[
https://issues.apache.org/jira/browse/RANGER-5827?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Abhishek Kumar resolved RANGER-5827.
------------------------------------
Fix Version/s: 3.0.0
Resolution: Fixed
Merged in master:
https://github.com/apache/ranger/commit/a1f647b0ad1794c0aca5f6227696c8ad35ab19fb
> Shared Kafka client authentication for Ranger services with support for both
> SASL/OAUTHBEARER and SASL/GSSAPI
> -------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5827
> URL: https://issues.apache.org/jira/browse/RANGER-5827
> Project: Ranger
> Issue Type: Improvement
> Components: audit-server
> Reporter: Abhishek Kumar
> Assignee: Abhishek Kumar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> Ranger's Kafka clients (audit-ingestor, audit-dispatchers, tagsync) each
> build their own SASL settings, support only Kerberos keytabs, and cannot
> authenticate on platforms that issue short-lived tokens such as Kubernetes
> projected service-account tokens. Kafka's bundled OAUTHBEARER handler is not
> a drop-in fix: it reads a {{[file://|file:///]}} token once and caches it, so
> after the platform rotates the token the client keeps presenting the expired
> one and fails to re-authenticate.
> Proposed changes:
> * New module ranger-kafka-client-auth:
> ** RangerKafkaClientSecurityConfig builds security.protocol / sasl.* client
> properties from .kafka.* for producers, consumers and admin clients. GSSAPI
> remains the default mechanism; OAUTHBEARER is selected with
> kafka.sasl.mechanism. JAAS is built from
> {{{}kafka.sasl.jaas.loginModuleName{}}},
> {{kafka.sasl.jaas.loginModuleControlFlag}} and any
> {{{}kafka.sasl.jaas.option.<name>{}}}, so Krb5LoginModule options such as
> {{useTicketCache}} are configuration, not code. {{<prefix>.kafka.sasl.*}} and
> {{<prefix>.kafka.ssl.*}} pass through and override.
> ** {{RangerKafkaOAuthBearerLoginCallbackHandler}} presents a JWT read from a
> file:// URL. It re-reads the file on every login and refresh, so the client
> always presents the current token after rotation. http(s):// endpoints use
> Kafka’s own client-credentials handler.
> ** RangerOAuthBearerToken, a reusable OAuthBearerToken built from parsed
> claims.
> * audit-ingestor, all audit-dispatcher backends and the audit topic
> bootstrap call the helper instead of building a Kerberos-only JAAS string
> each. audit-ingestor also loads the site XML given by {{-Daudit.config}}
> after the packaged default.
> * tagsync: new {{TAG_SOURCE_ATLAS_KAFKA_SASL_MECHANISM}} and
> {{TAG_SOURCE_ATLAS_KAFKA_OAUTH_TOKEN_URL}} install properties rendered into
> {{{}atlas-application.properties{}}}; module added to the tagsync
> distribution.
> * ranger-docker: the Kafka broker accepts GSSAPI and OAUTHBEARER; the
> {{ranger-kafka}} container mints and rotates dev tokens into a shared volume;
> {{KAFKA_SASL_MECHANISM}} in {{.env}} selects OAUTHBEARER (default) or GSSAPI
> for the ingestor, dispatchers and tagsync. The ingestor renders its site XML
> from YAML plus environment, as the admin container does.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
