RANGER-5723: Plugin SPIFFE outbound auth for audit-server destination

agents-audit/dest-auditserver/pom.xml

@@ -74,6 +74,12 @@
         </dependency>
 
         <!-- Test -->
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <version>${junit.jupiter.version}</version>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>log4j-over-slf4j</artifactId>

agents-audit/dest-auditserver/src/main/java/org/apache/ranger/audit/destination/RangerAuditServerDestination.java

@@ -27,6 +27,7 @@
 import org.apache.ranger.audit.model.AuthzAuditEvent;
 import org.apache.ranger.audit.provider.MiscUtil;
 import org.apache.ranger.plugin.authn.DefaultJwtProvider;
+import org.apache.ranger.plugin.util.PluginHeaderAuthConfig;
 import org.apache.ranger.plugin.util.RangerRESTClient;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -98,6 +99,14 @@ public void init(Properties props, String propPrefix) {
         this.restClient.setMaxRetryAttempts(maxRetryAttempts);
         this.restClient.setRetryIntervalMs(retryIntervalMs);
 
+        // SPIFFE header auth is orthogonal to authn.type (JWT/Basic/Kerberos): when enabled,
+        // trusted headers are added in addition to whatever authType configured above.
+        Map<String, String> spiffeHeaders = PluginHeaderAuthConfig.buildSpiffeAuthHeaders(props, propPrefix);
+        if (!spiffeHeaders.isEmpty()) {
+            this.restClient.setTrustedAuthHeaders(spiffeHeaders);
+            LOG.debug("SPIFFE header authentication enabled for audit-server destination");
+        }
+
         LOG.info("<== RangerAuditServerDestination:init()");
     }
 

agents-audit/dest-auditserver/src/test/java/org/apache/ranger/audit/destination/RangerAuditServerDestinationTest.java

@@ -0,0 +1,57 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ranger.audit.destination;
+
+import org.apache.ranger.plugin.util.PluginHeaderAuthConfig;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.Properties;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+public class RangerAuditServerDestinationTest {
+    private static final String AUDIT_DEST_PREFIX = "xasecure.audit.destination.auditserver";
+
+    @Test
+    public void buildSpiffeAuthHeadersUsesAuditDestinationPrefix() {
+        Properties props = new Properties();
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.header.enabled", "true");
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.header.spiffe", "X-Spiffe-Id");
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.spiffe.value",
+                "spiffe://example.com/ns/default/sa/hive");
+
+        Map<String, String> headers = PluginHeaderAuthConfig.buildSpiffeAuthHeaders(props, AUDIT_DEST_PREFIX);
+
+        assertEquals(1, headers.size());
+        assertEquals("spiffe://example.com/ns/default/sa/hive", headers.get("X-Spiffe-Id"));
+    }
+
+    @Test
+    public void buildSpiffeAuthHeadersEmptyWhenAuditDestinationDisabled() {
+        Properties props = new Properties();
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.header.enabled", "false");
+        props.setProperty(AUDIT_DEST_PREFIX + ".authn.spiffe.value",
+                "spiffe://example.com/ns/default/sa/hive");
+
+        Map<String, String> headers = PluginHeaderAuthConfig.buildSpiffeAuthHeaders(props, AUDIT_DEST_PREFIX);
+
+        assertTrue(headers.isEmpty());
+    }
+}

agents-common/src/main/java/org/apache/ranger/plugin/util/RangerRESTClient.java

@@ -60,6 +60,8 @@
 import java.security.SecureRandom;
 import java.security.UnrecoverableKeyException;
 import java.security.cert.CertificateException;
+import java.util.Collections;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Random;
@@ -143,6 +145,7 @@ public String getMethod() {
     private volatile Client       cookieAuthClient;
     private          JwtProvider  jwtProvider;
     private volatile String       authHeader;
+    private volatile Map<String, String> trustedAuthHeaders = Collections.emptyMap();
 
     public RangerRESTClient(String url, String sslConfigFileName, Configuration config) {
         this(url, sslConfigFileName, config, getPropertyPrefix(config));
@@ -215,6 +218,19 @@ public void setRetryIntervalMs(int retryIntervalMs) {
         this.retryIntervalMs = retryIntervalMs;
     }
 
+    /**
+     * Trusted HTTP headers for SPIFFE or other header-based auth.
+     * Applied to every REST request from this client.
+     */
+    public void setTrustedAuthHeaders(Map<String, String> headers) {
+        if (headers == null || headers.isEmpty()) {
+            trustedAuthHeaders = Collections.emptyMap();
+        } else {
+            trustedAuthHeaders = Collections.unmodifiableMap(new LinkedHashMap<>(headers));
+        }
+        resetClient();
+    }
+
     public void setBasicAuthInfo(String username, String password) {
         setBasicAuthFilter(username, password);
     }
@@ -494,9 +510,17 @@ private Invocation.Builder createInvocationBuilder(int currentIndex, String rela
             builder = builder.cookie(sessionId);
         }
 
+        applyTrustedAuthHeaders(builder);
+
         return builder;
     }
 
+    private void applyTrustedAuthHeaders(Invocation.Builder builder) {
+        for (Map.Entry<String, String> entry : trustedAuthHeaders.entrySet()) {
+            builder.header(entry.getKey(), entry.getValue());
+        }
+    }
+
     private Response performRequest(HttpMethod method, String relativeUrl, Map<String, String> params, Object requestBody, Cookie sessionId) throws Exception {
         Response finalResponse = null;
         int      startIndex    = this.lastKnownActiveUrlIndex;

agents-common/src/test/java/org/apache/ranger/plugin/util/TestRangerRESTClient.java

@@ -19,11 +19,23 @@
 
 package org.apache.ranger.plugin.util;
 
+import com.sun.net.httpserver.HttpServer;
+import org.apache.hadoop.conf.Configuration;
 import org.apache.ranger.authorization.hadoop.config.RangerPluginConfig;
 import org.apache.ranger.plugin.policyengine.RangerPolicyEngineOptions;
 import org.apache.ranger.plugin.service.RangerBasePlugin;
 import org.junit.jupiter.api.Test;
 
+import javax.ws.rs.core.Response;
+
+import java.net.InetSocketAddress;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -33,6 +45,8 @@ public class TestRangerRESTClient {
     private static final String SERVICE_NAME = "test-service";
     private static final String APP_ID = "test-app";
     private static final String ERR_MESSAGE = "Ranger URL is null or empty.";
+    private static final String VALID_SPIFFE =
+            "spiffe://prod-cluster.k8s.example.com/ns/ranger/sa/om";
 
     @Test
     public void testPluginInit_WithNoUrl_ThrowsException() {
@@ -50,4 +64,40 @@ public void testPluginInit_WithValidUrl_Succeeds() {
         plugin.init();
         assertNotNull(plugin, "RangerBasePlugin should be initialized successfully");
     }
+
+    @Test
+    public void setTrustedAuthHeadersAddsHeaderToOutboundRequest() throws Exception {
+        AtomicReference<String> capturedSpiffeHeader = new AtomicReference<>();
+        HttpServer httpServer = HttpServer.create(new InetSocketAddress(0), 0);
+
+        httpServer.createContext("/", exchange -> {
+            List<String> values = exchange.getRequestHeaders().get("X-Spiffe-Id");
+
+            if (values != null && !values.isEmpty()) {
+                capturedSpiffeHeader.set(values.get(0));
+            }
+
+            exchange.sendResponseHeaders(200, -1);
+            exchange.close();
+        });
+        httpServer.start();
+
+        try {
+            String serverUrl = "http://localhost:" + httpServer.getAddress().getPort();
+            Configuration conf = new Configuration();
+            RangerRESTClient client = new RangerRESTClient(serverUrl, null, conf);
+            Map<String, String> headers = new LinkedHashMap<>();
+
+            headers.put("X-Spiffe-Id", VALID_SPIFFE);
+            client.setTrustedAuthHeaders(headers);
+
+            try (Response response = client.get("/test", Collections.emptyMap())) {
+                assertEquals(200, response.getStatus());
+            }
+
+            assertEquals(VALID_SPIFFE, capturedSpiffeHeader.get());
+        } finally {
+            httpServer.stop(0);
+        }
+    }
 }

common-utils/src/main/java/org/apache/ranger/plugin/util/PluginHeaderAuthConfig.java

@@ -0,0 +1,125 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.plugin.util;
+
+import org.apache.commons.lang3.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+
+/**
+ * Outbound trusted-header auth for audit-server and other REST clients.
+ *
+ * <p>Properties are read under a caller-supplied prefix (audit destination example):
+ * <pre>
+ * xasecure.audit.destination.auditserver.authn.header.enabled=true
+ * xasecure.audit.destination.auditserver.authn.header.spiffe=X-Spiffe-Id
+ * </pre>
+ * SPIFFE ID value is resolved via {@link SpiffeIdentityResolver} under the same
+ * prefix (explicit value, identity file, or {@code SPIFFE_ID} environment variable).
+ */
+public final class PluginHeaderAuthConfig {
+    public static final String PROP_HEADER_AUTH_ENABLED   = "authn.header.enabled";
+    public static final String PROP_HEADER_SPIFFE         = "authn.header.spiffe";
+    public static final String DEFAULT_SPIFFE_HEADER_NAME = "X-Spiffe-Id";
+
+    private static final Logger LOG =
+            LoggerFactory.getLogger(PluginHeaderAuthConfig.class);
+
+    private PluginHeaderAuthConfig() {
+        // to block instantiation
+    }
+
+    /**
+     * Returns whether trusted header auth is enabled for the given config prefix.
+     *
+     * @param props        plugin or site configuration properties
+     * @param configPrefix property prefix for header-auth settings
+     * @return {@code true} when header auth is enabled
+     */
+    public static boolean isHeaderAuthEnabled(final Properties props,
+            final String configPrefix) {
+        if (props == null || StringUtils.isBlank(configPrefix)) {
+            return false;
+        }
+
+        return Boolean.parseBoolean(
+                props.getProperty(configPrefix + "." + PROP_HEADER_AUTH_ENABLED,
+                        "false"));
+    }
+
+    /**
+     * Builds SPIFFE header(s) for outbound REST calls when header auth is enabled.
+     *
+     * @param props        plugin or site configuration properties
+     * @param configPrefix prefix such as {@code xasecure.audit.destination.auditserver}
+     * @return immutable header map; empty when auth is disabled or misconfigured
+     */
+    public static Map<String, String> buildSpiffeAuthHeaders(final Properties props,
+            final String configPrefix) {
+        if (!isHeaderAuthEnabled(props, configPrefix)) {
+            return Collections.emptyMap();
+        }
+
+        List<String> headerNames = SpiffeIdUtil.parseHeaderNames(
+                resolveSpiffeHeaderName(props, configPrefix));
+        String spiffeId = SpiffeIdentityResolver.resolve(props, configPrefix);
+
+        if (headerNames.isEmpty()) {
+            LOG.warn("Plugin header auth enabled for {} but no SPIFFE header "
+                    + "name is configured", configPrefix);
+            return Collections.emptyMap();
+        }
+
+        if (StringUtils.isBlank(spiffeId)) {
+            LOG.warn("Plugin header auth enabled for {} but no SPIFFE ID could "
+                    + "be resolved", configPrefix);
+            return Collections.emptyMap();
+        }
+
+        if (!SpiffeIdUtil.isValidSpiffeId(spiffeId)) {
+            LOG.warn("Resolved SPIFFE ID for {} is not well-formed", configPrefix);
+            return Collections.emptyMap();
+        }
+
+        Map<String, String> headers = new LinkedHashMap<>();
+
+        for (String headerName : headerNames) {
+            headers.put(headerName, spiffeId);
+        }
+
+        return Collections.unmodifiableMap(headers);
+    }
+
+    private static String resolveSpiffeHeaderName(final Properties props,
+            final String configPrefix) {
+        String headerName = props != null
+                ? StringUtils.trimToNull(
+                        props.getProperty(configPrefix + "." + PROP_HEADER_SPIFFE))
+                : null;
+
+        return headerName != null ? headerName : DEFAULT_SPIFFE_HEADER_NAME;
+    }
+}