[
https://issues.apache.org/jira/browse/RANGER-5539?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18075392#comment-18075392
]
Chinmay N Hegde commented on RANGER-5539:
-----------------------------------------
Merged into apache master :
[https://github.com/apache/ranger/commit/13dc2c107a7704d10f784a922ebd51b416a89702]
> Add Authorisation Check for doAsUser Parameter
> ----------------------------------------------
>
> Key: RANGER-5539
> URL: https://issues.apache.org/jira/browse/RANGER-5539
> Project: Ranger
> Issue Type: Sub-task
> Components: Ranger, ranger-authn
> Reporter: Chinmay N Hegde
> Assignee: Chinmay N Hegde
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Currently {{RangerJwtAuthHandler}} accepts the {{doAsUser}} value directly
> from the incoming request and uses it to establish the authenticated user
> identity without performing any validation.
> So the user should be validated for impersonation permission on {{doAsUser}}
> parameter.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
