Hello Marton Greber, Attila Bukor, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/24864
to look at the new patch set (#2).
Change subject: Require authentication for REST catalog DDL
......................................................................
Require authentication for REST catalog DDL
The REST catalog handlers in rest_catalog_path_handlers.cc resolved the
acting user as
optional<string> user = req.username.empty() ? "default" : req.username;
before calling ListTables / CreateTableWithUser / AlterTableWithUser /
DeleteTableWithUser. When --enable_rest_api is set without SPNEGO, the
webserver leaves req.username empty for every unauthenticated caller, so
anyone able to reach the master webserver port could execute DDL as a
fabricated principal "default". Nothing coupled --enable_rest_api to any
form of webserver authentication.
Change-Id: Ib0112638a3462c84e6366b881c9229a334ad3c25
---
M src/kudu/master/master.cc
M src/kudu/master/master.h
M src/kudu/master/rest_catalog-test.cc
M src/kudu/master/rest_catalog_path_handlers.cc
M src/kudu/master/rest_catalog_path_handlers.h
5 files changed, 257 insertions(+), 19 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/64/24864/2
--
To view, visit http://gerrit.cloudera.org:8080/24864
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: Ib0112638a3462c84e6366b881c9229a334ad3c25
Gerrit-Change-Number: 24864
Gerrit-PatchSet: 2
Gerrit-Owner: Gabriella Lotz <[email protected]>
Gerrit-Reviewer: Attila Bukor <[email protected]>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <[email protected]>
