[HBASE-17115] HMaster/HRegion Info Server does not honour admin.acl

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.3.0, 2.1.9, 2.2.4
• Hadoop Flags: Reviewed

Release Note

Implements authorization for the HBase Web UI by limiting access to certain endpoints which could be used to extract sensitive information from HBase.

Access to these restricted endpoints can be limited to a group of administrators, identified either by a list of users (hbase.security.authentication.spnego.admin.users) or by a list of groups
(hbase.security.authentication.spnego.admin.groups). By default, neither of these values are set which will preserve backwards compatibility (allowing all authenticated users to access all endpoints).

Further, users who have sensitive information in the HBase service configuration can set hbase.security.authentication.ui.config.protected to true which will treat the configuration endpoint as a protected, admin-only resource. By default, all authenticated users may access the configuration endpoint.

• Assignee: Josh Elser
• Reporter: Mohammad Arshad
• Created: 16/Nov/16 16:22
• Updated: 11/Mar/20 03:31
• Resolved: 29/Jan/20 22:51

Description

Currently there is no way to enable protected URLs like /jmx, /conf only for admins. This is applicable for both Master and RegionServer.

Issue Links

• is duplicated by: HBASE-20472 InfoServer doesnot honour any acl set by the admin
• links to: GitHub Pull Request #936

Sub-Tasks

• Backport HBASE-17115 (HMaster/HRegion Info Server does not honour admin.acl) to 1.x: Resolved