kumaab opened a new pull request, #1279:
URL: https://github.com/apache/ranger/pull/1279
## What changes were proposed in this pull request?
- Adds `AuditHeaderPreAuthFilter`, which authenticates audit REST requests
from identity headers set by a trusted proxy (service mesh or ingress gateway).
- Registers it at `PRE_AUTH_FILTER`, so it runs before the existing JWT and
Kerberos filters; requests without an identity header fall through to those
unchanged.
- New configs in `ranger-audit-ingestor-site.xml` (disabled by default):
- `ranger.audit.ingestor.authn.header.enabled`
- `ranger.audit.ingestor.authn.header.username`: header carrying the
username; takes precedence.
- `ranger.audit.ingestor.authn.header.spiffe`: comma-separated header
name(s) carrying a SPIFFE ID; the first well-formed ID is used and the full ID
becomes the principal.
- The resolved principal is still subject to the per-service `allowed.users`
check.
- Should only be enabled when all traffic arrives through a proxy that
strips these headers from client requests.
- Fixes a log message typo in AuditREST ("is authorized" → "is not
authorized to").
- Adds mockito-core as a test dependency of audit-ingestor.
## How was this patch tested?
- Unit tests: new AuditHeaderPreAuthFilterTest (12 cases).
- Manual, on the Kerberized ranger-docker stack with header auth enabled and
DEBUG logging:
- Username header for an allowed user → 200; lower-case header name also
works.
- Username header for a user not allowed on the service → 403; blank
header → 401.
- SPIFFE ID listed in allowed.users → 200; unlisted ID → 403; malformed ID
→ 401 with a WARN.
- Two SPIFFE headers configured, first malformed → second one is used.
- Both username and SPIFFE headers present → username wins.
- No identity header → SPNEGO challenge (401); Kerberos client and the
Kafka plugin's own audit posts still authenticate.
- Accepted events were confirmed in the OpenSearch ranger_audits index;
rejected ones were absent.
- Authenticated principal for each request confirmed from the ingestor
DEBUG logs.
~~~
<details>
<summary>audit-ingestor DEBUG log excerpts</summary>
Startup:
INFO AuditHeaderPreAuthFilter Header-based authentication is enabled:
usernameHeader=X-Forwarded-User, spiffeHeaders=[X-Spiffe-Id,
x-awc-upstream-workload-id]
Username header, allowed user (200):
DEBUG AuditHeaderPreAuthFilter Authenticated request using trusted headers
for user=hdfs
DEBUG AuditREST Authenticated user: Principal: hdfs, shortName: hdfs
DEBUG AuditREST isAllowedServiceUser(serviceName=dev_hdfs, userName=hdfs):
ret=true
Username header, user not allowed for the service (403):
DEBUG AuditHeaderPreAuthFilter Authenticated request using trusted headers
for user=hive
DEBUG AuditREST isAllowedServiceUser(serviceName=dev_hdfs, userName=hive):
ret=false
ERROR AuditREST Unauthorized user: user=hive is not authorized to report
audit logs for service=dev_hdfs. Rejecting audit request.
First SPIFFE header malformed, second used (200):
WARN AuditHeaderPreAuthFilter SPIFFE header 'X-Spiffe-Id' value is not a
well-formed SPIFFE ID
DEBUG AuditHeaderPreAuthFilter Resolved SPIFFE ID
'spiffe://cluster.local/ns/hive/sa/hiveserver2' from header
'x-awc-upstream-workload-id'
DEBUG AuditHeaderPreAuthFilter Authenticated request using trusted headers
for user=spiffe://cluster.local/ns/hive/sa/hiveserver2
DEBUG AuditREST isAllowedServiceUser(serviceName=dev_hive,
userName=spiffe://cluster.local/ns/hive/sa/hiveserver2): ret=true
No identity header, falls through to Kerberos (200):
DEBUG AuditHeaderPreAuthFilter No trusted identity header found in the
request!
DEBUG AuditREST Authenticated user: Principal:
kafka/[email protected], shortName: kafka
DEBUG AuditREST isAllowedServiceUser(serviceName=dev_kafka, userName=kafka):
ret=true
</details>
~~~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
