Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(build-env): add libpam to tdp-builder #100

Merged
merged 1 commit into from
Oct 25, 2024
Merged

feat(build-env): add libpam to tdp-builder #100

merged 1 commit into from
Oct 25, 2024

Conversation

PACordonnier
Copy link
Member

@PACordonnier PACordonnier commented Oct 21, 2024

Apache Ranger pom.xml has a profile enabled if the lib pam headers are found on the host/. This profile enables the module unixauthpam.

This module simply compile a .c file, and the resulting binary is included in the distributed .tar.gz

This binary can then be used as an auth provider for the unixauthservice of the ranger-usersync. This binary uses Linux PAM as an authentication provider.

While this module is really not mandatory, I think it is worth bundling. Also it is built this way by other distros.

@PACordonnier
Copy link
Member Author

PACordonnier commented Oct 21, 2024

Some more details regarding the module unixauthpam.

By default, ranger-usersync exposes on port 5151 an Authentication Service. One can contact the port using TCP ( secured by TLS by default in TDP) and send a login attempt like this "LOGIN: <mylogin> <mypassword>". The service then challenges the authentication, and send back "OK" if working, "ERROR" if not.

The default authentication backend is unixauthnative, which simply checks the credentials against the file /etc/shadow found on the host.

It is possible to modify the authentication backend using the configuration ranger.usersync.passwordvalidator.path. The service simply executes the file, and send the credentials to the process through STDIN.

unixauthpam is simply another authprovider that uses PAM modules, namely ranger-remote (which can be linked to module login). Using PAM instead of /etc/shadow enables the use of SSSD.

Ranger Admin is compatible with this ranger-usersync authentication provider. There are 4 authentication providers for Ranger (LDAP, AD, PAM or UNIX). Unix is the one that uses this mechanism.

I wont go much further of why this can be useful, the purpose of this PR is simply to enable the build and packaging of the code given by Apache Ranger into TDP bundles.

@rpignolet rpignolet merged commit 09d5bc1 into main Oct 25, 2024
1 check passed
@rpignolet rpignolet deleted the add-libpam branch October 25, 2024 12:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants