[
https://issues.apache.org/jira/browse/RANGER-5749?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Eoin McDonnell reassigned RANGER-5749:
--------------------------------------
Assignee: Eoin McDonnell
> Add configurable concurrent session limit for Ranger Admin UI logins
> --------------------------------------------------------------------
>
> Key: RANGER-5749
> URL: https://issues.apache.org/jira/browse/RANGER-5749
> Project: Ranger
> Issue Type: Improvement
> Components: admin
> Reporter: Eoin McDonnell
> Assignee: Eoin McDonnell
> Priority: Major
>
> Ranger Admin currently allows a user to have an unlimited number of
> concurrent UI sessions. Customers who need tighter session control (for
> example, one active session per user) cannot configure this today.
> Cloudera Manager already provides this behavior via
> session_limit_concurrency: if the limit is 1, a second login from another
> browser expires the first session immediately.
> Proposal:
> 1. Add a Ranger Admin configuration (for example
> ranger.session.limit.concurrency) for the maximum number of concurrent UI
> sessions per user.
> 2. Default should preserve current behavior (unlimited / no limit).
> 3. When the limit is exceeded, expire the oldest session so the new login
> succeeds (same behavior as CM).
> 4. Apply the limit to UI logins. Plugin policy/tag/role download and similar
> service calls should not consume a user's session quota.
> 5. Add tests for the limit=1 case (second login expires the first session).
> Primary code areas:
> - security-admin/.../security-applicationContext.xml (Spring
> session-management)
> - security-admin/.../RangerAuthSuccessHandler.java
> - security-admin/.../SessionMgr.java
> - security-admin/.../RangerHttpSessionListener.java
> Related Cloudera ticket: https://cloudera.atlassian.net/browse/OPSAPS-71109
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
