[
https://issues.apache.org/jira/browse/HDDS-15460?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sergey Soldatov updated HDDS-15460:
-----------------------------------
Status: Patch Available (was: Open)
> Move ACL checks for key and prefix requests to preExecute
> ----------------------------------------------------------
>
> Key: HDDS-15460
> URL: https://issues.apache.org/jira/browse/HDDS-15460
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Sergey Soldatov
> Assignee: Sergey Soldatov
> Priority: Major
>
> Move ACL authorization checks for key operations (delete-keys, rename-keys)
> and key/prefix ACL operations (addAcl, removeAcl, setAcl, including FSO
> variants) from validateAndUpdateCache to preExecute. This ensures access
> control is enforced before the request enters the Raft log, avoiding
> unauthorized operations being persisted.
> For bulk operations (OMKeysDeleteRequest, OMKeysRenameRequest), keys that
> fail the ACL check are collected in new proto fields (aclDeniedKeys /
> aclDeniedRenameKeys) and stripped from the batch so that the remaining
> permitted keys can still be processed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
