[
https://issues.apache.org/jira/browse/OOZIE-3196?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16430243#comment-16430243
]
Peter Orova commented on OOZIE-3196:
------------------------------------
Some follow up:
1./ In the minimal viable product described by [~andras.piros] and [~dbist13],
it seems that the authorization level of non-admin user in the current
authorization scheme is not present. I.e. a user with read privileges on 'all'
does not exist. Such user could be useful when creating dashboards and such.
What do you all think?
2./ As far as the different levels of authorization that should be enforced,
as discussed with [~andras.piros] offline, a three level schema seems
reasonable with the following levels:
level1 - no authorization
level2 - currently existing authorization (admins, and plain users - the latter
having read privileges on all)
level3 - restricted (admins, users having r/w privileges on 'owned' items,
possibly service user(s) having read only access)
Could you share your thoughts on this?
> Authorization: restrict world readability by user
> -------------------------------------------------
>
> Key: OOZIE-3196
> URL: https://issues.apache.org/jira/browse/OOZIE-3196
> Project: Oozie
> Issue Type: New Feature
> Components: bundle, coordinator, workflow
> Affects Versions: 5.0.0b1
> Reporter: Andras Piros
> Assignee: Peter Orova
> Priority: Major
>
> The [*current authorization
> model*|https://issues.apache.org/jira/browse/OOZIE-228] does not fit the
> enterprise requirements as everything is readable and writable by everyone by
> default.
> Write access can be restricted using authorization but restricting read
> rights is only possible via Yarn ACLs and HDFS rights which still does not
> prevent accessing the workflow, coordinator or bundle job’s configurations
> for everyone.
> Improve authorization so it’s possible to configure read/write access for
> workflows, coordinators, and bundles in a more granular way. Could involve
> Sentry during implementation or create and design a new system that fits the
> needs.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
