[
https://issues.apache.org/jira/browse/RANGER-5677?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Vyom Mani Tiwari reassigned RANGER-5677:
----------------------------------------
Assignee: Vyom Mani Tiwari
> Plugin REST endpoints silently ignore supplied credentials due to
> security="none" filter bypass; authentication outcome depends on a trailing
> slash
> ---------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5677
> URL: https://issues.apache.org/jira/browse/RANGER-5677
> Project: Ranger
> Issue Type: Bug
> Components: admin
> Affects Versions: 3.0.0
> Reporter: Alex Cruise
> Assignee: Vyom Mani Tiwari
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Symptom
> A GET to a plugin download endpoint with valid Basic auth credentials is
> rejected with HTTP 400 {{{}Unauthenticated access not allowed{}}}, while the
> identical request with a trailing slash on the path succeeds:
> {code:java}
> $ curl -s -o /dev/null -w "%{http_code}\n" -u admin:rangerR0cks! \
>
> "http://localhost:6080/service/plugins/policies/download/dev_hive?lastKnownVersion=-1&pluginId=test@cluster-hive";
> 400
> $ curl -s -o /dev/null -w "%{http_code}\n" -u admin:rangerR0cks! \
>
> "http://localhost:6080/service/plugins/policies/download/dev_hive/?lastKnownVersion=-1&pluginId=test@cluster-hive";
> 200
> {code}
> The 400 body is
> {code:json}
> {"statusCode":400,"msgDesc":"Unauthenticated access not allowed"}
> {code}
> Reproduced on current master (3.0.0-SNAPSHOT, dev-support docker environment,
> default configuration). The same asymmetry exists on these endpoints:
> ||endpoint||no trailing slash||trailing slash||
> |/service/plugins/policies/download/\{name}|400|200|
> |/service/roles/download/\{name}|400|200|
> |/service/tags/download/\{name}|400|200|
> |/service/xusers/download/\{name}|400|200|
> |/service/plugins/secure/policies/download/\{name}|200|200|
> The {{/secure/}} variants are unaffected because they are not in the bypass
> list described below.
> h2. Root cause
> {{security-applicationContext.xml}} excludes the plugin endpoints from Spring
> Security entirely:
> {code:xml}
> <security:http pattern="/service/gds/download/*" security="none"/>
> <security:http pattern="/service/plugins/policies/download/*"
> security="none"/>
> <security:http pattern="/service/plugins/services/grant/*" security="none"/>
> <security:http pattern="/service/plugins/services/revoke/*"
> security="none"/>
> <security:http pattern="/service/tags/download/*" security="none"/>
> <security:http pattern="/service/roles/download/*" security="none"/>
> <security:http pattern="/service/xusers/download/*" security="none"/>
> {code}
> With {{security="none"}} the entire filter chain is skipped, so an
> Authorization header on a matching request is never processed; the request
> always reaches the REST layer with no user session.
> {{RangerBizUtil.failUnauthenticatedDownloadIfNotAllowed()}} then rejects it
> whenever {{ranger.admin.allow.unauthenticated.download.access}} is {{false}}
> (the default, inherited from {{ranger.admin.allow.unauthenticated.access}}
> which also defaults to {{{}false{}}}).
> The trailing slash changes the outcome only because the Ant pattern
> {{/service/plugins/policies/download/*}} does not match
> {{/service/plugins/policies/download/dev_hive/}}. The slashed form falls
> through to the main authenticated filter chain, where Basic auth is
> processed, a session is established, and the request succeeds.
> So the observable behavior matrix on a default-configured admin is:
> ||request||credentials sent||result||
> |no slash|yes|400, credentials silently ignored (filter bypass), treated as
> anonymous|
> |no slash|no|400, anonymous, unauthenticated download disallowed|
> |trailing slash|yes|200, misses the bypass pattern, auth is processed|
> |trailing slash|no|401, misses the bypass pattern, challenged by the
> authenticated chain|
> h2. Why this is a problem
> * Sending valid credentials to the canonical plugin URL yields a rejection,
> while an undocumented trailing-slash variant of the same URL succeeds. This
> is surprising, hard to diagnose (the 400 suggests a request problem, not an
> auth-routing problem), and effectively undocumented behavior.
> * Any client that authenticates to the non-Kerberos download endpoints with
> Basic auth cannot download policies/tags/roles/userstore at all against an
> admin where unauthenticated download access is disabled — even though it is
> presenting exactly the credentials that would satisfy the check.
> * Whether an endpoint enforces or bypasses security should not depend on
> trailing-slash matching subtleties of the Ant matcher. Note the fix direction
> matters: making the security="none" patterns slash-insensitive would widen
> the anonymous bypass and break the credentialed case in both URL forms;
> making them never match would break credential-less plugins. Neither
> normalization is correct.
> h2. Proposed fix
> Stop using {{security="none"}} for these service endpoints. Instead, route
> them through a filter chain that processes authentication when credentials
> are present (http-basic / kerberos filters) but permits anonymous access at
> the web tier (e.g. {{permitAll}} instead of {{isAuthenticated()}}), leaving
> the existing application-level checks (
> {{failUnauthenticatedDownloadIfNotAllowed()}} /
> {{failUnauthenticatedIfNotAllowed()}} ) as the enforcement point, exactly as
> they behave for anonymous callers today.
> This preserves behavior for credential-less plugins (anonymous still reaches
> the REST layer and is governed by
> {{ranger.admin.allow.unauthenticated.download.access}} ), makes credentialed
> requests work as expected, and removes the trailing-slash sensitivity
> entirely.
> h2. Environment
> Reproduced against apache/ranger master (3.0.0-SNAPSHOT) using the
> dev-support docker setup, default configuration, default admin credentials.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
