[RANGER-962] Ranger plugin should have an option to use X-Forwarded-For address

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.6.0
• Fix Version/s: 0.6.0
• Component/s: plugins
• Assignee: Abhay Kulkarni
• Reporter: Madhan Neethiraj
• Created: 30/Apr/16 00:04
• Updated: 07/Dec/18 02:08
• Resolved: 11/Jun/16 01:39

Description

Ranger plugins use the client IP address provided by the component for authorization and audit log. In cases where a client accesses data through a gateway, like Knox, the components provide Ranger with the IP address of the gateway, instead of the original client IP address. Hence, authorization and audit logs are performed using the IP address of the gateway - instead of the client's IP address.

Ranger plugins should be updated to be able to use client IP address, when available in X-Forwarded-For field of the request. Further X-Forwarded-For field should only be used when the request is through a trusted proxy address.

Issue Links

• is related to: RANGER-1077 Audit logs for Hive access show empty IP address
• relates to: RANGER-2306 Knox Plugin doesn't pass X-Forwarded-for remote address to Ranger
• relates to: HIVE-13418 HiveServer2 HTTP mode should support X-Forwarded-Host header for authorization/audits