[HBASE-20472] InfoServer doesnot honour any acl set by the admin

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Duplicate
• Component/s: security, UI
• Assignee: Nihal Jain
• Reporter: Nihal Jain
• Created: 21/Apr/18 12:46
• Updated: 21/Jul/21 14:25
• Resolved: 03/Oct/18 07:03

Description

The adminsAcl property can be used to restrict access to certain sections of the web UI only to a particular set of users/groups. But in hbase,  adminAcl variable for InfoServer is always null, rendering it to not honour any acl set by the admin. In fact I could not find any property in hbase to specify acl list for web server.

Analysis:

• InfoSever object forgets to set any adminAcl in the builder object for http server.

public InfoServer(String name, String bindAddress, int port, boolean findPort,
final Configuration c) {
    .
    .
   
    HttpServer.Builder builder =
new org.apache.hadoop.hbase.http.HttpServer.Builder();
    .
    .

    this.httpServer = builder.build();
}

See InfoServer constructor

• http server retreives a null value and sets it as adminsAcl, which is passed to createWebAppContext() method

private HttpServer(final Builder b) throws IOException {
    .
    .
    .

    this.adminsAcl = b.adminsAcl;
    this.webAppContext = createWebAppContext(b.name, b.conf, adminsAcl, appDir);
    
    .
    .
}

See L527 HttpServer.java

• This method next sets ADMIN_ACL attribute for the servlet context to null

private static WebAppContext createWebAppContext(String name,
Configuration conf, AccessControlList adminsAcl, final String appDir) {
    WebAppContext ctx = new WebAppContext();
    .
    .

    ctx.getServletContext().setAttribute(ADMINS_ACL, adminsAcl);

    .
    .
}

• Now any page having HttpServer.hasAdministratorAccess() will allow access to everyone, making this check useless. 

@Override
public void doGet(HttpServletRequest request, HttpServletResponse response
) throws ServletException, IOException {

    // Do the authorization
    if (!HttpServer.hasAdministratorAccess(getServletContext(), request,
    response)) {
    return;
    }

.
.
}

For example See L104 LogLevel.java

• hasAdministratorAccess() checks for the following and returns true, in any case as ADMIN_ACL is always null

public static boolean hasAdministratorAccess(
ServletContext servletContext, HttpServletRequest request,
HttpServletResponse response) throws IOException {
    .    
    .

    if (servletContext.getAttribute(ADMINS_ACL) != null &&
        !userHasAdministratorAccess(servletContext, remoteUser)) {
      response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "User "
         + remoteUser + " is unauthorized to access this page.");
       return false;
    }
    return true;
}

See line 1196 in HttpServer

 

Issue Links

• duplicates: HBASE-17115 HMaster/HRegion Info Server does not honour admin.acl