[
https://issues.apache.org/jira/browse/RANGER-5749?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Eoin McDonnell updated RANGER-5749:
-----------------------------------
Description:
Ranger Admin currently allows a user to have an unlimited number of concurrent
UI sessions. Customers who need tighter session control (for example, one
active session per user) cannot configure this today.
Proposal:
1. Add a Ranger Admin configuration (for example
ranger.session.limit.concurrency) for the maximum number of concurrent UI
sessions per user.
2. Default should preserve current behavior (unlimited / no limit).
3. When the limit is exceeded, expire the oldest session so the new login
succeeds (same behavior as CM).
4. Apply the limit to UI logins. Plugin policy/tag/role download and similar
service calls should not consume a user's session quota.
5. Add tests for the limit=1 case (second login expires the first session).
Primary code areas:
- security-admin/.../security-applicationContext.xml (Spring
session-management)
- security-admin/.../RangerAuthSuccessHandler.java
- security-admin/.../SessionMgr.java
- security-admin/.../RangerHttpSessionListener.java
was:
Ranger Admin currently allows a user to have an unlimited number of concurrent
UI sessions. Customers who need tighter session control (for example, one
active session per user) cannot configure this today.
Cloudera Manager already provides this behavior via session_limit_concurrency:
if the limit is 1, a second login from another browser expires the first
session immediately.
Proposal:
1. Add a Ranger Admin configuration (for example
ranger.session.limit.concurrency) for the maximum number of concurrent UI
sessions per user.
2. Default should preserve current behavior (unlimited / no limit).
3. When the limit is exceeded, expire the oldest session so the new login
succeeds (same behavior as CM).
4. Apply the limit to UI logins. Plugin policy/tag/role download and similar
service calls should not consume a user's session quota.
5. Add tests for the limit=1 case (second login expires the first session).
Primary code areas:
- security-admin/.../security-applicationContext.xml (Spring session-management)
- security-admin/.../RangerAuthSuccessHandler.java
- security-admin/.../SessionMgr.java
- security-admin/.../RangerHttpSessionListener.java
Related Cloudera ticket: https://cloudera.atlassian.net/browse/OPSAPS-71109
> Add configurable concurrent session limit for Ranger Admin UI logins
> --------------------------------------------------------------------
>
> Key: RANGER-5749
> URL: https://issues.apache.org/jira/browse/RANGER-5749
> Project: Ranger
> Issue Type: Improvement
> Components: admin
> Reporter: Eoin McDonnell
> Assignee: Eoin McDonnell
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Ranger Admin currently allows a user to have an unlimited number of
> concurrent UI sessions. Customers who need tighter session control (for
> example, one active session per user) cannot configure this today.
> Proposal:
> 1. Add a Ranger Admin configuration (for example
> ranger.session.limit.concurrency) for the maximum number of concurrent UI
> sessions per user.
> 2. Default should preserve current behavior (unlimited / no limit).
> 3. When the limit is exceeded, expire the oldest session so the new login
> succeeds (same behavior as CM).
> 4. Apply the limit to UI logins. Plugin policy/tag/role download and similar
> service calls should not consume a user's session quota.
> 5. Add tests for the limit=1 case (second login expires the first session).
> Primary code areas:
> - security-admin/.../security-applicationContext.xml (Spring
> session-management)
> - security-admin/.../RangerAuthSuccessHandler.java
> - security-admin/.../SessionMgr.java
> - security-admin/.../RangerHttpSessionListener.java
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
