kumaab opened a new pull request, #1197: URL: https://github.com/apache/ranger/pull/1197
## What changes were proposed in this pull request? - SPIFFE IDs as usernames in Ranger. - `:` allowed in usernames (config driven), and - header/trusted-proxy authn resolves the full SPIFFE ID as the principal in both Ranger Admin and the PDP. ## How was this patch tested? ### Config prerequisites (Docker) ~~~ # Admin ranger.admin.authn.header.enabled=true ranger.admin.authn.header.spiffe=X-Spiffe-Id ranger.admin.spiffe.as.username.enabled=true ranger.sso.enabled=true # PDP ranger.pdp.authn.header.enabled=true ranger.pdp.authn.header.spiffe=X-Spiffe-Id ~~~ - SPIFFE users are visible in Ranger UI: <img width="2216" height="364" alt="image" src="https://github.com/user-attachments/assets/f6318e22-0de2-46c8-8e0f-9d43fc4e58d5"; /> - SPIFFE users participate in policy creation/update. <img width="2224" height="106" alt="image" src="https://github.com/user-attachments/assets/f4d3dbdd-56b1-4f67-9d3b-98c126992703"; /> - PDP path ~~~ $ curl -sk -X POST http://localhost:6500/authz/v1/authorize \ -H 'Content-Type: application/json' -H "X-Spiffe-Id: $SID" \ -d "{\"requestId\":\"t6\",\"context\":{\"serviceName\":\"dev_hive\",\"serviceType\":\"hive\"},\"user\":{\"name\":\"$SID\"},\"access\":{\"resource\":{\"name\":\"database:default\"},\"action\":\"select\",\"permissions\":[\"select\"]}}" \ -w '\nHTTP %{http_code}\n' {"code":"UNAUTHORIZED","message":"Authentication required"} HTTP 401 # Grant the full SPIFFE ID 'select' on database=default in dev_hive $ SID='spiffe://spiffe.example.com/ns/sales/sa/trino' $ curl -sk -X POST http://localhost:6500/authz/v1/authorize \ -H 'Content-Type: application/json' -H "X-Spiffe-Id: $SID" \ -d "{\"requestId\":\"t6\",\"context\":{\"serviceName\":\"dev_hive\",\"serviceType\":\"hive\"},\"user\":{\"name\":\"$SID\"},\"access\":{\"resource\":{\"name\":\"database:default\"},\"action\":\"select\",\"permissions\":[\"select\"]}}" \ -w '\nHTTP %{http_code}\n' {"requestId":"t6","decision":"ALLOW","permissions":{"select":{"permission":"select","access":{"decision":"ALLOW","policy":{"id":52,"version":1}}}}} HTTP 200 ~~~ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
