ramackri opened a new pull request, #1139: URL: https://github.com/apache/ranger/pull/1139
## Summary Third slice of [RANGER-5655](https://issues.apache.org/jira/browse/RANGER-5655). Splits former [#1135](https://github.com/apache/ranger/pull/1135) into focused PRs. **JIRA:** [RANGER-5723](https://issues.apache.org/jira/browse/RANGER-5723) **Depends on:** [#1137](https://github.com/apache/ranger/pull/1137) (RANGER-5719) — merge #1137 first, then rebase this branch onto `master` so the diff shows only audit-server destination changes. Wire **outbound SPIFFE** into `RangerAuditServerDestination` using `PluginHeaderAuthConfig` + `RangerRESTClient.setTrustedAuthHeaders()`. Aligns with [RANGER-5700](https://issues.apache.org/jira/browse/RANGER-5700) / [#1096](https://github.com/apache/ranger/pull/1096): auth is configured on the audit destination prefix, not per-plugin security XML. ### Audit XML properties (plugin → ingestor) Prefix: `xasecure.audit.destination.auditserver` | Property | Required? | Default | Purpose | |----------|-----------|---------|---------| | `authn.header.enabled` | **Yes** (to enable) | **`false`** | Master switch; no SPIFFE headers unless `true` | | `authn.header.spiffe` | No | `X-Spiffe-Id` | Header name for workload SPIFFE ID | | `authn.spiffe.value` | No | *(unset)* | Explicit SPIFFE ID (highest priority) | | `authn.spiffe.file` | No | `/var/run/secrets/spiffe.io/identity/spiffe` | SPIRE/agent identity file | **Resolution order:** `authn.spiffe.value` → `authn.spiffe.file` → `SPIFFE_ID` env. **Minimum enable (SPIRE/K8s):** ```xml <property> <name>xasecure.audit.destination.auditserver.authn.header.enabled</name> <value>true</value> </property> ``` Also required (unchanged): `xasecure.audit.destination.auditserver=true` and `xasecure.audit.destination.auditserver.url`. **Safety:** defaults to disabled; no install-template changes. End-to-end ingestor validation requires RANGER-5722 (`AuditHeaderAuthFilter`). ## Test plan - [x] `mvn -pl agents-audit/dest-auditserver -am test -Dtest=RangerAuditServerDestinationTest` - [ ] Rebase onto `master` after #1137 merges; CI green on audit-server module only Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
