[AMBARI-14192] Enforce granular role-based access control for service functions

• Type: Task
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.4.0
• Fix Version/s: 2.4.0
• Component/s: ambari-server
• Labels: rbac
• Epic Link: Ambari role-based access control
• Assignee: Robert Levas
• Reporter: Robert Levas
• Created: 03/Dec/15 19:01
• Updated: 09/Dec/15 23:24
• Resolved: 09/Dec/15 17:52

Description

Enforce granular role-based access control for service functions:

	Cluster User	Service Operator	Service Administrator	Cluster Operator	Cluster Administrator	Administrator
Start/Stop/Restart Service
Decommission/recommission
Run service checks
Turn on/off maintenance mode
Perform service-specific tasks
Move to another host
Enable HA
Add Service to cluster
Install components
Modify service configurations
Set service users and groups

Entry points affected:

• GET /api/v1/clusters/:cluster_name/services
• GET /api/v1/clusters/:cluster_name/services/:service_name
• POST /api/v1/clusters/:cluster_name/services/:service_name
• PUT /api/v1/clusters/:cluster_name/services/:service_name
• DELETE /api/v1/clusters/:cluster_name/services/:service_name
• GET /api/v1/clusters/:cluster_name/services/:service_name/components
• GET /api/v1/clusters/:cluster_name/services/:service_name/components/:component_name
• POST /api/v1/clusters/:cluster_name/services/:service_name/components/:component_name
• PUT /api/v1/clusters/:cluster_name/services/:service_name/components/:component_name
• DELETE /api/v1/clusters/:cluster_name/services/:service_name/components/:component_name
• POST /api/v1/clusters/:cluster_name/hosts
• POST /api/v1/clusters/:cluster_name/requests

Issue Links

• links to: ReviewBoard