hadoop-mapreduce-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Yuanbo Liu (JIRA)" <j...@apache.org>
Subject [jira] [Created] (MAPREDUCE-6845) Job history server requires admin permission when accessing container log in secure environment, which is not correct
Date Wed, 08 Feb 2017 06:35:41 GMT
Yuanbo Liu created MAPREDUCE-6845:
-------------------------------------

             Summary: Job history server requires admin permission when accessing container
log in secure environment, which is not correct
                 Key: MAPREDUCE-6845
                 URL: https://issues.apache.org/jira/browse/MAPREDUCE-6845
             Project: Hadoop Map/Reduce
          Issue Type: Bug
            Reporter: Yuanbo Liu


A typical url of container log in job history server is like this:
{code}
http://{job history server address}:19888/jobhistory/logs/{node manager address}:45454/{container
id}/{entity id}/{app owner}
{code}
When accessing it in secure environment, this url requires authorization.

Because the parent path {/logs} has {{AdminAuthorizedServlet}} defined in {{HttpServer2.java}},
the container log url will execute AdminAuthorizedServlet  in the servlet chain and requires
admin permission too, which is wrong.
The container log url has it own authorization mechanism, besides, If the user is the owner
of the container but it doesn't belong to admins, then the user will not be allowed to access
the container log url, and it is not reasonable.

There are two ways to fix this defect:
* change the parent path of container log url, for example, use "/clogs" instead of "/logs"
* stop executing {{AdminAuthorizedServlet}} when accessing the child path of "/logs" in job
history server.




--
This message was sent by Atlassian JIRA
(v6.3.15#6346)

---------------------------------------------------------------------
To unsubscribe, e-mail: mapreduce-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: mapreduce-dev-help@hadoop.apache.org


Mime
View raw message