Skip to content

RANGER-5534: added validation logic for username and groupname for usersync process #903

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sneethiraj wants to merge 3 commits into
base: master
Choose a base branch
from
+86 −3
Open

RANGER-5534: added validation logic for username and groupname for usersync process #903

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2b80128
RANGER-5534: added validation logic for username and groupname for us…
sneethiraj Apr 1, 2026
a8b548f
RANGER-5534: replaced the regEx for user and group validations with m…
sneethiraj Apr 1, 2026
a60f56a
Merge remote-tracking branch 'upstream/master' into RANGER-5534
sneethiraj Apr 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions ugsync/src/main/java/org/apache/ranger/unixusersync/config/UserGroupSyncConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,16 @@ public class UserGroupSyncConfig {
private static final String SSL_KEYSTORE_PATH_PASSWORD_ALIAS = "usersync.ssl.key.password";
private static final String SSL_TRUSTSTORE_PATH_PASSWORD_ALIAS = "usersync.ssl.truststore.password";

private static final String UGSYNC_USERNAME_VALIDATION_REGEX_PROPERTY_NAME = "ranger.usersync.username.validation.regEx";
private static final String UGSYNC_GROUPNAME_VALIDATION_REGEX_PROPERTY_NAME = "ranger.usersync.groupname.validation.regEx";
private static final String UGSYNC_USERNAME_VALIDATE_PROPERTY_NAME = "ranger.usersync.username.validation.enabled";
private static final String UGSYNC_GROUPNAME_VALIDATE_PROPERTY_NAME = "ranger.usersync.groupname.validation.enabled";

private static final String DEFAULT_REGEX_USERNAME_VALIDATOR = "^[\\p{L}\\p{Mn}\\p{Nd}\\._-]{3,64}$" ;
private static final String DEFAULT_REGEX_GROUPNAME_VALIDATOR = "^[\\p{L}\\p{N}._\\-\\s]{1,256}$" ;
private static final boolean DEFAULT_USERNAME_VALIDATE_ENABLED = true ;
private static final boolean DEFAULT_GROUPNAME_VALIDATE_ENABLED = true ;

private static volatile UserGroupSyncConfig me;
private final Properties prop = new Properties();
private Configuration userGroupConfig;
Expand Down Expand Up @@ -1438,4 +1448,29 @@ private int getIntProperty(Properties prop, String key, int defaultValue) {

return ret;
}

public boolean isUserNameValidateEnabled() {
boolean ret = DEFAULT_USERNAME_VALIDATE_ENABLED ;
String validate = prop.getProperty(UGSYNC_USERNAME_VALIDATE_PROPERTY_NAME) ;
if (validate != null) {
ret = Boolean.parseBoolean(validate);
}
return ret;
}
public boolean isGroupNameValidateEnabled() {
boolean ret = DEFAULT_GROUPNAME_VALIDATE_ENABLED ;
String validate = prop.getProperty(UGSYNC_GROUPNAME_VALIDATE_PROPERTY_NAME) ;
if (validate != null) {
ret = Boolean.parseBoolean(validate);
}
return ret;
}

public String getUserNameValidateRegEx() {
return prop.getProperty(UGSYNC_USERNAME_VALIDATION_REGEX_PROPERTY_NAME,DEFAULT_REGEX_USERNAME_VALIDATOR) ;
}

public String getGroupNameValidateRegEx() {
return prop.getProperty(UGSYNC_GROUPNAME_VALIDATION_REGEX_PROPERTY_NAME,DEFAULT_REGEX_GROUPNAME_VALIDATOR) ;
}
}
36 changes: 33 additions & 3 deletions ugsync/src/main/java/org/apache/ranger/unixusersync/process/UnixUserGroupBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,10 @@ public class UnixUserGroupBuilder implements UserGroupSource {
private UnixSyncSourceInfo unixSyncSourceInfo;
private boolean isStartupFlag;
private boolean computeDeletes;
private String regExUserNameValidator;
private String regExGroupNameValidator;
private boolean validateUserName;
private boolean validateGroupName;

Set<String> allGroups = new HashSet<>();

Expand All @@ -96,6 +100,11 @@ public UnixUserGroupBuilder() {
unixGroupFile = config.getUnixGroupFile();
timeout = config.getUpdateMillisMin();
enumerateGroupMembers = config.isGroupEnumerateEnabled();
validateUserName = config.isUserNameValidateEnabled(); ;
validateGroupName = config.isGroupNameValidateEnabled() ;
regExUserNameValidator = config.getUserNameValidateRegEx() ;
regExGroupNameValidator = config.getGroupNameValidateRegEx(); ;


LOG.debug("Minimum UserId: {}, minimum GroupId: {}", minimumUserId, minimumGroupId);
}
Expand Down Expand Up @@ -330,6 +339,13 @@ private void buildUnixUserList(String command) throws Throwable {
continue;
}

if (validateUserName) {
if (!isValidUserName(userName)) {
LOG.warn("Ignoring Unix Username: [{}]: failed to confirm to validation-pattern: [{}]", userName, regExUserNameValidator);
Copy link
Copy Markdown
Contributor

@mneethiraj mneethiraj Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sneethiraj - this could result in usernames having valid non-English characters (accent characters, CJK character sets) to be skipped with default configuration. This can break environments already have such user names and group names.

Copy link
Copy Markdown
Member Author

@sneethiraj sneethiraj Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. We can implement the following regex validations that supports international char sets:

    private static final String DEFAULT_REGEX_USERNAME_VALIDATOR = "^[\\p{L}\\p{Mn}\\p{Nd}\\._-]{3,64}$" ;
    private static final String DEFAULT_REGEX_GROUPNAME_VALIDATOR = "^[\\p{L}\\p{N}._\\-\\s]{1,256}$"    ;

However, we need to document this as part of the upgrade to 2.8.1+ release that the username and groupname validations are defaulted to be ON with specific regex and customers are requested to review and modify if needed before deploying newer version of code.

Can you share your thoughts on the best approach to resolve this?

Copy link
Copy Markdown
Contributor

@vyommani vyommani Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I already fixed this issue as part of RANGER-5508 please check this fix and do let me know if it is completely different issue.

continue;
}
}

int numUserId;

try {
Expand Down Expand Up @@ -459,6 +475,13 @@ private void parseMembers(String line) {
return;
}

if (validateGroupName) {
if (!isValidGroupName(groupName)) {
LOG.warn("Ignoring Unix GroupName: [{}]: failed to confirm to validation-pattern: [{}]", groupName, regExGroupNameValidator);
return;
}
}

groupId2groupNameMap.put(groupId, groupName);

Map<String, String> groupAttrMap = new HashMap<>();
Expand Down Expand Up @@ -528,13 +551,13 @@ private void buildUnixGroupList(String allGroupsCmd, String groupCmd, boolean us

String command;

if (useGid) {
if (useGid) { //Linux will use this section of code
command = String.format(groupCmd, group.getKey());
} else {
} else { // Mac will use this section of code
command = String.format(groupCmd, group.getValue());
}

String[] cmd = new String[] {"bash", "-c", command + " " + group.getKey()};
String[] cmd = new String[] {"bash", "-c", command };

if (LOG.isDebugEnabled()) {
LOG.debug("Executing: {}", Arrays.toString(cmd));
Expand Down Expand Up @@ -592,4 +615,11 @@ private void buildUnixGroupList(String allGroupsCmd, String groupCmd, boolean us
LOG.debug("Done adding extra groups");
}
}
private boolean isValidUserName(String aUserName) {
return (aUserName != null && aUserName.matches(regExUserNameValidator)) ;
}

private boolean isValidGroupName(String aGroupName) {
return (aGroupName != null && aGroupName.matches(regExGroupNameValidator)) ;
}
}
18 changes: 18 additions & 0 deletions unixauthservice/conf.dist/ranger-ugsync-default.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,4 +73,22 @@
<name>ranger.usersync.dest.ranger.session.cookie.name</name>
<value>RANGERADMINSESSIONID</value>
</property>
<property>
<name>ranger.usersync.username.validation.enabled</name>
<value>true</value>
</property>
<property>
<name>ranger.usersync.username.validation.regEx</name>
<!-- <value>^[a-z_][a-z0-9_-]{0,31}$</value> -->
<values>^[\p{L}\p{Mn}\p{Nd}\._-]{3,64}$</values>
</property>
<property>
<name>ranger.usersync.groupname.validation.enabled</name>
<value>true</value>
</property>
<property>
<name>ranger.usersync.groupname.validation.regEx</name>
<!-- <value>^[a-z][a-z0-9-]{0,30}$</value> -->
<value>^[\p{L}\p{N}._\-\s]{1,256}$</value>
</property>
</configuration>
Loading