[
https://issues.apache.org/jira/browse/ATLAS-5388?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Umesh Patil updated ATLAS-5388:
-------------------------------
Attachment: Atlas-5388-Test-7.png
Atlas-5388-Test-6.png
Atlas-5388-Test-5.png
Atlas-5388-Test-4.png
Atlas-5388-Test-3.png
Atlas-5388-Test-2.png
Atlas-5388-Test-1.png
> Topic-scoped authorization for REST notification POST (POST_NOTIFICATION +
> AtlasNotificationRequest)
> ----------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5388
> URL: https://issues.apache.org/jira/browse/ATLAS-5388
> Project: Atlas
> Issue Type: Bug
> Components: atlas-core
> Affects Versions: 3.0.0
> Reporter: Umesh Patil
> Assignee: Umesh Patil
> Priority: Major
> Attachments: Atlas-5388-Test-1.png, Atlas-5388-Test-2.png,
> Atlas-5388-Test-3.png, Atlas-5388-Test-4.png, Atlas-5388-Test-5.png,
> Atlas-5388-Test-6.png, Atlas-5388-Test-7.png, Atlas-5388-Testdoc
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Problem Statement
> {{rest-notification-webapp}} checks auth using an admin privilege
> ({{{}service-notification-post{}}}). The URL topic ({{{}ATLAS_HOOK{}}},
> {{{}ATLAS_ENTITIES{}}}) is not used in the auth decision.
> So today:
> * A user with notification permission can POST to any topic
> * Hook accounts cannot be limited to one topic (e.g. hive-bridge →
> {{ATLAS_HOOK}} only)
> * Ranger has no {{notification-topic}} resource to create topic policies
>
> *
> h2. Affected Endpoint
>
> {code:java}
> POST http://<host>:41000/rest/api/atlas/v2/notification/topic/\{topicName}
> {code}
>
> * {{topicName}} examples: {{{}ATLAS_HOOK{}}}, {{ATLAS_ENTITIES}}
>
> Root cause
> ||Area||Today||
> |Request type|{{AtlasAdminAccessRequest}}|
> |Privilege|{{SERVICE_NOTIFICATION_POST}}|
> |Topic used in auth?|No — {{topicName}} ignored|
> |Ranger|No {{notification-topic}} in service-def|
>
> {code:java}
> verifyAccess(new AtlasAdminAccessRequest(SERVICE_NOTIFICATION_POST),
> ...){code}
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
