[NIFI-12765] Remove Apache Ranger Plugins

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0-M2, 2.0.0-M3
• Fix Version/s: 2.0.0-M3
• Assignee: Zoltán Kornél Török
• Reporter: Zoltán Kornél Török
• Created: 09/Feb/24 16:29
• Updated: 22/Feb/24 14:48
• Resolved: 15/Feb/24 00:17

Description

Bug description

Currently ranger plugins are not reporting audit events into ranger.

Investigation

In the nifi log I found the following ("classic") NoClassDefFoundError:

ERROR org.apache.ranger.audit.destination.SolrAuditDestination: Can't connect to Solr server. ZooKeepers=cfm-oudjal-dd-master0.cfm-5pax.svbr-nqvp.int.cldr.work:2181/solr-infrajava.lang.NoClassDefFoundError: org/eclipse/jetty/client/util/SPNEGOAuthentication
	at org.apache.ranger.audit.destination.SolrAuditDestination.connect(SolrAuditDestination.java:168)
	at org.apache.ranger.audit.destination.SolrAuditDestination.log(SolrAuditDestination.java:227)
	at org.apache.ranger.audit.queue.AuditBatchQueue.runLogAudit(AuditBatchQueue.java:309)
	at org.apache.ranger.audit.queue.AuditBatchQueue.run(AuditBatchQueue.java:215)
	at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.lang.ClassNotFoundException: org.eclipse.jetty.client.util.SPNEGOAuthentication
	at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:445)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:593)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
	... 5 common frames omitted 

As you can see ranger-audit depends on solr client which depends on jetty client.

The problem is that solr client class use org.eclipse.jetty.client.util.SPNEGOAuthentication - https://github.com/apache/solr/blob/main/solr/solrj/src/java/org/apache/solr/client/solrj/impl/Krb5HttpClientBuilder.java#L46

However in case jetty 12.x line, this class is moved to another package: https://github.com/jetty/jetty.project/commit/a1c5cefd0d5657df04e5364cca9315aa4e2a1aef

So the problem exist, since jetty version upgraded to 12

Proposed solution

Sadly there is no available solr client (or ranger client), which haven't had this dependency. The only solution what I found (and propose in my pr) is to override jetty version in case of ranger plugins to jetty line 11, where this class is not moved. I tested it on my environment and the audit logging to ranger worked well with that version.

Issue Links

• is related to: NIFI-12738 Nifi registry ranger integration is not working
• is related to: NIFI-12770 Deprecate Apache Ranger Integration for Removal
• relates to: NIFI-12738 Nifi registry ranger integration is not working
• links to: GitHub Pull Request #8381
• links to: GitHub Pull Request #8389