[
https://issues.apache.org/jira/browse/KYLIN-6119?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123748#comment-18123748
]
ASF subversion and git services commented on KYLIN-6119:
--------------------------------------------------------
Commit 854a2216e05a0caa6c8ee7ce27db440c9e75afd9 in kylin's branch
refs/heads/kylin5 from Li Yang
[ https://gitbox.apache.org/repos/asf?p=kylin.git;h=854a2216e0 ]
KYLIN-6119 require admin or service token on maintenance operations
Several system maintenance handlers were reachable without an
authorization check: roll_event_log and diag/progress were public in the
security chain, while do_cleanup_garbage and metadata/reload only
required an authenticated caller. Any authenticated low-privilege user
could therefore trigger heavy rollup, garbage-collection, or metadata
reload work, or forge diagnostic progress.
Gate the handlers behind the global-admin-or-service-token check already
used for the other internal RPC endpoints, and have the internal info
extractor attach the deployment-scoped token so diagnostics keep
reporting without extra configuration. The unit-of-work simulation
helper, which writes metadata, is gated as well for consistency.
> Potential unauthorized maintenance operation issue
> --------------------------------------------------
>
> Key: KYLIN-6119
> URL: https://issues.apache.org/jira/browse/KYLIN-6119
> Project: Kylin
> Issue Type: Bug
> Reporter: liyang
> Priority: Major
>
> Several internal maintenance operations exposed on the API port do not
> require administrator authorization. A caller can trigger an event-log
> rollup, a metadata reload, routine cleanup work, and diagnostic-progress
> updates. Some of these operations are reachable without authentication, and
> others require only an authenticated identity rather than an administrator.
> Fix direction: require either an authenticated global administrator or a
> valid internal service credential on these maintenance operations, and have
> the internal maintenance callers present the credential.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
