The Devlive Software Foundation

Hadoop 3.5.0 NameNode authorization overlay, signed local policies and access auditing. Java 17.

Open-source, plugin-based fine-grained authorization platform

Shared test utilities and architecture rules; used with test scope only

Framework-free building blocks: null-safe helpers, error codes and pagination models

Contract between the server and service type plugins: the service type definition model, the provider SPI and the plugin descriptor. Depends on nothing but JSpecify and is versioned on its own (ApiVersion).

Database-portable persistence foundation: IDs, base entity, naming rules and query helpers

Append-only audit trail of security events

What every agent in a protected system shares: downloads and checks the signed policy snapshots of its service, keeps the last one on disk, decides access with the policy engine and ships access events; runs on Java 8 with the engine, Jackson 2 and Bouncy Castle

Decides access requests against policies; embedded by the agents in the systems GrantForge protects, so it runs on Java 8 and depends on nothing

The resource catalog (applications, menus, pages, buttons, APIs), roles and grants

Tenants, user accounts, password hashing and first-run setup

The HDFS service type (M13-03), modelled on Apache Ranger's: paths with read, write and execute, looked up and tested with Hadoop's own (shaded) client over hdfs:// RPC, HA nameservices or webhdfs://, with simple or Kerberos authentication. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/hdfs.

The ZooKeeper service type: znode paths with ZooKeeper's own permissions (read, write, create, delete, admin), looked up, browsed and tested with ZooKeeper's own client over an ensemble's connection string, with no, digest or Kerberos (SASL) authentication and optional TLS. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/zookeeper.

The Apache Kafka service type: topics, consumer groups, transactional IDs, the cluster, delegation tokens and users, with Kafka's own operations as access types, so policies read like Kafka ACLs. Lookups go through Kafka's AdminClient over PLAINTEXT, TLS or SASL (PLAIN, SCRAM or Kerberos with a keytab or password). Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/kafka.

The Apache Hadoop YARN service type in YARN's own terms: queues, decided at every queue of their path as YARN's own queue ACLs are, applications by name within a queue, and the cluster's administration, with YARN's submit and administer access types. Lookups go through Hadoop's own YARN client, on Hadoop's shaded client, with simple or Kerberos (keytab or password) authentication and ResourceManager high availability. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/yarn.

The Apache Hive service type, as Apache Ranger defines it: databases, tables, columns and UDFs, URLs, the HiveServer2 service and replication, with Hive's access types, column masking and table row filters. Lookups go through HiveServer2's own JDBC driver, with a password or Kerberos and optional TLS, ZooKeeper discovery or HTTP transport. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/hive.

The Apache HBase service type in HBase's own terms: the global scope, namespaces, tables, column families and columns, with HBase's read, write, create and admin as access types. Lookups go through HBase's own client, on Hadoop's shaded client, with simple or Kerberos (keytab or password) authentication. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/hbase.

The Trino service type in Trino's own terms: catalogs, schemas, tables, columns, routines, session properties, users and system information, with row filters and column masks written as Trino SQL. Lookups go through Trino's JDBC driver with no authentication, a password, a JSON web token or Kerberos (keytab or password), over TLS where the server signs users in. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/trino.

The ClickHouse service type in ClickHouse's own terms: databases, their tables and the tables' columns, and the server as a whole, with access types that map to ClickHouse's privileges, and row filters that become ClickHouse row policies. Lookups read the system tables through ClickHouse's own Java client over HTTP, from one server or the next when one cannot be reached, signing in with a password or a TLS client certificate. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/clickhouse.

The OAuth 2.1 and OpenID Connect authorization server for applications of the catalog: their clients, the authorizations and tokens it issues, kept as hashes, and its rotating signing keys

The Apache Solr service type in Solr's own terms: collections, the request paths within them, such as /select or /export, and the cluster's administration, with access types grouped from Solr's own permission names: query, update, schema and config reading and editing, per-collection administration, health, metrics, read-only administration, security and full administration. Lookups go through SolrJ's JDK HTTP client against one node or several, signing in with basic authentication or a JSON web token, over TLS with a trust store of its own. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/solr.

The OpenSearch service type in OpenSearch's own terms: indices and data streams, their fields, and the cluster as a whole, with access types that map to the security plugin's action groups, row filters that become document level security and masks that become its masked fields. Lookups read the cluster through OpenSearch's own low-level REST client, from one node or the next when one cannot be reached, signing in with a password or a TLS client certificate. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/opensearch.

The Apache Pulsar service type in Pulsar's own terms: tenants, namespaces, topics and subscriptions, decided at every level of a topic's name as Pulsar's own namespace and topic grants are, and the clusters' administration, with Pulsar's produce, consume, functions, sources, sinks and packages actions and its administration. Lookups go through Pulsar's own admin client against one broker or several, signing in with a token, a user name and password, OAuth 2.0 client credentials or a TLS client certificate. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/pulsar.

The PostgreSQL service type in PostgreSQL's own terms: databases, their schemas, the schemas' tables and views and the tables' columns, with access types that map to PostgreSQL's privileges, and row filters that become row security policies. Lookups read the catalogs of each database through PostgreSQL's own JDBC driver, from one server or the next when one cannot be reached, signing in with a password or a TLS client certificate. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/postgresql.

The MySQL service type: databases, tables and columns with MySQL's own privileges, column masking and table row filters, looked up and tested through MariaDB Connector/J (LGPL), which speaks MySQL's protocol and is the driver GrantForge may redistribute. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/mysql.