RANGER-4458: Usersync Webapp, metrics and Docker changes by Sanket-Shelar · Pull Request #1103 · apache/ranger

Sanket-Shelar · 2026-07-22T13:39:20Z

What changes were proposed in this pull request?

Converted usersync to webapp module, added docker changes for usersync webapp and added metrics for usersync.

How was this patch tested?

Manual build passing and tested on docker.

RANGER-4458: Ranger Usersync - Convert to Web Application
RANGER-5701: Support for Usersync as WebApp in docker containers
RANGER-5702: Add/ Update metric details for Ranger UserSync

kumaab · 2026-07-22T15:40:00Z

Please add test scenarios that were tested in docker with this change. thanks.

Sanket-Shelar · 2026-07-23T11:55:50Z

Validated the following scenarios in the Docker environment:

UserSync with Unix source — confirmed the existing Unix-based sync flow continues to work as expected.
UserSync with LDAP source — verified LDAP sync using the local OpenLDAP setup.
UserSync metrics APIs — tested the new metrics endpoints and confirmed they respond as expected.
Please let me know if there are any additional scenarios you would like me to cover before this is merged.

Sanket-Shelar · 2026-08-04T08:38:41Z

The local build has passed successfully. With the updated patch I have also completed the following testing:

Verified the changes in a Docker environment using both Unix and LDAP sources.
Successfully tested the new usersync metrics APIs.

pradeepagrawal8184 · 2026-08-14T09:00:56Z

#	Severity	Location	Issue
1	Critical	`ranger-usersync-services.sh:100`	Log dir check uses literal `RANGER_USERSYNC_LOG_DIR` instead of `"${RANGER_USERSYNC_LOG_DIR}"`. Directory may never be created.
2	High	`spring-security.xml:26-36`	`/api/metrics/` has no `security="none"` or `permitAll`. Admin uses `<security:http pattern="/service/metrics/" security="none" />`. Metrics scraping may fail or redirect to `/login`.
3	High	`MetricCacheUtil.java`	`HashMap` counters are written from the sync thread and read from Tomcat/REST threads with no synchronization. Risk of lost updates or corruption.
4	High	`PolicyMgrUserGroupBuilder.getUserGroupAuditInfo()`	`AUDIT_COUNT_SUCCESS` is incremented unconditionally after failures; null responses can also NPE in `JsonUtils.jsonToObject()`.
5	High	`UserSyncMetricsWrapper.java`	Missing `RangerMetricsContainerSource` (KMS adds it explicitly). Tomcat connection/thread metrics won’t appear in Prometheus/JSON output.
6	High	`ranger_usersync.py`	Still launches `UnixAuthenticationService` with `lib/*` classpath. Ambari/Monarch installs won’t use the new webapp entry point.
7	High	`ranger-usersync-services.sh`	`VERSION` still uses `${cdir}/lib`; classpath still includes stale `${cdir}/lib/*` after assembly moved jars to `ews/lib`.

pradeepagrawal8184

Please check the above issues

kumaab

Thanks @Sanket-Shelar for the patch, added few comments.

kumaab · 2026-08-14T23:25:27Z

+
+    if [ ! -d RANGER_USERSYNC_LOG_DIR ]; then
+      mkdir -p $RANGER_USERSYNC_LOG_DIR
+      chmod 777 $RANGER_USERSYNC_LOG_DIR


777 gives all perms to everyone, use appropriate perms (minimally required).

Checked other scripts in the project and added permission 755

Sanket-Shelar · 2026-08-17T12:40:35Z

Severity Location Issue

1 Critical ranger-usersync-services.sh:100 Log dir check uses literal RANGER_USERSYNC_LOG_DIR instead of "${RANGER_USERSYNC_LOG_DIR}". Directory may never be created.
2 High spring-security.xml:26-36 /api/metrics/** has no security="none" or permitAll. Admin uses <security:http pattern="/service/metrics/**" security="none" />. Metrics scraping may fail or redirect to /login.
3 High MetricCacheUtil.java HashMap counters are written from the sync thread and read from Tomcat/REST threads with no synchronization. Risk of lost updates or corruption.
4 High PolicyMgrUserGroupBuilder.getUserGroupAuditInfo() AUDIT_COUNT_SUCCESS is incremented unconditionally after failures; null responses can also NPE in JsonUtils.jsonToObject().
5 High UserSyncMetricsWrapper.java Missing RangerMetricsContainerSource (KMS adds it explicitly). Tomcat connection/thread metrics won’t appear in Prometheus/JSON output.
6 High ranger_usersync.py Still launches UnixAuthenticationService with lib/* classpath. Ambari/Monarch installs won’t use the new webapp entry point.
7 High ranger-usersync-services.sh VERSION still uses ${cdir}/lib; classpath still includes stale ${cdir}/lib/* after assembly moved jars to ews/lib.

Addressed #1–#4, #6, and #7. For #5, we deferred RangerMetricsContainerSource because it depends on Admin/KMS’s server.tomcat.EmbeddedServer, which UserSync does not use; adding it broke Docker startup (NoClassDefFoundError). UserSync API/cache/sync metrics remain available;

pradeepagrawal8184 · 2026-08-19T16:33:30Z

+        }
+    }
+
+    public Map<String, Long> getMetric(MetricType metricType) {


Return defensive copies from getMetric()

Updated getMetric() to return an unmodifiable defensive copy. Introduced a private getInternalMetric() so incrementMetric() continues to update the live maps.

pradeepagrawal8184 · 2026-08-20T16:16:24Z

+    public Map<String, Long> getMetric(MetricType metricType) {
+        Map<String, Long> metric = getInternalMetric(metricType);
+
+        return metric == null ? null : Map.copyOf(metric);


MetricCacheUtil.getMetric() can return null — RangerUserSyncSourceApis.refresh() would NPE on totalApiCount.keySet(). Safer to return Collections.emptyMap() instead of null.

fimugdha requested review from dineshkumar-yadav, kumaab and spolavarpau1 July 24, 2026 06:31

pradeepagrawal8184 requested changes Jul 29, 2026

View reviewed changes

Comment thread unixauthservice/src/main/java/org/apache/ranger/authentication/server/EmbeddedServer.java

Sanket-Shelar force-pushed the RANGER-4458-RANGER-5701-RANGER-5702-usersync-webapp branch from 44cc8fb to 8b04499 Compare July 29, 2026 13:19

Sanket-Shelar requested a review from pradeepagrawal8184 July 29, 2026 13:21

Sanket-Shelar force-pushed the RANGER-4458-RANGER-5701-RANGER-5702-usersync-webapp branch 2 times, most recently from de1d8d3 to 3ac85df Compare July 31, 2026 06:34

Sanket-Shelar force-pushed the RANGER-4458-RANGER-5701-RANGER-5702-usersync-webapp branch from 3ac85df to dac07aa Compare August 10, 2026 14:59

Sanket-Shelar added 2 commits August 11, 2026 16:32

RANGER-4458: Ranger Usersync - Convert to Web Application

0c24013

RANGER-5701: Support for Usersync as WebApp in docker containers

dc067db

Sanket-Shelar force-pushed the RANGER-4458-RANGER-5701-RANGER-5702-usersync-webapp branch from dac07aa to df2a2ef Compare August 11, 2026 12:13

pradeepagrawal8184 changed the title ~~Usersync Webapp, metrics and Docker changes~~ RANGER-4458: Usersync Webapp, metrics and Docker changes Aug 11, 2026

pradeepagrawal8184 reviewed Aug 14, 2026

View reviewed changes

kumaab reviewed Aug 14, 2026

View reviewed changes

Sanket-Shelar force-pushed the RANGER-4458-RANGER-5701-RANGER-5702-usersync-webapp branch from df2a2ef to dfa7430 Compare August 17, 2026 12:11

Sanket-Shelar requested review from kumaab and pradeepagrawal8184 August 17, 2026 12:40

pradeepagrawal8184 reviewed Aug 19, 2026

View reviewed changes

RANGER-5702: Add/ Update metric details for Ranger UserSync

bd5f684

Sanket-Shelar force-pushed the RANGER-4458-RANGER-5701-RANGER-5702-usersync-webapp branch from dfa7430 to bd5f684 Compare August 20, 2026 12:34

Sanket-Shelar requested a review from pradeepagrawal8184 August 20, 2026 12:39

pradeepagrawal8184 approved these changes Aug 20, 2026

View reviewed changes

pradeepagrawal8184 reviewed Aug 20, 2026

View reviewed changes

pradeepagrawal8184 merged commit c5e10da into apache:master Aug 21, 2026
3 of 4 checks passed

Uh oh!

Conversation

Sanket-Shelar commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changes were proposed in this pull request?

How was this patch tested?

Uh oh!

kumaab commented Jul 22, 2026

Uh oh!

Sanket-Shelar commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Sanket-Shelar commented Aug 4, 2026

Uh oh!

pradeepagrawal8184 commented Aug 14, 2026

Uh oh!

pradeepagrawal8184 left a comment

Choose a reason for hiding this comment

Uh oh!

kumaab left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kumaab Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

Sanket-Shelar Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Sanket-Shelar commented Aug 17, 2026

Severity Location Issue

Uh oh!

pradeepagrawal8184 Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Sanket-Shelar Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pradeepagrawal8184 Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Sanket-Shelar commented Jul 22, 2026 •

edited

Loading

Sanket-Shelar commented Jul 23, 2026 •

edited

Loading