RANGER-5488: Allow clients to access secure API endpoints in Ranger admin forcibly via config (#849)

Author: kumaab

agents-common/src/main/java/org/apache/ranger/admin/client/AbstractRangerAdminClient.java

@@ -23,6 +23,7 @@
 import com.google.gson.GsonBuilder;
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.security.UserGroupInformation;
+import org.apache.ranger.audit.provider.MiscUtil;
 import org.apache.ranger.plugin.model.RangerRole;
 import org.apache.ranger.plugin.util.GrantRevokeRequest;
 import org.apache.ranger.plugin.util.GrantRevokeRoleRequest;
@@ -43,6 +44,8 @@ public abstract class AbstractRangerAdminClient implements RangerAdminClient {
 
     private boolean forceNonKerberos;
 
+    private boolean forceSecureEndpointAccess;
+
     @Override
     public void init(String serviceName, String appId, String configPropertyPrefix, Configuration config) {
         Gson gson = null;
@@ -54,7 +57,8 @@ public void init(String serviceName, String appId, String configPropertyPrefix,
         }
 
         this.gson             = gson;
-        this.forceNonKerberos = config.getBoolean(configPropertyPrefix + ".forceNonKerberos", false);
+        this.forceNonKerberos          = config.getBoolean(configPropertyPrefix + ".forceNonKerberos", false);
+        this.forceSecureEndpointAccess = config.getBoolean(configPropertyPrefix + ".forceSecureEndpointAccess", false);
     }
 
     @Override
@@ -127,12 +131,21 @@ public ServiceGdsInfo getGdsInfoIfUpdated(long lastKnownVersion, long lastActiva
         return null;
     }
 
+    public boolean isAuthenticationEnabled() {
+        return forceSecureEndpointAccess || isKerberosEnabled();
+    }
+
+    public boolean isKerberosEnabled() {
+        return isKerberosEnabled(MiscUtil.getUGILoginUser());
+    }
+
     public boolean isKerberosEnabled(UserGroupInformation user) {
         final boolean ret;
 
         if (forceNonKerberos) {
             ret = false;
         } else {
+            LOG.debug("UGI user: {}", user);
             ret = user != null && UserGroupInformation.isSecurityEnabled() && user.hasKerberosCredentials();
         }