vaijosh opened a new pull request, #3273:
URL: https://github.com/apache/hugegraph/pull/3273
## Purpose of the PR
- close #3272
- Introduce Apache Ranger-based authorization for HugeGraph to support
centralized policy management and auditability, while continuing to use
HugeGraph’s existing user/token identity model.
## Main Changes
- Added a new module: `hugegraph-server/hugegraph-ranger-plugin`
- `RangerHugeGraphAuthenticator`: plugs Ranger into HugeGraph auth flow
via `auth.authenticator`.
- `RangerAuthManager`: delegates identity CRUD/login to existing HugeGraph
auth manager, then merges Ranger grants into `RolePermission`.
- `RangerHugeGraphPlugin`: wraps `RangerBasePlugin`, maps HugeGraph
resource/permission model to Ranger access requests, and enables audit result
processing.
- `RangerHugeGraphService`: Ranger Admin-side service for **Test
Connection** and policy editor resource autocomplete (`graphspace -> graph ->
resource-type -> label`).
- `RangerOptions`: adds keys for `auth.ranger.service_name` and
`auth.ranger.config`.
- Added service/config resources:
- `ranger-servicedef-hugegraph.json`
- `ranger-hugegraph-security.xml`
- Added unit tests in `RangerHugeGraphPluginTest`.
- Added end-to-end integration assets under `docker/hgRangerIntegration`
- `Dockerfile.hugegraph`: builds HugeGraph image with Ranger plugin
enabled.
- `Dockerfile.ranger`: bakes thin HugeGraph Ranger service jar into Ranger
Admin classpath.
- `docker-compose.yml`: 4-service stack (Ranger Admin + Postgres + Solr +
HugeGraph).
- Audit bootstrap/config files (`ranger-audits-conf/*`, `solr-init.sh`,
`ranger-hugegraph-security.xml`, `rest-server.properties`,
`hugegraph.properties`).
- Integration docs:
- `docker/hgRangerIntegration/README.md`
- `docker/hgRangerIntegration/ranger-integration-test-guide.md`
- Packaging/compatibility notes
- Plugin module includes shaded packaging for runtime compatibility and
dependency isolation.
- Compiled for Java 8 target compatibility with Ranger Admin runtime.
- Default HugeGraph behavior remains unchanged unless Ranger
authenticator/config is explicitly enabled.
## Verifying these changes
- [ ] Trivial rework / code cleanup without any test coverage. (No Need)
- [ ] Already covered by existing tests, such as *(please modify tests
here)*.
- [x] Need tests and can be verified as follows:
- Unit test (executed):
- `mvn -pl hugegraph-server/hugegraph-ranger-plugin -am
-Dtest=RangerHugeGraphPluginTest -DfailIfNoTests=false test -DskipITs
-DskipIntegrationTests -Drat.skip=true -Dcheckstyle.skip=true`
- Result: **PASS** (`Tests run: 4, Failures: 0, Errors: 0, Skipped: 0`)
- Integration validation guide:
- Follow `docker/hgRangerIntegration/README.md` or
`docker/hgRangerIntegration/ranger-integration-test-guide.md` for policy
enforcement, cache-refresh, dynamic policy update, and audit checks.
## DDoes this PR potentially affect the following parts?
- [x] Dependencies ([add/update
license](https://hugegraph.apache.org/docs/contribution-guidelines/contribute/#321-check-licenses)
info &
[regenerate_known_dependencies.sh](../install-dist/scripts/dependency/regenerate_known_dependencies.sh))
- [x] Modify configurations
- [ ] The public API
- [x] Other affects (Docker-based Ranger integration test stack and setup
docs)
- [ ] Nope
## Documentation Status
- [ ] `Doc - TODO`: required documentation is pending; complete it before
merging.
- [x] `Doc - Done`: documentation is included here or linked below.
- [ ] `Doc - No Need`: no user-visible documentation is affected.
Documentation files in this PR or paired hugegraph-doc PR:
- `docker/hgRangerIntegration/README.md`
-
`hugegraph-server/hugegraph-ranger-plugin/src/main/resources/ranger-servicedef-hugegraph.json`
-
`hugegraph-server/hugegraph-ranger-plugin/src/main/resources/ranger-hugegraph-security.xml`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
