RANGER-5720: DB patch 078 for audit partition plan global state by ramackri · Pull Request #1138 · apache/ranger

ramackri · 2026-08-06T02:23:39Z

Summary

RANGER-5720 — DB patch 078 for RANGER-5655: seed audit partition-plan global state, x_audit_config runtime settings, and the rangerauditserver machine user on all Ranger DB backends. DB-only; no Java changes. Pairs with #1137.

Changes

Widen app_data column (per-backend type)
Insert RangerAuditPartitionPlan v1 JSON (empty plugins baseline)
Add x_audit_config table (cfg_name, cfg_value, version) with seed rows:
- ingestor.url → https://ranger-audit-ingestor:8765
- service.hive.allowed.users → hive
- topic-partitions → 30
Add rangerauditserver user + ROLE_ADMIN_AUDITOR (status=0, JDBC disabled; SPIFFE/header auth only)
Upgrade patch + optimized schema for MySQL, PostgreSQL, Oracle, SQL Server, SQL Anywhere

Backend notes: Oracle uses ' ' password placeholder ('' → NULL on NOT NULL column). SQL Server optimized schema drops a stale patch-077 FK CHECK. MySQL uses LONGTEXT for app_data. Oracle upgrade migrates VARCHAR2 → CLOB via add/copy/drop/rename (avoids ORA-22858).

Testing

Check	Status
CI (`build-17`, docker builds)	Pass
SQL Anywhere	SQL review only (no docker DB)

Docker E2E fresh install (ranger-docker, DB queried directly after db_setup.py):

Backend	Result	`app_data` type
Postgres	7/7 pass	`text`
MySQL	7/7 pass	`longtext`
Oracle	6/6 pass	`CLOB`
SQL Server	7/7 pass	`nvarchar`

What 7/7 (or 6/6) means: automated DB checks passed / total checks run per backend (not services or containers).

#	Check
1	`rangerauditserver` status = `0` (JDBC disabled)
2	`rangerauditserver` password empty (Oracle: `' '` placeholder counts as empty)
3	Role = `ROLE_ADMIN_AUDITOR`
4	Partition plan row exists (`RangerAuditPartitionPlan`)
5	Partition plan JSON contains `ranger_audits` (Oracle skipped — CLOB via sqlplus unreliable in harness)
6	Patch 078 applied in `x_db_version_h` (`active = Y`)
7	`app_data` column type widened (per backend)

Pull request overview

Adds DB patch 078 across all supported Ranger databases for audit partition-plan state and machine-user setup.

Changes:

Widens app_data for partition-plan growth.
Seeds the initial audit partition plan.
Creates rangerauditserver with ROLE_ADMIN_AUDITOR.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
security-admin/db/sqlserver/patches/078-audit-partition-plan-global-state.sql	Updated as part of this pull request.
security-admin/db/sqlserver/optimized/current/ranger_core_db_sqlserver.sql	Updated as part of this pull request.
security-admin/db/sqlanywhere/patches/078-audit-partition-plan-global-state.sql	Updated as part of this pull request.
security-admin/db/sqlanywhere/optimized/current/ranger_core_db_sqlanywhere.sql	Updated as part of this pull request.
security-admin/db/postgres/patches/078-audit-partition-plan-global-state.sql	Updated as part of this pull request.
security-admin/db/postgres/optimized/current/ranger_core_db_postgres.sql	Updated as part of this pull request.
security-admin/db/oracle/patches/078-audit-partition-plan-global-state.sql	Updated as part of this pull request.
security-admin/db/oracle/optimized/current/ranger_core_db_oracle.sql	Updated as part of this pull request.
security-admin/db/mysql/patches/078-audit-partition-plan-global-state.sql	Updated as part of this pull request.
security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql	Updated as part of this pull request.

Suppressed comments (2)

security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql:600

The plan is not bounded to this seed: it grows with plugin/service entries and each service's policy.download.auth.users. MySQL TEXT is limited to 65,535 bytes, so a sufficiently populated plan will fail to update even though the other backends use LOB/max types. Use at least MEDIUMTEXT and keep the upgrade and fresh-install definitions consistent.

`app_data` TEXT NULL DEFAULT NULL,

security-admin/db/mysql/patches/078-audit-partition-plan-global-state.sql:44

The plan is not bounded to this seed: it grows with plugin/service entries and each service's policy.download.auth.users. MySQL TEXT is limited to 65,535 bytes, so a sufficiently populated plan will fail to update even though the other backends use LOB/max types. Use at least MEDIUMTEXT and keep the upgrade and fresh-install definitions consistent.

            ALTER TABLE x_ranger_global_state MODIFY app_data TEXT DEFAULT NULL;

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Disable JDBC login for rangerauditserver (status=0, empty password) for SPIFFE-only Admin access; fix Oracle app_data ALTER guard; use SQL Anywhere ALTER COLUMN syntax.

… 078. Oracle stores empty string as NULL on NOT NULL PASSWORD; use a space placeholder for rangerauditserver. Remove stale x_policy_ref_user_FK_upd_by CHECK from SQL Server optimized schema (patch 077 regression).

Use LONGTEXT for app_data on MySQL so the partition plan can grow beyond TEXT limits. On Oracle upgrade, migrate VARCHAR2 app_data via add/copy/drop/ rename instead of MODIFY to avoid ORA-22858. Co-authored-by: Cursor <cursoragent@cursor.com>

mneethiraj

@ramackri - in addition to topic partition details, it might be necessary to store additional details, such as audit ingestor endpoint, allowed users per service. How about introducing a new table:

x_audit_config(cfg_name string  cfg_value string, version long);

insert into x_audit_config(cfg_name, cfg_value) values ("ingestor.url, "https://ranger-audit-ingestor:8765");
insert into x_audit_config(cfg_name, cfg_value) values ("service.hive.allowed.users", "hive");
insert into x_audit_config(cfg_name, cfg_value) values ("topic-partitions", 30);

Per review feedback, store ingestor URL, per-service allowed users, and topic partition count in x_audit_config (patch 078 + optimized schema on all DB backends). Seed defaults idempotently on fresh install and upgrade. Co-authored-by: Cursor <cursoragent@cursor.com>

Keep ingestor URL and per-service allow-list in x_audit_config; partition routing (topic, topicPartitionCount, plugins, buffer) stays in RangerAuditPartitionPlan JSON only. Drop topic-partitions from x_audit_config. Co-authored-by: Cursor <cursoragent@cursor.com>

This reverts commit 3b33734.

Store ingestor URL, topic, partition plan JSON, and per-service allow-list in x_audit_config. Revert patch 078 changes to x_ranger_global_state (no app_data widen, no RangerAuditPartitionPlan row). Keep rangerauditserver machine user setup in patch 078. Co-authored-by: Cursor <cursoragent@cursor.com>

mneethiraj

rename file 078-audit-partition-plan-global-state.sql as 078-add-x_audit_config.sql
is it necessary to add rangeradminserver user in user tables?

ramackri · 2026-08-27T05:49:03Z

rename file 078-audit-partition-plan-global-state.sql as 078-add-x_audit_config.sql

is it necessary to add rangeradminserver user in user tables?

rename file 078-audit-partition-plan-global-state.sql as 078-add-x_audit_config.sql ---> make sense we will do it
rangerauditserver will be used to invoke from Ranger audit ingestor to Ranger admin
Ingestor → Admin — X-Spiffe-Id as rangerauditserver for partition-plan download (no password).

RANGER-5720: DB patch 078 for audit partition plan global state

90ced3a

Add patch 078 and optimized schema updates for all DB backends: seed rangerauditserver with ROLE_ADMIN_AUDITOR and register RangerAuditPartitionPlan global state name for RANGER-5655 admin-managed partition plans.

This was referenced Aug 6, 2026

RANGER-5655: Shared partition plan library, DB patch 078, plugin SPIFFE auth #1135

Closed

RANGER-5719: Shared partition-plan library and SPIFFE header auth utilities #1137

Open

RANGER-5723: Plugin SPIFFE outbound auth for audit-server destination #1139

Merged

ramackri requested review from kumaab, mneethiraj and rameeshm August 6, 2026 02:32

rameeshm requested a lite review from Copilot August 24, 2026 18:05

Copilot started reviewing on behalf of rameeshm August 24, 2026 18:05 View session

Copilot AI reviewed Aug 24, 2026

View reviewed changes

ramk added 3 commits August 25, 2026 16:53

RANGER-5720: Address Copilot review on patch 078 audit DB changes.

7092596

Disable JDBC login for rangerauditserver (status=0, empty password) for SPIFFE-only Admin access; fix Oracle app_data ALTER guard; use SQL Anywhere ALTER COLUMN syntax.

Merge branch 'master' into RANGER-5720-patch

e2b8e72

rameeshm reviewed Aug 26, 2026

View reviewed changes

Comment thread security-admin/db/oracle/patches/078-audit-partition-plan-global-state.sql Outdated

Comment thread security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql Outdated

mneethiraj reviewed Aug 26, 2026

View reviewed changes

mneethiraj reviewed Aug 27, 2026

View reviewed changes

Comment thread security-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql Outdated

ramk and others added 3 commits August 27, 2026 08:55

Revert "RANGER-5720: Align x_audit_config with Option A config split."

44cd426

This reverts commit 3b33734.

mneethiraj reviewed Aug 27, 2026

View reviewed changes

Navigation Menu

Uh oh!

RANGER-5720: DB patch 078 for audit partition plan global state - #1138

RANGER-5720: DB patch 078 for audit partition plan global state#1138
ramackri wants to merge 9 commits into
apache:masterfrom
ramackri:RANGER-5720-patch

ramackri commented Aug 6, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mneethiraj left a comment

Uh oh!

Uh oh!

mneethiraj left a comment

Uh oh!

ramackri commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

ramackri commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Related

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mneethiraj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mneethiraj left a comment

Choose a reason for hiding this comment

Uh oh!

ramackri commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ramackri commented Aug 6, 2026 •

edited

Loading