Skip to content

ATLAS-5326: Enforce Atlas authorization on AdminResource REST endpoints #674

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rkundam wants to merge 1 commit into from
+294 −98
Closed

ATLAS-5326: Enforce Atlas authorization on AdminResource REST endpoints #674

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 36 additions & 6 deletions webapp/src/main/java/org/apache/atlas/web/resources/AdminResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,9 +268,11 @@ public AdminResource(ServiceState serviceState, MetricsService metricsService, A
@GET
@Path("stack")
@Produces(MediaType.TEXT_PLAIN)
public String getThreadDump() {
public String getThreadDump() throws AtlasBaseException {
LOG.debug("==> AdminResource.getThreadDump()");

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "thread dump");

ThreadGroup topThreadGroup = Thread.currentThread().getThreadGroup();

while (topThreadGroup.getParent() != null) {
Expand Down Expand Up @@ -360,9 +362,11 @@ public Response getStatus() {
@GET
@Path("session")
@Produces(Servlets.JSON_MEDIA_TYPE)
public Response getUserProfile(@Context HttpServletRequest request) {
public Response getUserProfile(@Context HttpServletRequest request) throws AtlasBaseException {
LOG.debug("==> AdminResource.getUserProfile()");

AtlasAuthorizationUtils.verifyAccess(new AtlasEntityAccessRequest(typeRegistry, AtlasPrivilege.ENTITY_READ), "session");

Response response;

boolean isEntityUpdateAccessAllowed = false;
Expand Down Expand Up @@ -735,6 +739,8 @@ public AtlasAsyncImportRequest importAsync(@DefaultValue("{}") @FormDataParam("r
@Produces(Servlets.JSON_MEDIA_TYPE)
@Consumes(MediaType.APPLICATION_JSON)
public void abortAsyncImport(@PathParam("importId") String importId) throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_IMPORT), "abort async import");

importService.abortAsyncImport(importId);
}

Expand All @@ -749,6 +755,8 @@ public PList<AsyncImportStatus> getAsyncImportStatus(@QueryParam("offset") @Defa
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "AdminResource.getAsyncImportStatus()");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_IMPORT), "async import status");

return importService.getAsyncImportsStatus(offset, limit);
} finally {
AtlasPerfTracer.log(perf);
Expand All @@ -766,6 +774,8 @@ public AtlasAsyncImportRequest getAsyncImportStatusById(@PathParam("importId") S
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "AdminResource.getAsyncImportStatusById(importId=" + importId + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_IMPORT), "async import status by id");

return importService.getAsyncImportRequest(importId);
} finally {
AtlasPerfTracer.log(perf);
Expand Down Expand Up @@ -923,6 +933,8 @@ public AtlasServer getCluster(@PathParam("serverName") String serverName) throws
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "cluster.getServer(" + serverName + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "get server");

AtlasServer cluster = new AtlasServer(serverName, serverName);

return atlasServerService.get(cluster);
Expand All @@ -946,6 +958,8 @@ public List<ExportImportAuditEntry> getExportImportAudit(@QueryParam("serverName
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "getExportImportAudit(" + serverName + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "export import audit");

return exportImportAuditService.get(userName, operation, serverName, startTime, endTime, limit, offset);
} finally {
AtlasPerfTracer.log(perf);
Expand Down Expand Up @@ -1018,6 +1032,8 @@ public List<AtlasEntityHeader> getAuditDetails(@PathParam("auditGuid") String au
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "AdminResource.getAuditDetails(" + auditGuid + ", " + limit + ", " + offset + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_AUDITS), "audit details");

List<AtlasEntityHeader> ret = new ArrayList<>();

AtlasAuditEntry auditEntry = auditService.toAtlasAuditEntry(entityStore.getById(auditGuid, false, true));
Expand Down Expand Up @@ -1050,14 +1066,18 @@ public List<AtlasEntityHeader> getAuditDetails(@PathParam("auditGuid") String au
@GET
@Path("activeSearches")
@Produces(Servlets.JSON_MEDIA_TYPE)
public Set<String> getActiveSearches() {
public Set<String> getActiveSearches() throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "active searches");

return activeSearches.getActiveSearches();
}

@DELETE
@Path("activeSearches/{id}")
@Produces(Servlets.JSON_MEDIA_TYPE)
public boolean terminateActiveSearch(@PathParam("id") String searchId) {
public boolean terminateActiveSearch(@PathParam("id") String searchId) throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "terminate active search");

SearchContext terminate = activeSearches.terminate(searchId);

return null != terminate;
Expand All @@ -1075,6 +1095,8 @@ public AtlasCheckStateResult checkState(AtlasCheckStateRequest request) throws A
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "checkState(" + request + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasEntityAccessRequest(typeRegistry, AtlasPrivilege.ENTITY_READ), "check state");

return entityStore.checkState(request);
} finally {
AtlasPerfTracer.log(perf);
Expand All @@ -1084,9 +1106,11 @@ public AtlasCheckStateResult checkState(AtlasCheckStateRequest request) throws A
@GET
@Path("patches")
@Produces(Servlets.JSON_MEDIA_TYPE)
public AtlasPatches getAtlasPatches() {
public AtlasPatches getAtlasPatches() throws AtlasBaseException {
LOG.debug("==> AdminResource.getAtlasPatches()");

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_IMPORT), "patches");

AtlasPatches ret = patchManager.getAllPatches();

LOG.debug("<== AdminResource.getAtlasPatches()");
Expand All @@ -1098,13 +1122,17 @@ public AtlasPatches getAtlasPatches() {
@Path("/tasks")
@Produces(Servlets.JSON_MEDIA_TYPE)
public List<AtlasTask> getTaskStatus(@QueryParam("guids") List<String> guids) throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_PURGE), "tasks");

return CollectionUtils.isNotEmpty(guids) ? taskManagement.getByGuids(guids) : taskManagement.getAll();
}

@DELETE
@Path("/tasks")
@Produces(Servlets.JSON_MEDIA_TYPE)
public void deleteTask(@QueryParam("guids") List<String> guids) throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_PURGE), "delete tasks");

if (CollectionUtils.isNotEmpty(guids)) {
taskManagement.deleteByGuids(guids);
}
Expand All @@ -1113,7 +1141,9 @@ public void deleteTask(@QueryParam("guids") List<String> guids) throws AtlasBase
@GET
@Path("/debug/metrics")
@Produces(MediaType.APPLICATION_JSON)
public Map<String, DebugMetrics> getDebugMetrics() {
public Map<String, DebugMetrics> getDebugMetrics() throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "debug metrics");

return debugMetricsRESTSink.getMetrics();
}

Expand Down
Loading
Loading