Skip to content

Commit e8f8063

Browse files
kumaabkumaab
authored
RANGER-5550: introduce authz-remote library to support minimal java client integration for plugins (#928)
1 parent deeb432 commit e8f8063

26 files changed

Lines changed: 2100 additions & 6 deletions

File tree

‎.github/workflows/docs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ name: docs
1818

1919
on:
2020
push:
21-
branches: [ ranger_5353, master ]
21+
branches: [ dev, master ]
2222

2323
permissions:
2424
contents: write

‎authz-remote/README.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
<!--
2+
Licensed to the Apache Software Foundation (ASF) under one
3+
or more contributor license agreements. See the NOTICE file
4+
distributed with this work for additional information
5+
regarding copyright ownership. The ASF licenses this file
6+
to You under the Apache License, Version 2.0 (the
7+
"License"); you may not use this file except in compliance
8+
with the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing,
13+
software distributed under the License is distributed on an
14+
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
KIND, either express or implied. See the License for the
16+
specific language governing permissions and limitations
17+
under the License.
18+
-->
19+
20+
# Ranger Authz Remote Client
21+
22+
The `authz-remote` module implements the `ranger-authz-api` authorizer interface and forwards authorization checks to Ranger PDP Service over HTTP(S).
23+
24+
## Configs
25+
26+
### PDP endpoint
27+
28+
Configure the PDP base URL with **`ranger.authz.remote.pdp.url`**.
29+
Other timeouts, TLS, and optional HTTP headers are documented under the same prefix in **`authz-remote/src/conf/ranger-authz-remote.properties`** and **`RangerRemoteAuthzConfig`**.
30+
31+
### Authentication modes
32+
33+
Client authentication is controlled by **`ranger.authz.remote.authn.type`**. Three modes are supported:
34+
35+
- **`header`** (default) — Header-based authentication. Set **`ranger.authz.remote.header.<header_name>=<header_value>`**
36+
- example: Set `ranger.authz.remote.header.X-Forwarded-User=test-user`, this header will be passed in all authz calls to PDP Server.
37+
38+
- **`jwt`**
39+
- Set **`ranger.authz.remote.authn.jwt.source`** to **`env`** or **`file`**.
40+
- For **`env`**, set **`ranger.authz.remote.authn.jwt.env`** as the name of the environment variable containing JWT.
41+
- For **`file`**, set **`ranger.authz.remote.authn.jwt.file`** to the token file path.
42+
43+
- **`kerberos`** — SPNEGO from a keytab. Set **`ranger.authz.remote.authn.kerberos.principal`** and **`ranger.authz.remote.authn.kerberos.keytab`**. Optionally set **`ranger.authz.remote.authn.kerberos.debug`** to `true` for JDK Kerberos diagnostics.
44+
45+
## Examples
46+
47+
For an end-to-end example (load configuration from a properties file, pass request as JSON, and call the authorizer), see:
48+
49+
`ranger-examples/sample-client/src/main/java/org/apache/ranger/examples/pdpclient/RemoteAuthzClient.java`
50+
**OR** run these commands after unzipping sample-client tarball: `ranger-<version>-sample-client.tar.gz`:
51+
52+
```bash
53+
# request.json contains the authz request body, and ranger-authz-remote.properties contains the client configs
54+
55+
# header based authn example
56+
java -cp "lib/*" org.apache.ranger.examples.pdpclient.RemoteAuthzClient request.json ranger-authz-remote-authn-header.properties
57+
58+
# jwt based authn with env variable example
59+
java -cp "lib/*" org.apache.ranger.examples.pdpclient.RemoteAuthzClient request.json
60+
61+
# kerberos based authn example
62+
java -cp "lib/*" org.apache.ranger.examples.pdpclient.RemoteAuthzClient request.json ranger-authz-remote-authn-kerberos.properties
63+
```
64+
65+
Add the dependency (for **applications** that use Ranger for authorization) to your project:
66+
67+
```xml
68+
<dependency>
69+
<groupId>org.apache.ranger</groupId>
70+
<artifactId>authz-remote</artifactId>
71+
<version>${ranger.version}</version>
72+
</dependency>
73+
```

‎authz-remote/pom.xml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
19+
<modelVersion>4.0.0</modelVersion>
20+
21+
<parent>
22+
<groupId>org.apache.ranger</groupId>
23+
<artifactId>ranger</artifactId>
24+
<version>3.0.0-SNAPSHOT</version>
25+
<relativePath>..</relativePath>
26+
</parent>
27+
28+
<artifactId>authz-remote</artifactId>
29+
<packaging>jar</packaging>
30+
31+
<name>Ranger Authorization Remote Client</name>
32+
<description>Ranger Authorization - Remote PDP client</description>
33+
34+
<properties>
35+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
36+
</properties>
37+
38+
<dependencies>
39+
<dependency>
40+
<groupId>com.fasterxml.jackson.core</groupId>
41+
<artifactId>jackson-databind</artifactId>
42+
<version>${fasterxml.jackson.version}</version>
43+
</dependency>
44+
45+
<dependency>
46+
<groupId>org.apache.httpcomponents</groupId>
47+
<artifactId>httpclient</artifactId>
48+
<version>${httpcomponents.httpclient.version}</version>
49+
</dependency>
50+
51+
<dependency>
52+
<groupId>org.apache.ranger</groupId>
53+
<artifactId>ranger-authz-api</artifactId>
54+
<version>${project.version}</version>
55+
</dependency>
56+
57+
<dependency>
58+
<groupId>org.junit.jupiter</groupId>
59+
<artifactId>junit-jupiter-api</artifactId>
60+
<version>${junit.jupiter.version}</version>
61+
<scope>test</scope>
62+
</dependency>
63+
64+
<dependency>
65+
<groupId>org.junit.jupiter</groupId>
66+
<artifactId>junit-jupiter-engine</artifactId>
67+
<version>${junit.jupiter.version}</version>
68+
<scope>test</scope>
69+
</dependency>
70+
</dependencies>
71+
</project>

‎authz-remote/src/conf/ranger-authz-remote.properties‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
ranger.authorizer.impl.class=org.apache.ranger.authz.remote.RangerRemoteAuthorizer
17+
ranger.authz.remote.pdp.url=http://localhost:6500
18+
ranger.authz.remote.pdp.connect.timeout.ms=5000
19+
ranger.authz.remote.pdp.read.timeout.ms=30000
20+
21+
# ranger.authz.remote.authn.type=header|jwt|kerberos
22+
ranger.authz.remote.authn.type=jwt
23+
24+
# required if ranger.authz.remote.authn.type=header
25+
ranger.authz.remote.authn.header.X-Forwarded-User=test-user
26+
27+
# required if ranger.authz.remote.authn.type=kerberos
28+
ranger.authz.remote.authn.kerberos.principal=
29+
ranger.authz.remote.authn.kerberos.keytab=
30+
# ranger.authz.remote.authn.kerberos.debug=true
31+
#
32+
# Optional Kerberos / JAAS
33+
# ranger.authz.remote.authn.kerberos.jaas.context.name=RangerRemoteClientKerberos
34+
# ranger.authz.remote.authn.kerberos.jaas.login.module=com.sun.security.auth.module.Krb5LoginModule
35+
# ranger.authz.remote.authn.kerberos.jaas.store.key=true
36+
# ranger.authz.remote.authn.kerberos.jaas.is.initiator=true
37+
# ranger.authz.remote.authn.kerberos.jaas.do.not.prompt=true
38+
# ranger.authz.remote.authn.kerberos.jaas.use.ticket.cache=false
39+
# ranger.authz.remote.authn.kerberos.jaas.refresh.krb5.config=true
40+
# ranger.authz.remote.authn.kerberos.spnego.strip.port=true
41+
# ranger.authz.remote.authn.kerberos.spnego.use.canonical.hostname=true
42+
43+
# required if ranger.authz.remote.authn.type=jwt
44+
# ranger.authz.remote.authn.jwt.source=env|file
45+
ranger.authz.remote.authn.jwt.source=env
46+
ranger.authz.remote.authn.jwt.env=RANGER_PDP_JWT
47+
# ranger.authz.remote.authn.jwt.source=file
48+
# ranger.authz.remote.authn.jwt.file=/path/to/jwt-token.txt

0 commit comments

Comments
 (0)