[
https://issues.apache.org/jira/browse/RANGER-5809?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Abhishek Kumar resolved RANGER-5809.
------------------------------------
Fix Version/s: 3.0.0
Resolution: Fixed
Merged in master:
https://github.com/apache/ranger/commit/b39c559b3d9f55966729f1bd367bebc868c2034a
> Use Ranger Admin secure endpoints by default
> --------------------------------------------
>
> Key: RANGER-5809
> URL: https://issues.apache.org/jira/browse/RANGER-5809
> Project: Ranger
> Issue Type: Task
> Components: Ranger
> Reporter: Abhishek Kumar
> Assignee: Abhishek Kumar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Plugins call Ranger Admin's secure endpoints only when their UGI has Kerberos
> credentials or basic auth/JWT is configured, and use the non-secure ones
> otherwise. RANGER-5488 added `forceSecureEndpointAccess` to opt in; this
> makes it the default.
>
> - `AbstractRangerAdminClient`: `<prefix>.forceSecureEndpointAccess` defaults
> to `true`, and to `false` when `<prefix>.forceNonKerberos=true`, so plugins
> set up for a non-Kerberized Ranger Admin keep the non-secure endpoints.
> - Tests: Kerberos-path tests set the flag to `false` explicitly; new tests
> cover the default and the `forceNonKerberos` opt-out for both admin clients.
>
> {*}Behaviour change{*}: plugins without Kerberos, basic auth or JWT need
> credentials, or `<prefix>.forceSecureEndpointAccess=false`, to download
> policies, tags, roles, user store and GDS info; the Knox plugin supports
> Kerberos only. Kerberized plugins in docker setup are unaffected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
