xiaoyuyao commented on a change in pull request #1801:
URL: https://github.com/apache/ozone/pull/1801#discussion_r565539787
##########
File path:
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OMDBCheckpointServlet.java
##########
@@ -106,6 +139,35 @@ public void doGet(HttpServletRequest request,
HttpServletResponse response) {
return;
}
+ // Check ACL for dbCheckpoint only when global Ozone ACL is enable
+ if (om.getAclsEnabled()) {
+ final java.security.Principal userPrincipal = request.getUserPrincipal();
+ if (userPrincipal == null) {
+ // Fallback to checking login user if getUserPrincipal returns null.
+ // Note: In prod, a secure cluster with Kerberos should not hit this
+ // branch. This is mostly here for UT and dev testing.
+ final String remoteUser = request.getRemoteUser();
+ if (!hasPermission(remoteUser)) {
+ LOG.error("Permission denied: Current login user '{}' does not have"
+ + " access to /dbCheckpoint.", remoteUser);
+ response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+ return;
+ }
+ LOG.debug("Granted login user '{}' access to /dbCheckpoint.",
+ remoteUser);
+ } else {
+ final String userPrincipalName = userPrincipal.getName();
+ if (!hasPermission(userPrincipalName)) {
Review comment:
Can we refactor like below to dedup
String remoteUser = null;
final java.security.Principal userPrincipal = request.getUserPrincipal();
if (userPrincipal == null) {
remoteUser = request.getRemoteUser();
} else {
remoteuser = userPrincipal.getName();
}
if (remoteUser == null || !hasPermission(remoteUser)) {
LOG.error("Permission denied: User remoteUser '{}' does not have"
" access to /dbCheckpoint.", remoteUser);
response.setStatus(HttpServletResponse.SC_FORBIDDEN);
return;
}
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@ozone.apache.org
For additional commands, e-mail: issues-h...@ozone.apache.org
