kumaab opened a new pull request, #1258: URL: https://github.com/apache/ranger/pull/1258
## What changes were proposed in this pull request? Simplifies JWT handling in `ranger-authn` by delegating token validation to nimbus, as discussed in RANGER-5528. - one `DefaultJWTProcessor` is built at init and reused for every request; the per-request processor, the duplicate `jwtToken.verify()` path and the hand-written `validate*` methods are removed - claims are validated by `DefaultJWTClaimsVerifier`: `exp` and `sub` are required claims, `jwt.audiences` and `jwt.issuer` are mandatory configuration and `initialize()` fails with a clear message when either is unset - accepted signature algorithms are the RSA and EC families; `typ` may be `JWT`, `at+jwt` or absent - Ranger Admin: JWT auth uses `ranger.sso.providerurl` (JWKS) only; `ranger.sso.publicKey` stays with the Knox SSO filter. JWT logins get their own auth type, so Audits > Login Sessions shows `JWT` - PDP: new `ranger.pdp.authn.jwt.issuer`, wired through `RangerPdpConfig`/`RangerPdpServer`; audit ingestor: new `ranger.audit.jwt.auth.issuer` - docker: admin YAMLs and the PDP site XML ship defaults for the public dev provider https://jwkserve.com, replacing a placeholder host - `LOG.isDebugEnabled()` guards dropped in touched files Note: JWT bearer auth now requires audiences and issuer to be configured. ## How was this patch tested? - Unit tests sign real tokens against a local JWKS endpoint and a self-signed certificate and cover signature, `kid`, algorithm, `exp`, `nbf`, `aud`, `iss`, `sub`, `typ` and configuration handling. PDP tests cover the issuer setting and handler registration. `ranger-authn`, `security-admin` filter tests and `pdp` are green. - Live: fresh build, Ranger Admin and PDP containers with the shipped configs and no overrides. Valid tokens from jwkserve.com authenticate as `sub`; tokens failing any check are rejected with the reason logged. - Login Sessions shows `JWT`: <img width="1431" height="709" alt="image" src="https://github.com/user-attachments/assets/0a82aefd-7628-429c-b8cc-4130ea3b4100"; /> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
