[HADOOP-10679] Authorize webui access using ServiceAuthorizationManager

• Type: New Feature
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Component/s: security
• Labels: BB2015-05-TBR
• Assignee: Benoy Antony
• Reporter: Benoy Antony
• Created: 10/Jun/14 22:02
• Updated: 02/Mar/17 20:42

Description

Currently accessing Hadoop via RPC can be authorized using ServiceAuthorizationManager. But there is no uniform authorization of the HTTP access. Some of the servlets check for admin privilege.
This creates an inconsistency of authorization between access via RPC vs HTTP.

The fix is to enable authorization of the webui access also using ServiceAuthorizationManager.

Issue Links

• depends upon: HADOOP-10650 Add ability to specify a reverse ACL (black list) of users and groups
• depends upon: HADOOP-10651 Add ability to restrict service access using IP addresses and hostnames
• relates to: YARN-6254 Provide a mechanism to whitelist the RM REST API clients
• relates to: HADOOP-10671 Unify and simplify common configurations for authentication filters between web console and web hdfs

Sub-Tasks

• Refactor Service Authorization Framework: Patch Available
• Add an authorization framework for HTTP access: Open