RANGER-5712: Fix Trino/Ozone plugin auth in ranger-docker - #1116
Open
ramackri wants to merge 12 commits into
Open
RANGER-5712: Fix Trino/Ozone plugin auth in ranger-docker#1116ramackri wants to merge 12 commits into
ramackri wants to merge 12 commits into
Conversation
Configure policy.rest.client username/password so the Trino plugin uses secure download endpoints instead of relying on unauthenticated Admin access.
ramackri
changed the title
Wire OM/SCM/DN keytabs, ozone-site kerberos settings, and plugin JAAS so the Ozone plugin authenticates to Ranger Admin via secure download instead of unauthenticated access.
ramackri
changed the title
added 4 commits
July 30, 2026 09:39
Policy download uses OM kerberos from docker-config; Solr audit JAAS settings are not needed in install.properties.
Policy download auth is driven by policy.download.auth.users and OM Kerberos from docker-config, not the service hadoop.security.authentication field.
Do not pass KERBEROS_ENABLED into Ozone containers because Ozone libexec/entrypoint.sh waits for its own mini-KDC at krb5:8081. Ranger already provisions om/scm/dn keytabs via ranger-kdc; use RANGER_KERBEROS_ENABLED for setup-script keytab wait and keep Kerberos enabled via ozone-site.xml plus mounted keytabs.
Align dev-support/ranger-docker .env with pom.xml ozone.version for Kerberos policy-download testing on Ozone 2.1.x.
Quarantine jersey-server from Ozone lib on host setup and OM startup to avoid WadlAutoDiscoverable ClassCastException when Kerberos secure download uses the Ranger plugin Jersey client.
Align plugin-ozone.xml packaging with RANGER-5642 so the plugin uses Ozone's Jersey on the app classpath and avoids WadlAutoDiscoverable ClassCastException when Kerberos secure policy download is enabled.
mneethiraj
reviewed
Jul 30, 2026
added 2 commits
July 30, 2026 23:26
Keep the Jersey/Jackson assembly fix in plugin-ozone.xml only.
Restore dev-support/ranger-docker/README.md to match master.
mneethiraj
reviewed
Jul 30, 2026
The plugin-ozone.xml packaging fix excludes duplicate Jersey/Jackson from the plugin tarball; quarantining Ozone lib jars is no longer needed.
mneethiraj
approved these changes
Jul 30, 2026
Contributor
|
Thanks @ramackri for the patch. I think at least one authz call from Ozone and Trino into Ranger should be tested and see that we observe an audit record in Audits tab in Ranger UI after these changes. |
Jersey 2.x needs javax.annotation.Priority on the same classpath as Ozone's jersey-client after excluding duplicate Jersey from the plugin tarball.
kumaab
reviewed
Jul 30, 2026
| OZONE_VERSION: ${OZONE_VERSION} | ||
| RANGER_KERBEROS_ENABLED: ${KERBEROS_ENABLED} | ||
| # Jersey 2.x on Ozone's OM classpath needs javax.annotation.Priority (jar is under share/ozone/lib but omitted from default OM CP). | ||
| OZONE_MANAGER_CLASSPATH: /opt/hadoop/ranger-ozone-plugin/lib/libext/*:/opt/hadoop/ranger-ozone-plugin/conf:/opt/hadoop/share/ozone/lib/javax.annotation-api-*.jar |
Contributor
There was a problem hiding this comment.
This env variable is already present in Dockerfile, please see if it can be removed from here.
Adding @adoroszlai for review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix Ozone and Trino plugin authentication in ranger-docker so policy/role download works when Ranger Admin unauthenticated download is disabled (RANGER-5635).
Root cause: Plugins poll Admin without a session while
ranger.admin.allow.unauthenticated.download.access=false. Ozone/Trino must authenticate (Kerberos SPNEGO →/secure/.../download/URLs) instead of using legacy unauthenticated download endpoints, which return HTTP 400 (Unauthenticated access not allowed).Ozone (Kerberos policy/role pull)
krb5.confon OM/SCM/DN viadocker-compose.ranger-ozone.ymlscripts/ozone/docker-config(envtoconf.py)RANGER_KERBEROS_ENABLED+wait_for_keytab/wait_for_scminranger-ozone-setup.sh(avoid Ozone entrypointkrb5:8081wait)om/scm/dnprincipals in KDCentrypoint.shOZONE_VERSION=2.1.1in docker.env(matchespom.xml)Trino
ranger-trino-security.xmlfor secure downloadDeploy notes (Ozone 2.1.1 docker)
dist/keytabs/om,scm,datanode/service/plugins/secure/policies/download/dev_ozoneHTTP 200 (not HTTP 400 on non-secure/download/)Verification (Ranger Admin access log)
Before (non-secure URLs, no Kerberos session):
After (Kerberos SPNEGO on secure endpoints, Ozone 2.1.1 / Java 21):
The initial 401 → 200 on roles is expected Kerberos SPNEGO behavior. Steady-state polls return 304 (not modified) with
lastKnownVersion=25/lastKnownRoleVersion=8.Test plan
/etc/keytabsmounted; nokrb5:8081waitpolicyVersion=25,roleVersion=8on Ozone 2.1.1)dev_ozonereturn 200; no recurring 400 on non-secure/download/