Gabriella Lotz has uploaded this change for review. ( http://gerrit.cloudera.org:8080/24864
Change subject: Require authentication for REST catalog DDL ...................................................................... Require authentication for REST catalog DDL The REST catalog handlers in rest_catalog_path_handlers.cc resolved the acting user as optional<string> user = req.username.empty() ? "default" : req.username; before calling ListTables / CreateTableWithUser / AlterTableWithUser / DeleteTableWithUser. When --enable_rest_api is set without SPNEGO, the webserver leaves req.username empty for every unauthenticated caller, so anyone able to reach the master webserver port could execute DDL as a fabricated principal "default". Nothing coupled --enable_rest_api to any form of webserver authentication. Change-Id: Ib0112638a3462c84e6366b881c9229a334ad3c25 --- M src/kudu/master/master.cc M src/kudu/master/master.h M src/kudu/master/rest_catalog-test.cc M src/kudu/master/rest_catalog_path_handlers.cc M src/kudu/master/rest_catalog_path_handlers.h 5 files changed, 187 insertions(+), 16 deletions(-) git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/64/24864/1 -- To view, visit http://gerrit.cloudera.org:8080/24864 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: Ib0112638a3462c84e6366b881c9229a334ad3c25 Gerrit-Change-Number: 24864 Gerrit-PatchSet: 1 Gerrit-Owner: Gabriella Lotz <[email protected]>
