ramackri opened a new pull request, #1118: URL: https://github.com/apache/ranger/pull/1118
## Summary Fixes incorrect Ranger audit field mapping for KMS invalidate-cache and reencrypt operations ([RANGER-5716](https://issues.apache.org/jira/browse/RANGER-5716)). When the Ranger KMS plugin is enabled, multi-threaded stress workloads produced Access Audit rows where **Client IP = key name** and **Resource Path was empty**, especially for invalidate cache and reencrypt/batch reencrypt calls. This change passes the HTTP client address and KMS key name to the correct `assertAccess` overload so Ranger audits record: - **Client IP** = `request.getRemoteAddr()` (via `getClientIp()` helper) - **Resource** = KMS key name for key-scoped operations ## Root cause `RangerKMSAccessRequest` maps `resource` from the key name and `clientIPAddress` from the client IP argument. Several KMS endpoints called the 4-argument `assertAccess(type, user, operation, clientIp)` overload and passed the **key name** as the 4th parameter. That left `key` null and put the key name into the client-IP field, producing swapped/wrong audit rows. Affected endpoints: - `invalidateCache` — missing `HttpServletRequest`; used 4-arg overload with key name - `reencryptEncryptedKeys` (batch) — same - `handleEncryptedKeyOp` (single reencrypt) — same ## Changes **`KMS.java`** - Add `@Context HttpServletRequest request` to `invalidateCache` and `reencryptEncryptedKeys` - Call 5-arg `assertAccess(..., key, getClientIp(request))` for invalidate, single reencrypt, and batch reencrypt - Add `getClientIp(HttpServletRequest)` helper (delegates to `getRemoteAddr()`) **`TestKMS.java`** - Update `testInvalidateCacheWithOnlyInputValues` and `testReencryptEncryptedKeys` for new method signatures ## Steps to reproduce (before fix) 1. Enable Ranger KMS plugin with audit to Solr/Admin. 2. Run multi-threaded KMS stress, e.g. `ranger-tools/src/main/python/stress/stress_kms.py` (16 threads, keys prefixed `test_`). 3. Open Access Audit for the KMS repository (as `keyadmin`). 4. Observe rows where Client IP = key name (e.g. `test_13_10`) and Resource is empty for invalidate/reencrypt operations. ## Expected behavior (after fix) - Client IP = HTTP client address (`request.getRemoteAddr()`) - Resource = KMS key name for key-scoped operations ## Test plan - [x] `mvn test -pl kms -Dtest=TestKMS` - [x] Manual E2E: Kerberos stress (invalidate + reencrypt + batch reencrypt) — new audits show Resource = key name, Client IP = Docker client IP (`172.18.0.x`) - [ ] Ranger committers: review Access Audit in Admin UI after redeploying rebuilt KMS Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
