smengcl opened a new pull request, #11914: URL: https://github.com/apache/ozone/pull/11914
Generated-by: Claude Code (Opus 5.5) ## What changes were proposed in this pull request? `SCMClientProtocolServer.getContainerToken` authorizes the caller with `checkAdminAccess(remoteUser, true)`, the read form of the SCM admin check, so a principal that is only in `ozone.readonly.administrators` (or its groups) obtains a container token for any container. A container token carries no access mode, unlike the block token, so it is not limited to read operations, while the SCM operations that change a container's state already require a full admin. This change calls `checkAdminAccess(remoteUser, false)`, so only a full SCM administrator obtains a container token, as before HDDS-8456. The token contents, the generator, the audit action and the protocol are unchanged. With container tokens enabled (`hdds.container.token.enabled=true`), a principal that is only a read-only administrator is now refused by the client commands that fetch a container token through `ContainerOperationClient.getEncodedContainerToken`. With container tokens disabled nothing changes. ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-17679 ## How was this patch tested? Added `TestSCMClientProtocolServer#testGetContainerTokenRequiresFullAdmin`: the SCM starter user (a full admin) obtains a token, and a principal that is only a read-only administrator is refused with `AccessControlException`. The test fails without the change. CI on this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
