Skip to content

RANGER-5698 : Disable Unix Authentication Service by default #1171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fimugdha wants to merge 2 commits into
base: master
Choose a base branch
from
Open

RANGER-5698 : Disable Unix Authentication Service by default #1171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ca836c7
RANGER-5698 : Disable Unix Authentication Service by default
fimugdha Aug 21, 2026
7ec2fea
RANGER-5698 : Stop Curator leader latch only when Unix Auth listener …
fimugdha Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ PATCH_RETRY_INTERVAL=120
STALE_PATCH_ENTRY_HOLD_TIME=10

hadoop_conf=
authentication_method=UNIX
authentication_method=PAM

#------------ Kerberos Config -----------------
spnego_principal=HTTP/ranger.rangernw@EXAMPLE.COM
Expand Down
2 changes: 1 addition & 1 deletion dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ PATCH_RETRY_INTERVAL=120
STALE_PATCH_ENTRY_HOLD_TIME=10

hadoop_conf=
authentication_method=UNIX
authentication_method=PAM

#------------ Kerberos Config -----------------
spnego_principal=HTTP/ranger.rangernw@EXAMPLE.COM
Expand Down
2 changes: 1 addition & 1 deletion dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ PATCH_RETRY_INTERVAL=120
STALE_PATCH_ENTRY_HOLD_TIME=10

hadoop_conf=
authentication_method=UNIX
authentication_method=PAM

#------------ Kerberos Config -----------------
spnego_principal=HTTP/ranger.rangernw@EXAMPLE.COM
Expand Down
2 changes: 1 addition & 1 deletion dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ PATCH_RETRY_INTERVAL=120
STALE_PATCH_ENTRY_HOLD_TIME=10

hadoop_conf=
authentication_method=UNIX
authentication_method=PAM

#------------ Kerberos Config -----------------
spnego_principal=HTTP/ranger.rangernw@EXAMPLE.COM
Expand Down
11 changes: 9 additions & 2 deletions dev-support/ranger-docker/scripts/usersync/ranger-usersync-install.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,11 @@ POLICY_MGR_URL = http://ranger.rangernw:6080
# defaults to unix
SYNC_SOURCE = unix

# Enable unix auth service, only when sync source is set to unix along with unix backend is set to passwd.
# Also, Unix authentication is enabled in Ranger Admin.
# defaults to false
ENABLE_UNIX_AUTH = false

#
# Minimum Unix User-id to start SYNC.
# This should avoid creating UNIX system-level users in the Policy Manager
Expand Down Expand Up @@ -61,10 +66,12 @@ hadoop_conf=/home/ranger/scripts
#
CRED_KEYSTORE_FILENAME=/opt/ranger/usersync/conf/rangerusersync.jceks

# SSL Authentication
AUTH_SSL_ENABLED=true
# SSL Authentication configuration to be enabled when unix authentication is enabled.
AUTH_SSL_ENABLED=false
AUTH_SSL_KEYSTORE_FILE=/opt/ranger/usersync/conf/cert/unixauthservice.jks
AUTH_SSL_KEYSTORE_PASSWORD=UnIx529p

# Usersync SSL Truststore configuration
AUTH_SSL_TRUSTSTORE_FILE=
AUTH_SSL_TRUSTSTORE_PASSWORD=

Expand Down
11 changes: 11 additions & 0 deletions security-admin/scripts/setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1514,6 +1514,17 @@ do_authentication_setup(){
updatePropertyToFilePy $propertyName "${newPropertyValue}" $ldap_file
fi
fi

if [ $authentication_method = "PAM" ] ; then
newPropertyValue='PAM'
pam_service="login"
config_file=$app_home/WEB-INF/classes/conf/ranger-admin-site.xml
if test -f $config_file; then
propertyName=ranger.authentication.method
newPropertyValue="${authentication_method}"
updatePropertyToFilePy $propertyName $newPropertyValue $config_file
fi
fi

log "[I] Finished setup based on user authentication method=$authentication_method";
}
Expand Down
5 changes: 4 additions & 1 deletion security-admin/scripts/setup_authentication.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
# limitations under the License.


USAGE="Usage: setup_authentication.sh [UNIX|LDAP|AD|NONE] <path>"
USAGE="Usage: setup_authentication.sh [UNIX|LDAP|AD|PAM|NONE] <path>"

if [ $# -ne 2 ]
then
Expand Down Expand Up @@ -92,6 +92,9 @@ elif [ $authentication_method = "ACTIVE_DIRECTORY" ]; then
/AD_SEC_SETTINGS_END/{f=0}!f' $path/META-INF/contextXML/ad_security_settings.xml $CONFIG_FILE > tmp
mv tmp $CONFIG_FILE

exit 0;
elif [ $authentication_method = "PAM" ]; then
echo $path;
exit 0;
elif [ $authentication_method = "NONE" ]; then
echo $path;
Expand Down
2 changes: 1 addition & 1 deletion security-admin/src/bin/ranger_usersync.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ def get_java_env():
jdk_options = get_jdk_options()
class_path = get_ranger_classpath()
java_class = 'org.apache.ranger.authentication.server.RangerUserSyncServer'
class_arguments = '-enableUnixAuth'
class_arguments = ''

dom = getDOMImplementation()
xmlDoc = dom.createDocument(None, 'service', None)
Expand Down
4 changes: 4 additions & 0 deletions security-admin/src/main/resources/conf.dist/ranger-admin-default-site.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -711,4 +711,8 @@
<name>ranger.allow.kerberos.auth.login.browser</name>
<value>false</value>
</property>
<property>
<name>ranger.pam.service</name>
<value>login</value>
</property>
</configuration>
16 changes: 13 additions & 3 deletions ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,13 +195,15 @@ public class UserGroupSyncConfig {
/* SSL Configs */
private static final String SSL_KEYSTORE_FILE_TYPE_PARAM = "ranger.keystore.file.type";
private static final String SSL_TRUSTSTORE_FILE_TYPE_PARAM = "ranger.truststore.file.type";
private static final String SSL_KEYSTORE_PATH_PARAM = "ranger.usersync.keystore.file";
private static final String SSL_KEYSTORE_PATH_PASSWORD_PARAM = "ranger.usersync.keystore.password";
private static final String SSL_KEYSTORE_PATH_PARAM = "ranger.usersync.service.https.attrib.keystore.file";
Comment thread
fimugdha marked this conversation as resolved.
private static final String SSL_KEYSTORE_PATH_PASSWORD_PARAM = "ranger.usersync.service.https.attrib.keystore.pass";
private static final String SSL_TRUSTSTORE_PATH_PARAM = "ranger.usersync.truststore.file";
private static final String SSL_TRUSTSTORE_PATH_PASSWORD_PARAM = "ranger.usersync.truststore.password";
private static final String SSL_KEYSTORE_PATH_PASSWORD_ALIAS = "usersync.ssl.key.password";
private static final String SSL_KEYSTORE_PATH_PASSWORD_ALIAS = "ranger.usersync.service.https.attrib.keystore.pass";
private static final String SSL_TRUSTSTORE_PATH_PASSWORD_ALIAS = "usersync.ssl.truststore.password";

private static final String UGSYNC_UNIX_AUTH_ENABLED = "ranger.usersync.unix.auth.enabled";

private static volatile UserGroupSyncConfig me;
private final Properties prop = new Properties();
private Configuration userGroupConfig;
Expand Down Expand Up @@ -411,6 +413,14 @@ public String getSSLTrustStorePathPassword() {
return prop.getProperty(SSL_TRUSTSTORE_PATH_PASSWORD_PARAM);
}

public boolean getUserSyncUnixAuth() {
boolean enableUnixAuth = false;
if (prop.containsKey(UGSYNC_UNIX_AUTH_ENABLED)) {
enableUnixAuth = Boolean.parseBoolean(prop.getProperty(UGSYNC_UNIX_AUTH_ENABLED));
}
return enableUnixAuth;
}

public long getUpdateMillisMin() {
String val = prop.getProperty(UGSYNC_UPDATE_MILLIS_MIN);

Expand Down
2 changes: 1 addition & 1 deletion ugsync/src/test/java/org/apache/ranger/unixusersync/config/TestUserGroupSyncConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ public void testD_getSSLStorePathPasswords_updateFromAlias_noCrash() {
cfg.setProperty("ranger.usersync.ssl.keystore.type", "jks");

// Touch properties using correct parameter keys and ensure returned
cfg.setProperty("ranger.usersync.keystore.password", "ksp");
cfg.setProperty("ranger.usersync.service.https.attrib.keystore.pass", "ksp");
cfg.setProperty("ranger.usersync.truststore.password", "tsp");
assertEquals("ksp", cfg.getSSLKeyStorePathPassword());
assertEquals("tsp", cfg.getSSLTrustStorePathPassword());
Expand Down
2 changes: 1 addition & 1 deletion unixauthservice/conf.dist/ranger-ugsync-default.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
<configuration>
<property>
<name>ranger.usersync.port</name>
<value>5151</value>
<value>5151</value>
</property>
<property>
<name>ranger.usersync.ssl</name>
Expand Down
9 changes: 8 additions & 1 deletion unixauthservice/scripts/install.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,11 @@ POLICY_MGR_URL =
# defaults to unix
SYNC_SOURCE = unix

# Enable unix auth service, only when sync source is set to unix along with unix backend is set to passwd.
# Also, Unix authentication is enabled in Ranger Admin.
# defaults to false
ENABLE_UNIX_AUTH = false

Comment thread
fimugdha marked this conversation as resolved.
#
# Minimum Unix User-id to start SYNC.
# This should avoid creating UNIX system-level users in the Policy Manager
Expand Down Expand Up @@ -61,10 +66,12 @@ hadoop_conf=/etc/hadoop/conf
#
CRED_KEYSTORE_FILENAME=/etc/ranger/usersync/conf/rangerusersync.jceks

# SSL Authentication
# SSL Authentication configuration to be enabled when unix authentication is enabled.
AUTH_SSL_ENABLED=false
AUTH_SSL_KEYSTORE_FILE=/etc/ranger/usersync/conf/cert/unixauthservice.jks
AUTH_SSL_KEYSTORE_PASSWORD=UnIx529p

# Usersync SSL Truststore configuration
AUTH_SSL_TRUSTSTORE_FILE=
AUTH_SSL_TRUSTSTORE_PASSWORD=

Expand Down
2 changes: 1 addition & 1 deletion unixauthservice/scripts/ranger-usersync-services.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ if [ "${action}" == "START" ]; then
fi
fi
SLEEP_TIME_AFTER_START=5
nohup java -Dproc_rangerusersync ${JAVA_OPTS} -Duser=rangerusersync -Dhostname=${HOSTNAME} -Dservername=rangerusersync -Dranger.usersync.home=`pwd` -Dlogdir="${logdir}" -Dranger.usersync.log.dir="${RANGER_USERSYNC_LOG_DIR}" -Dlogback.configurationFile=file:${USERSYNC_CONF_DIR}/logback.xml -Djdk.tls.ephemeralDHKeySize=2048 -Dranger.usersync.webapp.dir="${RANGER_USERSYNC_WEBAPP}" -Dranger.usersync.service.host="${HOSTNAME}" -Dcatalina.base=${cdir}/ews -cp "${cp}" org.apache.ranger.authentication.server.RangerUserSyncServer -enableUnixAuth > ${RANGER_USERSYNC_LOG_DIR}/catalina.out 2>&1 &
nohup java -Dproc_rangerusersync ${JAVA_OPTS} -Duser=rangerusersync -Dhostname=${HOSTNAME} -Dservername=rangerusersync -Dranger.usersync.home=`pwd` -Dlogdir="${logdir}" -Dranger.usersync.log.dir="${RANGER_USERSYNC_LOG_DIR}" -Dlogback.configurationFile=file:${USERSYNC_CONF_DIR}/logback.xml -Djdk.tls.ephemeralDHKeySize=2048 -Dranger.usersync.webapp.dir="${RANGER_USERSYNC_WEBAPP}" -Dranger.usersync.service.host="${HOSTNAME}" -Dcatalina.base=${cdir}/ews -cp "${cp}" org.apache.ranger.authentication.server.RangerUserSyncServer > ${RANGER_USERSYNC_LOG_DIR}/catalina.out 2>&1 &
VALUE_OF_PID=$!
echo "Starting Ranger Usersync Service"
sleep $SLEEP_TIME_AFTER_START
Expand Down
23 changes: 14 additions & 9 deletions unixauthservice/scripts/setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@
pamAuthProgramName = join(nativeAuthFolderName, 'pamCredValidator.uexe')

defaultKSPassword = 'UnIx529p'
defaultDNAME = 'cn=unixauthservice,ou=authenticator,o=mycompany,c=US'
defaultDNAME = 'cn=Ranger Usersync Unixauthservice, ST=CA, C=US'

unixUserProp = 'unix_user'
unixGroupProp = 'unix_group'
Expand Down Expand Up @@ -438,17 +438,22 @@ def main():
if (localLogFolderName != ugsyncLogFolderName):
os.symlink(ugsyncLogFolderName, localLogFolderName)

if (not 'ranger.usersync.keystore.file' in mergeProps):
mergeProps['ranger.usersync.keystore.file'] = defaultKSFileName
enableUnixAuth = globalDict.get('ENABLE_UNIX_AUTH', 'false').lower() == 'true'
if enableUnixAuth:
mergeProps['ranger.usersync.unix.backend'] = 'passwd'
if (not 'ranger.usersync.keystore.file' in mergeProps):
mergeProps['ranger.usersync.keystore.file'] = defaultKSFileName

ksFileName = mergeProps['ranger.usersync.keystore.file']
ksFileName = mergeProps['ranger.usersync.keystore.file']

if (not isfile(ksFileName)):
mergeProps['ranger.usersync.keystore.password'] = defaultKSPassword
createJavaKeystoreForSSL(ksFileName, defaultKSPassword)
if (not isfile(ksFileName)):
mergeProps['ranger.usersync.keystore.password'] = defaultKSPassword
createJavaKeystoreForSSL(ksFileName, defaultKSPassword)

if ('ranger.usersync.keystore.password' not in mergeProps):
mergeProps['ranger.usersync.keystore.password'] = defaultKSPassword
if ('ranger.usersync.keystore.password' not in mergeProps):
mergeProps['ranger.usersync.keystore.password'] = defaultKSPassword
else:
mergeProps['ranger.usersync.unix.backend'] = 'nss'

fn = join(installTemplateDirName, templateFileName)
outfn = join(confFolderName, outputFileName)
Expand Down
3 changes: 2 additions & 1 deletion unixauthservice/scripts/templates/installprop2xml.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,8 @@ AUTH_SSL_TRUSTSTORE_PASSWORD = ranger.usersync.truststore.password
AUTH_SSL_ENABLED = ranger.usersync.ssl
SYNC_LDAP_REFERRAL = ranger.usersync.ldap.referral
usersync_principal= ranger.usersync.kerberos.principal
usersync_keytab= ranger.usersync.kerberos.keytab
usersync_keytab = ranger.usersync.kerberos.keytab
ENABLE_UNIX_AUTH = ranger.usersync.unix.auth.enabled
#JVM metrics related property
JVM_METRICS_ENABLED=ranger.usersync.metrics.enabled
JVM_METRICS_FILENAME=ranger.usersync.metrics.filename
Expand Down
Loading
Loading