[HADOOP-10651] Add ability to restrict service access using IP addresses and hostnames

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5.0
• Fix Version/s: 2.7.0
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Benoy Antony
• Reporter: Benoy Antony
• Created: 02/Jun/14 01:47
• Updated: 31/Jul/17 09:30
• Resolved: 08/Jan/15 18:12

Description

In some use cases, it make sense to authorize the usage of some services only from specific hosts. Just like ACLS for Service Authorization , there can be a list of hosts for each service and this list can be checked during authorization.

Similar to ACLS, there can be a whitelist of ip and blacklist of ips. The default whitelist will be * and default blacklist will be empty. It should be possible to override the default whitelist and default blacklist. It should be possible to define whitelist and blacklist per service.
It should be possible to define ip ranges in blacklists and whitelists

Issue Links

• depends upon: HADOOP-10649 Allow overriding the default ACL for service authorization
• depends upon: HADOOP-10650 Add ability to specify a reverse ACL (black list) of users and groups
• is depended upon by: HADOOP-10654 Support pluggable mechanism to specify Service Authorization
• is depended upon by: HADOOP-10679 Authorize webui access using ServiceAuthorizationManager
• is related to: HADOOP-14702 Fix formatting issue and regression caused by conversion from APT to Markdown
• requires: HADOOP-10565 Support IP ranges (CIDR) in proxyuser.hosts