DRILL-8548: Integrate Apache Ranger authorization for Drill

auth/drill-ranger-plugin-shim/pom.xml

@@ -0,0 +1,99 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>org.apache.drill</groupId>
+    <artifactId>auth-parent</artifactId>
+    <version>1.23.0-SNAPSHOT</version>
+  </parent>
+
+  <artifactId>drill-ranger-plugin-shim</artifactId>
+  <name>Drill : Ranger Drill Plugin Shim</name>
+  <description>
+    Thin shim between the Drillbit and the drill-ranger-plugin authorization
+    module. Lives on the Drillbit's main classpath and implements the
+    org.apache.drill.exec.security.spi.AccessAuthorizer SPI; delegates all
+    calls to DrillAccessControl (in drill-ranger-plugin) via reflection
+    through an isolated DrillRangerPluginClassLoader.
+
+    Mirrors Presto's ranger-presto-plugin-shim in the Ranger repository:
+      - drill-ranger-plugin-shim : Drillbit main classpath (this module)
+      - drill-ranger-plugin      : RangerPluginClassLoader isolated directory
+                                   (jars/ranger-drill-plugin-impl/)
+
+    The shim deliberately has NO compile-time dependency on
+    drill-ranger-plugin: DrillAccessControl is referenced only via a string
+    constant and reflection, so the two jars are coupled solely at runtime
+    through the plugin classloader.
+
+    The Drillbit discovers this module's RangerAccessAuthorizerFactory via
+    META-INF/services (ServiceLoader) registered in this jar.
+  </description>
+
+  <dependencies>
+    <!--
+      Drill engine authorization SPI (AccessAuthorizer / AccessAuthorizerFactory /
+      UserIdentity / AccessType), extracted into the standalone JDK-only
+      drill-security-spi module. Provided scope: at runtime the classes are
+      supplied by drill-security-spi.jar on the Drillbit classpath (jars/).
+      This is also the artifact the plugin side (drill-ranger-plugin) compiles
+      against — the plugin classloader's parent fallback resolves these types
+      to the same Class objects at runtime, so the shim can cast the
+      reflectively-created DrillAccessControl instance to AccessAuthorizer.
+    -->
+    <dependency>
+      <groupId>org.apache.drill</groupId>
+      <artifactId>drill-security-spi</artifactId>
+      <version>${project.version}</version>
+      <scope>provided</scope>
+    </dependency>
+    <!--
+      Base RangerPluginClassLoader that DrillRangerPluginClassLoader extends.
+      Provided scope: at runtime the jar is shipped in jars/3rdparty/ by the
+      distribution assembly.
+    -->
+    <dependency>
+      <groupId>org.apache.ranger</groupId>
+      <artifactId>ranger-plugin-classloader</artifactId>
+      <version>${ranger.version}</version>
+      <scope>provided</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-api</artifactId>
+      <scope>provided</scope>
+    </dependency>
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <version>${mockito.version}</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+</project>

auth/drill-ranger-plugin-shim/src/main/java/org/apache/drill/exec/security/ranger/DrillRangerPluginClassLoader.java

@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.drill.exec.security.ranger;
+
+import org.apache.ranger.plugin.classloader.RangerPluginClassLoader;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.List;
+
+/**
+ * A {@link RangerPluginClassLoader} subclass that blocks the Jersey 3.1.9
+ * MultiPart SPI from leaking into the Jersey 2.35 Ranger client via the
+ * parent (Drillbit) classpath.
+ */
+public final class DrillRangerPluginClassLoader extends RangerPluginClassLoader {
+
+  private static final Logger logger = LoggerFactory.getLogger(DrillRangerPluginClassLoader.class);
+
+  /**
+   * SPI resource name that Jersey's {@code ServiceFinder} scans to locate
+   * auto-discoverable providers. Jersey 2.35 and 3.1.9 share this file
+   * name (the SPI contract is package-private and unchanged across the
+   * two versions).
+   */
+  private static final String AUTODISCOVERABLE_SPI =
+      "META-INF/services/org.glassfish.jersey.internal.spi.AutoDiscoverable";
+
+  /**
+   * FQN that exists only in Jersey 3.x. Its presence in an
+   * {@code AutoDiscoverable} SPI file is a reliable marker that the file
+   * comes from a Jersey 3.1.9 jar on the Drillbit classpath and must be
+   * hidden from the 2.35 {@code ServiceFinder}.
+   */
+  private static final String JERSEY3_MULTIPART_MARKER =
+      "org.glassfish.jersey.media.multipart.MultiPartFeatureAutodiscoverable";
+
+  public DrillRangerPluginClassLoader(String pluginType, Class<?> pluginClass) throws Exception {
+    super(pluginType, pluginClass);
+    logger.info("DrillRangerPluginClassLoader initialized for plugin type: {}", pluginType);
+  }
+
+  /**
+   * Returns merged child+component resources, with the Jersey 3.1.9
+   * MultiPart {@code AutoDiscoverable} SPI entry removed when present.
+   *
+   * <p>Non-SPI resources are returned unchanged so that Ranger's own
+   * resource lookups (configuration files, native libraries, etc.) are
+   * not affected.</p>
+   */
+  @Override
+  public Enumeration<URL> findResources(String name) {
+    // Base RangerPluginClassLoader.findResources does not declare IOException,
+    // so super.findResources cannot throw it either; no try/catch needed.
+    Enumeration<URL> merged = super.findResources(name);
+    if (!AUTODISCOVERABLE_SPI.equals(name)) {
+      return merged;
+    }
+    List<URL> kept = new ArrayList<>();
+    while (merged.hasMoreElements()) {
+      URL url = merged.nextElement();
+      if (!declaresJersey3Multipart(url)) {
+        kept.add(url);
+      } else {
+        logger.debug("Filtered Jersey 3.1.9 MultiPart AutoDiscoverable SPI entry: {}", url);
+      }
+    }
+    return Collections.enumeration(kept);
+  }
+
+  /**
+   * Returns {@code true} if the given SPI resource URL declares the
+   * Jersey 3.x {@code MultiPartFeatureAutodiscoverable} FQN.
+   *
+   * <p>If the URL cannot be read, conservatively returns {@code false}
+   * (keep the entry) to avoid accidentally dropping a legitimate SPI
+   * file that might be unreadable due to transient I/O conditions.</p>
+   */
+  private boolean declaresJersey3Multipart(URL url) {
+    try (BufferedReader reader = new BufferedReader(
+        new InputStreamReader(url.openStream(), StandardCharsets.UTF_8))) {
+      String line;
+      while ((line = reader.readLine()) != null) {
+        // SPI files use FQNs (optionally with comment/whitespace); a plain
+        // contains() check is sufficient and avoids false negatives from
+        // edge-case formatting (trailing spaces, trailing comments).
+        if (line.contains(JERSEY3_MULTIPART_MARKER)) {
+          return true;
+        }
+      }
+    } catch (IOException e) {
+      logger.warn("Could not read SPI entry {} to inspect content; keeping it", url, e);
+      return false;
+    }
+    return false;
+  }
+}