RANGER-5723: Plugin SPIFFE outbound auth for audit-server destination - #1139
RANGER-5723: Plugin SPIFFE outbound auth for audit-server destination#1139ramackri wants to merge 2 commits into
Conversation
d0194d2 to
aa1a2e3
Compare
Add PluginHeaderAuthConfig, SpiffeIdentityResolver, and RangerRESTClient.setTrustedAuthHeaders(); wire SPIFFE headers into RangerAuditServerDestination when audit XML authn.header.enabled=true.
…uting Add agents-common partition plan model, allocator, validator, routing helpers, and PolicyDownloadAuthUsersUtil for RANGER-5655. SPIFFE header utilities move to RANGER-5723 (apache#1139).
aa1a2e3 to
143fa62
Compare
Drop configPrefixForServiceType, resolveEnabledConfigPrefix, and RANGER_CONFIG_PREFIX; audit destination passes an explicit config prefix to buildSpiffeAuthHeaders.
| Map<String, String> headers = new LinkedHashMap<>(); | ||
|
|
||
| for (String headerName : headerNames) { | ||
| headers.put(headerName, spiffeId.trim()); |
There was a problem hiding this comment.
spiffeId is already guaranteed trimmed by every path in SpiffeIdentityResolver.resolve() (value/file/env all go through StringUtils.trimToNull). The extra .trim() is dead code
| } | ||
|
|
||
| if (StringUtils.isBlank(spiffeId)) { | ||
| LOG.warn("Plugin header auth enabled for {} but no SPIFFE ID could " |
There was a problem hiding this comment.
at 91, 97 and 103 LOG.warn misconfiguration branches (missing header name, unresolved SPIFFE ID, malformed SPIFFE ID) aren't covered by PluginHeaderAuthConfigTest.
| builder = builder.cookie(sessionId); | ||
| } | ||
|
|
||
| applyTrustedAuthHeaders(builder); |
There was a problem hiding this comment.
There's no test in the REST client test suite asserting the header actually lands on the outbound Invocation.Builder/request, current tests only validate header construction in PluginHeaderAuthConfig, not application. Worth one test verifying setTrustedAuthHeaders(...) results in the header being present on a built request
| Map<String, String> spiffeHeaders = PluginHeaderAuthConfig.buildSpiffeAuthHeaders(props, propPrefix); | ||
| if (!spiffeHeaders.isEmpty()) { | ||
| this.restClient.setTrustedAuthHeaders(spiffeHeaders); | ||
| LOG.debug("SPIFFE header authentication enabled for audit-server destination"); | ||
| } |
There was a problem hiding this comment.
Worth a README note (or at least a code comment) on whether SPIFFE header auth is meant to be combined with the existing authn.type (JWT/Basic) config, since this is wired in unconditionally alongside whatever authType was configured above. If combining is intentional (defense-in-depth), a one-line comment would save the next reader from wondering; if it's meant to be mutually exclusive, might be worth validating/warning on conflicting config.
2 participants
Summary
Plugin outbound SPIFFE authentication for RANGER-5655 audit delivery.
JIRA: RANGER-5723
Split from closed #1135. Self-contained — compiles and tests against
masterwithout #1137.Changes (7 files)
common-utils)PluginHeaderAuthConfig,SpiffeIdentityResolver, testsagents-common)RangerRESTClient.javasetTrustedAuthHeaders()— applyX-Spiffe-Idon every outbound requestRangerAuditServerDestination.java, test,pom.xmlauthn.header.enabled=trueAligned with RANGER-5700 / #1096: auth is configured on the audit destination prefix, not per-plugin security XML.
Audit XML properties (plugin → ingestor)
Prefix:
xasecure.audit.destination.auditserverauthn.header.enabledfalseauthn.header.spiffeX-Spiffe-Idauthn.spiffe.valueauthn.spiffe.file/var/run/secrets/spiffe.io/identity/spiffeResolution order:
authn.spiffe.value→authn.spiffe.file→SPIFFE_IDenv.Minimum enable:
Also required (unchanged):
xasecure.audit.destination.auditserver=trueand.url.Safety: defaults to disabled; no install-template changes. E2E ingestor validation requires RANGER-5722 (
AuditHeaderAuthFilter).Related PRs
Test plan
mvn -pl agents-audit/dest-auditserver -am test -Dtest=RangerAuditServerDestinationTestmvn -pl common-utils test -Dtest=PluginHeaderAuthConfigTestbuild-17,plugins-docker-build