[
https://issues.apache.org/jira/browse/RANGER-5749?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Eoin McDonnell updated RANGER-5749:
-----------------------------------
Description:
Ranger Admin currently allows a user to have an unlimited number of concurrent
UI sessions. There is no way to cap how many active Admin UI sessions one user
can hold at the same time.
Proposal:
1. Add a Ranger Admin configuration (ranger.session.limit.concurrency) for the
maximum number of concurrent UI sessions per user.
2. Default should preserve current behavior (unlimited / no limit).
3. When the limit is exceeded, expire the oldest session so the new login
succeeds.
4. Apply the limit to UI logins. Plugin policy/tag/role download and similar
service calls should not consume a user's session quota.
5. Add tests for the limit=1 case (second login expires the first session).
was:
Ranger Admin currently allows a user to have an unlimited number of concurrent
UI sessions. Customers who need tighter session control (for example, one
active session per user) cannot configure this today.
Proposal:
1. Add a Ranger Admin configuration (for example
ranger.session.limit.concurrency) for the maximum number of concurrent UI
sessions per user.
2. Default should preserve current behavior (unlimited / no limit).
3. When the limit is exceeded, expire the oldest session so the new login
succeeds (same behavior as CM).
4. Apply the limit to UI logins. Plugin policy/tag/role download and similar
service calls should not consume a user's session quota.
5. Add tests for the limit=1 case (second login expires the first session).
Primary code areas:
- security-admin/.../security-applicationContext.xml (Spring
session-management)
- security-admin/.../RangerAuthSuccessHandler.java
- security-admin/.../SessionMgr.java
- security-admin/.../RangerHttpSessionListener.java
> Add configurable concurrent session limit for Ranger Admin UI logins
> --------------------------------------------------------------------
>
> Key: RANGER-5749
> URL: https://issues.apache.org/jira/browse/RANGER-5749
> Project: Ranger
> Issue Type: Improvement
> Components: admin
> Reporter: Eoin McDonnell
> Assignee: Eoin McDonnell
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Ranger Admin currently allows a user to have an unlimited number of
> concurrent UI sessions. There is no way to cap how many active Admin UI
> sessions one user can hold at the same time.
> Proposal:
> 1. Add a Ranger Admin configuration (ranger.session.limit.concurrency) for
> the maximum number of concurrent UI sessions per user.
> 2. Default should preserve current behavior (unlimited / no limit).
> 3. When the limit is exceeded, expire the oldest session so the new login
> succeeds.
> 4. Apply the limit to UI logins. Plugin policy/tag/role download and similar
> service calls should not consume a user's session quota.
> 5. Add tests for the limit=1 case (second login expires the first session).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
