[
https://issues.apache.org/jira/browse/ATLAS-5414?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18118663#comment-18118663
]
ASF subversion and git services commented on ATLAS-5414:
--------------------------------------------------------
Commit bb1e1b5a67685fb432a6ecc5385f5e9f38975111 in atlas's branch
refs/heads/atlas-2.6 from chaitalicod
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=bb1e1b5a6 ]
ATLAS-5414: Enforce authorization on AdminResource active search list and
cancel endpoints (#765)
Co-authored-by: chaitali borole <[email protected]>
(cherrypicked from 027fa9bbea349203292d008446bda7ab4e41c43a)
> Enforce authorization on AdminResource active search list and cancel endpoints
> ------------------------------------------------------------------------------
>
> Key: ATLAS-5414
> URL: https://issues.apache.org/jira/browse/ATLAS-5414
> Project: Atlas
> Issue Type: Improvement
> Components: atlas-webui
> Affects Versions: 3.0.0
> Reporter: chaitali borole
> Assignee: chaitali borole
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Summary
> The GET and DELETE handlers for /api/atlas/admin/activeSearches in
> AdminResource do not use the same authorization pattern as other admin
> endpoints in that class.
> Background
> When a metadata search runs for a long time, Atlas registers it in
> SearchTracker so administrators can observe and cancel active queries. Those
> operations are exposed under the admin REST API and are intended to be
> restricted to privileged users, consistent with endpoints such as debug
> metrics, export, and audits.
> A prior change added authorization to many AdminResource handlers but did not
> include the active search list and cancel endpoints.
> Current behavior
> GET /api/atlas/admin/activeSearches returns the set of active search IDs with
> no privilege check.
> DELETE /api/atlas/admin/activeSearches/{id} cancels a search by ID with no
> privilege check.
> SearchTracker keys entries by the executing thread name and does not record
> which user initiated the search, so cancellation cannot be limited to the
> initiating user or an administrator.
> Expected behavior
> Listing all active searches requires an administrative privilege (aligned
> with other operational admin APIs, e.g. ADMIN_EXPORT).
> Cancelling a search is allowed for users with that administrative privilege,
> or for the user who started the search; other users should receive the
> standard Atlas authorization failure response.
> Each tracked search should record the initiating user at registration time
> for ownership checks on cancel.
> Proposed changes
> AdminResource
> Call AtlasAuthorizationUtils.verifyAccess with ADMIN_EXPORT before returning
> active search IDs.
> On terminate: allow if the caller has ADMIN_EXPORT; otherwise allow only when
> the search owner matches the current user; otherwise enforce authorization
> (403).
> SearchTracker
> Store the initiating user (from RequestContext.getCurrentUser()) when a
> search is added.
> Expose owner lookup by search ID for the REST layer.
> Tests
> Update AdminResourceTest for the new authorization paths.
> Add SearchTrackerTest for owner recording and terminate behavior.
> Test plan
> Unprivileged user: GET /api/atlas/admin/activeSearches → 403 (same as other
> admin endpoints such as debug metrics).
> User A runs searches; user B (without admin export) → cannot list all active
> searches; cannot cancel A’s search (403).
> User A can cancel their own in-flight search when not granted admin export
> (if product accepts owner-only cancel).
> User with ADMIN_EXPORT can list and cancel any active search.
> Existing unit tests for AdminResource and new SearchTracker tests pass.
> Affected components
> atlas-webapp: org.apache.atlas.web.resources.AdminResource
> atlas-repository: org.apache.atlas.util.SearchTracker
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
