kumaab opened a new pull request, #1157: URL: https://github.com/apache/ranger/pull/1157
## What changes were proposed in this pull request? This PR completely removes the legacy Knox SSO authentication mechanism (RANGER-685) from Ranger Admin, which is no longer used in practice now that JWT/Bearer-token authentication (RANGER-3739) is handled by the shared `ranger-authn` framework. **Root problem addressed:** the `ranger.sso.enabled` flag was overloaded — it drove JWT user auto-provisioning, audit auth-type classification, and the auth-provider branch. This caused operational bugs (e.g. an empty `<value></value>` public key silently breaking unrelated auth flows, and header/JWT user provisioning being coupled to an unrelated "SSO" flag). Backend: - Removed the `ranger.sso.enabled` flag and everything it drove: the SSO branch in `RangerAuthenticationProvider` (`isSsoEnabled`/`setSsoEnabled`/`getSSOAuthentication`), `RangerBizUtil.isSSOEnabled()`, `ServiceREST.checkSSO()` (`/checksso`), `UserSessionBase.isSSOEnabled`, and the `locallogin` scaffolding in `RangerAuthenticationEntryPoint`, `RangerJwtAuthWrapper`, and `RestUtil`. - Decoupled user auto-provisioning from `ranger.sso.enabled`. `SessionMgr` now provisions absent users based on the actual authentication mechanism of the request (SPNEGO/Kerberos, trusted-proxy header, JWT, or the internal healthcheck user). `RangerJwtAuthFilter` sets a `jwtAuthenticated` request attribute that also drives `AUTH_TYPE_SSO` audit classification for token logins. - JWT (RANGER-3739) config namespace moved from `ranger.sso.*` to `ranger.admin.jwt.*`, with a transparent backward-compatible fallback to the legacy `ranger.sso.*` names so existing JWT deployments keep working. JWT now activates automatically when a provider URL or public key is configured (no separate enable flag), and empty-string config values are correctly treated as unset. Config: - Replaced the Knox `ranger.sso.*` block with the `ranger.admin.jwt.*` namespace in `ranger-admin-site.xml`, `install.properties`, and `setup.sh`; removed `sso_enabled=true` from the docker admin install properties. UI (React): - Removed the Knox SSO flows: `checkKnoxSSO`/`plugins/checksso`, the `/knoxSSOWarning` route and `checkSSOTrue` error page, and the `/locallogin` route. Logout now simply clears state and redirects to `login.jsp`. Intentionally kept (not part of Knox admin SSO): the `AUTH_TYPE_SSO` DB enum for historical audit records, `RestUtil.constructForwardableURL/constructRedirectURL` (used by Kerberos logout), and the entire `ranger-knox-plugin` (Knox authorization). ## How was this patch tested? - `mvn test-compile` for `security-admin` (main + test sources) passes. - Ran the affected unit-test classes with no failures: `TestRangerAuthenticationProvider`, `TestSessionMgr`, `TestRangerBizUtil`, `TestRangerSecurityContextFormationFilter`, `TestRangerJwtAuthFilter`, `TestRangerJwtAuthWrapper`, `TestRangerAuthenticationEntryPoint`, `TestRangerKRBAuthenticationFilter`, `TestRangerCSRFPreventionFilter`, and `TestServiceREST`. Existing tests were updated to reflect the mechanism-based auth-type/provisioning behavior and the removed SSO endpoints/flags. - Verified the project Checkstyle configuration (`dev-support/checkstyle.xml`, including test sources) passes for the `security-admin` module. - Confirmed no dangling references remain to the removed symbols and `ranger.sso.*` properties across the repository. - More tests - Pending. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
