The Devlive Software Foundation

Hadoop 3.5.0 NameNode authorization overlay, signed local policies and access auditing. Java 17.

Framework-free building blocks: null-safe helpers, error codes and pagination models

Open-source, plugin-based fine-grained authorization platform

Shared test utilities and architecture rules; used with test scope only

Database-portable persistence foundation: IDs, base entity, naming rules and query helpers

Contract between the server and service type plugins: the service type definition model, the provider SPI and the plugin descriptor. Depends on nothing but JSpecify and is versioned on its own (ApiVersion).

What every agent in a protected system shares: downloads and checks the signed policy snapshots of its service, keeps the last one on disk, decides access with the policy engine and ships access events; runs on Java 8 with the engine, Jackson 2 and Bouncy Castle

Append-only audit trail of security events

Decides access requests against policies; embedded by the agents in the systems GrantForge protects, so it runs on Java 8 and depends on nothing

Tenants, user accounts, password hashing and first-run setup

The resource catalog (applications, menus, pages, buttons, APIs), roles and grants

The HDFS service type (M13-03), modelled on Apache Ranger's: paths with read, write and execute, looked up and tested with Hadoop's own (shaded) client over hdfs:// RPC, HA nameservices or webhdfs://, with simple or Kerberos authentication. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/hdfs.

The ZooKeeper service type: znode paths with ZooKeeper's own permissions (read, write, create, delete, admin), looked up, browsed and tested with ZooKeeper's own client over an ensemble's connection string, with no, digest or Kerberos (SASL) authentication and optional TLS. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/zookeeper.

The MySQL service type: databases, tables and columns with MySQL's own privileges, column masking and table row filters, looked up and tested through MariaDB Connector/J (LGPL), which speaks MySQL's protocol and is the driver GrantForge may redistribute. Packaged as a plugin directory (descriptor, classes and lib/) that the release ships in plugins/mysql.

Loads service type plugins: built-in ones from the classpath, external ones from the plugins directory, each in its own class loader

The services of a tenant that plugins manage permissions of, such as an HDFS cluster: their configuration, with secrets encrypted, connection tests and resource lookups

The OAuth 2.1 and OpenID Connect authorization server for applications of the catalog: their clients, the authorizations and tokens it issues, kept as hashes, and its rotating signing keys

Enforces GrantForge policies inside ZooKeeper servers 3.6 to 3.9: an authentication provider for the sasl scheme that decides the ACL entry sasl:grantforge with the service's signed policy snapshot, and keeps every other sasl entry as ZooKeeper's own provider does. One Java 8 jar with the agent core inside it, for the servers' lib directory.

Enforces GrantForge policies for MySQL 8 servers as a proxy that clients connect to in place of the server: it relays MySQL's protocol and sign-in, checks every statement against the service's signed policy snapshot down to columns, rewrites reads with the masks and row filters that apply, and reports access events. One runnable jar.

Hadoop-free Java 8 policy, path, runtime and audit logic shared by versioned NameNode adapters

Shared Java 8 native permission, inode, lifecycle and metrics adapter compiled against the Hadoop 2.7 baseline

Version-specific Hadoop 2.7 NameNode adapter, isolated release jar with native permission enforcement

Version-specific Hadoop 2.10 NameNode adapter, isolated release jar with native permission enforcement

Version-specific Hadoop 3.3 NameNode adapter, isolated release jar with native permission enforcement

Version-specific Hadoop 3.2 NameNode adapter, isolated release jar with native permission enforcement