apache · kumaab · Aug 14, 2026
diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-mysql.properties
@@ -119,6 +119,3 @@ audit_jaas_client_option_useTicketCache=true
 audit_jaas_client_option_serviceName=ranger
 audit_jaas_client_option_keyTab=/etc/keytabs/rangeradmin.keytab
 audit_jaas_client_option_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
-
-#-- SSO Configs --#
-sso_enabled=true
diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-oracle.properties
@@ -120,6 +120,3 @@ audit_jaas_client_option_useTicketCache=true
 audit_jaas_client_option_serviceName=ranger
 audit_jaas_client_option_keyTab=/etc/keytabs/rangeradmin.keytab
 audit_jaas_client_option_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
-
-#-- SSO Configs --#
-sso_enabled=true
diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-postgres.properties
@@ -126,6 +126,3 @@ audit_jaas_client_option_serviceName=
 audit_jaas_client_option_useTicketCache=false
 audit_jaas_client_option_keyTab=/etc/keytabs/rangeradmin.keytab
 audit_jaas_client_option_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
-
-#-- SSO Configs --#
-sso_enabled=true
diff --git a/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties b/dev-support/ranger-docker/scripts/admin/ranger-admin-install-sqlserver.properties
@@ -117,6 +117,3 @@ audit_jaas_client_1_option_useTicketCache=true
 audit_jaas_client_1_option_serviceName=ranger
 audit_jaas_client_1_option_keyTab=/etc/keytabs/rangeradmin.keytab
 audit_jaas_client_1_option_principal=rangeradmin/ranger.rangernw@EXAMPLE.COM
-
-#-- SSO Configs --#
-sso_enabled=true
diff --git a/security-admin/scripts/install.properties b/security-admin/scripts/install.properties
@@ -256,14 +256,15 @@ audit_jaas_client_option_keyTab=
 audit_jaas_client_option_principal=
 hadoop_conf=/etc/hadoop/conf
 #
-#-------- SSO CONFIG - Start ------------------
+#-------- JWT (Bearer token) AUTH CONFIG - Start ------------------
+# JWT authentication (RANGER-3739) activates automatically when a provider URL or public key is configured.
+# Leave both empty to disable JWT authentication.
 #
-sso_enabled=false
-sso_providerurl=https://127.0.0.1:8443/gateway/knoxsso/api/v1/websso
-sso_publickey=
+jwt_providerurl=
+jwt_publickey=
 
 #
-#-------- SSO CONFIG - END ------------------
+#-------- JWT (Bearer token) AUTH CONFIG - END ------------------
 
 # Custom log directory path
 RANGER_ADMIN_LOG_DIR=$PWD

diff --git a/security-admin/scripts/setup.sh b/security-admin/scripts/setup.sh
@@ -172,9 +172,8 @@ sqlserver_audit_file=$(get_prop 'sqlserver_audit_file' $PROPFILE)
 sqlanywhere_core_file=$(get_prop 'sqlanywhere_core_file' $PROPFILE)
 sqlanywhere_audit_file=$(get_prop 'sqlanywhere_audit_file' $PROPFILE)
 cred_keystore_filename=$(eval echo "$(get_prop 'cred_keystore_filename' $PROPFILE)")
-sso_enabled=$(get_prop 'sso_enabled' $PROPFILE)
-sso_providerurl=$(get_prop 'sso_providerurl' $PROPFILE)
-sso_publickey=$(get_prop 'sso_publickey' $PROPFILE)
+jwt_providerurl=$(get_prop 'jwt_providerurl' $PROPFILE)
+jwt_publickey=$(get_prop 'jwt_publickey' $PROPFILE)
 FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION=$(get_prop_or_default 'FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION' $PROPFILE 'false')
 RANGER_ADMIN_LOG_DIR=$(eval echo "$(get_prop 'RANGER_ADMIN_LOG_DIR' $PROPFILE)")
 RANGER_ADMIN_LOGBACK_CONF_FILE=$(eval echo "$(get_prop 'RANGER_ADMIN_LOGBACK_CONF_FILE' $PROPFILE)")
@@ -1059,38 +1058,9 @@ update_properties() {
 	updatePropertyToFilePyIfNotEmpty 'xasecure.audit.jaas.Client.option.keyTab' "$(get_prop_or_default 'audit_jaas_client_option_keyTab' $PROPFILE '')" $to_file_ranger
 	updatePropertyToFilePyIfNotEmpty 'xasecure.audit.jaas.Client.option.principal' "$(get_prop_or_default 'audit_jaas_client_option_principal' $PROPFILE '')" $to_file_ranger
 
-	if [ "${sso_enabled}" == "" ]
-	then
-		sso_enabled="false"
-	fi
-
-	sso_enabled=`echo $sso_enabled | tr '[:upper:]' '[:lower:]'`
-
-	if [ "${sso_enabled}" == "true" ]
-	then
-		if [ "${sso_providerurl}" == "" ] || [ "${sso_publickey}" == "" ]
-		then
-			log "[E] Please provide valid values in SSO config properties!";
-			exit 1
-		fi
-		propertyName=ranger.sso.enabled
-		newPropertyValue="${sso_enabled}"
-		updatePropertyToFilePy $propertyName "${newPropertyValue}" $to_file_ranger
-
-		propertyName=ranger.sso.providerurl
-		newPropertyValue="${sso_providerurl}"
-		updatePropertyToFilePy $propertyName "${newPropertyValue}" $to_file_ranger
-
-		propertyName=ranger.sso.publicKey
-		newPropertyValue="${sso_publickey}"
-		updatePropertyToFilePy $propertyName "${newPropertyValue}" $to_file_ranger
-
-	 else
-                propertyName=ranger.sso.enabled
-                newPropertyValue="false"
-                updatePropertyToFilePy $propertyName "${newPropertyValue}" $to_file_ranger
-
-	fi
+	# JWT (Bearer token) authentication (RANGER-3739) activates automatically when a provider URL or public key is set.
+	updatePropertyToFilePyIfNotEmpty 'ranger.admin.jwt.providerurl' "${jwt_providerurl}" $to_file_ranger
+	updatePropertyToFilePyIfNotEmpty 'ranger.admin.jwt.publickey' "${jwt_publickey}" $to_file_ranger
 
 	ff_enable_ozone_action_matches_condition=$(echo "${FF_ENABLE_OZONE_ACTION_MATCHES_CONDITION}" | tr '[:upper:]' '[:lower:]')
 	if [ "${ff_enable_ozone_action_matches_condition}" != "true" ]

diff --git a/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java b/security-admin/src/main/java/org/apache/ranger/biz/RangerBizUtil.java
@@ -1088,16 +1088,6 @@ public boolean checkUserAccessible(VXUser vXUser) {
         return isAccessible;
     }
 
-    public boolean isSSOEnabled() {
-        UserSessionBase session = ContextUtil.getCurrentUserSession();
-
-        if (session != null) {
-            return session.isSSOEnabled() == null ? PropertiesUtil.getBooleanProperty("ranger.sso.enabled", false) : session.isSSOEnabled();
-        } else {
-            throw restErrorUtil.createRESTException("User session is not created", MessageEnums.OPER_NOT_ALLOWED_FOR_STATE);
-        }
-    }
-
     public boolean isUserAllowed(RangerService rangerService, String cfgNameAllowedUsers) {
         Map<String, String> map         = rangerService.getConfigs();
         String              user        = null;

diff --git a/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java b/security-admin/src/main/java/org/apache/ranger/biz/SessionMgr.java
@@ -121,7 +121,7 @@ public UserSessionBase processSuccessLogin(int authType, String userAgent, HttpS
         }
 
         if (newSessionCreation) {
-            getSSOSpnegoAuthCheckForAPI(currentLoginId, httpRequest);
+            createExternalUserIfAbsent(currentLoginId, authType, httpRequest);
 
             // Need to build the UserSession
             XXPortalUser gjUser = daoManager.getXXPortalUser().findByLoginId(currentLoginId);
@@ -188,20 +188,6 @@ public UserSessionBase processSuccessLogin(int authType, String userAgent, HttpS
                 userSession.setSpnegoEnabled(true);
             }
 
-            boolean ssoEnabled;
-
-            if (authType == XXAuthSession.AUTH_TYPE_TRUSTED_PROXY) {
-                ssoEnabled = true;
-            } else {
-                Object ssoEnabledObj = httpRequest.getAttribute("ssoEnabled");
-
-                ssoEnabled = ssoEnabledObj != null ? Boolean.parseBoolean(String.valueOf(ssoEnabledObj)) : PropertiesUtil.getBooleanProperty("ranger.sso.enabled", false);
-            }
-
-            logger.debug("session id = {} ssoenabled = {}", userSession.getLoginId(), ssoEnabled);
-
-            userSession.setSSOEnabled(ssoEnabled);
-
             resetUserSessionForProfiles(userSession);
             resetUserModulePermission(userSession);
 
@@ -522,23 +508,37 @@ protected XXAuthSession storeAuthSession(XXAuthSession gjAuthSession) {
         return dbMAuthSession;
     }
 
-    private void getSSOSpnegoAuthCheckForAPI(String currentLoginId, HttpServletRequest request) {
-        RangerSecurityContext context    = RangerContextHolder.getSecurityContext();
-        UserSessionBase       session    = context != null ? context.getUserSession() : null;
-        boolean               ssoEnabled = session != null ? session.isSSOEnabled() : PropertiesUtil.getBooleanProperty("ranger.sso.enabled", false);
-        XXPortalUser          gjUser     = daoManager.getXXPortalUser().findByLoginId(currentLoginId);
-
-        if (gjUser == null && ((request.getAttribute("spnegoEnabled") != null && (boolean) request.getAttribute("spnegoEnabled")) || (ssoEnabled))) {
-            logger.debug("User : {} doesn't exist in Ranger DB So creating user as it's SSO or Spnego authenticated", currentLoginId);
+    /**
+     * Auto-provisions a Ranger DB user for externally-authenticated principals that do not yet exist.
+     * Provisioning is driven by the actual authentication mechanism of the request (SPNEGO/Kerberos,
+     * trusted-proxy header auth, JWT bearer auth, or the internal health-check user) rather than the
+     * removed {@code ranger.sso.enabled} flag. Password/LDAP/AD logins are never auto-provisioned here
+     * since those principals must already exist to authenticate.
+     */
+    private void createExternalUserIfAbsent(String currentLoginId, int authType, HttpServletRequest request) {
+        XXPortalUser gjUser = daoManager.getXXPortalUser().findByLoginId(currentLoginId);
 
+        if (gjUser == null) {
             if (bizUtil.isHealthCheckUser(currentLoginId)) {
+                logger.debug("User : {} doesn't exist in Ranger DB. Creating healthcheck user synchronously.", currentLoginId);
+
                 xUserMgr.createServiceConfigUserSynchronously(currentLoginId);
-            } else {
+            } else if (isExternallyAuthenticated(authType, request)) {
+                logger.debug("User : {} doesn't exist in Ranger DB. Creating user as it is externally authenticated (SPNEGO/trusted-proxy/JWT).", currentLoginId);
+
                 xUserMgr.createServiceConfigUser(currentLoginId);
             }
         }
     }
 
+    private boolean isExternallyAuthenticated(int authType, HttpServletRequest request) {
+        boolean spnegoEnabled    = request.getAttribute("spnegoEnabled") != null && Boolean.parseBoolean(String.valueOf(request.getAttribute("spnegoEnabled")));
+        boolean jwtAuthenticated = request.getAttribute("jwtAuthenticated") != null && Boolean.parseBoolean(String.valueOf(request.getAttribute("jwtAuthenticated")));
+        boolean trustedProxy     = authType == XXAuthSession.AUTH_TYPE_TRUSTED_PROXY;
+
+        return spnegoEnabled || jwtAuthenticated || trustedProxy;
+    }
+
     private void setUserRoles(UserSessionBase userSession) {
         List<String>           strRoleList = new ArrayList<>();
         List<XXPortalUserRole> roleList    = daoManager.getXXPortalUserRole().findByUserId(userSession.getUserId());

diff --git a/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java b/security-admin/src/main/java/org/apache/ranger/common/UserSessionBase.java
@@ -42,7 +42,6 @@ public class UserSessionBase implements Serializable {
     private int                  authProvider   = RangerConstants.USER_APP;
     private List<String>         userRoleList   = new ArrayList<>();
     private RangerUserPermission rangerUserPermission;
-    private Boolean              isSSOEnabled;
     private Boolean              isSpnegoEnabled = Boolean.FALSE;
 
     public Long getUserId() {
@@ -170,14 +169,6 @@ public void setRangerUserPermission(RangerUserPermission rangerUserPermission) {
         this.rangerUserPermission = rangerUserPermission;
     }
 
-    public Boolean isSSOEnabled() {
-        return isSSOEnabled;
-    }
-
-    public void setSSOEnabled(Boolean isSSOEnabled) {
-        this.isSSOEnabled = isSSOEnabled;
-    }
-
     public Boolean isSpnegoEnabled() {
         return isSpnegoEnabled;
     }

diff --git a/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java b/security-admin/src/main/java/org/apache/ranger/rest/ServiceREST.java
@@ -2948,13 +2948,6 @@ public List<RangerPolicy> getPoliciesWithMetaAttributes(List<RangerPolicy> polic
         return svcStore.getPoliciesWithMetaAttributes(policies);
     }
 
-    @GET
-    @Path("/checksso")
-    @Produces(MediaType.TEXT_PLAIN)
-    public String checkSSO() {
-        return String.valueOf(bizUtil.isSSOEnabled());
-    }
-
     @GET
     @Path("/csrfconf")
     @Produces("application/json")