[YARN-6890] If UI is not secured, we allow user to kill other users' job even yarn cluster is secured.

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 3.0.0-beta1, 2.8.2
• Target Version/s: 3.0.0-beta1, 2.8.2
• Assignee: Junping Du
• Reporter: Sumana Sathish
• Created: 27/Jul/17 17:18
• Updated: 09/May/19 11:26
• Resolved: 08/Aug/17 21:47

Description

Configuring SPNEGO for web browser could be a head ache, so many production cluster choose to configure a unsecured UI access even for a secured cluster. In this setup, users (login as some random guy) could watch other users job which is expected. However, the kill button (added in YARN-3249 which enabled by default) shouldn't work in this situation.

Issue Links

• is duplicated by: YARN-6891 Can kill other user's applications via RM UI
• is related to: YARN-9522 AppBlock ignores full qualified class name of PseudoAuthenticationHandler
• relates to: YARN-3249 Add a "kill application" button to Resource Manager's Web UI