kumaab opened a new pull request, #1206:
URL: https://github.com/apache/ranger/pull/1206
## What changes were proposed in this pull request?
When header based authn is enabled:
- Add support in Ranger Admin (via new config
`ranger.admin.authn.header.roles`) to assign roles to users based on the
configured HTTP header in config.
- Valid roles from the configured roles header are added to the
`RangerAuthenticationToken`.
- User/SPIFFE principals with valid headers will now be auto-provisioned on
first Ranger Admin API access.
- This enables service identities such as Ranger Usersync to call Admin REST
APIs using SPIFFE ID plus `ROLE_SYS_ADMIN`.
## How was this patch tested?
### Applied Configs (Docker)
~~~
ranger.admin.authn.header.enabled: true
ranger.admin.authn.header.username: X-Forwarded-User
ranger.admin.authn.header.spiffe: X-Spiffe-Id
ranger.admin.authn.header.roles: X-Forwarded-Roles
ranger.admin.spiffe.as.username.enabled: true
~~~
- Simulated Ranger Usersync calls to Ranger Admin using SPIFFE header authn
and role as `RANGER_ROLE_SYS_ADMIN`:
~~~
SPIFFE='spiffe://cluster.local/ns/ranger/sa/ranger-usersync'
GROUP='ugsync_curl_group_1788327006'
USER1='ugsync_curl_user1_1788327033'
USER2='ugsync_curl_user2_1788327033'
curl -sS -w '\nHTTP=%{http_code}\n' \
-X POST 'http://localhost:6080/service/xusers/ugsync/groups' \
-H "X-Spiffe-Id: $SPIFFE" \
-H 'X-Forwarded-Roles: RANGER_ROLE_SYS_ADMIN' \
-H 'Content-Type: application/json' \
--data-binary "{\"vXGroups\":[{\"name\":\"$GROUP\",\"description\":\"curl
SPIFFE usersync
group\",\"groupSource\":1,\"isVisible\":1,\"syncSource\":\"curl-spiffe\"}]}"
1
HTTP=200
curl -sS -w '\nHTTP=%{http_code}\n' \
-X POST 'http://localhost:6080/service/xusers/ugsync/users' \
-H "X-Spiffe-Id: $SPIFFE" \
-H 'X-Forwarded-Roles: RANGER_ROLE_SYS_ADMIN' \
-H 'Content-Type: application/json' \
--data-binary
"{\"vXUsers\":[{\"name\":\"$USER1\",\"firstName\":\"Curl\",\"lastName\":\"UserOne\",\"userSource\":1,\"isVisible\":1,\"syncSource\":\"curl-spiffe\",\"userRoleList\":[\"ROLE_USER\"],\"groupNameList\":[\"$GROUP\"]},{\"name\":\"$USER2\",\"firstName\":\"Curl\",\"lastName\":\"UserTwo\",\"userSource\":1,\"isVisible\":1,\"syncSource\":\"curl-spiffe\",\"userRoleList\":[\"ROLE_USER\"],\"groupNameList\":[\"$GROUP\"]}]}"
2
HTTP=200
curl -sS -w '\nHTTP=%{http_code}\n' \
-X POST 'http://localhost:6080/service/xusers/ugsync/groupusers' \
-H "X-Spiffe-Id: $SPIFFE" \
-H 'X-Forwarded-Roles: RANGER_ROLE_SYS_ADMIN' \
-H 'Content-Type: application/json' \
--data-binary
"[{\"groupName\":\"$GROUP\",\"addUsers\":[\"$USER1\",\"$USER2\"],\"delUsers\":[]}]"
1
HTTP=200
~~~
- Verified the SPIFFE principal was auto-created with Ranger role
`ROLE_SYS_ADMIN` and normal users with default roles.
Users tab:
<img width="2464" height="168" alt="image"
src="https://github.com/user-attachments/assets/cac5332e-324e-4f0f-add1-f254a9735954";
/>
Groups tab:
<img width="2227" height="62" alt="Screenshot 2026-09-01 at 10 55 41 PM"
src="https://github.com/user-attachments/assets/1f0a8df3-d5d2-4a58-bf5e-b14929f30da9";
/>
<img width="839" height="264" alt="Screenshot 2026-09-01 at 10 55 23 PM"
src="https://github.com/user-attachments/assets/fbe6181d-0e57-4bf2-9a0c-3a7dca6772c3";
/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
