rzo1 commented on PR #9183: URL: https://github.com/apache/storm/pull/9183#issuecomment-6335753842
Thanks @jnioche! All points are addressed in c7bfb06cd: 1. Unauthenticated `doAsUser`: `SingleUserPrincipal.equals`/`hashCode` are null-safe, so there is no NPE anymore. The request still counts as impersonation: without an impersonation authorizer DRPC behaves as before, with one it is denied with 401 (`ImpersonationAuthorizer` denies a real principal without a name). The UI had the same NPE through `AuthorizedUserFilter`; it now answers such requests with 401. Tests cover HTTP, the Thrift context and the authorizer. 2. Added the reverse proxy note to SECURITY.md. 3. `isAllowedToImpersonateFromHost` checks `getHostAddress()` first, so IP-based ACLs skip the reverse lookup (test with mocked `InetAddress`). Nits: an allowed impersonated request now logs one INFO line, and the denial names the function. Could you have another look? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
