[ https://issues.apache.org/jira/browse/AMBARI-18635?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Robert Levas updated AMBARI-18635: ---------------------------------- Attachment: AMBARI-18635_trunk_02.patch AMBARI-18635_branch-2.5_02.patch AMBARI-18635_branch-2.4_02.patch > Authorizations given to roles, should use generic role-based principals > rather than hard-coded pseudo-role-based principals > --------------------------------------------------------------------------------------------------------------------------- > > Key: AMBARI-18635 > URL: https://issues.apache.org/jira/browse/AMBARI-18635 > Project: Ambari > Issue Type: Bug > Components: ambari-server > Affects Versions: 2.4.0 > Reporter: Robert Levas > Assignee: Robert Levas > Fix For: 2.4.2 > > Attachments: AMBARI-18635_branch-2.4_01.patch, > AMBARI-18635_branch-2.4_02.patch, AMBARI-18635_branch-2.5_01.patch, > AMBARI-18635_branch-2.5_02.patch, AMBARI-18635_trunk_01.patch, > AMBARI-18635_trunk_02.patch > > > Authorizations given to roles, should use generic role-based principals > rather than hard-coded resource types. > Access to views can be assigned to all users with a given role. The > implementation for this lead to the creation of hard-coded principals that > represent the current set of roles. This is not dynamic enough for possibly > future enhancements where new roles may be created by administrators. > This needs to be changed such that rather that using the hard-coded > pseudo-role-principals, the dynamically generated role-principals are to be > used. > The hard-coded pseudo-role-principals have the following > {{adminprincipaltype}} values as opposed to "ROLE": > * ALL.CLUSTER.ADMINISTRATOR > * ALL.CLUSTER.OPERATOR > * ALL.SERVICE.ADMINISTRATOR > * ALL.SERVICE.OPERATOR > * ALL.CLUSTER.USER > These should be removed along with the associated {{adminprincipal}} records. > Also, the FE should be updated to set permissions using the dynamic > role-principals. > Finally, code should be cleaned up to remove unneeded code in > * > org.apache.ambari.server.security.authorization.ClusterInheritedPermissionHelper > * > org.apache.ambari.server.controller.internal.GroupPrivilegeResourceProvider#getResources > * > org.apache.ambari.server.controller.internal.PrivilegeResourceProvider#toEntity > * > org.apache.ambari.server.controller.internal.UserPrivilegeResourceProvider#getResources > * > org.apache.ambari.server.security.authorization.AuthorizationHelper#isAuthorized > * org.apache.ambari.server.view.ViewRegistry#addClusterInheritedPermissions > * ... -- This message was sent by Atlassian JIRA (v6.3.4#6332)