You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@storm.apache.org by "GGraziadei (via GitHub)" <gi...@apache.org> on 2026/08/23 10:09:09 UTC

[PR] Evaluate authorization for requests that carry no principal (storm)

GGraziadei opened a new pull request, #9005:
URL: https://github.com/apache/storm/pull/9005

   ## Summary
   
   `SimpleACLAuthorizer.permit` and `SupervisorSimpleACLAuthorizer.permit` dereferenced `context.principal()` directly, so a request that carries no principal ended in a `NullPointerException` instead of an authorization decision. Over the UI this surfaced as HTTP 500 rather than 403.
   
   Both now read the principal defensively, the way `SimpleWhitelistAuthorizer` and `DRPCSimpleACLAuthorizer` already do. `IPrincipalToLocal.toLocal(Principal)` is null-safe already.
   
   ## Behaviour
   
   No decision logic changes. A request without a principal simply follows the rules that were already written: it matches no admin, supervisor or nimbus entry; it keeps the allow-all behaviour when `nimbus.users` and `nimbus.groups` are both empty; and it is denied as soon as a list is configured or a topology-level ACL applies.
   
   ## Testing
   
   - `mvn -pl storm-client test -DskipITs` — 661 tests, 0 failures
   - `mvn -pl storm-server test -DskipITs` — 490 tests, 0 failures
   - New cases cover a principal-less request against configured lists, against empty lists, and against a topology operation, for both authorizers.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@storm.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Evaluate authorization for requests that carry no principal (storm)

Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 merged PR #9005:
URL: https://github.com/apache/storm/pull/9005


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@storm.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org