vyommani opened a new pull request, #1359: URL: https://github.com/apache/ranger/pull/1359
## What changes were proposed in this pull request? RANGER-5541 and RANGER-5812 added validation of endpoint URLs in service configurations for Test Connection and resource lookup. This PR applies that validation consistently for KMS services. ServiceMgr: validateOutboundServiceConfigs() now evaluates the endpoint the client actually connects to. Nested provider URIs (kms://...) are unnested the same way the KMS client does it (ProviderUtils.unnestUri). Encoded values are normalised before validation. Every host in a multi-host (HA) provider list is validated. KmsKeyMgr: the endpoint validation now runs in getKMSURL(), before Key Manager operations (get, search, create, rollover, delete) connect to the configured provider. A validation failure is reported to the caller as an invalid-input error instead of "service not found". KmsKeyMgr / KMSClient: HTTP redirects are no longer followed by the Key Manager and Test Connection KMS clients. Behaviour notes: A KMS provider that responds with a redirect (for example http to https) must now be configured with its final scheme and host. Provider endpoints that do not pass the existing service-config endpoint validation are now also rejected for Key Manager operations, not only for Test Connection. ## How was this patch tested? New TestKmsProviderHostCheck (security-admin): endpoint validation across validateConfig, lookupResource and all Key Manager operations; HA provider lists continue to be accepted; ordinary config values are unaffected; redirects are not followed. New TestKMSClientRedirect (plugin-kms): Test Connection client does not follow redirects. Updated TestKmsKeyMgr: the test provider URL fixture now uses a documentation address (192.0.2.10) so it passes the endpoint validation. Existing TestKmsKeyMgr, TestServiceMgr, KMSClientTest pass, including the HA failover tests. mvn clean install on security-admin and plugin-kms. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
