[SPARK-19652] REST API does not perform user auth for individual apps

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0, 2.1.0
• Fix Version/s: 2.0.3, 2.1.1, 2.2.0
• Component/s: Web UI
• Assignee: Marcelo Masiero Vanzin
• Reporter: Marcelo Masiero Vanzin
• Created: 18/Feb/17 00:08
• Updated: 22/Feb/17 23:49
• Resolved: 22/Feb/17 23:49

Description

(This goes back further than 2.0.0, btw.)

The REST API currently only performs authorization at the root of the UI; this works for live UIs, but not for the history server, where the root allows everybody to read data. That means that currently any user can see any application in the SHS through the REST API, when auth is enabled.

Instead, the REST API should behave like the regular UI and perform authentication at the app level too.

Issue Links

• relates to: SPARK-19642 Improve the security guarantee for rest api and ui
• links to: [Github] Pull Request #16978 (vanzin)
• links to: [Github] Pull Request #17019 (vanzin)
• links to: [Github] Pull Request #17029 (vanzin)