hbase-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From apurt...@apache.org
Subject [2/4] hbase git commit: HBASE-13085 Security issue in the implementation of Rest gataway 'doAs' proxy user support (Jerry He)
Date Tue, 24 Feb 2015 18:23:48 GMT
HBASE-13085 Security issue in the implementation of Rest gataway 'doAs' proxy user support
(Jerry He)


Project: http://git-wip-us.apache.org/repos/asf/hbase/repo
Commit: http://git-wip-us.apache.org/repos/asf/hbase/commit/f27f1af3
Tree: http://git-wip-us.apache.org/repos/asf/hbase/tree/f27f1af3
Diff: http://git-wip-us.apache.org/repos/asf/hbase/diff/f27f1af3

Branch: refs/heads/branch-1.0
Commit: f27f1af3cce83d3220f51fc82d0566930591891c
Parents: 7ec02aa
Author: Andrew Purtell <apurtell@apache.org>
Authored: Tue Feb 24 10:18:17 2015 -0800
Committer: Andrew Purtell <apurtell@apache.org>
Committed: Tue Feb 24 10:18:27 2015 -0800

----------------------------------------------------------------------
 .../java/org/apache/hadoop/hbase/rest/RESTServletContainer.java   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/hbase/blob/f27f1af3/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServletContainer.java
----------------------------------------------------------------------
diff --git a/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServletContainer.java
b/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServletContainer.java
index 2ce8ede..b5ecb35 100644
--- a/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServletContainer.java
+++ b/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServletContainer.java
@@ -56,7 +56,8 @@ public class RESTServletContainer extends ServletContainer {
       if (!servlet.supportsProxyuser()) {
         throw new ServletException("Support for proxyuser is not configured");
       }
-      UserGroupInformation ugi = servlet.getRealUser();
+      // Authenticated remote user is attempting to do 'doAs' proxy user.
+      UserGroupInformation ugi = UserGroupInformation.createRemoteUser(request.getRemoteUser());
       // create and attempt to authorize a proxy user (the client is attempting
       // to do proxy user)
       ugi = UserGroupInformation.createProxyUser(doAsUserFromQuery, ugi);


Mime
View raw message