Vyom Mani Tiwari created RANGER-5683:
----------------------------------------
Summary: Add Microsoft EntraID (Azure AD) as a UserSync source via
the Microsoft Graph API
Key: RANGER-5683
URL: https://issues.apache.org/jira/browse/RANGER-5683
Project: Ranger
Issue Type: New Feature
Components: Ranger
Affects Versions: 2.8.0
Reporter: Vyom Mani Tiwari
Assignee: Vyom Mani Tiwari
Fix For: 3.0.0
Ranger UserSync currently supports LDAP/AD, Unix, and file-based sources.
Organizations that use Microsoft EntraID (Azure AD) as their identity provider
and do not expose LDAP/AD — for example, cloud-native or private-cloud
deployments where direct LDAP/AD access is restricted or prohibited — have no
first-class way to synchronize users and groups into Ranger. Today this
requires custom scripting or intermediary directory infrastructure.
This enhancement adds EntraID as a native UserSync source that pulls users,
groups, and group memberships directly from the Microsoft Graph API, plugging
into the existing {{UserGroupSource}} SPI via
{{{}ranger.usersync.source.impl.class{}}}.
*Proposed Solution*
A new EntraID UserSync source ({{{}EntraIdUserGroupSource{}}}) backed by a
Microsoft Graph client ({{{}EntraIdGraphClientImpl{}}}) that:
* Authenticates to Microsoft Entra using the OAuth2 client-credentials flow,
supporting both client-secret and certificate credentials.
* Synchronizes users, groups, and memberships via Graph {{/delta}} queries,
using delta tokens for incremental cycles so only changes are pulled after the
initial full sync.
* Handles Graph paging ({{{}@odata.nextLink{}}}), delta-token expiry/resync,
and throttling (HTTP 429/503 with Retry-After backoff).
* Supports both DIRECT and TRANSITIVE group-membership modes, with a
first-sync inline-membership optimization on the DIRECT path to avoid a
per-group members call.
* Integrates with the existing sink to add/update principals and to remove
principals no longer present in the source, keyed by the stable EntraID object
GUID.
Configuration is supplied through Ranger's existing UserGroupSync configuration
under a {{ranger.usersync.entraid.*}} namespace, loaded into a typed,
validated, immutable config object.
*Scope*
In scope: user/group/membership sync (full and incremental), client-secret and
certificate auth, DIRECT and TRANSITIVE membership, deletion handling,
paging/throttling/delta-expiry resilience.
Out of scope / follow-ups: server-side attribute-based group filtering (Graph
{{/delta}} does not support attribute {{{}$filter{}}}; client-side
post-filtering is a follow-up), and any nested-group flattening beyond what
TRANSITIVE membership provides.
*Compatibility*
Additive — introduces a new optional source selected via
{{{}ranger.usersync.source.impl.class{}}}. Existing LDAP/Unix/file sources are
unaffected. No new third-party runtime dependencies are introduced beyond what
UserSync already ships.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
