Mailing-List: contact mapreduce-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: mapreduce-issues@hadoop.apache.org
Message-ID: <1871165382.428931266833068221.JavaMail.jira@brutus.apache.org>
Date: Mon, 22 Feb 2010 10:04:28 +0000 (UTC)
From: "Vinod K V (JIRA)" <jira@apache.org>
To: mapreduce-issues@hadoop.apache.org
Subject: [jira] Commented: (MAPREDUCE-1455) Authorization for servlets
In-Reply-To: <663344622.28361265262030144.JavaMail.jira@brutus.apache.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/MAPREDUCE-1455?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12836564#action_12836564 ] 

Vinod K V commented on MAPREDUCE-1455:
--------------------------------------

> What about the configuration webinterface.private.actions?
>>> We need to think of this more and decide.
Let's open a new issue.

> The variable 'conf' should actually be removed
>>> So would it be better to handle this in MAPREDUCE-1493 as that is using getJobInfo() and in turn this "conf" variable ?
+1

> Make it something like JSPUtil.checkAccessAndDoOperation(JobOperation).
>>> Hmm. This may make the method checkAccessAndDoOperation() complex
OK. We'll leave it as is.

> Authorization for servlets
> --------------------------
>
>                 Key: MAPREDUCE-1455
>                 URL: https://issues.apache.org/jira/browse/MAPREDUCE-1455
>             Project: Hadoop Map/Reduce
>          Issue Type: Sub-task
>          Components: jobtracker, security, tasktracker
>            Reporter: Devaraj Das
>            Assignee: Ravi Gummadi
>             Fix For: 0.22.0
>
>         Attachments: 1455.patch, 1455.v1.patch
>
>
> This jira is about building the authorization for servlets (on top of MAPREDUCE-1307). That is, the JobTracker/TaskTracker runs authorization checks on web requests based on the configured job permissions. For e.g., if the job permission is 600, then no one except the authenticated user can look at the job details via the browser. The authenticated user in the servlet can be obtained using the HttpServletRequest method.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.