Skip to content

Commit 92d121c

Browse files
shfshihuafengshfshihuafeng
committed
DRILL-8548: Integrate Apache Ranger authorization for Drill
1 parent 86e9b82 commit 92d121c

46 files changed

Lines changed: 5711 additions & 6 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎distribution/pom.xml‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,53 @@
7373
<artifactId>drill-common</artifactId>
7474
<version>${project.version}</version>
7575
</dependency>
76+
<dependency>
77+
<groupId>org.apache.drill</groupId>
78+
<artifactId>drill-ranger-plugin</artifactId>
79+
<version>${project.version}</version>
80+
<exclusions>
81+
<exclusion>
82+
<groupId>org.glassfish.jersey.core</groupId>
83+
<artifactId>*</artifactId>
84+
</exclusion>
85+
<exclusion>
86+
<groupId>org.glassfish.jersey.inject</groupId>
87+
<artifactId>*</artifactId>
88+
</exclusion>
89+
<exclusion>
90+
<groupId>org.glassfish.hk2</groupId>
91+
<artifactId>*</artifactId>
92+
</exclusion>
93+
<exclusion>
94+
<groupId>org.glassfish.hk2.external</groupId>
95+
<artifactId>*</artifactId>
96+
</exclusion>
97+
<exclusion>
98+
<groupId>jakarta.ws.rs</groupId>
99+
<artifactId>jakarta.ws.rs-api</artifactId>
100+
</exclusion>
101+
<exclusion>
102+
<groupId>jakarta.annotation</groupId>
103+
<artifactId>jakarta.annotation-api</artifactId>
104+
</exclusion>
105+
<exclusion>
106+
<groupId>jakarta.inject</groupId>
107+
<artifactId>jakarta.inject-api</artifactId>
108+
</exclusion>
109+
</exclusions>
110+
</dependency>
111+
<!--
112+
Ranger Admin service plugin (REST-based, JDK 8 bytecode, no Drill deps).
113+
Deployed into Ranger Admin's WEB-INF/lib. No shade/fat jar needed:
114+
the plugin uses only HttpURLConnection (JDK-standard) and Jackson
115+
(provided by Ranger Admin).
116+
-->
117+
<dependency>
118+
<groupId>org.apache.drill</groupId>
119+
<artifactId>ranger-drill-service</artifactId>
120+
<version>${project.version}</version>
121+
<type>jar</type>
122+
</dependency>
76123
<dependency>
77124
<groupId>org.apache.drill</groupId>
78125
<artifactId>drill-yarn</artifactId>
@@ -279,6 +326,137 @@
279326

280327
<build>
281328
<plugins>
329+
<plugin>
330+
<groupId>org.apache.maven.plugins</groupId>
331+
<artifactId>maven-dependency-plugin</artifactId>
332+
<executions>
333+
<execution>
334+
<id>copy-ranger-plugin-isolated-deps</id>
335+
<phase>prepare-package</phase>
336+
<goals>
337+
<goal>copy</goal>
338+
</goals>
339+
<configuration>
340+
<!--
341+
Force-copy the 2.x versions of Jersey, HK2, JAX-RS API,
342+
and annotation APIs that Maven dependency mediation would
343+
otherwise resolve to 3.x (because Drill's own REST server
344+
depends on the 3.x versions at a shallower depth).
345+
346+
These jars go into the isolated ranger-drill-plugin-impl/
347+
directory and are loaded by RangerPluginClassLoader, NOT
348+
the Drillbit classloader. Using maven-dependency-plugin:copy
349+
(not the assembly dependencySet) ensures we get the exact
350+
versions required by Jersey 2.35 / HK2 2.6.1, regardless of
351+
what Maven mediation picks for the main classpath.
352+
-->
353+
<artifactItems>
354+
<!-- JAX-RS 2.x API (javax.ws.rs.* package) -->
355+
<artifactItem>
356+
<groupId>jakarta.ws.rs</groupId>
357+
<artifactId>jakarta.ws.rs-api</artifactId>
358+
<version>${jaxrs.api.version}</version>
359+
<type>jar</type>
360+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
361+
</artifactItem>
362+
<!-- Jersey 2.x client runtime -->
363+
<artifactItem>
364+
<groupId>org.glassfish.jersey.core</groupId>
365+
<artifactId>jersey-client</artifactId>
366+
<version>${jersey.ranger.version}</version>
367+
<type>jar</type>
368+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
369+
</artifactItem>
370+
<artifactItem>
371+
<groupId>org.glassfish.jersey.core</groupId>
372+
<artifactId>jersey-common</artifactId>
373+
<version>${jersey.ranger.version}</version>
374+
<type>jar</type>
375+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
376+
</artifactItem>
377+
<artifactItem>
378+
<groupId>org.glassfish.jersey.inject</groupId>
379+
<artifactId>jersey-hk2</artifactId>
380+
<version>${jersey.ranger.version}</version>
381+
<type>jar</type>
382+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
383+
</artifactItem>
384+
<artifactItem>
385+
<groupId>org.glassfish.jersey.core</groupId>
386+
<artifactId>jersey-server</artifactId>
387+
<version>${jersey.ranger.version}</version>
388+
<type>jar</type>
389+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
390+
</artifactItem>
391+
<artifactItem>
392+
<groupId>org.glassfish.jersey.media</groupId>
393+
<artifactId>jersey-media-json-jackson</artifactId>
394+
<version>${jersey.ranger.version}</version>
395+
<type>jar</type>
396+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
397+
</artifactItem>
398+
<artifactItem>
399+
<groupId>org.glassfish.jersey.ext</groupId>
400+
<artifactId>jersey-entity-filtering</artifactId>
401+
<version>${jersey.ranger.version}</version>
402+
<type>jar</type>
403+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
404+
</artifactItem>
405+
<!-- HK2 2.6.1 (DI container used by Jersey 2.x) -->
406+
<artifactItem>
407+
<groupId>org.glassfish.hk2</groupId>
408+
<artifactId>hk2-locator</artifactId>
409+
<version>${hk2.ranger.version}</version>
410+
<type>jar</type>
411+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
412+
</artifactItem>
413+
<artifactItem>
414+
<groupId>org.glassfish.hk2</groupId>
415+
<artifactId>hk2-api</artifactId>
416+
<version>${hk2.ranger.version}</version>
417+
<type>jar</type>
418+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
419+
</artifactItem>
420+
<artifactItem>
421+
<groupId>org.glassfish.hk2</groupId>
422+
<artifactId>hk2-utils</artifactId>
423+
<version>${hk2.ranger.version}</version>
424+
<type>jar</type>
425+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
426+
</artifactItem>
427+
<artifactItem>
428+
<groupId>org.glassfish.hk2.external</groupId>
429+
<artifactId>aopalliance-repackaged</artifactId>
430+
<version>${hk2.ranger.version}</version>
431+
<type>jar</type>
432+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
433+
</artifactItem>
434+
<artifactItem>
435+
<groupId>org.glassfish.hk2</groupId>
436+
<artifactId>osgi-resource-locator</artifactId>
437+
<version>${osgi.resource.locator.version}</version>
438+
<type>jar</type>
439+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
440+
</artifactItem>
441+
<artifactItem>
442+
<groupId>jakarta.annotation</groupId>
443+
<artifactId>jakarta.annotation-api</artifactId>
444+
<version>${jakarta.annotation.api.version}</version>
445+
<type>jar</type>
446+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
447+
</artifactItem>
448+
<artifactItem>
449+
<groupId>jakarta.inject</groupId>
450+
<artifactId>jakarta.inject-api</artifactId>
451+
<version>${jakarta.inject.api.version}</version>
452+
<type>jar</type>
453+
<outputDirectory>${project.build.directory}/ranger-drill-plugin-impl</outputDirectory>
454+
</artifactItem>
455+
</artifactItems>
456+
</configuration>
457+
</execution>
458+
</executions>
459+
</plugin>
282460
<plugin>
283461
<artifactId>maven-assembly-plugin</artifactId>
284462
<executions>

‎distribution/src/assemble/component.xml‎

Lines changed: 101 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,67 @@
9898
<useProjectArtifact>false</useProjectArtifact>
9999
</dependencySet>
100100

101+
<!--
102+
Ranger Admin service plugin. Kept in its own directory so it never lands on the
103+
Drillbit classpath. Users copy this jar into Ranger Admin's
104+
WEB-INF/classes/lib to enable Test Connection and resource autocomplete
105+
in the Ranger policy editor.
106+
-->
107+
<dependencySet>
108+
<includes>
109+
<include>org.apache.drill:ranger-drill-service:jar</include>
110+
</includes>
111+
<outputDirectory>jars/ranger-service</outputDirectory>
112+
<useProjectArtifact>false</useProjectArtifact>
113+
</dependencySet>
114+
115+
<!--
116+
Ranger framework jars (NOT Jersey/HK2 — those are force-copied by
117+
maven-dependency-plugin:copy in distribution/pom.xml to ensure
118+
correct 2.x versions are used).
119+
120+
These jars are NOT on the Drillbit's main classpath; they are loaded
121+
by RangerPluginClassLoader from this directory. This isolation is
122+
required because the plugin ships Jersey 2.35 (org.glassfish.jersey.*
123+
+ javax.ws.rs.*) which conflicts with Drill's own Jersey 3.1.9
124+
(org.glassfish.jersey.* + jakarta.ws.rs.*) on the main classpath.
125+
126+
Shared deps (SLF4J, Netty, Hadoop, Jackson) are 'provided' scope in
127+
drill-ranger-plugin/pom.xml and intentionally NOT listed here — the
128+
plugin classloader falls back to the Drillbit classloader for those.
129+
-->
130+
<dependencySet>
131+
<includes>
132+
<!-- Plugin itself -->
133+
<include>org.apache.drill:drill-ranger-plugin:jar</include>
134+
<!-- Ranger plugin framework -->
135+
<include>org.apache.ranger:ranger-plugins-common:jar</include>
136+
<include>org.apache.ranger:ranger-knox-plugin:jar</include>
137+
<include>org.apache.ranger:ranger-audit-core:jar</include>
138+
<include>org.apache.ranger:ranger-authz-api:jar</include>
139+
<include>org.apache.ranger:ugsync-util:jar</include>
140+
</includes>
141+
<outputDirectory>jars/ranger-drill-plugin-impl</outputDirectory>
142+
<unpack>false</unpack>
143+
<useProjectArtifact>false</useProjectArtifact>
144+
</dependencySet>
145+
146+
<!--
147+
RangerPluginClassLoader must be on the Drillbit's main classpath because
148+
RangerAccessAuthorizer (in drill-java-exec.jar) directly references it to
149+
create the isolated classloader for the Ranger plugin. It cannot itself
150+
be loaded by the isolated classloader.
151+
-->
152+
<dependencySet>
153+
<includes>
154+
<include>org.apache.ranger:ranger-plugin-classloader:jar</include>
155+
</includes>
156+
<outputDirectory>jars/3rdparty</outputDirectory>
157+
<unpack>false</unpack>
158+
<useProjectArtifact>false</useProjectArtifact>
159+
<scope>compile</scope>
160+
</dependencySet>
161+
101162
<dependencySet>
102163
<outputDirectory>jars/classb</outputDirectory>
103164
<unpack>false</unpack>
@@ -125,6 +186,22 @@
125186
<include>org.jvnet.mimepull</include>
126187
<include>org.reflections</include>
127188
</includes>
189+
<!--
190+
Exclude Jersey 2.x jars (used by drill-ranger-plugin via
191+
RangerPluginClassLoader). These go to jars/ranger-drill-plugin-impl/
192+
instead, to avoid org.glassfish.jersey.* package conflicts with
193+
Drill's own Jersey 3.1.9 on the main classpath.
194+
-->
195+
<excludes>
196+
<exclude>org.glassfish.jersey.core:jersey-client:jar:${jersey.ranger.version}</exclude>
197+
<exclude>org.glassfish.jersey.core:jersey-common:jar:${jersey.ranger.version}</exclude>
198+
<exclude>org.glassfish.jersey.core:jersey-server:jar:${jersey.ranger.version}</exclude>
199+
<exclude>org.glassfish.jersey.inject:jersey-hk2:jar:${jersey.ranger.version}</exclude>
200+
<exclude>org.glassfish.jersey.media:jersey-media-json-jackson:jar:${jersey.ranger.version}</exclude>
201+
<exclude>org.glassfish.jersey.media:jersey-media-multipart:jar:${jersey.ranger.version}</exclude>
202+
<exclude>org.glassfish.jersey.ext:jersey-entity-filtering:jar:${jersey.ranger.version}</exclude>
203+
<exclude>jakarta.ws.rs:jakarta.ws.rs-api:jar:${jaxrs.api.version}</exclude>
204+
</excludes>
128205
</dependencySet>
129206
<dependencySet>
130207
<outputDirectory>jars/3rdparty/</outputDirectory>
@@ -152,10 +229,16 @@
152229
<exclude>org.apache.drill.exec</exclude>
153230
<exclude>org.apache.drill.memory</exclude>
154231
<exclude>org.apache.drill.metastore</exclude>
232+
<!--
233+
Ranger plugin jars and their transitive deps go to
234+
jars/ranger-drill-plugin-impl/ (loaded by RangerPluginClassLoader),
235+
NOT jars/3rdparty/ (main classpath).
236+
-->
237+
<exclude>org.apache.ranger</exclude>
238+
<exclude>org.glassfish.hk2.external</exclude>
239+
<exclude>org.glassfish.hk2</exclude>
155240
<exclude>org.apache.zookeeper</exclude>
156241
<exclude>org.eclipse.jetty</exclude>
157-
<exclude>org.glassfish.hk2</exclude>
158-
<exclude>org.glassfish.hk2.external</exclude>
159242
<exclude>org.glassfish.jersey.containers</exclude>
160243
<exclude>org.glassfish.jersey.core</exclude>
161244
<exclude>org.glassfish.jersey.ext</exclude>
@@ -216,10 +299,26 @@
216299
<directory>../sample-data</directory>
217300
<outputDirectory>sample-data</outputDirectory>
218301
</fileSet>
302+
<!--
303+
JAX-RS 2.x API (jakarta.ws.rs-api:2.1.6) and Jersey HK2 2.35 that were
304+
force-copied by maven-dependency-plugin:copy in distribution/pom.xml.
305+
These must use the 2.x versions, not the 3.x versions that Maven
306+
dependency mediation would otherwise pick (because Drill's own REST
307+
server depends on the 3.x versions at a shallower depth).
308+
-->
309+
<fileSet>
310+
<directory>${project.build.directory}/ranger-drill-plugin-impl</directory>
311+
<outputDirectory>jars/ranger-drill-plugin-impl</outputDirectory>
312+
</fileSet>
219313
<fileSet>
220314
<directory>${project.build.directory}/winutils</directory>
221315
<outputDirectory>winutils/bin</outputDirectory>
222316
</fileSet>
317+
<fileSet>
318+
<directory>src/main/resources/ranger</directory>
319+
<outputDirectory>conf/ranger</outputDirectory>
320+
<fileMode>0640</fileMode>
321+
</fileSet>
223322
</fileSets>
224323

225324
<files>

‎distribution/src/main/resources/drill-config.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -365,6 +365,11 @@ export DRILLBIT_LOG_PATH="${DRILL_LOG_PREFIX}.log"
365365
# Add Drill conf folder at the beginning of the classpath
366366
CP="$DRILL_CONF_DIR"
367367

368+
# Add Ranger config directory if it exists (for ranger-drill-security.xml etc.)
369+
if [ -d "$DRILL_CONF_DIR/ranger" ]; then
370+
CP="$CP:$DRILL_CONF_DIR/ranger"
371+
fi
372+
368373
# If both user and YARN-provided Java lib paths exist,
369374
# combine them.
370375

‎distribution/src/main/resources/ranger/ranger-drill-audit.xml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?xml version="1.0"?>
2+
<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
3+
<!--
4+
Licensed to the Apache Software Foundation (ASF) under one or more
5+
contributor license agreements. See the NOTICE file distributed with
6+
this work for additional information regarding copyright ownership.
7+
The ASF licenses this file to You under the Apache License, Version 2.0
8+
(the "License"); you may not use this file except in compliance with
9+
the License. You may obtain a copy of the License at
10+
11+
http://www.apache.org/licenses/LICENSE-2.0
12+
13+
Unless required by applicable law or agreed to in writing, software
14+
distributed under the License is distributed on an "AS IS" BASIS,
15+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
See the License for the specific language governing permissions and
17+
limitations under the License.
18+
-->
19+
<configuration>
20+
<!-- Audit log destination. Set to Solr or HDFS for persistent audit storage.
21+
If not configured, RangerDefaultAuditHandler logs to the Drillbit log. -->
22+
<property>
23+
<name>xasecure.audit.is.audit.to.solr</name>
24+
<value>false</value>
25+
</property>
26+
<property>
27+
<name>xasecure.audit.solr.url</name>
28+
<value>http://ranger-admin-host:6083/solr/ranger_audits</value>
29+
</property>
30+
31+
<property>
32+
<name>xasecure.audit.is.audit.to.hdfs</name>
33+
<value>false</value>
34+
</property>
35+
<property>
36+
<name>xasecure.audit.hdfs.config.directory</name>
37+
<value>hdfs://namenode:8020/ranger/audit</value>
38+
</property>
39+
<property>
40+
<name>xasecure.audit.hdfs.config.file</name>
41+
<value>/etc/hadoop/conf/core-site.xml</value>
42+
</property>
43+
44+
<!-- Audit to log4j as fallback (always enabled) -->
45+
<property>
46+
<name>xasecure.audit.is.audit.to.log4j</name>
47+
<value>true</value>
48+
</property>
49+
</configuration>

0 commit comments

Comments
 (0)