RANGER-5698 : Disable Unix Authentication Service by default - #1171
RANGER-5698 : Disable Unix Authentication Service by default#1171fimugdha wants to merge 2 commits into
Conversation
| && rm -f /home/ranger/dist/ranger-${RANGER_VERSION}-admin.tar.gz \ | ||
| && rm -f /opt/ranger/admin/install.properties \ | ||
| && mkdir -p /var/run/ranger /var/log/ranger /usr/share/java/ \ | ||
| && chmod 755 ${RANGER_SCRIPTS}/setup-ranger-shadow-group.sh \ |
There was a problem hiding this comment.
Adding users/groups have moved to the base image: https://github.com/apache/ranger-tools/blob/main/docker/Dockerfile , please see this script: https://github.com/apache/ranger-tools/blob/0e27092aedb0db01be54300f2936a6244e80ec6c/docker/create_users_and_groups.sh#L1 if a user like shadow is really required to be added.
There was a problem hiding this comment.
@kumaab, Created this pull-request on ranger-tools repository : apache/ranger-tools#16. Could you please review ? It will be needed for me to test this ranger side changes.
There was a problem hiding this comment.
Can you test this once when unix auth is disabled and usersync is running in HA once.
There was a problem hiding this comment.
@pradeepagrawal8184, Sure, I will test it and keep you updated.
There was a problem hiding this comment.
@pradeepagrawal8184 , Thanks for this review. Earlier the Unix Auth used to be enabled always using the argument -enableUnixAuth, the main thread remains alive inside startService() and the finally block never runs, therefore the curator leader election kept running. With this PR fix it caused a regression on leader selection when Unix Auth is disabled.
Updated the fix and tested this fix on a HA setup cluster with both unix auth enabled & disabled.
d1ff0fa to
ca836c7
Compare
3 participants
What changes were proposed in this pull request?
The Unix Authentication service is rarely utilized for Ranger authentication, as the vast majority of deployments have migrated to modern alternatives like PAM or LDAP.
To optimize default startup behavior, we are removing the Unix Authentication service from the Ranger Usersync default startup sequence.
Moving forward, this service will run only if explicitly enabled via the
ranger.usersync.unix.auth.enabledproperty within theranger-ugsync-site.xmlconfiguration file.How was this patch tested?