[
https://issues.apache.org/jira/browse/RANGER-5809?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Abhishek Kumar updated RANGER-5809:
-----------------------------------
Description:
Plugins call Ranger Admin's secure endpoints only when their UGI has Kerberos
credentials or basic auth/JWT is configured, and use the non-secure ones
otherwise. RANGER-5488 added `forceSecureEndpointAccess` to opt in; this makes
it the default.
- `AbstractRangerAdminClient`: `<prefix>.forceSecureEndpointAccess` defaults
to `true`, and to `false` when `<prefix>.forceNonKerberos=true`, so plugins set
up for a non-Kerberized Ranger Admin keep the non-secure endpoints.
- Tests: Kerberos-path tests set the flag to `false` explicitly; new tests
cover the default and the `forceNonKerberos` opt-out for both admin clients.
{*}Behaviour change{*}: plugins without Kerberos, basic auth or JWT need
credentials, or `<prefix>.forceSecureEndpointAccess=false`, to download
policies, tags, roles, user store and GDS info; the Knox plugin supports
Kerberos only. Kerberized plugins in docker setup are unaffected.
was:
Plugins call Ranger Admin's secure endpoints only when their UGI has Kerberos
credentials or basic auth/JWT is configured, and use the non-secure ones
otherwise. RANGER-5488 added `forceSecureEndpointAccess` to opt in; this makes
it the default.
- `AbstractRangerAdminClient`: `<prefix>.forceSecureEndpointAccess` defaults to
`true`, and to `false` when `<prefix>.forceNonKerberos=true`, so plugins set up
for a non-Kerberized Ranger Admin keep the non-secure endpoints.
- Tests: Kerberos-path tests set the flag to `false` explicitly; new tests
cover the default and the `forceNonKerberos` opt-out for both admin clients.
Behaviour change: plugins without Kerberos, basic auth or JWT need credentials,
or `<prefix>.forceSecureEndpointAccess=false`, to download policies, tags,
roles, user store and GDS info; the Knox plugin supports Kerberos only.
Kerberized plugins in docker setup are unaffected.
> Use Ranger Admin secure endpoints by default
> --------------------------------------------
>
> Key: RANGER-5809
> URL: https://issues.apache.org/jira/browse/RANGER-5809
> Project: Ranger
> Issue Type: Task
> Components: Ranger
> Reporter: Abhishek Kumar
> Assignee: Abhishek Kumar
> Priority: Major
>
> Plugins call Ranger Admin's secure endpoints only when their UGI has Kerberos
> credentials or basic auth/JWT is configured, and use the non-secure ones
> otherwise. RANGER-5488 added `forceSecureEndpointAccess` to opt in; this
> makes it the default.
>
> - `AbstractRangerAdminClient`: `<prefix>.forceSecureEndpointAccess` defaults
> to `true`, and to `false` when `<prefix>.forceNonKerberos=true`, so plugins
> set up for a non-Kerberized Ranger Admin keep the non-secure endpoints.
> - Tests: Kerberos-path tests set the flag to `false` explicitly; new tests
> cover the default and the `forceNonKerberos` opt-out for both admin clients.
>
> {*}Behaviour change{*}: plugins without Kerberos, basic auth or JWT need
> credentials, or `<prefix>.forceSecureEndpointAccess=false`, to download
> policies, tags, roles, user store and GDS info; the Knox plugin supports
> Kerberos only. Kerberized plugins in docker setup are unaffected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
