[YARN-8539] TimelineWebService#getUser null leads to empty entities list

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Component/s: timelineservice
• Assignee: Unassigned
• Reporter: Shen Yinjie
• Created: 16/Jul/18 04:53
• Updated: 16/Jul/18 07:11
• Resolved: 16/Jul/18 05:24

Description

When we integrate tez-ui with timeline server and set yarn.acl.enabled=true. tez-ui will invoke the timeline rest ** interface(ws/v1/timeline/TEZ_DAG_ID) to get all dags . But tez-ui shows "no records available" .

after some digging, I find when tez-ui invoke ".../ws/v1/timeline/TEZ_DAG_ID". TimelineWebService#getUser(HttpServletRequest req) returns callerUgi = null

In TimelineACLsManager#checkAccess()

......
if (callerUGI != null
&& (adminAclsManager.isAdmin(callerUGI) ||
callerUGI.getShortUserName().equals(owner) ||
domainACL.isUserAllowed(callerUGI))) {
return true;
}
return false;
}

Finally, Tez ui get nothing because of couldn't pass this checkAccess().

I also refer to the similar code in RMWebServices

 protected Boolean hasAccess(RMApp app, HttpServletRequest hsr) {
 // Check for the authorization.
 UserGroupInformation callerUGI = getCallerUserGroupInformation(hsr, true);
......
 if (callerUGI != null
 && !(this.rm.getApplicationACLsManager().checkAccess(callerUGI,
 ApplicationAccessType.VIEW_APP, app.getUser(),
 app.getApplicationId())
 || this.rm.getQueueACLsManager().checkAccess(callerUGI,
 QueueACL.ADMINISTER_QUEUE, app, hsr.getRemoteAddr(),
 forwardedAddresses))) {
 return false;
 }
 return true;
 }

 

when callerUgi= null, hasAcces() returns true.

So , I made a similar fix for TimelineWebServices.