Copilot commented on code in PR #1138:
URL: https://github.com/apache/ranger/pull/1138#discussion_r3846226882
##########
security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql:
##########
@@ -1819,11 +1820,13 @@ INSERT INTO
x_portal_user(create_time,update_time,added_by_id,upd_by_id,first_na
INSERT INTO
x_portal_user(create_time,update_time,added_by_id,upd_by_id,first_name,last_name,pub_scr_name,login_id,password,email,status,user_src,notes)
VALUES
(UTC_TIMESTAMP(),UTC_TIMESTAMP(),NULL,NULL,'rangerusersync','','rangerusersync','rangerusersync','70b8374d3dfe0325aaa5002a688c7e3b','rangerusersync',1,0,NULL);
INSERT INTO
x_portal_user(create_time,update_time,added_by_id,upd_by_id,first_name,last_name,pub_scr_name,login_id,password,email,status,user_src,notes)
VALUES
(UTC_TIMESTAMP(),UTC_TIMESTAMP(),NULL,NULL,'keyadmin','','keyadmin','keyadmin','a05f34d2dce2b4688fa82e82a89ba958','keyadmin',1,0,NULL);
INSERT INTO
x_portal_user(create_time,update_time,added_by_id,upd_by_id,first_name,last_name,pub_scr_name,login_id,password,email,status,user_src,notes)
VALUES
(UTC_TIMESTAMP(),UTC_TIMESTAMP(),NULL,NULL,'rangertagsync','','rangertagsync','rangertagsync','f5820e1229418dcf2575908f2c493da5','rangertagsync',1,0,NULL);
+INSERT INTO
x_portal_user(create_time,update_time,added_by_id,upd_by_id,first_name,last_name,pub_scr_name,login_id,password,email,status,user_src,notes)
VALUES
(UTC_TIMESTAMP(),UTC_TIMESTAMP(),NULL,NULL,'rangerauditserver','','rangerauditserver','rangerauditserver','9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3','rangerauditserver',1,0,NULL);
Review Comment:
This fresh-install row creates `rangerauditserver` as an active (`status =
1`) JDBC user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so fresh installations retain the same password-based credential
for this auditor account. Provision a per-install secret or disable password
authentication for this SPIFFE-only account, and apply that consistently across
the upgrade and fresh-install paths.
##########
security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql:
##########
@@ -2069,6 +2069,10 @@ INSERT INTO
x_portal_user(ID,CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SC
INSERT INTO
x_portal_user_role(id,create_time,update_time,user_id,user_role,status)
VALUES(X_PORTAL_USER_ROLE_SEQ.nextval,sys_extract_utc(systimestamp),sys_extract_utc(systimestamp),getXportalUIdByLoginId('rangertagsync'),'ROLE_SYS_ADMIN',1);
INSERT INTO x_user(id,create_time,update_time,user_name,descr,status) values
(X_USER_SEQ.nextval,sys_extract_utc(systimestamp),sys_extract_utc(systimestamp),'rangertagsync','rangertagsync',0);
+INSERT INTO
x_portal_user(ID,CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_NAME,LOGIN_ID,PASSWORD,EMAIL,STATUS,USER_SRC)
VALUES(X_PORTAL_USER_SEQ.nextval,sys_extract_utc(systimestamp),sys_extract_utc(systimestamp),'rangerauditserver',NULL,'rangerauditserver','rangerauditserver','9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3','rangerauditserver',1,0);
Review Comment:
This fresh-install row creates `rangerauditserver` as an active (`status =
1`) JDBC user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so fresh installations retain the same password-based credential
for this auditor account. Provision a per-install secret or disable password
authentication for this SPIFFE-only account, and apply that consistently across
the upgrade and fresh-install paths.
##########
security-admin/db/mysql/patches/078-audit-partition-plan-global-state.sql:
##########
@@ -0,0 +1,76 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+DELIMITER $$
+DROP PROCEDURE IF EXISTS getXportalUIdByLoginId$$
+CREATE PROCEDURE `getXportalUIdByLoginId`(IN input_val VARCHAR(100), OUT myid
BIGINT)
+BEGIN
+SET myid = 0;
+SELECT x_portal_user.id INTO myid FROM x_portal_user WHERE
x_portal_user.login_id = input_val;
+END $$
+
+DELIMITER ;
+
+DROP PROCEDURE IF EXISTS patch_audit_partition_plan_global_state;
+
+DELIMITER ;;
+CREATE PROCEDURE patch_audit_partition_plan_global_state()
+BEGIN
+ DECLARE adminID BIGINT;
+ DECLARE auditServerID BIGINT;
+ DECLARE planJson TEXT DEFAULT
'{"version":1,"topic":"ranger_audits","topicPartitionCount":9,"plugins":{},"buffer":{"partitions":[1,2,3,4,5,6,7,8,9]}}';
+
+ IF EXISTS (
+ SELECT 1 FROM information_schema.columns
+ WHERE table_schema = DATABASE() AND table_name =
'x_ranger_global_state' AND column_name = 'state_name'
+ ) THEN
+ IF EXISTS (
+ SELECT 1 FROM information_schema.columns
+ WHERE table_schema = DATABASE() AND table_name =
'x_ranger_global_state'
+ AND column_name = 'app_data' AND data_type = 'varchar'
+ ) THEN
+ ALTER TABLE x_ranger_global_state MODIFY app_data TEXT DEFAULT
NULL;
+ END IF;
+
+ IF NOT EXISTS (SELECT 1 FROM x_portal_user WHERE login_id =
'rangerauditserver') THEN
+ INSERT INTO x_portal_user(create_time, update_time, added_by_id,
upd_by_id, first_name, last_name, pub_scr_name, login_id, password, email,
status, user_src, notes)
+ VALUES (UTC_TIMESTAMP(), UTC_TIMESTAMP(), NULL, NULL,
'rangerauditserver', '', 'rangerauditserver', 'rangerauditserver',
'9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3', 'rangerauditserver', 1, 0, NULL);
Review Comment:
This upgrade inserts `rangerauditserver` as an active (`status = 1`) JDBC
user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so upgraded installations retain the same password-based
credential for this auditor account. Provision a per-install secret or disable
password authentication for this SPIFFE-only account, and apply that
consistently across the upgrade and fresh-install paths.
##########
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql:
##########
@@ -1997,6 +1997,10 @@ INSERT INTO
x_portal_user(CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_N
INSERT INTO
x_portal_user_role(CREATE_TIME,UPDATE_TIME,USER_ID,USER_ROLE,STATUS)VALUES(current_timestamp,current_timestamp,getXportalUIdByLoginId('rangertagsync'),'ROLE_SYS_ADMIN',1);
INSERT INTO
x_user(CREATE_TIME,UPDATE_TIME,user_name,status,descr)VALUES(current_timestamp,current_timestamp,'rangertagsync',0,'rangertagsync');
+INSERT INTO
x_portal_user(CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_NAME,LOGIN_ID,PASSWORD,EMAIL,STATUS)VALUES(current_timestamp,current_timestamp,'rangerauditserver','','rangerauditserver','rangerauditserver','9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3','rangerauditserver',1);
Review Comment:
This fresh-install row creates `rangerauditserver` as an active (`status =
1`) JDBC user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so fresh installations retain the same password-based credential
for this auditor account. Provision a per-install secret or disable password
authentication for this SPIFFE-only account, and apply that consistently across
the upgrade and fresh-install paths.
##########
security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql:
##########
@@ -2132,6 +2132,12 @@ INSERT INTO
x_portal_user_role(create_time,update_time,added_by_id,upd_by_id,use
GO
INSERT INTO
x_user(create_time,update_time,added_by_id,upd_by_id,user_name,descr,status)
values (CURRENT_TIMESTAMP,
CURRENT_TIMESTAMP,NULL,NULL,'rangertagsync','rangertagsync',0);
GO
+INSERT INTO
x_portal_user(create_time,update_time,added_by_id,upd_by_id,first_name,last_name,pub_scr_name,login_id,password,email,status,user_src,notes)
VALUES
(CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,NULL,NULL,'rangerauditserver','','rangerauditserver','rangerauditserver','9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3','rangerauditserver',1,0,NULL);
Review Comment:
This fresh-install row creates `rangerauditserver` as an active (`status =
1`) JDBC user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so fresh installations retain the same password-based credential
for this auditor account. Provision a per-install secret or disable password
authentication for this SPIFFE-only account, and apply that consistently across
the upgrade and fresh-install paths.
##########
security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql:
##########
@@ -4456,6 +4456,9 @@ insert into x_user
(CREATE_TIME,UPDATE_TIME,user_name,status,descr) values (CURR
insert into x_portal_user
(CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_NAME,LOGIN_ID,PASSWORD,EMAIL,STATUS)
values
(CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,'rangertagsync','','rangertagsync','rangertagsync','f5820e1229418dcf2575908f2c493da5','rangertagsync',1);
insert into x_portal_user_role
(CREATE_TIME,UPDATE_TIME,USER_ID,USER_ROLE,STATUS) values
(CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,dbo.getXportalUIdByLoginId('rangertagsync'),'ROLE_SYS_ADMIN',1);
insert into x_user (CREATE_TIME,UPDATE_TIME,user_name,status,descr) values
(CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,'rangertagsync',0,'rangertagsync');
+insert into x_portal_user
(CREATE_TIME,UPDATE_TIME,FIRST_NAME,LAST_NAME,PUB_SCR_NAME,LOGIN_ID,PASSWORD,EMAIL,STATUS)
values
(CURRENT_TIMESTAMP,CURRENT_TIMESTAMP,'rangerauditserver','','rangerauditserver','rangerauditserver','9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3','rangerauditserver',1);
Review Comment:
This fresh-install row creates `rangerauditserver` as an active (`status =
1`) JDBC user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so fresh installations retain the same password-based credential
for this auditor account. Provision a per-install secret or disable password
authentication for this SPIFFE-only account, and apply that consistently across
the upgrade and fresh-install paths.
##########
security-admin/db/sqlserver/patches/078-audit-partition-plan-global-state.sql:
##########
@@ -0,0 +1,68 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+SET ANSI_NULLS ON
+GO
+SET QUOTED_IDENTIFIER ON
+GO
+IF EXISTS (SELECT *
+ FROM sys.objects
+ WHERE object_id = OBJECT_ID(N'dbo.getXportalUIdByLoginId')
+ AND type IN ( N'FN', N'IF', N'TF', N'FS', N'FT' ))
+ DROP FUNCTION dbo.getXportalUIdByLoginId
+GO
+CREATE FUNCTION dbo.getXportalUIdByLoginId(@inputValue varchar(200))
+RETURNS int
+AS
+BEGIN
+ DECLARE @myid int;
+ SELECT @myid = id FROM x_portal_user WHERE x_portal_user.login_id =
@inputValue;
+ RETURN @myid;
+END
+GO
+
+IF EXISTS(SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME =
'x_ranger_global_state' AND COLUMN_NAME = 'state_name')
+BEGIN
+ IF EXISTS(SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME =
'x_ranger_global_state' AND COLUMN_NAME = 'app_data' AND DATA_TYPE = 'varchar')
+ BEGIN
+ ALTER TABLE [dbo].[x_ranger_global_state] ALTER COLUMN [app_data]
NVARCHAR(MAX) NULL;
+ END;
+
+ IF NOT EXISTS(SELECT * FROM x_portal_user WHERE login_id =
'rangerauditserver')
+ BEGIN
+ INSERT INTO x_portal_user (create_time, update_time, added_by_id,
upd_by_id, first_name, last_name, pub_scr_name, login_id, password, email,
status, user_src, notes)
+ VALUES (CURRENT_TIMESTAMP, CURRENT_TIMESTAMP, NULL, NULL,
'rangerauditserver', '', 'rangerauditserver', 'rangerauditserver',
'9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3', 'rangerauditserver', 1, 0, NULL);
Review Comment:
This upgrade inserts `rangerauditserver` as an active (`status = 1`) JDBC
user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so upgraded installations retain the same password-based
credential for this auditor account. Provision a per-install secret or disable
password authentication for this SPIFFE-only account, and apply that
consistently across the upgrade and fresh-install paths.
##########
security-admin/db/oracle/patches/078-audit-partition-plan-global-state.sql:
##########
@@ -0,0 +1,83 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+CREATE OR REPLACE FUNCTION getXportalUIdByLoginId(input_val IN VARCHAR2)
+RETURN NUMBER IS
+BEGIN
+DECLARE
+ myid Number := 0;
+BEGIN
+ SELECT x_portal_user.id INTO myid FROM x_portal_user WHERE
x_portal_user.login_id = input_val;
+ RETURN myid;
+END;
+END;
+/
+
+DECLARE
+ t_count number := 0;
+ v_admin_id number;
+ v_audit_user_id number;
+ v_plan_count number := 0;
+ v_user_count number := 0;
+ v_role_count number := 0;
+ v_xuser_count number := 0;
+ v_plan_json CLOB :=
'{"version":1,"topic":"ranger_audits","topicPartitionCount":9,"plugins":{},"buffer":{"partitions":[1,2,3,4,5,6,7,8,9]}}';
+ sql_stmt VARCHAR2(4000);
+BEGIN
+ SELECT count(*) INTO t_count FROM user_tables WHERE table_name =
'X_RANGER_GLOBAL_STATE';
+ IF (t_count > 0) THEN
+ BEGIN
+ EXECUTE IMMEDIATE 'ALTER TABLE x_ranger_global_state MODIFY
(app_data CLOB)';
+ EXCEPTION
+ WHEN OTHERS THEN
+ NULL;
+ END;
+
+ v_admin_id := getXportalUIdByLoginId('admin');
+
+ SELECT count(*) INTO v_user_count FROM x_portal_user WHERE login_id =
'rangerauditserver';
+ IF (v_user_count = 0) THEN
+ sql_stmt := 'INSERT INTO x_portal_user (id, create_time,
update_time, first_name, last_name, pub_scr_name, login_id, password, email,
status, user_src) VALUES (X_PORTAL_USER_SEQ.nextval,
sys_extract_utc(systimestamp), sys_extract_utc(systimestamp), :1, NULL, :2, :3,
:4, :5, 1, 0)';
+ EXECUTE IMMEDIATE sql_stmt USING 'rangerauditserver',
'rangerauditserver', 'rangerauditserver', '9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3',
'rangerauditserver';
Review Comment:
This upgrade inserts `rangerauditserver` as an active (`status = 1`) JDBC
user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so upgraded installations retain the same password-based
credential for this auditor account. Provision a per-install secret or disable
password authentication for this SPIFFE-only account, and apply that
consistently across the upgrade and fresh-install paths.
##########
security-admin/db/oracle/patches/078-audit-partition-plan-global-state.sql:
##########
@@ -0,0 +1,83 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+CREATE OR REPLACE FUNCTION getXportalUIdByLoginId(input_val IN VARCHAR2)
+RETURN NUMBER IS
+BEGIN
+DECLARE
+ myid Number := 0;
+BEGIN
+ SELECT x_portal_user.id INTO myid FROM x_portal_user WHERE
x_portal_user.login_id = input_val;
+ RETURN myid;
+END;
+END;
+/
+
+DECLARE
+ t_count number := 0;
+ v_admin_id number;
+ v_audit_user_id number;
+ v_plan_count number := 0;
+ v_user_count number := 0;
+ v_role_count number := 0;
+ v_xuser_count number := 0;
+ v_plan_json CLOB :=
'{"version":1,"topic":"ranger_audits","topicPartitionCount":9,"plugins":{},"buffer":{"partitions":[1,2,3,4,5,6,7,8,9]}}';
+ sql_stmt VARCHAR2(4000);
+BEGIN
+ SELECT count(*) INTO t_count FROM user_tables WHERE table_name =
'X_RANGER_GLOBAL_STATE';
+ IF (t_count > 0) THEN
+ BEGIN
+ EXECUTE IMMEDIATE 'ALTER TABLE x_ranger_global_state MODIFY
(app_data CLOB)';
+ EXCEPTION
+ WHEN OTHERS THEN
+ NULL;
+ END;
Review Comment:
This handler swallows every failure from the column conversion, so a
permission error, lock/conversion failure, or other unexpected Oracle error
still lets patch 078 continue and be recorded while `app_data` remains
`VARCHAR2(255)`. The later partition-plan updates can then fail once they
exceed that limit. Check `USER_TAB_COLUMNS.DATA_TYPE` and skip the `ALTER` only
when it is already `CLOB`; let unexpected `ALTER TABLE` errors propagate.
##########
security-admin/db/sqlanywhere/patches/078-audit-partition-plan-global-state.sql:
##########
@@ -0,0 +1,55 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+CREATE OR REPLACE FUNCTION dbo.getXportalUIdByLoginId (input_val CHAR(60))
+RETURNS INTEGER
+BEGIN
+ DECLARE myid INTEGER;
+ SELECT x_portal_user.id INTO myid FROM x_portal_user WHERE
x_portal_user.login_id = input_val;
+ RETURN (myid);
+END;
+GO
+
+BEGIN
+ DECLARE planJson LONG VARCHAR DEFAULT
'{"version":1,"topic":"ranger_audits","topicPartitionCount":9,"plugins":{},"buffer":{"partitions":[1,2,3,4,5,6,7,8,9]}}';
+
+ IF EXISTS(SELECT * FROM SYS.SYSCOLUMNS WHERE tname =
'x_ranger_global_state' AND cname = 'state_name') THEN
+ IF EXISTS(SELECT * FROM SYS.SYSCOLUMNS WHERE tname =
'x_ranger_global_state' AND cname = 'app_data' AND coltype = 'varchar') THEN
+ ALTER TABLE dbo.x_ranger_global_state MODIFY app_data LONG VARCHAR
DEFAULT NULL;
Review Comment:
`MODIFY` is not SQL Anywhere's `ALTER TABLE` column-type syntax; the
existing SQL Anywhere patches use `ALTER [COLUMN]` (for example, patches 047
and 060). This statement will abort patch 078 before the account and
global-state inserts on upgraded databases. Use the SQL Anywhere `ALTER
app_data LONG VARCHAR ...` form.
##########
security-admin/db/sqlanywhere/patches/078-audit-partition-plan-global-state.sql:
##########
@@ -0,0 +1,55 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+CREATE OR REPLACE FUNCTION dbo.getXportalUIdByLoginId (input_val CHAR(60))
+RETURNS INTEGER
+BEGIN
+ DECLARE myid INTEGER;
+ SELECT x_portal_user.id INTO myid FROM x_portal_user WHERE
x_portal_user.login_id = input_val;
+ RETURN (myid);
+END;
+GO
+
+BEGIN
+ DECLARE planJson LONG VARCHAR DEFAULT
'{"version":1,"topic":"ranger_audits","topicPartitionCount":9,"plugins":{},"buffer":{"partitions":[1,2,3,4,5,6,7,8,9]}}';
+
+ IF EXISTS(SELECT * FROM SYS.SYSCOLUMNS WHERE tname =
'x_ranger_global_state' AND cname = 'state_name') THEN
+ IF EXISTS(SELECT * FROM SYS.SYSCOLUMNS WHERE tname =
'x_ranger_global_state' AND cname = 'app_data' AND coltype = 'varchar') THEN
+ ALTER TABLE dbo.x_ranger_global_state MODIFY app_data LONG VARCHAR
DEFAULT NULL;
+ END IF;
+
+ IF NOT EXISTS(SELECT * FROM x_portal_user WHERE login_id =
'rangerauditserver') THEN
+ INSERT INTO x_portal_user(create_time, update_time, added_by_id,
upd_by_id, first_name, last_name, pub_scr_name, login_id, password, email,
status, user_src, notes)
+ VALUES (CURRENT_TIMESTAMP, CURRENT_TIMESTAMP, NULL, NULL,
'rangerauditserver', '', 'rangerauditserver', 'rangerauditserver',
'9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3', 'rangerauditserver', 1, 0, NULL);
Review Comment:
This upgrade inserts `rangerauditserver` as an active (`status = 1`) JDBC
user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so upgraded installations retain the same password-based
credential for this auditor account. Provision a per-install secret or disable
password authentication for this SPIFFE-only account, and apply that
consistently across the upgrade and fresh-install paths.
##########
security-admin/db/postgres/patches/078-audit-partition-plan-global-state.sql:
##########
@@ -0,0 +1,67 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+select 'delimiter start';
+CREATE OR REPLACE FUNCTION patch_audit_partition_plan_global_state()
+RETURNS void AS $$
+DECLARE
+ v_column_is_varchar integer := 0;
+ v_admin_id bigint;
+ v_audit_user_id bigint;
+ v_plan_json text :=
'{"version":1,"topic":"ranger_audits","topicPartitionCount":9,"plugins":{},"buffer":{"partitions":[1,2,3,4,5,6,7,8,9]}}';
+BEGIN
+ IF EXISTS (SELECT 1 FROM pg_class WHERE relname = 'x_ranger_global_state')
THEN
+ SELECT count(*) INTO v_column_is_varchar
+ FROM pg_attribute
+ WHERE attrelid = (SELECT oid FROM pg_class WHERE relname =
'x_ranger_global_state')
+ AND attname = 'app_data'
+ AND atttypid = (SELECT oid FROM pg_type WHERE typname = 'varchar');
+
+ IF v_column_is_varchar > 0 THEN
+ ALTER TABLE x_ranger_global_state ALTER COLUMN app_data TYPE TEXT;
+ END IF;
+
+ SELECT getXportalUIdByLoginId('admin') INTO v_admin_id;
+
+ IF NOT EXISTS (SELECT 1 FROM x_portal_user WHERE login_id =
'rangerauditserver') THEN
+ INSERT INTO x_portal_user(create_time, update_time, first_name,
last_name, pub_scr_name, login_id, password, email, status)
+ VALUES (current_timestamp, current_timestamp, 'rangerauditserver',
'', 'rangerauditserver', 'rangerauditserver',
'9c8f4e2b1a0d6e3f7b5c4a8291d0e6f3', 'rangerauditserver', 1);
Review Comment:
This upgrade inserts `rangerauditserver` as an active (`status = 1`) JDBC
user with a fixed repository-defined password verifier. The Admin JDBC
authentication query reads this table, while the installer rotates only the
existing default accounts (`admin`, `rangertagsync`, `rangerusersync`, and
`keyadmin`), so upgraded installations retain the same password-based
credential for this auditor account. Provision a per-install secret or disable
password authentication for this SPIFFE-only account, and apply that
consistently across the upgrade and fresh-install paths.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
