[OOZIE-3196] Authorization: restrict world readability by user

• Type: New Feature
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 5.0.0b1, 5.0.0
• Fix Version/s: 5.3.0
• Component/s: bundle, coordinator, workflow
• Assignee: Mate Juhasz
• Reporter: Andras Piros
• Created: 14/Mar/18 09:10
• Updated: 10/Oct/19 11:19

Description

The current authorization model does not fit the enterprise requirements as everything is readable and writable by everyone by default.

Write access can be restricted using authorization but restricting read rights is only possible via Yarn ACLs and HDFS rights which still does not prevent accessing the workflow, coordinator or bundle job’s configurations for everyone.

Improve authorization so it’s possible to configure read/write access for workflows, coordinators, and bundles in a more granular way. Could involve Sentry during implementation or create and design a new system that fits the needs.

Issue Links

• is related to: OOZIE-3217 Enable definition of admin users using oozie-site.xml
• relates to: OOZIE-3215 Improve testability for authorization
• relates to: OOZIE-3216 Enable Authorization testing on REST endpoints
• links to: review board request
• links to: review board request v2