SteNicholas opened a new pull request, #3759: URL: https://github.com/apache/celeborn/pull/3759
### What changes were proposed in this pull request? Call `checkAuth(context, appId)` before serving `PbApplicationMetaRequest` in the Master, consistent with the other application-scoped handlers (`RequestSlots`, `UnregisterShuffle`, `ApplicationLost`). Workers fetch application meta over the internal channel, where the connection has no per-application client id, so the check is a no-op for them; it only rejects an external application that asks for another application's secret. ### Why are the changes needed? The Master served `PbApplicationMetaRequest` by returning the requested application's SASL secret without an authorization check. With authentication enabled, a caller on the external application port could read another application's secret and impersonate it. ### Does this PR resolve a correctness bug? - [ ] Yes ### Does this PR introduce _any_ user-facing change? - [ ] Yes ### How was this patch tested? - New `MasterApplicationMetaAuthSuite` verifying `PbApplicationMetaRequest` is authorized against the registered application. - New case in `MasterSuite` verifying a caller requesting another application's secret is rejected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
