Yuanbo Liu created MAPREDUCE-6845:
-------------------------------------
Summary: Job history server requires admin permission when accessing container
log in secure environment, which is not correct
Key: MAPREDUCE-6845
URL: https://issues.apache.org/jira/browse/MAPREDUCE-6845
Project: Hadoop Map/Reduce
Issue Type: Bug
Reporter: Yuanbo Liu
A typical url of container log in job history server is like this:
{code}
http://{job history server address}:19888/jobhistory/logs/{node manager address}:45454/{container
id}/{entity id}/{app owner}
{code}
When accessing it in secure environment, this url requires authorization.
Because the parent path {/logs} has {{AdminAuthorizedServlet}} defined in {{HttpServer2.java}},
the container log url will execute AdminAuthorizedServlet in the servlet chain and requires
admin permission too, which is wrong.
The container log url has it own authorization mechanism, besides, If the user is the owner
of the container but it doesn't belong to admins, then the user will not be allowed to access
the container log url, and it is not reasonable.
There are two ways to fix this defect:
* change the parent path of container log url, for example, use "/clogs" instead of "/logs"
* stop executing {{AdminAuthorizedServlet}} when accessing the child path of "/logs" in job
history server.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
---------------------------------------------------------------------
To unsubscribe, e-mail: mapreduce-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: mapreduce-dev-help@hadoop.apache.org
|