Ramachandran Krishnan created RANGER-5712:
---------------------------------------------
Summary: Enable unauthenticated plugin download in ranger-docker
dev sandbox
Key: RANGER-5712
URL: https://issues.apache.org/jira/browse/RANGER-5712
Project: Ranger
Issue Type: Task
Components: Ranger
Affects Versions: 2.8.0
Reporter: Ramachandran Krishnan
Assignee: Ramachandran Krishnan
Fix For: 3.0.0
Trino and Ozone plugins in the ranger-docker dev sandbox fail to download
policies, roles, tags, and xusers from Ranger Admin with HTTP 400
({{{}Unauthenticated access not allowed{}}}). HDFS/Hive work because they use
Kerberos-backed secure download paths. The dev sandbox uses plain HTTP and does
not configure plugin Kerberos auth on the Admin REST client, so downloads are
rejected unless {{ranger.admin.allow.unauthenticated.download.access}} is
enabled.
Problem
After RANGER-5635 (#1048), {{failUnauthenticatedDownloadIfNotAllowed()}} is
enforced even when Hadoop security is not fully enabled. In ranger-docker:
* Admin runs with {{policymgr_http_enabled=true}} and
{{authentication_method=UNIX}}
* Trino/Ozone plugins call non-secure download URLs (no SPNEGO/Kerberos on the
plugin REST client)
* Default {{ranger.admin.allow.unauthenticated.download.access=false}} in
{{ranger-admin-default-site.xml}}
Affected endpoints:
* {{/service/plugins/policies/download/}}
* {{/service/roles/download/}}
* {{/service/tags/download/}}
* {{/service/xusers/download/}}
Symptom in Admin logs: {{Unauthenticated access not allowed}} → HTTP 400 in
access logs.
This is a dev/docker configuration gap, not a plugin or REST bug.
{{policy.download.auth.users}} on the service (e.g. trino, om) is not
sufficient when unauthenticated download is disabled globally.
----
Root cause
# RANGER-5635 tightened download auth checks (correct for production).
# ranger-docker never wires
{{ranger.admin.allow.unauthenticated.download.access}} into
{{{}ranger-admin-site.xml{}}}.
# Adding the property only to docker {{install.properties}} does not work
today — {{setup.sh}} only updates keys that already exist in
{{ranger-admin-site.xml}} (same pattern as
{{{}FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION{}}}).
----
Proposed solution
Wire a new install property through Admin setup into
{{{}ranger-admin-site.xml{}}}, and set it to {{true}} only in docker dev
install files.
Install property (suggested name):
ranger_admin_allow_unauthenticated_download_access=true # docker dev only
ranger_admin_allow_unauthenticated_download_access=false # default everywhere
else
Maps to site.xml:
{code:java}
ranger.admin.allow.unauthenticated.download.access{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
