[FALCON-1367] Improve the ACL handling in Falcon

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Assignee: Unassigned
• Reporter: Venkat Ranganathan
• Created: 04/Aug/15 14:33
• Updated: 04/Aug/15 19:06

Description

Currently the ACL element is part of the entity and has the owner and group specified in it. The owner of the entity is used as the proxy user of the entity.

This seems problematic. We don't want to embed authorization of a resource inside a resource. Also, scheduling an entity by a user should be independent of the owner as whom it runs (The proxy user work that sowmyaramesh is adding a doAs capability)

Moving it out of the entity will allow authorization managers like Apache Ranger to manage the authorization of the entities.

We want to

1. deprecate the use of ACL inside the entity by making it optional
2. Allow the owner and group of an entity to be managed separately (either by Falcon or controlled via a plugin by Authorization managers)
3. Identity and fix the permission models (only superuser or owner can change permissions etc)

Sub-Tasks

• Falcon allows change of entity owner by non-super user: Open
• Inconsistent behaviour of entity/instance operations regarding authorization: Open