[MAPREDUCE-1455] Authorization for servlets

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.21.0
• Component/s: jobtracker, security, tasktracker
• Hadoop Flags: Reviewed

Release Note

Adds job-level authorization to servlets(other than history related servlets) for accessing job related info. Deprecates mapreduce.jobtracker.permissions.supergroup and adds the config mapreduce.cluster.permissions.supergroup at cluster level sothat it will be used by TaskTracker also. Authorization checks are done if authentication is succeeded and mapreduce.cluster.job-authorization-enabled is set to true.

• Assignee: Ravi Gummadi
• Reporter: Devaraj Das
• Created: 04/Feb/10 05:39
• Updated: 24/Aug/10 21:20
• Resolved: 02/Mar/10 13:52

Description

This jira is about building the authorization for servlets (on top of MAPREDUCE-1307). That is, the JobTracker/TaskTracker runs authorization checks on web requests based on the configured job permissions. For e.g., if the job permission is 600, then no one except the authenticated user can look at the job details via the browser. The authenticated user in the servlet can be obtained using the HttpServletRequest method.

Issue Links

• blocks: MAPREDUCE-1493 Authorization for job-history pages
• is blocked by: MAPREDUCE-1307 Introduce the concept of Job Permissions
• is related to: HADOOP-6568 Authorization for default servlets
• is related to: MAPREDUCE-1307 Introduce the concept of Job Permissions