Skip to content

RANGER-5710: Default access audit store to Solr - #1115

Merged
ramackri merged 1 commit into
masterfrom
RANGER-5710
Jul 29, 2026
Merged

RANGER-5710: Default access audit store to Solr#1115
ramackri merged 1 commit into
masterfrom
RANGER-5710

Conversation

@ramackri

@ramackri ramackri commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Summary

The ClassCastException on multi-value requestUser occurred because installs fell through to the deprecated DB audit path when ranger.audit.source.type was unset or misconfigured:

  1. RangerBizUtil defaulted to AUDIT_STORE_RDBMS when the property was missing
  2. Docker Postgres install.properties had audit_store=opensearch active while Solr URLs were commented out

This PR fixes configuration defaults so fresh installs and docker stacks use Solr (or explicitly configured OpenSearch), not the legacy DB path.

Changes

  • RangerBizUtil: default auditDBTypeAUDIT_STORE_SOLR (was AUDIT_STORE_RDBMS)
  • conf.dist/ranger-admin-site.xml: default ranger.audit.source.typesolr (was db)
  • Docker Postgres install.properties: enable audit_store=solr with FQDN Solr URLs; comment out OpenSearch block

Test plan

  • Fresh install: ranger.audit.source.type=solr in ranger-admin-site.xml after setup
  • Docker Postgres stack: Admin audit UI queries Solr (no DB path in logs)
  • GET /service/assets/accessAudit?requestUser=admin&requestUser=hive → HTTP 200 via Solr path
  • Existing installs with explicit ranger.audit.source.type unchanged

https://issues.apache.org/jira/browse/RANGER-5710

@vperiasamy vperiasamy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mneethiraj

Copy link
Copy Markdown
Contributor

@ramackri - Ranger doesn't support RDBMS as access audit log store since 2.2.0 release (see RANGER-3184), so this code path is a surprise! This code path was taken due to couple of things:

  1. Configuration ranger.audit.source.type is not set in ranger-admin-site.xml
  2. Default store is still RDBMS (see the following code block)
class RangerBizUtil {
    String auditDBType = AUDIT_STORE_RDBMS;

   ...
}

Couple of fixes to address this issue:

  1. Make sure ranger-admin-site.xml in docker setup is set to solr or opensearch
  2. Change the default in RangerBizUtil to AUDIT_STORE_SOLR.

RDBMS access audit has been unsupported since RANGER-3184 (2.2.0). The RC1 Access Audit UI
ClassCastException occurred because ranger.audit.source.type fell back to DB when
unset (RangerBizUtil default) and docker Postgres install defaulted to OpenSearch.

- Default auditDBType in RangerBizUtil: SOLR instead of RDBMS
- conf.dist ranger-admin-site.xml: solr instead of db
- Docker Postgres install.properties: audit_store=solr (OpenSearch commented)
@ramackri ramackri changed the title RANGER-5710: Fix DB access audit search for multi-value requestUser filter RANGER-5710: Default access audit store to Solr Jul 29, 2026
@ramackri

Copy link
Copy Markdown
Contributor Author

Thanks @mneethiraj — agreed. RDBMS access audit has been deprecated since RANGER-3184; fixing the STR_LIST cast on XAccessAuditService was treating a symptom on a path we should not hit.

Updated this PR to your suggested fixes:

  1. RangerBizUtil: default auditDBType is now AUDIT_STORE_SOLR (was AUDIT_STORE_RDBMS)
  2. conf.dist/ranger-admin-site.xml: default ranger.audit.source.type is now solr (was db)
  3. Docker Postgres install.properties: audit_store=solr with FQDN Solr URLs enabled; OpenSearch block commented out

Removed the XAccessAuditService STR_LIST change — with Solr as the default, RC1/docker validation should use the Solr path (AccessAuditsService, which already declares requestUser as STR_LIST).

@ramackri
ramackri merged commit 3c23981 into master Jul 29, 2026
8 checks passed
ramackri pushed a commit that referenced this pull request Jul 29, 2026
Backport from master (#1115). RDBMS access audit is unsupported since
RANGER-3184 (2.2.0); default auditDBType to SOLR and ranger.audit.source.type
to solr in conf.dist. Docker Postgres install.properties already uses Solr
from f7e4809 (RANGER-5687).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants