Hi Madhan, Thanks for the RC1 validation feedback. Here is a quick summary of root cause and fixes for RC2:
1. Solr audit UI — ClassCastException Long-standing DB audit bug (not Solr-specific): multi-value filters ( requestUser, zoneName) did not match XAccessAuditService field types. Likely exposed in RC1 when docker Postgres default was changed from Solr to OpenSearch, causing the DB audit path to be used. ranger-admin-install-postgres.properties to Solr as the docker default (restore docker default to Solr. OpenSearch commented out) The ClassCastException on multi-value requestUser occurred because installs fell through to the deprecated DB audit path when ranger.audit.source.type was unset or misconfigured: 1. RangerBizUtil defaulted to AUDIT_STORE_RDBMS when the property was missing 2. Docker Postgres install.properties had audit_store=opensearch active while Solr URLs were commented out Fix: This PR: https://github.com/apache/ranger/pull/1115 fixes configuration defaults so fresh installs and docker stacks use Solr (or explicitly configured OpenSearch), not the legacy DB path. 2. Ozone version in .env Oversight since Jul 10 Ozone backport — pom.xml was 2.1.1 but docker .env stayed at 1.4.0 (present in RC0). Fix: Updated.env to 2.1.1. 3. audit-server README Introduced in RC1 (RANGER-5687) — docs backported from master; audit-server is not in 2.9.0. Fix: Removed those references. 4.Roles download request from KMS fails with HTTP status 400, as seen in following Ranger admin server log: 2026-07-27 21:50:33,841 [http-nio-6080-exec-10] INFO [RESTErrorUtil.java:64] Request failed. loginId=rangerkms, logMessage=Logged in user is not allowed to read service, name: dev_kms javax.ws.rs.WebApplicationException: null Fix: KMS plugin users (e.g. rangerkms) were getting HTTP 400 on secure roles, tags, and userstore download. Those endpoints called getServiceByName(), which requires keyadmin to read a KMS service—before the download allowlist is checked. Policy download already uses getServiceByNameForDP() for KMS. This PR https://github.com/apache/ranger/pull/1114 applies the same pattern to: Endpoint Allowlist config RoleREST.getSecureRangerRolesIfUpdated() policy.download.auth.users TagREST.getSecureServiceTagsIfUpdated() tag.download.auth.users XUserREST.getSecureRangerUserStoreIfUpdated() userstore.download.auth.users Thanks Ram On Tue, Jul 28, 2026 at 3:44 AM Madhan Neethiraj <[email protected]> wrote: > Ram, > > Thank you for 2.9.0 release candidate 1. Following issues found while > validating the release need to be addressed. Please review. > > Thanks, > Madhan > > 1. Ranger access audit UI fails to retrieve audit logs from Solr. Ranger > admin server's catalina.out has following error: > SEVERE: Servlet.service() for servlet [REST Service] in context with path > [] threw exception > java.lang.ClassCastException: java.util.ArrayList cannot be cast to > java.lang.String > at > org.apache.ranger.common.SearchUtil.buildWhereClause(SearchUtil.java:513) > at > org.apache.ranger.common.SearchUtil.buildWhereClause(SearchUtil.java:385) > at > org.apache.ranger.common.SearchUtil.createSearchQuery(SearchUtil.java:688) > at > org.apache.ranger.service.AbstractBaseResourceService.createQuery(AbstractBaseResourceService.java:526) > at > org.apache.ranger.service.AbstractBaseResourceService.getCountForSearchQuery(AbstractBaseResourceService.java:542) > at > org.apache.ranger.service.AbstractBaseResourceService.searchResources(AbstractBaseResourceService.java:571) > at > org.apache.ranger.service.XAccessAuditService.searchXAccessAudits(XAccessAuditService.java:174) > at org.apache.ranger.biz > .AssetMgr.getAccessLogs(AssetMgr.java:1180) > at > org.apache.ranger.rest.AssetREST.getAccessLogs(AssetREST.java:668) > > 2. Ozone version in dev-support/ranger-docker/.env should be updated from > 1.4.0 to 2.1.1, to be in sync with the version in pom.xml. > > 3. audit-server is not available in 2.9.0 release. Its references in > dev-support/ranger-docker/README.md must be removed. > > 4. Roles download request from KMS fails with HTTP status 400, as seen in > following Ranger admin server log: > 2026-07-27 21:50:33,841 [http-nio-6080-exec-10] INFO > [RESTErrorUtil.java:64] Request failed. loginId=rangerkms, > logMessage=Logged in user is not allowed to read service, name: dev_kms > javax.ws.rs.WebApplicationException: null > at > org.apache.ranger.common.RESTErrorUtil.createRESTException(RESTErrorUtil.java:57) > at > org.apache.ranger.common.RESTErrorUtil.createRESTException(RESTErrorUtil.java:329) > at org.apache.ranger.biz > .ServiceDBStore.getServiceByName(ServiceDBStore.java:2000) > at > org.apache.ranger.rest.RoleREST.getSecureRangerRolesIfUpdated(RoleREST.java:1091) > > > On 7/27/26, 7:24 AM, "Nixon Rodrigues" <[email protected] <mailto: > [email protected]>> wrote: > > > +1 (non-binding) > > > Thanks Ram K for preparing the RC for Apache Ranger. > > > I verified the Apache Ranger 2.9.0-rc1 source release: > > > - Release tag *release-2.9.0-rc1 *present in the Apache Ranger git repo. > - Downloaded apache-ranger-2.9.0.tar.gz and checksum/signature files from > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/ < > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/> > - SHA256 and SHA512 checksums match the published hash values > - PGP signature is good, signed by Ramachandran Krishnan (Apache Ranger > Release > Manager), key 892BEE12C818D203249C8C73D49DAD7F7A2F45BC (present in KEYS) > - Source tarball contains no pre-built jar/war/class artifacts. > - pom.xml version is 2.9.0 > - Built successfully from source on Darwin arm64 with OpenJDK 1.8.0_492 and > Maven 3.9.16 > - Ranger was up and running in docker with Atlas plugin ON in Atlas service > and atlas authorization audits collected in Ranger Audits(Solr). > > > > > Thanks and Regards > Nixon > > > On Wed, Jul 22, 2026 at 1:31 PM Ramachandran Krishnan <[email protected] > <mailto:[email protected]>> > wrote: > > > > Hi Rangers, > > > > Apache Ranger 2.9.0 release candidate #1 is now available for a vote > within > > the dev community. Links to all the release artifacts are given below. > > Please take some time to review and vote. > > > > The vote will be open for at least 72 hours or until necessary votes are > > reached. > > [ ] +1 approve > > [ ] +0 no opinion > > [ ] -1 disapprove (and reason why) > > > > Changes since RC0 (release-2.9.0-rc0): > > > > This RC1 build includes the following fixes on top of RC0: > > > > - RANGER-5513 — Enhance Ranger lookup API input validation (#1070) > > - RANGER-5689 — Standardize TLS hostname verification across Ranger HTTP > > clients (#1078) > > - RANGER-5694 — Refactor policy condition rendering component (#1083) > > - RANGER-5693 — Stop logging full JWT bearer token on validation failure > > (#1089) > > - RANGER-5690 — UnixAuth service rate limiting (#1098) > > - RANGER-5687 — Add feature flag for Ozone action-matcher work > > (RANGER-5628) (#1094) > > > > Link of all Issues/Improvements addressed in this release: > > > > > > > https://issues.apache.org/jira/issues/?jql=project%20%3D%20RANGER%20AND%20fixVersion%20%3D%202.9.0%20ORDER%20BY%20summary%20ASC%2C%20priority%20DESC%2C%20updated%20DESC > < > https://issues.apache.org/jira/issues/?jql=project%20%3D%20RANGER%20AND%20fixVersion%20%3D%202.9.0%20ORDER%20BY%20summary%20ASC%2C%20priority%20DESC%2C%20updated%20DESC > > > > > > Git tag for the release: > > > > https://github.com/apache/ranger/releases/tag/release-2.9.0-rc1 < > https://github.com/apache/ranger/releases/tag/release-2.9.0-rc1> > > https://github.com/apache/ranger/tree/release-2.9.0-rc1 < > https://github.com/apache/ranger/tree/release-2.9.0-rc1> > > > > Sources for the release: > > > > > > > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/apache-ranger-2.9.0.tar.gz > < > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/apache-ranger-2.9.0.tar.gz > > > > > > Source Release Verification: > > > > > > - PGP signature: > > > > > > > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/apache-ranger-2.9.0.tar.gz.asc > < > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/apache-ranger-2.9.0.tar.gz.asc > > > > - SHA512 hash: > > > > > > > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/apache-ranger-2.9.0.tar.gz.sha512 > < > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/apache-ranger-2.9.0.tar.gz.sha512 > > > > - SHA256 hash: > > > > > > > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/apache-ranger-2.9.0.tar.gz.sha256 > < > https://dist.apache.org/repos/dist/dev/ranger/2.9.0-rc1/apache-ranger-2.9.0.tar.gz.sha256 > > > > > > Checksums (apache-ranger-2.9.0.tar.gz): > > > > SHA256: 001b031995ab053639649f72ab30b6d9a6eb56fa039cfc3df583bacb078395be > > SHA512: > > > > > d221e13d790390b0c2313e46f9e0daec1fdad29f050464a24fb78653d85279a0582890838c04a792d78b45e4b59b4d74691b85f2427c50d32ef1e6fba85836ee > > > > Keys to verify the signature of the release artifacts are available at: > > > > https://dist.apache.org/repos/dist/release/ranger/KEYS < > https://dist.apache.org/repos/dist/release/ranger/KEYS> > > (Signed with key D49DAD7F7A2F45BC / [email protected] <mailto: > [email protected]>) > > > > Release Notes: > > > > > > > https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+2.9.0+-+Release+Notes > < > https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+2.9.0+-+Release+Notes > > > > > > Thanks, > > Ram > > > > > > >
