[
https://issues.apache.org/jira/browse/ATLAS-5365?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Umesh Patil updated ATLAS-5365:
-------------------------------
Description:
h2. Summary
The rest-notification-webapp module (introduced in ATLAS-5207 / PR #622) is
missing authorization on the Kafka hook notification REST endpoint POST
/api/atlas/v2/notification/topic/\{topicName}. The main webapp NotificationREST
already enforces SERVICE_NOTIFICATION_POST via
AtlasAuthorizationUtils.verifyAccess(), but the rest-notification copy did not
— allowing authenticated read-only users (e.g. DATA_SCIENTIST / rangertagsync)
to POST hook messages (including ENTITY_CREATE_V2) to ATLAS_HOOK and reach the
entity pipeline via Kafka.
h2. Related work
* Parent feature JIRA: ATLAS-5207 (Closed — rest-notification module port)
* Merged PR: [GitHub PR #622|https://github.com/apache/atlas/pull/622]
* Webapp reference (correct behavior):
webapp/src/main/java/org/apache/atlas/web/rest/NotificationREST.java line ~91
h2. Problem (before fix)
||Entry point||Authorization||
|webapp NotificationREST|verifyAccess(SERVICE_NOTIFICATION_POST) — OK|
|rest-notification NotificationREST|Missing verifyAccess — VULNERABLE|
*Attack path:* Read-only user authenticates to rest-notification server (port
41000) → POST ENTITY_CREATE_V2 JSON to
/rest/api/atlas/v2/notification/topic/ATLAS_HOOK → message published to Kafka →
main Atlas consumer processes entity create/update/delete.
*Root cause:* Authorization check existed in webapp since ATLAS-4335 but was
never added when rest-notification was created (CDH CDPD-45331, Nov 2022) or
when ported to Apache OSS (commit 8427a05, ATLAS-5207). Commit 573f23e only
removed unused auth imports during checkstyle cleanup — it did not remove
working authorization (verifyAccess was never implemented in the method body).
h2. Expected behavior (requirement)
"Please refer to the authorization added in NotificationREST in Webapp module
and apply it accordingly."
Read-only users must receive HTTP 403 on rest-notification POST. Admin users
must still receive HTTP 204. Unauthenticated users must receive HTTP 401.
h2. Proposed fix
Add the same authorization line as webapp
NotificationREST.handleNotifications():
{code:java}
AtlasAuthorizationUtils.verifyAccess(
new AtlasAdminAccessRequest(AtlasPrivilege.SERVICE_NOTIFICATION_POST),
"post on rest notification service");
{code}
*File:*
rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/rest/NotificationREST.java
*Imports required:*
* org.apache.atlas.authorize.AtlasAdminAccessRequest
* org.apache.atlas.authorize.AtlasAuthorizationUtils
* org.apache.atlas.authorize.AtlasPrivilege
h2. How to test
# Start main Atlas (port 21000): atlas_start.py
# Start rest-notification (port 41000):
rest-notification-webapp/bin/rest_start.py
# Distro default credentials: admin/admin, rangertagsync/rangertagsync
* Test A — read-only POST to rest-notification → expect HTTP 403
* Test B — admin POST to rest-notification → expect HTTP 204
* Test C — read-only POST to webapp → expect HTTP 403 (unchanged)
* Test D — entity GET after Test A → expect HTTP 404 (not created)
* Test F — unauthenticated POST → expect HTTP 401
Example curl (read-only, must fail with 403):
{code:bash}
curl -v -u rangertagsync:rangertagsync \
-X POST -H "Content-Type: application/json" \
-d @/tmp/hook_entity_create.json \
"http://localhost:41000/rest/api/atlas/v2/notification/topic/ATLAS_HOOK";
{code}
was:
h2. Summary
The rest-notification-webapp module (introduced in ATLAS-5207 / PR #622) is
missing authorization on the Kafka hook notification REST endpoint POST
/api/atlas/v2/notification/topic/\{topicName}. The main webapp NotificationREST
already enforces SERVICE_NOTIFICATION_POST via
AtlasAuthorizationUtils.verifyAccess(), but the rest-notification copy did not
— allowing authenticated read-only users (e.g. DATA_SCIENTIST / rangertagsync)
to POST hook messages (including ENTITY_CREATE_V2) to ATLAS_HOOK and reach the
entity pipeline via Kafka.
h2. Related work
* Parent feature JIRA:
[ATLAS-5207|https://issues.apache.org/jira/browse/ATLAS-5207] (Closed —
rest-notification module port)
* Merged PR: [GitHub PR #622|https://github.com/apache/atlas/pull/622]
* Webapp reference (correct behavior):
webapp/src/main/java/org/apache/atlas/web/rest/NotificationREST.java line ~91
h2. Problem (before fix)
|| Entry point || Authorization ||
| webapp NotificationREST | verifyAccess(SERVICE_NOTIFICATION_POST) — OK |
| rest-notification NotificationREST | Missing verifyAccess — VULNERABLE |
*Attack path:* Read-only user authenticates to rest-notification server (port
41000) → POST ENTITY_CREATE_V2 JSON to
/rest/api/atlas/v2/notification/topic/ATLAS_HOOK → message published to Kafka →
main Atlas consumer processes entity create/update/delete.
*Root cause:* Authorization check existed in webapp since ATLAS-4335 but was
never added when rest-notification was created (CDH CDPD-45331, Nov 2022) or
when ported to Apache OSS (commit 8427a05, ATLAS-5207). Commit 573f23e only
removed unused auth imports during checkstyle cleanup — it did not remove
working authorization (verifyAccess was never implemented in the method body).
h2. Expected behavior (Nixon email requirement)
"Please refer to the authorization added in NotificationREST in Webapp module
and apply it accordingly."
Read-only users must receive HTTP 403 on rest-notification POST. Admin users
must still receive HTTP 204. Unauthenticated users must receive HTTP 401.
h2. Proposed fix
Add the same authorization line as webapp
NotificationREST.handleNotifications():
{code:java}
AtlasAuthorizationUtils.verifyAccess(
new AtlasAdminAccessRequest(AtlasPrivilege.SERVICE_NOTIFICATION_POST),
"post on rest notification service");
{code}
*File:*
rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/rest/NotificationREST.java
*Imports required:*
* org.apache.atlas.authorize.AtlasAdminAccessRequest
* org.apache.atlas.authorize.AtlasAuthorizationUtils
* org.apache.atlas.authorize.AtlasPrivilege
h2. How to test
# Start main Atlas (port 21000): atlas_start.py
# Start rest-notification (port 41000):
rest-notification-webapp/bin/rest_start.py
# Distro default credentials: admin/admin, rangertagsync/rangertagsync
* Test A — read-only POST to rest-notification → expect HTTP 403
* Test B — admin POST to rest-notification → expect HTTP 204
* Test C — read-only POST to webapp → expect HTTP 403 (unchanged)
* Test D — entity GET after Test A → expect HTTP 404 (not created)
* Test F — unauthenticated POST → expect HTTP 401
Example curl (read-only, must fail with 403):
{code:bash}
curl -v -u rangertagsync:rangertagsync \
-X POST -H "Content-Type: application/json" \
-d @/tmp/hook_entity_create.json \
"http://localhost:41000/rest/api/atlas/v2/notification/topic/ATLAS_HOOK";
{code}
> Missing SERVICE_NOTIFICATION_POST authorization on rest-notification
> NotificationREST POST /topic/{topicName}.
> --------------------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5365
> URL: https://issues.apache.org/jira/browse/ATLAS-5365
> Project: Atlas
> Issue Type: Bug
> Components: atlas-core
> Affects Versions: 3.0.0
> Reporter: Umesh Patil
> Assignee: Umesh Patil
> Priority: Major
> Fix For: 3.0.0
>
>
> h2. Summary
> The rest-notification-webapp module (introduced in ATLAS-5207 / PR #622) is
> missing authorization on the Kafka hook notification REST endpoint POST
> /api/atlas/v2/notification/topic/\{topicName}. The main webapp
> NotificationREST already enforces SERVICE_NOTIFICATION_POST via
> AtlasAuthorizationUtils.verifyAccess(), but the rest-notification copy did
> not — allowing authenticated read-only users (e.g. DATA_SCIENTIST /
> rangertagsync) to POST hook messages (including ENTITY_CREATE_V2) to
> ATLAS_HOOK and reach the entity pipeline via Kafka.
> h2. Related work
> * Parent feature JIRA: ATLAS-5207 (Closed — rest-notification module port)
> * Merged PR: [GitHub PR #622|https://github.com/apache/atlas/pull/622]
> * Webapp reference (correct behavior):
> webapp/src/main/java/org/apache/atlas/web/rest/NotificationREST.java line ~91
> h2. Problem (before fix)
> ||Entry point||Authorization||
> |webapp NotificationREST|verifyAccess(SERVICE_NOTIFICATION_POST) — OK|
> |rest-notification NotificationREST|Missing verifyAccess — VULNERABLE|
> *Attack path:* Read-only user authenticates to rest-notification server (port
> 41000) → POST ENTITY_CREATE_V2 JSON to
> /rest/api/atlas/v2/notification/topic/ATLAS_HOOK → message published to Kafka
> → main Atlas consumer processes entity create/update/delete.
> *Root cause:* Authorization check existed in webapp since ATLAS-4335 but was
> never added when rest-notification was created (CDH CDPD-45331, Nov 2022) or
> when ported to Apache OSS (commit 8427a05, ATLAS-5207). Commit 573f23e only
> removed unused auth imports during checkstyle cleanup — it did not remove
> working authorization (verifyAccess was never implemented in the method body).
> h2. Expected behavior (requirement)
> "Please refer to the authorization added in NotificationREST in Webapp module
> and apply it accordingly."
> Read-only users must receive HTTP 403 on rest-notification POST. Admin users
> must still receive HTTP 204. Unauthenticated users must receive HTTP 401.
> h2. Proposed fix
> Add the same authorization line as webapp
> NotificationREST.handleNotifications():
> {code:java}
> AtlasAuthorizationUtils.verifyAccess(
> new AtlasAdminAccessRequest(AtlasPrivilege.SERVICE_NOTIFICATION_POST),
> "post on rest notification service");
> {code}
> *File:*
> rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/rest/NotificationREST.java
> *Imports required:*
> * org.apache.atlas.authorize.AtlasAdminAccessRequest
> * org.apache.atlas.authorize.AtlasAuthorizationUtils
> * org.apache.atlas.authorize.AtlasPrivilege
> h2. How to test
> # Start main Atlas (port 21000): atlas_start.py
> # Start rest-notification (port 41000):
> rest-notification-webapp/bin/rest_start.py
> # Distro default credentials: admin/admin, rangertagsync/rangertagsync
> * Test A — read-only POST to rest-notification → expect HTTP 403
> * Test B — admin POST to rest-notification → expect HTTP 204
> * Test C — read-only POST to webapp → expect HTTP 403 (unchanged)
> * Test D — entity GET after Test A → expect HTTP 404 (not created)
> * Test F — unauthenticated POST → expect HTTP 401
> Example curl (read-only, must fail with 403):
> {code:bash}
> curl -v -u rangertagsync:rangertagsync \
> -X POST -H "Content-Type: application/json" \
> -d @/tmp/hook_entity_create.json \
> "http://localhost:41000/rest/api/atlas/v2/notification/topic/ATLAS_HOOK";
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
