RANGER-5655: Shared partition plan library, DB patch 078, plugin SPIFFE auth

agents-audit/dest-auditserver/pom.xml

@@ -74,6 +74,12 @@
         </dependency>
 
         <!-- Test -->
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <version>${junit.jupiter.version}</version>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>log4j-over-slf4j</artifactId>

agents-audit/dest-auditserver/src/main/java/org/apache/ranger/audit/destination/RangerAuditServerDestination.java

@@ -27,6 +27,7 @@
 import org.apache.ranger.audit.model.AuthzAuditEvent;
 import org.apache.ranger.audit.provider.MiscUtil;
 import org.apache.ranger.plugin.authn.DefaultJwtProvider;
+import org.apache.ranger.plugin.util.PluginHeaderAuthConfig;
 import org.apache.ranger.plugin.util.RangerRESTClient;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -98,6 +99,12 @@ public void init(Properties props, String propPrefix) {
         this.restClient.setMaxRetryAttempts(maxRetryAttempts);
         this.restClient.setRetryIntervalMs(retryIntervalMs);
 
+        Map<String, String> spiffeHeaders = PluginHeaderAuthConfig.buildSpiffeAuthHeaders(props, propPrefix);
+        if (!spiffeHeaders.isEmpty()) {
+            this.restClient.setTrustedAuthHeaders(spiffeHeaders);
+            LOG.debug("SPIFFE header authentication enabled for audit-server destination");
+        }
+
         LOG.info("<== RangerAuditServerDestination:init()");
     }
 

agents-audit/dest-auditserver/src/test/java/org/apache/ranger/audit/destination/RangerAuditServerDestinationTest.java

@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ranger.audit.destination;
+
+import org.apache.ranger.plugin.util.PluginHeaderAuthConfig;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.Properties;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+public class RangerAuditServerDestinationTest {
+    private static final String AUDIT_DEST_PREFIX = "xasecure.audit.destination.auditserver";
+
+    @Test
+    public void buildSpiffeAuthHeadersUsesAuditDestinationPrefix() {
+        Properties props = new Properties();
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.header.enabled", "true");
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.header.spiffe", "X-Spiffe-Id");
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.spiffe.value",
+                "spiffe://example.com/ns/default/sa/hive");
+
+        Map<String, String> headers = PluginHeaderAuthConfig.buildSpiffeAuthHeaders(props, AUDIT_DEST_PREFIX);
+
+        assertEquals(1, headers.size());
+        assertEquals("spiffe://example.com/ns/default/sa/hive", headers.get("X-Spiffe-Id"));
+    }
+
+    @Test
+    public void buildSpiffeAuthHeadersEmptyWhenAuditDestinationDisabled() {
+        Properties props = new Properties();
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.header.enabled", "false");
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.spiffe.value",
+                "spiffe://example.com/ns/default/sa/hive");
+
+        Map<String, String> headers = PluginHeaderAuthConfig.buildSpiffeAuthHeaders(props, AUDIT_DEST_PREFIX);
+
+        assertTrue(headers.isEmpty());
+    }
+}

agents-common/src/main/java/org/apache/ranger/audit/partition/AuditPartitionPlanAdminConfig.java

@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.audit.partition;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.hadoop.conf.Configuration;
+
+/** Reads Admin site configuration for audit partition plan allocation. */
+public final class AuditPartitionPlanAdminConfig {
+    private AuditPartitionPlanAdminConfig() {
+    }
+
+    public static int resolvePartitionsPerPlugin(String pluginId, Configuration config) {
+        if (config == null || StringUtils.isBlank(pluginId)) {
+            return AuditPartitionPlanConstants.DEFAULT_PARTITIONS_PER_PLUGIN;
+        }
+        String overrideKey = AuditPartitionPlanConstants.PROP_ADMIN_PLUGIN_PARTITION_OVERRIDE_PREFIX + pluginId.trim();
+        if (StringUtils.isNotBlank(config.get(overrideKey))) {
+            return config.getInt(overrideKey, AuditPartitionPlanConstants.DEFAULT_PARTITIONS_PER_PLUGIN);
+        }
+        return config.getInt(AuditPartitionPlanConstants.PROP_ADMIN_PARTITIONS_PER_PLUGIN, AuditPartitionPlanConstants.DEFAULT_PARTITIONS_PER_PLUGIN);
+    }
+}

agents-common/src/main/java/org/apache/ranger/audit/partition/AuditPartitionPlanConstants.java

@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.audit.partition;
+
+public final class AuditPartitionPlanConstants {
+    public static final int    INITIAL_PLAN_VERSION = 1;
+    public static final String DEFAULT_AUDIT_TOPIC  = "ranger_audits";
+
+    /** Default partition slots allocated when a plugin is first promoted from buffer. */
+    public static final int DEFAULT_PARTITIONS_PER_PLUGIN = 3;
+
+    /** Admin site: {@code ranger-admin-default-site.xml} / {@code ranger-admin-site.xml}. */
+    public static final String PROP_ADMIN_PARTITIONS_PER_PLUGIN = "ranger.admin.audit.partition.plan.partitions.per.plugin";
+
+    /** Per-plugin override prefix, e.g. {@code ...plugin.partition.overrides.hiveServer2}. */
+    public static final String PROP_ADMIN_PLUGIN_PARTITION_OVERRIDE_PREFIX = "ranger.admin.audit.partition.plan.plugin.partition.overrides.";
+
+    private AuditPartitionPlanConstants() {
+    }
+}