Eoin McDonnell created RANGER-5749:
--------------------------------------
Summary: Add configurable concurrent session limit for Ranger
Admin UI logins
Key: RANGER-5749
URL: https://issues.apache.org/jira/browse/RANGER-5749
Project: Ranger
Issue Type: Improvement
Components: admin
Reporter: Eoin McDonnell
Ranger Admin currently allows a user to have an unlimited number of concurrent
UI sessions. Customers who need tighter session control (for example, one
active session per user) cannot configure this today.
Cloudera Manager already provides this behavior via session_limit_concurrency:
if the limit is 1, a second login from another browser expires the first
session immediately.
Proposal:
1. Add a Ranger Admin configuration (for example
ranger.session.limit.concurrency) for the maximum number of concurrent UI
sessions per user.
2. Default should preserve current behavior (unlimited / no limit).
3. When the limit is exceeded, expire the oldest session so the new login
succeeds (same behavior as CM).
4. Apply the limit to UI logins. Plugin policy/tag/role download and similar
service calls should not consume a user's session quota.
5. Add tests for the limit=1 case (second login expires the first session).
Primary code areas:
- security-admin/.../security-applicationContext.xml (Spring session-management)
- security-admin/.../RangerAuthSuccessHandler.java
- security-admin/.../SessionMgr.java
- security-admin/.../RangerHttpSessionListener.java
Related Cloudera ticket: https://cloudera.atlassian.net/browse/OPSAPS-71109
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
