RANGER-5603: Docker setup updated to use Solr 9.4.1#981
Open
pradeepagrawal8184 wants to merge 2 commits into
Open
RANGER-5603: Docker setup updated to use Solr 9.4.1#981pradeepagrawal8184 wants to merge 2 commits into
pradeepagrawal8184 wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Ranger Docker dev stack and related Solr plugin packaging/configuration to run against Solr 9.4.1 with Kerberos/SPNEGO, including changes to keytab/policy-cache locations and Solr 9 security module wiring.
Changes:
- Bump Docker dev stack Solr version to 9.4.1 and adjust container entrypoint/config mounts accordingly.
- Update Solr Kerberos/SPNEGO configuration (Solr 9 Hadoop auth plugin class, JAAS/keytab paths, audit URL FQDN).
- Adjust Ranger Solr plugin packaging/runtime bits (assembly deps, authorizer handler null-safety, policy-cache path, enhanced Jersey validation logging).
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| plugin-solr/src/main/java/org/apache/ranger/authorization/solr/authorizer/RangerSolrAuthorizer.java | Avoids repeated handler lookup and prevents potential NPE in warning log when handler is null. |
| distro/src/main/assembly/plugin-solr.xml | Updates dependency include list for the Solr plugin assembly (adds Graal/ICU artifacts, removes some previously bundled libs). |
| dev-support/ranger-docker/scripts/solr/solr-security.json | Switches Kerberos auth plugin class to Solr 9 hadoop-auth FQCN. |
| dev-support/ranger-docker/scripts/solr/solr-ranger_audits/solrconfig.xml | Updates cache implementations to Caffeine-based caches for Solr 9. |
| dev-support/ranger-docker/scripts/solr/solr-jaas.conf | Minor cleanup (trailing whitespace removal). |
| dev-support/ranger-docker/scripts/solr/ranger-solr.sh | Updates Solr container startup to use mounted keytabs/JAAS, enable hadoop-auth module, set allowPaths, and bootstrap core.properties when needed. |
| dev-support/ranger-docker/scripts/solr/ranger-solr-plugin-install.properties | Sets policy cache path under /etc/ranger/... for the dev Solr repo. |
| dev-support/ranger-docker/scripts/solr/ranger_audits/core.properties | Adds Solr 9 core instance marker file for the ranger_audits core. |
| dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties | Points Ranger Admin audit Solr URL at the Solr FQDN and updates JAAS options for SPNEGO behavior. |
| dev-support/ranger-docker/Dockerfile.ranger-solr | Updates default Solr image tag to 9.4.1 and prepares /etc/ranger ownership/dirs. |
| dev-support/ranger-docker/docker-compose.ranger.yml | Adds bind mounts for core config/core.properties, mounts updated enable template, relocates JAAS mount, and disables Solr SecurityManager by default. |
| dev-support/ranger-docker/.env | Bumps SOLR_VERSION to 9.4.1. |
| agents-common/src/main/java/org/apache/ranger/plugin/util/RangerJersey2ClientBuilder.java | Improves logging details during anti-MOXy validation (but changes validation behavior). |
Comments suppressed due to low confidence (2)
dev-support/ranger-docker/scripts/solr/ranger-solr.sh:36
solr.kerberos.cookie.domainis set toranger-solr, but the rest of the stack (e.g., Solr principal and Ranger Admin audit URL) uses the FQDNranger-solr.rangernw. With a mismatched cookie domain, SPNEGO auth cookies may be rejected by clients (leading to repeated 401s). Consider setting the cookie domain toranger-solr.rangernw(host-only) or.rangernw(domain-wide), aligned with how Solr is accessed.
# Use KDC-generated keytabs from the volume mount (/etc/keytabs); do not copy into
# /var/solr/data or they go stale after KDC restart (Checksum failed on login).
JAAS_CONFIG="-Djava.security.auth.login.config=/var/solr/data/jaas.conf"
JAAS_APPNAME="-Dsolr.kerberos.jaas.appname=Client"
KRB5_CONF="-Djava.security.krb5.conf=/etc/krb5.conf"
KERBEROS_KEYTAB="-Dsolr.kerberos.keytab=/etc/keytabs/HTTP.keytab"
KERBEROS_PRINCIPAL="-Dsolr.kerberos.principal=HTTP/ranger-solr.rangernw@EXAMPLE.COM"
COOKIE_DOMAIN="-Dsolr.kerberos.cookie.domain=ranger-solr"
dev-support/ranger-docker/scripts/solr/solr-security.json:9
kerberos.cookie.domain/cookie.domainare set toranger-solr, but the configured principal usesranger-solr.rangernwand other services in this dev stack use the FQDN. A cookie domain that doesn’t match the host clients use can cause SPNEGO auth cookies to be rejected (leading to repeated 401s). Align these cookie domain values with the actual hostname/FQDN used to access Solr (e.g.,ranger-solr.rangernwor.rangernw).
"class": "org.apache.solr.security.hadoop.KerberosPlugin",
"kerberos.principal": "HTTP/ranger-solr.rangernw@EXAMPLE.COM",
"kerberos.keytab": "/etc/keytabs/HTTP.keytab",
"kerberos.name.rules": "RULE:[2:$1@$0](.*@EXAMPLE.COM)s/@.*//\nRULE:[1:$1@$0](.*@EXAMPLE.COM)s/@.*//\nDEFAULT",
"kerberos.cookie.domain": "ranger-solr",
"cookie.domain": "ranger-solr",
"token.valid": 3600
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if (!jacksonRegistered) { | ||
| LOG.error("CRITICAL: Jackson JSON provider is not registered! Default JSON processing may fail."); | ||
| isValid = false; | ||
| LOG.error("CRITICAL: Jackson JSON provider is not registered! Default JSON processing may fail. Classes={}", config.getClasses().stream().map(Class::getCanonicalName).collect(Collectors.toList())); |
mneethiraj
approved these changes
May 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Updates Ranger Docker dev stack for Solr 9.4.1 with Kerberos: use mounted keytabs under /etc/keytabs, policy cache under /etc/ranger, Solr 9 Kerberos/hadoop-auth wiring, and Ranger Admin Solr audit access via FQDN + JAAS (fixes SPNEGO / xaudit 401).
Changes:
How was this patch tested?