## What changes were proposed in this pull request?

According to our roles chart a cluster operator should have been able to edit 
shared widgets. However this was not the case: only Ambari Administrators and 
Cluster Administrators could do it. I also observed that we did not even use 
our new RBAC framework (based on `AuthorizationHelper`) in 
`WidgetResourceProvider`)

## How was this patch tested?

Running JUnit tests in `ambari-server`.

In addition to this I created users with different roles and tried to edit a 
widget with the following results:

- Ambari administrator - OK
- Cluster administrator - OK
- Cluster operator - OK
- Cluster user - Authorization failure
- Service administrator - Authorization failure
- Service operator - Authorization failure
- None - Authorization failure

[ Full content available at: https://github.com/apache/ambari/pull/2274 ]
This message was relayed via gitbox.apache.org for [email protected]

Reply via email to