kumaab opened a new pull request, #1259:
URL: https://github.com/apache/ranger/pull/1259
## What changes were proposed in this pull request?
Plugins call Ranger Admin's secure endpoints only when their UGI has
Kerberos credentials or basic auth/JWT is configured, and use the non-secure
ones otherwise. RANGER-5488 added `forceSecureEndpointAccess` to opt in; this
makes it the default.
- `AbstractRangerAdminClient`: `<prefix>.forceSecureEndpointAccess` defaults
to `true`, and to `false` when `<prefix>.forceNonKerberos=true`, so plugins set
up for a non-Kerberized Ranger Admin keep the non-secure endpoints.
- Tests: Kerberos-path tests set the flag to `false` explicitly; new tests
cover the default and the `forceNonKerberos` opt-out for both admin clients.
**Behavior change**: plugins without Kerberos, basic auth or JWT need
credentials, or `<prefix>.forceSecureEndpointAccess=false`, to download
policies, tags, roles, user store and GDS info;
Kerberized plugins are unaffected.
## How was this patch tested?
- Unit tests
- ranger-docker with Kerberos: Knox downloads policies, roles and tags from
the `/secure/` endpoints (HTTP 200), and still does with
`forceSecureEndpointAccess=false`.
```
cd dev-support/ranger-docker && export RANGER_DB_TYPE=postgres
docker compose -f docker-compose.ranger.yml -f
docker-compose.ranger-knox.yml up -d ranger-knox
curl -sk -u guest:guest-password
'https://localhost:8443/gateway/sandbox/webhdfs/v1/?op=LISTSTATUS'
docker exec ranger sh -c 'grep "secure/.*dev_knox"
/var/log/ranger/access-*.log'
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
