[YARN-8415] TimelineWebServices.getEntity should throw ForbiddenException instead of 404 when ACL checks fail

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.2.0, 3.1.1
• Hadoop Flags: Reviewed
• Assignee: Suma Shivaprasad
• Reporter: Sumana Sathish
• Created: 12/Jun/18 00:50
• Updated: 02/Jul/18 23:06
• Resolved: 02/Jul/18 22:36

Description

private TimelineEntity doGetEntity(
      String entityType,
      String entityId,
      EnumSet<Field> fields,
      UserGroupInformation callerUGI) throws YarnException, IOException {
    TimelineEntity entity = null;
    entity =
        store.getEntity(entityId, entityType, fields);
    if (entity != null) {
      addDefaultDomainIdIfAbsent(entity);
      // check ACLs
      if (!timelineACLsManager.checkAccess(
          callerUGI, ApplicationAccessType.VIEW_APP, entity)) {
          entity = null;   //Should differentiate from an entity get failure vs ACL check failure here by throwing an Exception.*
      }
    }
    return entity;
  }