[PR] Enforce RBAC on the embedded Hop Server API in Hop Web (fixes #8150) (hop)

["bamaer (via GitHub)" <gi...@apache.org>]

bamaer opened a new pull request, #8169:
URL: https://github.com/apache/hop/pull/8169

   The Hop Server servlet is co-deployed under /hop/* inside the Hop Web webapp but had no authorization: any authenticated session (including the READ_ONLY role) could deploy and execute pipelines and workflows via the API, bypassing the RBAC the RAP UI enforces. In the default open install (mode NONE) the same endpoints were reachable unauthenticated.
   
   - HopServerEndpointPermissionMapper (core): maps each /hop/* endpoint to the Permission it requires.
   - HopServerAuthorizationFilter (rap), mapped after the auth filters:
     * BASIC/EXTERNAL/OAUTH2 - resolve the request principal's roles and require the endpoint's permission; 403 otherwise. Unknown endpoints default-deny so new servlets cannot silently widen the surface.
     * NONE - no user identity, so the API is all-open or all-closed. Closed by default (allowUnauthenticatedServerApi=false) so the default image does not expose unauthenticated execution; opt in via the config flag, HOP_WEB_ALLOW_UNAUTHENTICATED_SERVER_API, or the Security config UI.
   - web.xml (web assembly and the EXTERNAL local-auth-config sample) register the filter on /hop/*.
   - Security -> General tab: checkbox for the NONE opt-in.
   - Tests: mapper + filter unit tests; HopServerApiRbacTest (web-tests) drives the endpoints per role over HTTP; manual curl scripts under web-tests/api-checks.
   - Docs: hop-web.adoc notes the /hop/* authorization and the NONE default.
   
   Standalone hop-server and hop-rest are unchanged.
   
   **Please** add a meaningful description for your change here
   
   ------------------------
   
   Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:
   - [x] Run `mvn clean install apache-rat:check` to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
   - [x] If you have a group of commits related to the same change, please squash your commits into one and force push your branch using `git rebase -i`.
   - [x] Mention the appropriate issue in your description (for example: `addresses #123`), if applicable.
   
   To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
   you have to acknowledge this by using the following check-box.
   
   - [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
   - [ ] In any other case, please file an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf).
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enforce RBAC on the embedded Hop Server API in Hop Web (fixes #8150) (hop)

["mattcasters (via GitHub)" <gi...@apache.org>]

mattcasters merged PR #8169:
URL: https://github.com/apache/hop/pull/8169


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@hop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org