[accumulo] branch main updated: Revert "Fix unneeded audit message about denial (#1827)"

[ct...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

ctubbsii pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/accumulo.git


The following commit(s) were added to refs/heads/main by this push:
     new 1fa84ae  Revert "Fix unneeded audit message about denial (#1827)"
1fa84ae is described below

commit 1fa84ae2ea7b40081a2c1a94a560cda2f91b5f36
Author: Christopher Tubbs <ct...@apache.org>
AuthorDate: Tue Dec 8 16:22:37 2020 -0500

    Revert "Fix unneeded audit message about denial (#1827)"
    
    This reverts commit 8908b56fa1fd36cb2bf54f4ce7dbbd579c52955f.
    
    The original order is required in order to ensure the user is
    authenticated when the user's credentials are checked in the
    `canPerformSystemActions` method. The fact that credentials are checked
    by this method is relied upon in the `authenticateUser` method in order
    to avoid checking credentials twice.
---
 .../apache/accumulo/server/security/SecurityOperation.java   | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java b/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
index 90cf445..904002c 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
@@ -227,15 +227,13 @@ public class SecurityOperation {
     }
   }
 
-  private boolean canAskAboutUser(TCredentials credentials, String user)
+  public boolean canAskAboutUser(TCredentials credentials, String user)
       throws ThriftSecurityException {
     // Authentication done in canPerformSystemActions
-    // check if user is current user first, to avoid unnecessary audit log if not a system user
-    // current user can always ask about themselves
-    if (credentials.getPrincipal().equals(user) || canPerformSystemActions(credentials))
-      return true;
-    throw new ThriftSecurityException(credentials.getPrincipal(),
-        SecurityErrorCode.PERMISSION_DENIED);
+    if (!(canPerformSystemActions(credentials) || credentials.getPrincipal().equals(user)))
+      throw new ThriftSecurityException(credentials.getPrincipal(),
+          SecurityErrorCode.PERMISSION_DENIED);
+    return true;
   }
 
   public boolean authenticateUser(TCredentials credentials, TCredentials toAuth)