You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@storm.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2014/08/05 04:24:12 UTC

[jira] [Commented] (STORM-349) (Security) ui actions should have nimbus like authroization

    [ https://issues.apache.org/jira/browse/STORM-349?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14085685#comment-14085685 ] 

ASF GitHub Bot commented on STORM-349:
--------------------------------------

GitHub user harshach opened a pull request:

    https://github.com/apache/incubator-storm/pull/215

    STORM-349. (Security) ui actions should have nimbus like authroization.

    Upgraded ring to 1.3.0.  Added IAuthorizer instance to UI daemon. Added
    hadoop-auth as a dependency which allow users to configure
    AuthenticationFilter.

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/harshach/incubator-storm STORM-349-V2

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/incubator-storm/pull/215.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #215
    
----
commit 3208a8e3f39140227fe6be9c686b795a19777e64
Author: Sriharsha Chintalapani <ma...@harsha.io>
Date:   2014-08-05T02:18:26Z

    STORM-349. (Security) ui actions should have nimbus like authroization.
    Upgraded ring to 1.3.0.  Added IAuthorizer instance to UI daemon. Added
    hadoop-auth as a dependency which allow users to configure
    AuthenticationFilter.

----


> (Security) ui actions should have nimbus like authroization
> -----------------------------------------------------------
>
>                 Key: STORM-349
>                 URL: https://issues.apache.org/jira/browse/STORM-349
>             Project: Apache Storm (Incubating)
>          Issue Type: Bug
>            Reporter: Robert Joseph Evans
>              Labels: security
>
> The UI provides APIs to kill, rebalance, ... a topology.  For security we originally took the route to optionally disable these, but ideally the UI server would load an IAuthorizer instance like nimbus, and check if the user is allowed to perform that operation before doing it on behalf of the user.
> This should be fairly straight forward but may require some glue code like is being used in the drpc server for its web interface.



--
This message was sent by Atlassian JIRA
(v6.2#6252)