RANGER-5767: Extend header based authn to support ROLEs in Ranger Admin

[kumaab]

What changes were proposed in this pull request?

When header based authn is enabled:

• Add support in Ranger Admin (via new config ranger.admin.authn.header.roles) to assign roles to users based on the configured HTTP header in config.
• Valid roles from the configured roles header are added to the RangerAuthenticationToken.
• User/SPIFFE principals with valid headers will now be auto-provisioned on first Ranger Admin API access.
• This enables service identities such as Ranger Usersync to call Admin REST APIs using SPIFFE ID plus ROLE_SYS_ADMIN.

How was this patch tested?

Applied Configs (Docker)

ranger.admin.authn.header.enabled: true
ranger.admin.authn.header.username: X-Forwarded-User
ranger.admin.authn.header.spiffe: X-Spiffe-Id
ranger.admin.authn.header.roles: X-Forwarded-Roles
ranger.admin.spiffe.as.username.enabled: true

• Simulated Ranger Usersync calls to Ranger Admin using SPIFFE header authn and role as RANGER_ROLE_SYS_ADMIN:

SPIFFE='spiffe://cluster.local/ns/ranger/sa/ranger-usersync'
GROUP='ugsync_curl_group_1788327006'
USER1='ugsync_curl_user1_1788327033'
USER2='ugsync_curl_user2_1788327033'

curl -sS -w '\nHTTP=%{http_code}\n' \
  -X POST 'http://localhost:6080/service/xusers/ugsync/groups' \
  -H "X-Spiffe-Id: $SPIFFE" \
  -H 'X-Forwarded-Roles: RANGER_ROLE_SYS_ADMIN' \
  -H 'Content-Type: application/json' \
  --data-binary "{\"vXGroups\":[{\"name\":\"$GROUP\",\"description\":\"curl SPIFFE usersync group\",\"groupSource\":1,\"isVisible\":1,\"syncSource\":\"curl-spiffe\"}]}"
1
HTTP=200

curl -sS -w '\nHTTP=%{http_code}\n' \
  -X POST 'http://localhost:6080/service/xusers/ugsync/users' \
  -H "X-Spiffe-Id: $SPIFFE" \
  -H 'X-Forwarded-Roles: RANGER_ROLE_SYS_ADMIN' \
  -H 'Content-Type: application/json' \
  --data-binary "{\"vXUsers\":[{\"name\":\"$USER1\",\"firstName\":\"Curl\",\"lastName\":\"UserOne\",\"userSource\":1,\"isVisible\":1,\"syncSource\":\"curl-spiffe\",\"userRoleList\":[\"ROLE_USER\"],\"groupNameList\":[\"$GROUP\"]},{\"name\":\"$USER2\",\"firstName\":\"Curl\",\"lastName\":\"UserTwo\",\"userSource\":1,\"isVisible\":1,\"syncSource\":\"curl-spiffe\",\"userRoleList\":[\"ROLE_USER\"],\"groupNameList\":[\"$GROUP\"]}]}"
2
HTTP=200

curl -sS -w '\nHTTP=%{http_code}\n' \
  -X POST 'http://localhost:6080/service/xusers/ugsync/groupusers' \
  -H "X-Spiffe-Id: $SPIFFE" \
  -H 'X-Forwarded-Roles: RANGER_ROLE_SYS_ADMIN' \
  -H 'Content-Type: application/json' \
  --data-binary "[{\"groupName\":\"$GROUP\",\"addUsers\":[\"$USER1\",\"$USER2\"],\"delUsers\":[]}]"
1
HTTP=200

• Verified the SPIFFE principal was auto-created with Ranger role ROLE_SYS_ADMIN and normal users with default roles.

Users tab:

Groups tab: