[HDDS-1796] Add admin access check for write opertaions in SCMClientProtocolServer and SCMBlockProtocolServer

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.4.0
• Fix Version/s: 1.4.0
• Component/s: SCM
• Labels: pull-request-available
• Target Version/s: 1.4.0
• Assignee: Devesh Kumar Singh
• Reporter: Mukul Kumar Singh
• Created: 14/Jul/19 13:43
• Updated: 06/Oct/23 09:01
• Resolved: 07/Sep/23 13:57

Description

SCM side currently doesn't support fine grained user access control. It can only tell if the user behinds a client is a admin or not. So for write operations in SCMClientProtocolServer and SCMBlockProtocolServer, only admins are allowed. For read operations, it doesn't have such check. The goal of the admin check is to prevent authorized user to start resource consuming actions or critical actions on SCM, such as add new scm, decommission scm, delete container, delete block, etc.

Issue Links

• is related to: HDDS-9376 Ozone put key failed with SCM superuser privilege error
• relates to: HDDS-9403 Add admin access check for allocateBlock and deleteKeyBlocks
• links to: GitHub Pull Request #5203