fimugdha commented on code in PR #1171:
URL: https://github.com/apache/ranger/pull/1171#discussion_r3964755196
##########
unixauthservice/src/main/java/org/apache/ranger/authentication/UnixAuthenticationService.java:
##########
@@ -105,31 +106,43 @@ public UnixAuthenticationService() {
}
public static void main(String[] args) {
- enableUnixAuth =
Arrays.stream(args).anyMatch("-enableUnixAuth"::equalsIgnoreCase);
UnixAuthenticationService service = new UnixAuthenticationService();
service.userSyncHAInitializerImpl =
UserSyncHAInitializerImpl.getInstance(UserGroupSyncConfig.getInstance().getUserGroupConfig());
service.run();
}
public void run() {
+ boolean unixAuthServiceStarted = false;
try {
+ UserGroupSyncConfig config = UserGroupSyncConfig.getInstance();
+ enableUnixAuth = config.getUserSyncUnixAuth();
+ unixBackend = config.getUnixBackend();
+
LOG.info("Starting User Sync Service!");
startUnixUserGroupSyncProcess();
Thread.sleep(5000);
- if (enableUnixAuth) {
+ if (enableUnixAuth && "passwd".equalsIgnoreCase(unixBackend)) {
LOG.info("Enabling Unix Auth Service!");
init();
+ unixAuthServiceStarted = true;
Review Comment:
@pradeepagrawal8184 , Agreed that setting unixAuthServiceStarted before
startService() means a bind/SSL failure would still stop the HA curator leader
latch in finally while UserGroupSync keeps running. That matches the
pre-existing behavior when -enableUnixAuth was always passed and finally
unconditionally stopped curator leader latch on any exit from run().
The primary regression this change fixes is when Unix Auth is disabled (the
new default): the main thread returns after starting UserGroupSync, and we must
not stop leader election in that case. Keeping the flag before startService()
preserves the prior enabled-auth shutdown semantics on listener exit or
startService() failure.
I kept the current placement for minimal change. Extensive HA testing has
already been completed with the current placement.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
