[
https://issues.apache.org/jira/browse/RANGER-5539?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Chinmay N Hegde updated RANGER-5539:
------------------------------------
Fix Version/s: 2.9.0
> Add Authorisation Check for doAsUser Parameter
> ----------------------------------------------
>
> Key: RANGER-5539
> URL: https://issues.apache.org/jira/browse/RANGER-5539
> Project: Ranger
> Issue Type: Sub-task
> Components: Ranger, ranger-authn
> Reporter: Chinmay N Hegde
> Assignee: Chinmay N Hegde
> Priority: Major
> Fix For: 3.0.0, 2.9.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Currently {{RangerJwtAuthHandler}} accepts the {{doAsUser}} value directly
> from the incoming request and uses it to establish the authenticated user
> identity without performing any validation.
> So the user should be validated for impersonation permission on {{doAsUser}}
> parameter.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
