[ADH-4642]: Implement Ranger plugin for SSM

conf/ranger-ssm-audit.xml

@@ -0,0 +1,51 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+<configuration>
+    <!-- DB audit provider configuration -->
+    <property>
+        <name>xasecure.audit.destination.db</name>
+        <value>false</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.jdbc.driver</name>
+        <value>com.mysql.jdbc.Driver</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.password</name>
+        <value>rangerlogger</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.user</name>
+        <value>rangerlogger</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.batch.filespool.dir</name>
+        <value>/tmp/audit/db/spool</value>
+    </property>
+
+    <!-- HDFS audit provider configuration -->
+    <property>
+        <name>xasecure.audit.destination.hdfs</name>
+        <value>false</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.hdfs.batch.filespool.dir</name>
+        <value>/tmp/audit/hdfs/spool</value>
+    </property>
+
+    <!-- Log4j audit provider configuration -->
+    <property>
+        <name>xasecure.audit.destination.log4j</name>
+        <value>true</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.log4j.logger</name>
+        <value>ranger_audit_logger</value>
+    </property>
+</configuration>

conf/ranger-ssm-security.xml

@@ -0,0 +1,76 @@
+<?xml version="1.0"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+<configuration>
+
+    <property>
+        <name>ranger.plugin.ssm.service.name</name>
+        <value>ssm</value>
+        <description>
+            Name of the Ranger service containing policies for this ssm instance
+        </description>
+    </property>
+
+    <property>
+        <name>ranger.plugin.ssm.policy.source.impl</name>
+        <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value>
+        <description>
+            Class to retrieve policies from the source
+        </description>
+    </property>
+
+    <property>
+        <name>ranger.plugin.ssm.policy.rest.ssl.config.file</name>
+        <value>ranger-policymgr-ssl.xml</value>
+        <description>
+            Path to the file containing SSL details to contact Ranger Admin
+        </description>
+    </property>
+
+    <property>
+        <name>ranger.plugin.ssm.policy.pollIntervalMs</name>
+        <value>30000</value>
+        <description>
+            How often to poll for changes in policies?
+        </description>
+    </property>
+
+    <property>
+        <name>ranger.plugin.ssm.policy.cache.dir</name>
+        <value>/tmp</value>
+        <description>
+            Directory where Ranger policies are cached after successful retrieval from the source
+        </description>
+    </property>
+
+    <property>
+        <name>ranger.plugin.ssm.policy.rest.client.connection.timeoutMs</name>
+        <value>120000</value>
+        <description>
+            RangerRestClient Connection Timeout in Milli Seconds
+        </description>
+    </property>
+
+    <property>
+        <name>ranger.plugin.ssm.policy.rest.client.read.timeoutMs</name>
+        <value>30000</value>
+        <description>
+            RangerRestClient read Timeout in Milli Seconds
+        </description>
+    </property>
+</configuration>

conf/smart-default.xml

@@ -526,6 +526,14 @@
     </description>
   </property>
 
+  <property>
+    <name>smart.rest.server.auth.ranger.enabled</name>
+    <value>false</value>
+    <description>
+      Whether to enable Apache Ranger authorization for SSM REST server.
+    </description>
+  </property>
+
   <property>
     <name>smart.action.client.cache.ttl</name>
     <value>10m</value>

conf/ssm-ranger.json

@@ -0,0 +1,145 @@
+{
+  "name": "ssm",
+  "label": "SSM Service",
+  "description": "SSM Ranger Security Plugin",
+  "guid": "b8290b7f-6f69-44a9-89cc-06b6975ea676",
+  "implClass": "io.arenadata.ranger.service.ssm.SsmRangerService",
+  "version": 1,
+  "isEnabled": 1,
+  "resources": [
+    {
+      "itemId": 1,
+      "name": "cluster",
+      "type": "string",
+      "level": 10,
+      "parent": "",
+      "mandatory": false,
+      "lookupSupported": true,
+      "recursiveSupported": true,
+      "excludesSupported": true,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
+      "matcherOptions": {
+        "wildCard": true,
+        "ignoreCase": true
+      },
+      "validationRegEx": "",
+      "validationMessage": "",
+      "uiHint": "",
+      "label": "Cluster",
+      "description": "List of SSM cluster nodes",
+      "accessTypeRestrictions": [
+        "VIEW"
+      ]
+    },
+    {
+      "itemId": 2,
+      "name": "rule",
+      "type": "string",
+      "level": 10,
+      "parent": "",
+      "mandatory": false,
+      "lookupSupported": true,
+      "recursiveSupported": true,
+      "excludesSupported": true,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
+      "matcherOptions": {
+        "wildCard": true,
+        "ignoreCase": true
+      },
+      "validationRegEx": "",
+      "validationMessage": "",
+      "uiHint": "",
+      "label": "Rule",
+      "description": "Rule",
+      "accessTypeRestrictions": [
+        "VIEW",
+        "CREATE",
+        "DELETE",
+        "EDIT"
+      ]
+    },
+    {
+      "itemId": 3,
+      "name": "action",
+      "type": "string",
+      "level": 10,
+      "parent": "",
+      "mandatory": false,
+      "lookupSupported": true,
+      "recursiveSupported": true,
+      "excludesSupported": true,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
+      "matcherOptions": {
+        "wildCard": true,
+        "ignoreCase": true
+      },
+      "validationRegEx": "",
+      "validationMessage": "",
+      "uiHint": "",
+      "label": "Action",
+      "description": "Action",
+      "accessTypeRestrictions": [
+        "VIEW", "SUBMIT"
+      ]
+    },
+    {
+      "itemId": 4,
+      "name": "audit",
+      "type": "string",
+      "level": 10,
+      "parent": "",
+      "mandatory": false,
+      "lookupSupported": true,
+      "recursiveSupported": true,
+      "excludesSupported": true,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerDefaultResourceMatcher",
+      "matcherOptions": {
+        "wildCard": true,
+        "ignoreCase": true
+      },
+      "validationRegEx": "",
+      "validationMessage": "",
+      "uiHint": "",
+      "label": "Audit",
+      "description": "Audit",
+      "accessTypeRestrictions": [
+        "VIEW"
+      ]
+    }
+  ],
+  "accessTypes": [
+    {
+      "itemId": 1,
+      "name": "VIEW",
+      "label": "View"
+    },
+    {
+      "itemId": 2,
+      "name": "CREATE",
+      "label": "Create"
+    },
+    {
+      "itemId": 3,
+      "name": "DELETE",
+      "label": "Delete"
+    },
+    {
+      "itemId": 4,
+      "name": "EDIT",
+      "label": "Edit"
+    },
+    {
+      "itemId": 5,
+      "name": "SUBMIT",
+      "label": "Submit action"
+    }
+  ],
+  "configs": [
+  ],
+  "enums": [
+  ],
+  "contextEnrichers": [
+  ],
+  "policyConditions": [
+  ]
+}

pom.xml

@@ -54,6 +54,7 @@
     <module>smart-dist</module>
     <module>smart-integration</module>
     <module>smart-web-server</module>
+    <module>smart-ranger-plugin</module>
     <module>smart-hadoop-support</module>
   </modules>
 
@@ -109,6 +110,8 @@
     <cache2k.version>2.6.1.Final</cache2k.version>
     <smart.hadoop.artifact>smart-hadoop-3.3</smart.hadoop.artifact>
     <smart.hadoop.client.artifact>smart-hadoop-client-3</smart.hadoop.client.artifact>
+    <ranger.version>2.4.0</ranger.version>
+    <ranger.jna.version>5.8.0</ranger.jna.version>
     <maven-replacer-plugin.version>1.5.3</maven-replacer-plugin.version>
     <hadoop-thirdparty-shaded.prefix>org.apache.hadoop.thirdparty</hadoop-thirdparty-shaded.prefix>
     <hadoop-thirdparty-shaded.protobuf.prefix>${hadoop-thirdparty-shaded.prefix}.protobuf</hadoop-thirdparty-shaded.protobuf.prefix>

smart-integration/src/test/resources/ranger-ssm-audit.xml

@@ -0,0 +1,63 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
+<configuration>
+    <!-- DB audit provider configuration -->
+    <property>
+        <name>xasecure.audit.destination.db</name>
+        <value>false</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.jdbc.driver</name>
+        <value>com.mysql.jdbc.Driver</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.jdbc.url</name>
+        <value>jdbc:mysql://10.92.3.109/ranger_audit</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.password</name>
+        <value>rangerlogger</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.user</name>
+        <value>rangerlogger</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.db.batch.filespool.dir</name>
+        <value>/tmp/audit/db/spool</value>
+    </property>
+
+
+    <!-- HDFS audit provider configuration -->
+    <property>
+        <name>xasecure.audit.destination.hdfs</name>
+        <value>false</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.hdfs.dir</name>
+        <value>hdfs://10.92.3.109:8020/ranger/audit</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.hdfs.batch.filespool.dir</name>
+        <value>/tmp/audit/hdfs/spool</value>
+    </property>
+
+
+    <!-- Log4j audit provider configuration -->
+    <property>
+        <name>xasecure.audit.destination.log4j</name>
+        <value>true</value>
+    </property>
+
+    <property>
+        <name>xasecure.audit.destination.log4j.logger</name>
+        <value>ranger_audit_logger</value>
+    </property>
+</configuration>