RANGER-5683: Add Microsoft EntraID (Azure AD) as a UserSync source via the Microsoft Graph API

[vyommani]

What changes were proposed in this pull request?

What this does

Adds a new UserSync source that synchronizes users, groups, and group memberships from Microsoft EntraID (Azure AD) via the Microsoft Graph API. It targets deployments where LDAP/AD access is unavailable or prohibited (e.g. cloud-native or restricted private-cloud environments) and there is no first-class way to sync EntraID identities into Ranger today.

The source plugs into the existing UserGroupSource SPI and is selected via ranger.usersync.source.impl.class — existing LDAP/Unix/file sources are unaffected.

Key capabilities

1. OAuth2 client-credentials authentication, supporting both client-secret and certificate credentials.
2. Delta-based incremental sync — full initial load, then only changes on subsequent cycles via Graph /delta tokens.
3. Handles Graph paging (@odata.nextLink), delta-token expiry/resync, and throttling (429/503 with Retry-After backoff).
4. DIRECT and TRANSITIVE membership modes, with a first-sync inline-membership optimization on the DIRECT path to avoid per-group member calls.
5. Per-record deletion of principals no longer present in the source, keyed by the stable EntraID object GUID.
6. Resilient to individual group fetch failures (a single group 404 is skipped with a warning rather than aborting the cycle; systemic failures still fail the cycle).
7. Pagination/delta URLs are validated against the configured Graph host before being followed, preventing bearer-token leakage to a tampered @odata.nextLink.

Configuration

Configured via ranger.usersync.entraid.* properties. Required: tenant.id, client.id, auth.type, graph.base.url, and the credential. Optional properties (membership mode, page size, timeouts, select attributes) default sensibly.

How was this patch tested?

Testing

Unit tests cover source orchestration (cycle-type decisions, delta handling, deletion routing, membership modes, resync, per-group failure resilience) and the Graph client (paging, delta, throttling, cross-page membership merge, certificate JWT assertion, SSRF host validation, malformed-response handling).
Validated end-to-end against a live Ranger instance at target scale (40,000 users / 8,000 groups), in both DIRECT and TRANSITIVE membership modes, including a 30,000-member group to exercise cross-page membership aggregation. Full incremental lifecycle (add/delete/modify) verified at the database level. Peak UserSync memory ~420 MB.

This has not yet been tested against a live Microsoft EntraID tenant. All testing to date used a stateful mock Graph server that reproduces Graph's delta/paging/membership semantics as we understand them. The following require real-tenant validation and are not confirmed by this PR:

Certificate authentication (JWT signing, x5t thumbprint format) against the real Entra token endpoint.
Actual Graph response shapes, paging, and delta-token expiry behavior.

The connector and its Ranger integration are validated; the Graph-side assumptions are not yet confirmed against Microsoft. Real-tenant validation is planned as a follow-up.

openitem

Open item — deployment wiring

Configuration currently threads through ranger-ugsync-site.xml. How EntraID properties should flow through the standard install.properties setup path is.