Skip to content

ATLAS-5326: Enforce Atlas authorization on AdminResource REST endpoints#675

Open
rkundam wants to merge 1 commit into
masterfrom
atlas-5326-master
Open

ATLAS-5326: Enforce Atlas authorization on AdminResource REST endpoints#675
rkundam wants to merge 1 commit into
masterfrom
atlas-5326-master

Conversation

@rkundam

@rkundam rkundam commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

What changes were proposed in this pull request?

  • Add AtlasAuthorizationUtils.verifyAccess() to sensitive AdminResource REST endpoints that previously lacked Atlas-level authorization checks.
  • Leave operational and UI-facing endpoints (/version, /status, /metrics, /metricsstats*, /liveness, /readiness) accessible to any authenticated user without an additional Atlas privilege check.

Changes

  • AdminResource.java: Enforce authorization on 15 endpoint groups using existing privileges (ADMIN_EXPORT, ADMIN_IMPORT, ADMIN_PURGE, ADMIN_AUDITS, ENTITY_READ).
  • AdminResourceTest.java: Add withAuthorizationBypass / withAuthorizationBypassCallable test helpers and update unit tests for protected vs. open endpoints.

Protected endpoints

Endpoint Privilege
GET /stack ADMIN_EXPORT
GET /session ENTITY_READ
GET/DELETE /activeSearches ADMIN_EXPORT
GET /server/{serverName} ADMIN_EXPORT
GET /expimp/audit ADMIN_EXPORT
POST /checkstate ENTITY_READ
GET /patches ADMIN_IMPORT
GET /audit/{auditGuid}/details ADMIN_AUDITS
GET/DELETE /tasks ADMIN_PURGE
GET /debug/metrics ADMIN_EXPORT
DELETE /async/import/{importId} ADMIN_IMPORT
GET /async/import/status* ADMIN_IMPORT

Intentionally unprotected (authentication only)

  • GET /version, /status, /metrics
  • GET /metricsstats, /metricsstat/{collectionTime}, /metricsstats/range, /metricsstats/charts
  • GET /liveness, /readiness

How was this patch tested?

Manual testing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant