Expected behavior
* Caller identity for Ranger authorization is taken from Elasticsearch X-Pack
{{{}SecurityContext{}}}.
* Non-system REST and transport requests without a verified authenticated user
are rejected.
* System/internal requests continue to bypass Ranger checks as today.
* REST and transport paths use the same identity resolution logic.
> Best Practices: Align Elasticsearch plugin caller identity with X-Pack
> Security
> -------------------------------------------------------------------------------
>
> Key: RANGER-5740
> URL: https://issues.apache.org/jira/browse/RANGER-5740
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Affects Versions: 2.9.0
> Reporter: Pradeep Agrawal
> Assignee: Pradeep Agrawal
> Priority: Major
> Fix For: 3.0.0
>
>
> h2. Problem statement
> The Ranger Elasticsearch plugin resolves the caller identity used for
> authorization checks from client-supplied request data instead of from
> Elasticsearch’s authenticated security context.
> For REST and transport requests, the plugin should use the identity
> established by Elasticsearch X-Pack Security after authentication. Relying on
> unverified client input can produce inconsistent authorization behavior
> between REST and transport paths and may allow requests to be evaluated under
> an identity that Elasticsearch has not verified.
> This misalignment also means non-system requests without a verified
> authenticated user may not be handled consistently across plugin entry points.
> ----
> h2. Background
> The Elasticsearch plugin integrates with Ranger to enforce index-level access
> policies. Authorization decisions depend on the resolved caller identity
> being the same identity Elasticsearch has authenticated for the request.
> Other Ranger plugins typically rely on the underlying platform’s
> authenticated principal. The Elasticsearch plugin should follow the same
> pattern by using X-Pack {{SecurityContext}} rather than parsing credentials
> from incoming HTTP headers.
> ----
> h2. Expected behavior
> * Caller identity for Ranger authorization is taken from Elasticsearch
> X-Pack {{{}SecurityContext{}}}.
> * Non-system REST and transport requests without a verified authenticated
> user are rejected.
> * System/internal requests continue to bypass Ranger checks as today.
> * REST and transport paths use the same identity resolution logic.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
