[
https://issues.apache.org/jira/browse/OOZIE-3287?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16513566#comment-16513566
]
Ramgopal N edited comment on OOZIE-3287 at 6/15/18 9:05 AM:
------------------------------------------------------------
i am not quite sure if this should be the behaviour when
"oozie.authentication.simple.anonymous.allowed= false". But it looks same as
"oozie.authentication.simple.anonymous.allowed= true" with some
non-existing/invalid user added to the url.
Is this the correct way of accessing the oozie url "/oozie/v2/admin/metrics" ?
was (Author: ramgopalnaali):
i am not quite sure if this should be the behaviour when
"oozie.authentication.simple.anonymous.allowed= false". But it looks same as
"oozie.authentication.simple.anonymous.allowed= true" with some
non-existing/invalid user added to the url.
> Able to access the oozie web GUI with any invalid user when
> oozie.authentication.simple.anonymous.allowed is false
> ------------------------------------------------------------------------------------------------------------------
>
> Key: OOZIE-3287
> URL: https://issues.apache.org/jira/browse/OOZIE-3287
> Project: Oozie
> Issue Type: Bug
> Components: ui
> Affects Versions: 4.1.0
> Reporter: Ramgopal N
> Priority: Major
>
> i have made "oozie.authentication.simple.anonymous.allowed=false" in
> oozie-site.xml to not allow anonymous user to access
> "http://ooziebaseurl:11000/oozie/v2/admin/metrics";
> I want to access this url with admin user(hdfs) listed in conf/adminusers.txt
> under oozie.
> Able to access
> "http://ooziebaseurl:11000/oozie/v2/admin/metrics?user.name=hdfs"
> But also able to access with any random user like
> "http://ooziebaseurl:11000/oozie/v2/admin/metrics?user.name=XYZ";
>
> Couldnt find any other configuration restricting radom users.
>
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
