Skip to content

RANGER-5734: Update EmbeddedServer to use custom TrustStore - #1188

Open
vikaskr22 wants to merge 1 commit into
apache:masterfrom
vikaskr22:RANGER-5734
Open

RANGER-5734: Update EmbeddedServer to use custom TrustStore#1188
vikaskr22 wants to merge 1 commit into
apache:masterfrom
vikaskr22:RANGER-5734

Conversation

@vikaskr22

Copy link
Copy Markdown
Contributor

What changes were proposed in this pull request?

embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java class reads and uses custom truststore and updates the defaultSSLContext.

But Ranger-Admin/KMS uses the connector approach and Tomcat's connector doesn't use the keyStore/TrustStore from the defaultContext. Here, code to set keyStore into Tomcat's connector is already available but similar code to set custom trustStore was missing. Hence , it was falling back to JVM's default cacerts.

As part of this PR, code has been added to use custom user provided trustStore.

How was this patch tested?

-mvn build has passed

  • Existing UTs has passed
  • Took patch, applied and deployed on internal cluster and verified if custom trustStore is being used or not. For this, I enabled mTLS between KMS & Admin by setting ranger.service.https.attrib.clientAuth=true and found it working.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant