RANGER-5703: Remove unixauthservice stack and relocate usersync launcher and PAM

THREAT_MODEL.md

@@ -68,7 +68,7 @@ limitations under the License.
 | Tag sync | `tagsync/` | Atlas/Kafka; writes to Admin | **In** |
 | Audit framework | `agents-audit/`, `audit-server/` | Solr/OpenSearch/Kafka/HDFS/DB audit sinks | **In** |
 | Ranger KMS | `kms/`, `plugin-kms/` | Key store (DB/HSM), HDFS NameNode/DataNode | **In** (model at its own trust level — handles key material) |
-| Authentication | `ranger-authn/`, `unixauthservice/`, `agents-cred/`, `credentialbuilder/` | Kerberos/SPNEGO/LDAP; credential stores | **In** |
+| Authentication | `ranger-authn/`, `security-admin/` (PAM/JAAS login), `agents-cred/`, `credentialbuilder/` | Kerberos/SPNEGO/LDAP/PAM; credential stores | **In** |
 | Examples / sample app + tools | `ranger-examples/`, `ranger-tools/` *(documented — repo layout)* | Demo / utility | **In** *(maintainer, 2026-06-12 — §14 Q4)* |
 | Build / install / migration / ugsync tooling | `distro/`, `agents-installer/`, `migration-util/`, ugsync `filesourceusersynctool`/`ldapconfigchecktool`, `dev-support/` | Build/deploy host | **Out** *(maintainer, 2026-06-12 — §14 Q4)* |
 

dev-support/ranger-docker/scripts/usersync/ranger-usersync.sh

@@ -47,7 +47,7 @@ fi
 
 cd ${RANGER_HOME}/usersync && ./start.sh
 
-RANGER_USERSYNC_PID=`ps -ef  | grep -v grep | grep -i "org.apache.ranger.authentication.UnixAuthenticationService" | awk '{print $2}'`
+RANGER_USERSYNC_PID=`ps -ef  | grep -v grep | grep -i "proc_rangerusersync" | awk '{print $2}'`
 
 # prevent the container from exiting
 if [ -z "$RANGER_USERSYNC_PID" ]

distro/pom.xml

@@ -464,18 +464,6 @@
             <version>${project.version}</version>
             <scope>provided</scope>
         </dependency>
-        <dependency>
-            <groupId>org.apache.ranger</groupId>
-            <artifactId>unixauthclient</artifactId>
-            <version>${project.version}</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.ranger</groupId>
-            <artifactId>unixauthservice</artifactId>
-            <version>${project.version}</version>
-            <scope>provided</scope>
-        </dependency>
         <dependency>
             <groupId>org.apache.ranger</groupId>
             <artifactId>unixusersync</artifactId>
@@ -589,6 +577,35 @@
                 </plugins>
             </build>
         </profile>
+        <profile>
+            <id>ranger-usersync</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <artifactId>maven-assembly-plugin</artifactId>
+                        <version>${assembly.plugin.version}</version>
+                        <configuration>
+                            <finalName>ranger-${project.version}</finalName>
+                            <outputDirectory>../target</outputDirectory>
+                        </configuration>
+                        <executions>
+                            <execution>
+                                <goals>
+                                    <goal>single</goal>
+                                </goals>
+                                <phase>package</phase>
+                                <configuration>
+                                    <skipAssembly>false</skipAssembly>
+                                    <descriptors>
+                                        <descriptor>src/main/assembly/usersync.xml</descriptor>
+                                    </descriptors>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
 
         <profile>
             <id>ranger-hdfs-plugin</id>

distro/src/main/assembly/admin-web.xml

@@ -38,7 +38,6 @@
     <moduleSet>
       <useAllReactorProjects>true</useAllReactorProjects>
       <includes>
-        <include>org.apache.ranger:unixauthclient</include>
       </includes>
       <binaries>
         <outputDirectory>ews/ranger_jaas</outputDirectory>

distro/src/main/assembly/usersync.xml

@@ -26,7 +26,6 @@
 		<moduleSet>
 			<useAllReactorProjects>true</useAllReactorProjects>
 			<includes>
-				<include>org.apache.ranger:unixauthservice</include>
 				<include>org.apache.ranger:unixusersync</include>
 			</includes>
 			<binaries>
@@ -126,20 +125,30 @@
 	</moduleSets>
 
 	<fileSets>
+		<fileSet>
+			<directory>../ugsync/target</directory>
+			<outputDirectory>dist</outputDirectory>
+			<includes>
+				<include>unixusersync-${project.version}.jar</include>
+			</includes>
+			<fileMode>644</fileMode>
+		</fileSet>
+		<fileSet>
+			<directory>../ugsync/target/lib</directory>
+			<outputDirectory>lib</outputDirectory>
+			<fileMode>644</fileMode>
+		</fileSet>
 		<fileSet>
 			<directoryMode>755</directoryMode>
 			<fileMode>644</fileMode>
 			<outputDirectory>conf.dist</outputDirectory>
-			<directory>../unixauthservice/conf.dist</directory>
-			<excludes>
-				<exclude>jaas.conf</exclude>
-			</excludes>
+			<directory>../ugsync/conf.dist</directory>
 		</fileSet>
 		<fileSet>
 			<directoryMode>755</directoryMode>
 			<fileMode>544</fileMode>
 			<outputDirectory></outputDirectory>
-			<directory>../unixauthservice/scripts</directory>
+			<directory>../ugsync/scripts</directory>
 			<excludes>
 				<exclude>*.properties</exclude>
 				<exclude>initd</exclude>
@@ -149,7 +158,7 @@
 			<directoryMode>755</directoryMode>
 			<fileMode>700</fileMode>
 			<outputDirectory></outputDirectory>
-			<directory>../unixauthservice/scripts</directory>
+			<directory>../ugsync/scripts</directory>
 			<includes>
 				<include>*.properties</include>
 			</includes>
@@ -158,34 +167,16 @@
 			<directoryMode>755</directoryMode>
 			<fileMode>644</fileMode>
 			<outputDirectory>conf.dist/cert</outputDirectory>
-			<directory>../unixauthservice/cert</directory>
-		</fileSet>
-		<fileSet>
-			<directoryMode>755</directoryMode>
-			<fileMode>750</fileMode>
-			<outputDirectory>native</outputDirectory>
-			<directory>../unixauthnative/target</directory>
-			<includes>
-				<include>credValidator.*</include>
-			</includes>
-		</fileSet>
-		<fileSet>
-			<directoryMode>755</directoryMode>
-			<fileMode>750</fileMode>
-			<outputDirectory>native</outputDirectory>
-			<directory>../unixauthpam/target</directory>
-			<includes>
-				<include>pamCredValidator.*</include>
-			</includes>
+			<directory>../ugsync/cert</directory>
 		</fileSet>
 		<fileSet>
 			<directoryMode>755</directoryMode>
+			<fileMode>444</fileMode>
 			<outputDirectory></outputDirectory>
 			<directory>${project.build.directory}</directory>
 			<includes>
 				<include>version</include>
 			</includes>
-			<fileMode>444</fileMode>
 		</fileSet>
 		<fileSet>
 			<outputDirectory></outputDirectory>
@@ -243,7 +234,7 @@
 	</fileSets>
 	<files>
 		<file>
-			<source>${project.parent.basedir}/unixauthservice/scripts/initd</source>
+			<source>${project.parent.basedir}/ugsync/scripts/initd</source>
 			<outputDirectory></outputDirectory>
 			<destName>ranger-usersync</destName>
 			<fileMode>755</fileMode>

migration-util/ambari2.0-hdp2.2-ranger0.40/bin/import_ranger_to_ambari.py

@@ -176,9 +176,6 @@ def add_advanced_ranger_configurations(add_admin_or_usersync, ranger_service_pro
 			advanced_admin_properties['policymgr_external_url'] = ranger_service_properties_from_file['xa.webapp.url.root']
 			advanced_admin_properties['policymgr_http_enabled'] = ranger_service_properties_from_file['http.enabled']
 			advanced_admin_properties['authentication_method'] = get_authentication_method()
-                        advanced_admin_properties['remoteLoginEnabled'] = ranger_service_properties_from_file.get('remoteLoginEnabled','false')
-                        advanced_admin_properties['authServiceHostName'] = ranger_service_properties_from_file.get('authServiceHostName','localhost')
-                        advanced_admin_properties['authServicePort'] = ranger_service_properties_from_file.get('authServicePort','5151')
 			advanced_admin_properties['xa_ldap_url'] = ranger_service_properties_from_file['xa_ldap_url']
 			advanced_admin_properties['xa_ldap_userDNpattern'] = ranger_service_properties_from_file['xa_ldap_userDNpattern']
 			advanced_admin_properties['xa_ldap_groupSearchBase'] = ranger_service_properties_from_file['xa_ldap_groupSearchBase']
@@ -426,12 +423,10 @@ def get_additional_properties_for_admin(ranger_admin_properties_from_file):
 	ranger_webserver_properties_path = os.path.join(ranger_conf_path, 'ranger_webserver.properties')
 	ranger_ldap_properties_path = os.path.join(ranger_conf_path, 'xa_ldap.properties')
 	ranger_system_properties_path = os.path.join(ranger_conf_path, 'xa_system.properties')
-	ranger_unixauth_properties_path = os.path.join(ranger_conf_path, 'ranger_jaas', 'unixauth.properties')
         try:
 	    ranger_admin_properties_from_file = import_properties_from_file(ranger_webserver_properties_path, ranger_admin_properties_from_file)
 	    ranger_admin_properties_from_file = import_properties_from_file(ranger_ldap_properties_path, ranger_admin_properties_from_file)
 	    ranger_admin_properties_from_file = import_properties_from_file(ranger_system_properties_path, ranger_admin_properties_from_file)
-	    ranger_admin_properties_from_file = import_properties_from_file(ranger_unixauth_properties_path, ranger_admin_properties_from_file)
         except Exception, e:
             print "Error loading property files: ", str(e)
 
@@ -500,12 +495,14 @@ def get_additional_properties_for_admin(ranger_admin_properties_from_file):
 
 def get_additional_properties_for_usersync(ranger_usersync_properties_from_file):
 	ranger_conf_path = '/etc/ranger/usersync/conf'
-	unix_auth_properties_path = os.path.join(ranger_conf_path, 'unixauthservice.properties')
-	ranger_usersync_properties_from_file = import_properties_from_file(unix_auth_properties_path, ranger_usersync_properties_from_file)
-	if (('unix'.lower()) in str(ranger_usersync_properties_from_file['usergroupSync.source.impl.class']).lower()):
+	ranger_ugsync_default_site_xml_properties = os.path.join(ranger_conf_path, 'ranger-ugsync-default.xml')
+	ranger_ugsync_site_xml_properties = os.path.join(ranger_conf_path, 'ranger-ugsync-site.xml')
+	ranger_usersync_properties_from_file = import_properties_from_xml(ranger_ugsync_default_site_xml_properties, ranger_usersync_properties_from_file)
+	ranger_usersync_properties_from_file = import_properties_from_xml(ranger_ugsync_site_xml_properties, ranger_usersync_properties_from_file)
+	if (('unix'.lower()) in str(ranger_usersync_properties_from_file.get('ranger.usersync.source.impl.class', '')).lower()):
 		print('sync_source is unix')
 		ranger_usersync_properties_from_file['SYNC_SOURCE'] = 'unix'
-	if (('ldap'.lower()) in str(ranger_usersync_properties_from_file['usergroupSync.source.impl.class']).lower()):
+	if (('ldap'.lower()) in str(ranger_usersync_properties_from_file.get('ranger.usersync.source.impl.class', '')).lower()):
 		print('sync source is ldap')
 		ranger_usersync_properties_from_file['SYNC_SOURCE'] = 'ldap'
 	return ranger_usersync_properties_from_file

migration-util/ambari2.1-hdp2.3-ranger0.50/bin/import_ranger_to_ambari.py

@@ -303,9 +303,6 @@ def add_advanced_ranger_configurations(add_admin_or_usersync, ranger_service_pro
 			advanced_ranger_admin_site_properties['ranger.jpa.audit.jdbc.user'] = ranger_service_properties_from_file.get('ranger.jpa.audit.jdbc.user','{{ranger_audit_db_user}}')
 			advanced_ranger_admin_site_properties['ranger.jpa.audit.jdbc.password'] = ranger_service_properties_from_file.get('ranger.jpa.audit.jdbc.password','_')
 			advanced_ranger_admin_site_properties['ranger.jpa.audit.jdbc.credential.alias'] = ranger_service_properties_from_file.get('ranger.jpa.audit.jdbc.credential.alias','rangeraudit')
-			advanced_ranger_admin_site_properties['ranger.unixauth.remote.login.enabled'] = ranger_service_properties_from_file.get('ranger.unixauth.remote.login.enabled','true')
-			advanced_ranger_admin_site_properties['ranger.unixauth.service.hostname'] = ranger_service_properties_from_file.get('ranger.unixauth.service.hostname','localhost')
-			advanced_ranger_admin_site_properties['ranger.unixauth.service.port'] = ranger_service_properties_from_file.get('ranger.unixauth.service.port','5151')
 			advanced_ranger_admin_site_properties['ranger.jpa.jdbc.dialect'] = ranger_service_properties_from_file.get('ranger.jpa.jdbc.dialect','{{jdbc_dialect}}')
 			advanced_ranger_admin_site_properties['ranger.jpa.audit.jdbc.dialect'] = ranger_service_properties_from_file.get('ranger.jpa.audit.jdbc.dialect','{{jdbc_dialect}')
 			advanced_ranger_admin_site_properties['ranger.audit.solr.zookeepers'] = ranger_service_properties_from_file.get('ranger.audit.solr.zookeepers','NONE')
@@ -344,13 +341,10 @@ def add_advanced_ranger_configurations(add_admin_or_usersync, ranger_service_pro
 			sys.exit(1)
 
 	elif (add_admin_or_usersync == 2):
-		advanced_user_sync_properties['ranger.usersync.port'] = ranger_service_properties_from_file['ranger.usersync.port']
-		advanced_user_sync_properties['ranger.usersync.ssl'] = ranger_service_properties_from_file['ranger.usersync.ssl']
 		advanced_user_sync_properties['ranger.usersync.keystore.file'] = ranger_service_properties_from_file['ranger.usersync.keystore.file']
 		advanced_user_sync_properties['ranger.usersync.keystore.password'] = ranger_service_properties_from_file.get('ranger.usersync.keystore.password','UnIx529p')
 		advanced_user_sync_properties['ranger.usersync.truststore.file'] = ranger_service_properties_from_file.get('ranger.usersync.truststore.file','/usr/hdp/current/ranger-usersync/conf/mytruststore.jks')
 		advanced_user_sync_properties['ranger.usersync.truststore.password'] = ranger_service_properties_from_file.get('ranger.usersync.truststore.password','changeit')
-		advanced_user_sync_properties['ranger.usersync.passwordvalidator.path'] = ranger_service_properties_from_file['ranger.usersync.passwordvalidator.path']
 		advanced_user_sync_properties['ranger.usersync.sink.impl.class'] = ranger_service_properties_from_file['ranger.usersync.sink.impl.class']
 		advanced_user_sync_properties['ranger.usersync.policymanager.baseURL'] = ranger_service_properties_from_file['ranger.usersync.policymanager.baseURL']
 		advanced_user_sync_properties['ranger.usersync.policymanager.maxrecordsperapicall'] = ranger_service_properties_from_file['ranger.usersync.policymanager.maxrecordsperapicall']

mkdocs/docs/project/release-process.md

@@ -101,7 +101,6 @@ mvn versions:set -DnewVersion=${RANGER_VERSION} -DgenerateBackupPoms=false
 # Also, manually update versions in:
 # - dev-support/ranger-docker/.env
 # - docs/pom.xml
-# - unixauthnative/pom.xml
 # - ranger-trino-plugin-shim/pom.xml
 ```
 

pom.xml

@@ -976,8 +976,6 @@
                 <module>ugsync</module>
                 <module>ugsync-util</module>
                 <module>ugsync/ldapconfigchecktool/ldapconfigcheck</module>
-                <module>unixauthclient</module>
-                <module>unixauthservice</module>
             </modules>
         </profile>
         <profile>
@@ -1327,22 +1325,6 @@
                 <module>ugsync</module>
                 <module>ugsync-util</module>
                 <module>ugsync/ldapconfigchecktool/ldapconfigcheck</module>
-                <module>unixauthclient</module>
-                <module>unixauthservice</module>
-            </modules>
-        </profile>
-        <profile>
-            <id>linux-pam</id>
-            <activation>
-                <os>
-                    <family>linux</family>
-                </os>
-                <file>
-                    <exists>/usr/include/security/pam_appl.h</exists>
-                </file>
-            </activation>
-            <modules>
-                <module>unixauthpam</module>
             </modules>
         </profile>
         <profile>
@@ -1415,8 +1397,6 @@
                 <module>ugsync</module>
                 <module>ugsync-util</module>
                 <module>ugsync/ldapconfigchecktool/ldapconfigcheck</module>
-                <module>unixauthclient</module>
-                <module>unixauthservice</module>
             </modules>
             <build>
                 <plugins>

security-admin/pom.xml

@@ -545,11 +545,6 @@
                 </exclusion>
             </exclusions>
         </dependency>
-        <dependency>
-            <groupId>org.apache.ranger</groupId>
-            <artifactId>unixauthclient</artifactId>
-            <version>${project.version}</version>
-        </dependency>
         <dependency>
             <groupId>org.apache.solr</groupId>
             <artifactId>solr-solrj</artifactId>
@@ -710,6 +705,11 @@
             <groupId>org.glassfish.jersey.media</groupId>
             <artifactId>jersey-media-multipart</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.kohsuke</groupId>
+            <artifactId>libpam4j</artifactId>
+            <version>${libpam4j.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>log4j-over-slf4j</artifactId>

security-admin/scripts/install.properties

@@ -173,23 +173,11 @@ unix_group=ranger
 #
 
 #
-# UNIX authentication service for Policy Manager
-#
-# PolicyManager can authenticate using UNIX username/password
-# The UNIX server specified here as authServiceHostName needs to be installed with ranger-unix-ugsync package.
-# Once the service is installed on authServiceHostName, the UNIX username/password from the host <authServiceHostName> can be used to login into policy manager
-#
-# ** The installation of ranger-unix-ugsync package can be installed after the policymanager installation is finished.
+# Authentication method for Policy Manager UI login.
+# UNIX uses PAM on the Ranger Admin host (local OS accounts).
 #
 #LDAP|ACTIVE_DIRECTORY|UNIX|NONE
 authentication_method=NONE
-remoteLoginEnabled=true
-authServiceHostName=localhost
-authServicePort=5151
-ranger_unixauth_keystore=keystore.jks
-ranger_unixauth_keystore_password=password
-ranger_unixauth_truststore=cacerts
-ranger_unixauth_truststore_password=changeit
 
 ####LDAP settings - Required only if have selected LDAP authentication ####
 #