chaitali borole created ATLAS-5414:
--------------------------------------
Summary: Enforce authorization on AdminResource active search list
and cancel endpoints
Key: ATLAS-5414
URL: https://issues.apache.org/jira/browse/ATLAS-5414
Project: Atlas
Issue Type: Improvement
Components: atlas-webui
Affects Versions: 3.0.0
Reporter: chaitali borole
Assignee: chaitali borole
Summary
The GET and DELETE handlers for /api/atlas/admin/activeSearches in
AdminResource do not use the same authorization pattern as other admin
endpoints in that class.
Background
When a metadata search runs for a long time, Atlas registers it in
SearchTracker so administrators can observe and cancel active queries. Those
operations are exposed under the admin REST API and are intended to be
restricted to privileged users, consistent with endpoints such as debug
metrics, export, and audits.
A prior change added authorization to many AdminResource handlers but did not
include the active search list and cancel endpoints.
Current behavior
GET /api/atlas/admin/activeSearches returns the set of active search IDs with
no privilege check.
DELETE /api/atlas/admin/activeSearches/{id} cancels a search by ID with no
privilege check.
SearchTracker keys entries by the executing thread name and does not record
which user initiated the search, so cancellation cannot be limited to the
initiating user or an administrator.
Expected behavior
Listing all active searches requires an administrative privilege (aligned with
other operational admin APIs, e.g. ADMIN_EXPORT).
Cancelling a search is allowed for users with that administrative privilege, or
for the user who started the search; other users should receive the standard
Atlas authorization failure response.
Each tracked search should record the initiating user at registration time for
ownership checks on cancel.
Proposed changes
AdminResource
Call AtlasAuthorizationUtils.verifyAccess with ADMIN_EXPORT before returning
active search IDs.
On terminate: allow if the caller has ADMIN_EXPORT; otherwise allow only when
the search owner matches the current user; otherwise enforce authorization
(403).
SearchTracker
Store the initiating user (from RequestContext.getCurrentUser()) when a search
is added.
Expose owner lookup by search ID for the REST layer.
Tests
Update AdminResourceTest for the new authorization paths.
Add SearchTrackerTest for owner recording and terminate behavior.
Test plan
Unprivileged user: GET /api/atlas/admin/activeSearches → 403 (same as other
admin endpoints such as debug metrics).
User A runs searches; user B (without admin export) → cannot list all active
searches; cannot cancel A’s search (403).
User A can cancel their own in-flight search when not granted admin export (if
product accepts owner-only cancel).
User with ADMIN_EXPORT can list and cancel any active search.
Existing unit tests for AdminResource and new SearchTracker tests pass.
Affected components
atlas-webapp: org.apache.atlas.web.resources.AdminResource
atlas-repository: org.apache.atlas.util.SearchTracker
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
