Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

exclude jackson-jaxrs from ranger-security, update documentation to reflect ranger update #15481

Merged
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 4 additions & 7 deletions docs/development/extensions-core/druid-ranger-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,24 +21,21 @@ title: "Apache Ranger Security"
~ specific language governing permissions and limitations
~ under the License.
-->

This Apache Druid extension adds an Authorizer which implements access control for Druid, backed by [Apache Ranger](https://ranger.apache.org/). Please see [Authentication and Authorization](../../operations/auth.md) for more information on the basic facilities this extension provides.

Make sure to [include](../../configuration/extensions.md#loading-extensions) `druid-ranger-security` in the extensions load list.

:::info
The latest release of Apache Ranger is at the time of writing version 2.0. This version has a dependency on `log4j 1.2.17` which has a vulnerability if you configure it to use a `SocketServer` (CVE-2019-17571). Next to that, it also includes Kafka 2.0.0 which has 2 known vulnerabilities (CVE-2019-12399, CVE-2018-17196). Kafka can be used by the audit component in Ranger, but is not required.
xvrl marked this conversation as resolved.
Show resolved Hide resolved
:::

## Configuration

Support for Apache Ranger authorization consists of three elements:
Support for Apache Ranger authorization consists of three elements:
* configuring the extension in Apache Druid
* configuring the connection to Apache Ranger
* providing the service definition for Druid to Apache Ranger

### Enabling the extension
Ensure that you have a valid authenticator chain and escalator set in your `common.runtime.properties`. For every authenticator your wish to use the authorizer for, set `druid.auth.authenticator.<authenticatorName>.authorizerName` to the name you will give the authorizer, e.g. `ranger`.
Ensure that you have a valid authenticator chain and escalator set in your `common.runtime.properties`. For every authenticator your wish to use the authorizer for, set `druid.auth.authenticator.<authenticatorName>.authorizerName` to the name you will give the authorizer, e.g. `ranger`.

Then add the following and amend to your needs (in case you need to use multiple authorizers):

Expand Down
4 changes: 4 additions & 0 deletions extensions-core/druid-ranger-security/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,10 @@
<groupId>org.elasticsearch.plugin</groupId>
<artifactId>*</artifactId>
</exclusion>
<exclusion>
xvrl marked this conversation as resolved.
Show resolved Hide resolved
<groupId>org.codehus.jackson</groupId>
janjwerner-confluent marked this conversation as resolved.
Show resolved Hide resolved
<artifactId>jackson-jaxrs</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand Down