Kyuubi AuthZ Plugin For Spark SQL Solr Kerberos

[RusbNoit]

Hi!

Is possible configure Ranger plugin to store audit in Solr (+Zookeeper) with Kerberos?

We build mvn clean package -pl :kyuubi-spark-authz_2.12 -DskipTests -Dspark.version=3.3.2 for Spark 3.3.2

and get error:

23/12/14 14:30:46 ERROR BaseAuditHandler: Error sending message to Solr

java.lang.Exception: Login failed due to: Unable to login with spark/ [email protected] due to: No CallbackHandler available to garner authentication information from the user

    at org.apache.ranger.audit.utils.KerberosAction.execute(KerberosAction.java:57)

    at org.apache.ranger.audit.destination.SolrAuditDestination.addDocsToSolr(SolrAuditDestination.java:460)

    at org.apache.ranger.audit.destination.SolrAuditDestination.log(SolrAuditDestination.java:243)

    at org.apache.ranger.audit.provider.BaseAuditHandler.logJSON(BaseAuditHandler.java:193)

    at org.apache.ranger.audit.queue.AuditFileSpool.sendEvent(AuditFileSpool.java:880)

    at org.apache.ranger.audit.queue.AuditFileSpool.runLogAudit(AuditFileSpool.java:827)

    at org.apache.ranger.audit.queue.AuditFileSpool.run(AuditFileSpool.java:757)

    at java.lang.Thread.run(Thread.java:750)

Caused by: javax.security.auth.login.LoginException: Unable to login with spark/[email protected] due to: No CallbackHandler available to garner authentication information from the user

    at com.sun.security.auth.module.Krb5LoginModule.promptForPass(Krb5LoginModule.java:907)

    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:766)

    at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:618)

    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

    at java.lang.reflect.Method.invoke(Method.java:498)

    at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755)

    at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195)

    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682)

    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:680)

    at java.security.AccessController.doPrivileged(Native Method)

    at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)

    at javax.security.auth.login.LoginContext.login(LoginContext.java:587)

    at org.apache.ranger.audit.utils.AbstractKerberosUser.login(AbstractKerberosUser.java:82)

    at org.apache.ranger.audit.utils.KerberosAction.execute(KerberosAction.java:54)

    ... 7 more

23/12/14 14:30:46 ERROR AuditFileSpool: Error sending logs to consumer. provider=sparkSql.async.batch, consumer=sparkSql.async.batch.solr

    <property>

            <name>xasecure.audit.destination.solr</name>

            <value>true</value>

    </property>

    <property>

            <name>xasecure.audit.destination.solr.batch.filespool.dir</name>

            <value>/srv/ranger/spark3_plugin/audit_solr_spool</value>

    </property>

    <property>

            <name>xasecure.audit.destination.solr.force.use.inmemory.jaas.config</name>

            <value>True</value>

    </property>

    <property>

            <name>xasecure.audit.destination.solr.zookeepers</name>

            <value>master.domain.net:2181/solr.server</value>

    </property>

    <property>

            <name>xasecure.audit.is.enabled</name>

            <value>True</value>

    </property>

    <property>

            <name>xasecure.audit.jaas.Client.loginModuleControlFlag</name>

            <value>required</value>

    </property>

    <property>

            <name>xasecure.audit.jaas.Client.loginModuleName</name>

            <value>com.sun.security.auth.module.Krb5LoginModule</value>

    </property>

    <property>

            <name>xasecure.audit.jaas.Client.option.keyTab</name>

            <value>/etc/security/keytabs/spark.service.keytab</value>

    </property>

    <property>

            <name>xasecure.audit.jaas.Client.option.principal</name>

            <value>spark/[[email protected]](mailto:[email protected])</value>

    </property>

    <property>

            <name>xasecure.audit.jaas.Client.option.serviceName</name>

            <value>solr</value>

    </property>

    <property>

            <name>xasecure.audit.jaas.Client.option.storeKey</name>

            <value>False</value>

    </property>

    <property>

            <name>xasecure.audit.jaas.Client.option.useKeyTab</name>

            <value>True</value>

    </property>

[RusbNoit]

How build AuthZ plugin for scala 2.13 ?

[RusbNoit]

How build AuthZ plugin for scala 2.13 ?
Found solution in #5189