[AMBARI-25734] CLUSTER.USER is able to perform actions on service through API calls

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.6
• Fix Version/s: 2.8.0, 2.7.7
• Component/s: ambari-server
• Assignee: Vishal Suvagia
• Reporter: Satheesh Akuthota
• Created: 20/Sep/22 09:13
• Updated: 23/Oct/22 19:21
• Resolved: 17/Oct/22 07:12

Description

Hi Team ,

CLUSTER.USER is able to perform actions on services (eg . maintenance off/on on ambari_mertrics)

 

http://abcserver:8080/api/v1/clusters/CERTIFICATION/services/AMBARI_METRICS

request:

{
    "ServiceInfo" : {
        "maintenance_state" : "OFF"
    }
} 

user previlege details :

{
  "href" : "http://hostservername:8080/api/v1/users/svcambaritest4/",
  "Users" : {
    "active" : true,
    "admin" : false,
    "consecutive_failures" : 0,
    "created" : 1663235359782,
    "display_name" : "svcambaritest4",
    "groups" : [ ],
    "ldap_user" : false,
    "local_user_name" : "svcambaritest4",
    "user_name" : "svcambaritest4",
    "user_type" : "LOCAL"
  },
  "widget_layouts" : [ ],
  "privileges" : [
    {
      "href" : "http://hostservername:8080/api/v1/users/svcambaritest4/privileges/4",
      "PrivilegeInfo" : {
        "privilege_id" : 4,
        "user_name" : "svcambaritest4"
      }
    }
  ],
  "sources" : [
    {
      "href" : "http://hostservername:8080/api/v1/users/svcambaritest4/sources/4",
      "AuthenticationSourceInfo" : {
        "source_id" : 4,
        "user_name" : "svcambaritest4"
      }
    }
  ]
} 

{
  "href" : "http://sserverhostname:8080/api/v1/users/svcambaritest4/privileges/4",
  "PrivilegeInfo" : {
    "cluster_name" : "CLUSTERNAME",
    "permission_label" : "Cluster User",
    "permission_name" : "CLUSTER.USER",
    "principal_name" : "svcambaritest4",
    "principal_type" : "USER",
    "privilege_id" : 4,
    "type" : "CLUSTER",
    "user_name" : "svcambaritest4"
  }
}

Note : From UI we are not able to do this action

 

Issue Links

• is related to: AMBARI-15213 RBAC : For "Service Operator/Administrator and Cluster Operator" role, the "Background jobs" dialog box doesn't open up (come to foreground) when a background job is triggered.
• links to: GitHub PR#3388