[
https://issues.apache.org/jira/browse/AMBARI-20768?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Keta Patel updated AMBARI-20768:
--------------------------------
Summary: Local Ambari user with no cluster role must not be able to access
Logsearch UI (was: Local Ambari user with no cluster role can access Logsearch
UI)
> Local Ambari user with no cluster role must not be able to access Logsearch UI
> ------------------------------------------------------------------------------
>
> Key: AMBARI-20768
> URL: https://issues.apache.org/jira/browse/AMBARI-20768
> Project: Ambari
> Issue Type: Bug
> Components: logsearch
> Affects Versions: trunk, 2.5.0
> Reporter: Keta Patel
> Assignee: Keta Patel
>
> Ambari admin and local Ambari user with no cluster roles assigned to it are
> able to successfully log into Logsearch UI.
> However, when the local user is assigned some cluster role, that user is not
> able to log into Logsearch UI.
> As a fix to access the Logsearch UI by the cluster roles, the property
> "logsearch.roles.allowed" is added under Log
> Search->configs->Advanced->Custom logsearch-properties. This value of this
> property is a comma-separated list of the cluster roles allowed to log into
> Logsearch UI. As a result of this, the local ambari users having the
> corresponding roles are now able to log into Logsearch UI, but Ambari admins
> show unsuccessful login.
> On removing the "logsearch.roles.allowed" property, all Ambari admins, local
> users with NO roles assigned are able to successfully log into Logsearch UI,
> but users with some cluster roles assigned to them are not allowed to login.
> The following behavior is what is required:
> - Ambari Admins must be able to successfully log into Logsearch UI regardless
> of whether the "logsearch.roles.allowed" property has been added or not.
> - All local users with NO roles assigned to them must NOT be able to log into
> the Logsearch UI. This behavior is seen after adding the
> "logsearch.roles.allowed" property, but not before that. Ideally, those users
> must not be able to log into Logsearch UI regardless of whether the
> "logsearch.roles.allowed" was added or not.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
