[HADOOP-8314] HttpServer#hasAdminAccess should return false if authorization is enabled but user is not authenticated

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.0, 2.0.0-alpha, 3.0.0-alpha1
• Fix Version/s: 1.1.0, 2.0.0-alpha
• Component/s: security
• Hadoop Flags: Incompatible change, Reviewed
• Assignee: Alejandro Abdelnur
• Reporter: Alejandro Abdelnur
• Created: 24/Apr/12 23:22
• Updated: 12/May/16 18:22
• Resolved: 26/Apr/12 20:43

Description

If the user is not authenticated (request.getRemoteUser() returns NULL) or there is not authentication filter configured (thus returning also NULL), hasAdminAccess should return false. Note that a filter could allow anonymous access, thus the first case.