Mailing-List: contact issues-help@ambari.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ambari.apache.org
Date: Thu, 20 Oct 2016 20:02:58 +0000 (UTC)
From: "Robert Levas (JIRA)" <jira@apache.org>
To: issues@ambari.apache.org
Message-ID: <JIRA.13013565.1476891917000.43783.1476993778767@Atlassian.JIRA>
In-Reply-To: <JIRA.13013565.1476891917000@Atlassian.JIRA>
References: <JIRA.13013565.1476891917000@Atlassian.JIRA> <JIRA.13013565.1476891917789@arcas>
Subject: [jira] [Updated] (AMBARI-18635) Authorizations given to roles,
 should use generic role-based principals rather than hard-coded
 pseudo-role-based principals
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 20 Oct 2016 20:03:00 -0000


     [ https://issues.apache.org/jira/browse/AMBARI-18635?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Robert Levas updated AMBARI-18635:
----------------------------------
    Attachment: AMBARI-18635_trunk_02.patch
                AMBARI-18635_branch-2.5_02.patch
                AMBARI-18635_branch-2.4_02.patch

> Authorizations given to roles, should use generic role-based principals rather than hard-coded pseudo-role-based principals
> ---------------------------------------------------------------------------------------------------------------------------
>
>                 Key: AMBARI-18635
>                 URL: https://issues.apache.org/jira/browse/AMBARI-18635
>             Project: Ambari
>          Issue Type: Bug
>          Components: ambari-server
>    Affects Versions: 2.4.0
>            Reporter: Robert Levas
>            Assignee: Robert Levas
>             Fix For: 2.4.2
>
>         Attachments: AMBARI-18635_branch-2.4_01.patch, AMBARI-18635_branch-2.4_02.patch, AMBARI-18635_branch-2.5_01.patch, AMBARI-18635_branch-2.5_02.patch, AMBARI-18635_trunk_01.patch, AMBARI-18635_trunk_02.patch
>
>
> Authorizations given to roles, should use generic role-based principals rather than hard-coded resource types.  
> Access to views can be assigned to all users with a given role.  The implementation for this lead to the creation of hard-coded principals that represent the current set of roles. This is not dynamic enough for possibly future enhancements where new roles may be created by administrators. 
> This needs to be changed such that rather that using the hard-coded pseudo-role-principals, the dynamically generated role-principals are to be used.
> The hard-coded pseudo-role-principals have the following {{adminprincipaltype}} values as opposed to "ROLE":
> * ALL.CLUSTER.ADMINISTRATOR
> * ALL.CLUSTER.OPERATOR
> * ALL.SERVICE.ADMINISTRATOR
> * ALL.SERVICE.OPERATOR
> * ALL.CLUSTER.USER
> These should be removed along with the associated {{adminprincipal}} records. 
> Also, the FE should be updated to set permissions using the dynamic role-principals.
> Finally, code should be cleaned up to remove unneeded code in 
> * org.apache.ambari.server.security.authorization.ClusterInheritedPermissionHelper
> * org.apache.ambari.server.controller.internal.GroupPrivilegeResourceProvider#getResources
> * org.apache.ambari.server.controller.internal.PrivilegeResourceProvider#toEntity
> * org.apache.ambari.server.controller.internal.UserPrivilegeResourceProvider#getResources
> * org.apache.ambari.server.security.authorization.AuthorizationHelper#isAuthorized
> * org.apache.ambari.server.view.ViewRegistry#addClusterInheritedPermissions
> * ...


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)