[LIVY-591] ACLs enforcement should occur on both session owner and proxy user

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 0.6.0
• Component/s: Server
• Assignee: Unassigned
• Reporter: Ankur Gupta
• Created: 24/Apr/19 17:32
• Updated: 22/Aug/19 02:44
• Resolved: 22/Aug/19 02:44

Description

Currently ACLs enforcement occurs only on session owner. So, a request is authorized if the request user is same as session owner or has correct ACLs configured.

Eg: https://github.com/apache/incubator-livy/blob/master/server/src/main/scala/org/apache/livy/server/interactive/InteractiveSessionServlet.scala#L70

In case of impersonation, proxy user is checked against session owner, instead he should be checked against session proxy. Otherwise, a proxy user who created the session will not be able to submit statements against it, if ACLs are not configured correctly.

Additionally, it seems there is no auth-check right now while creating a session. We should add that check as well (against modify-session acls).

Issue Links

• duplicates: LIVY-592 Proxy user cannot view its session log
• links to: GitHub Pull Request #171