Skip to content

ATLAS-5326: Enforce Atlas authorization on AdminResource REST endpoints #675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rkundam wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ATLAS-5326: Enforce Atlas authorization on AdminResource REST endpoints #675

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 36 additions & 6 deletions webapp/src/main/java/org/apache/atlas/web/resources/AdminResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,9 +268,11 @@ public AdminResource(ServiceState serviceState, MetricsService metricsService, A
@GET
@Path("stack")
@Produces(MediaType.TEXT_PLAIN)
public String getThreadDump() {
public String getThreadDump() throws AtlasBaseException {
LOG.debug("==> AdminResource.getThreadDump()");

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "thread dump");

ThreadGroup topThreadGroup = Thread.currentThread().getThreadGroup();

while (topThreadGroup.getParent() != null) {
Expand Down Expand Up @@ -360,9 +362,11 @@ public Response getStatus() {
@GET
@Path("session")
@Produces(Servlets.JSON_MEDIA_TYPE)
public Response getUserProfile(@Context HttpServletRequest request) {
public Response getUserProfile(@Context HttpServletRequest request) throws AtlasBaseException {
LOG.debug("==> AdminResource.getUserProfile()");

AtlasAuthorizationUtils.verifyAccess(new AtlasEntityAccessRequest(typeRegistry, AtlasPrivilege.ENTITY_READ), "session");

@nixonrodrigues nixonrodrigues Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove this authz check, because this endpoint only outputs only authenticated user's information and not entity or type related information.


Response response;

boolean isEntityUpdateAccessAllowed = false;
Expand Down Expand Up @@ -735,6 +739,8 @@ public AtlasAsyncImportRequest importAsync(@DefaultValue("{}") @FormDataParam("r
@Produces(Servlets.JSON_MEDIA_TYPE)
@Consumes(MediaType.APPLICATION_JSON)
public void abortAsyncImport(@PathParam("importId") String importId) throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_IMPORT), "abort async import");

importService.abortAsyncImport(importId);
}

Expand All @@ -749,6 +755,8 @@ public PList<AsyncImportStatus> getAsyncImportStatus(@QueryParam("offset") @Defa
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "AdminResource.getAsyncImportStatus()");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_IMPORT), "async import status");

return importService.getAsyncImportsStatus(offset, limit);
} finally {
AtlasPerfTracer.log(perf);
Expand All @@ -766,6 +774,8 @@ public AtlasAsyncImportRequest getAsyncImportStatusById(@PathParam("importId") S
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "AdminResource.getAsyncImportStatusById(importId=" + importId + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_IMPORT), "async import status by id");

return importService.getAsyncImportRequest(importId);
} finally {
AtlasPerfTracer.log(perf);
Expand Down Expand Up @@ -923,6 +933,8 @@ public AtlasServer getCluster(@PathParam("serverName") String serverName) throws
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "cluster.getServer(" + serverName + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "get server");

AtlasServer cluster = new AtlasServer(serverName, serverName);

return atlasServerService.get(cluster);
Expand All @@ -946,6 +958,8 @@ public List<ExportImportAuditEntry> getExportImportAudit(@QueryParam("serverName
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "getExportImportAudit(" + serverName + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "export import audit");

return exportImportAuditService.get(userName, operation, serverName, startTime, endTime, limit, offset);
} finally {
AtlasPerfTracer.log(perf);
Expand Down Expand Up @@ -1018,6 +1032,8 @@ public List<AtlasEntityHeader> getAuditDetails(@PathParam("auditGuid") String au
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "AdminResource.getAuditDetails(" + auditGuid + ", " + limit + ", " + offset + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_AUDITS), "audit details");

List<AtlasEntityHeader> ret = new ArrayList<>();

AtlasAuditEntry auditEntry = auditService.toAtlasAuditEntry(entityStore.getById(auditGuid, false, true));
Expand Down Expand Up @@ -1050,14 +1066,18 @@ public List<AtlasEntityHeader> getAuditDetails(@PathParam("auditGuid") String au
@GET
@Path("activeSearches")
@Produces(Servlets.JSON_MEDIA_TYPE)
public Set<String> getActiveSearches() {
public Set<String> getActiveSearches() throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "active searches");

@nixonrodrigues nixonrodrigues Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove this authz, this returns only authenticated user's search Ids( threadId's) and do not expose other information.


return activeSearches.getActiveSearches();
}

@DELETE
@Path("activeSearches/{id}")
@Produces(Servlets.JSON_MEDIA_TYPE)
public boolean terminateActiveSearch(@PathParam("id") String searchId) {
public boolean terminateActiveSearch(@PathParam("id") String searchId) throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "terminate active search");

@nixonrodrigues nixonrodrigues Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove this authz. Search do not have authz. if authz added here. The user can make search calls but not able to terminate the search Rest.


SearchContext terminate = activeSearches.terminate(searchId);

return null != terminate;
Expand All @@ -1075,6 +1095,8 @@ public AtlasCheckStateResult checkState(AtlasCheckStateRequest request) throws A
perf = AtlasPerfTracer.getPerfTracer(PERF_LOG, "checkState(" + request + ")");
}

AtlasAuthorizationUtils.verifyAccess(new AtlasEntityAccessRequest(typeRegistry, AtlasPrivilege.ENTITY_READ), "check state");

return entityStore.checkState(request);
} finally {
AtlasPerfTracer.log(perf);
Expand All @@ -1084,9 +1106,11 @@ public AtlasCheckStateResult checkState(AtlasCheckStateRequest request) throws A
@GET
@Path("patches")
@Produces(Servlets.JSON_MEDIA_TYPE)
public AtlasPatches getAtlasPatches() {
public AtlasPatches getAtlasPatches() throws AtlasBaseException {
LOG.debug("==> AdminResource.getAtlasPatches()");

AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_IMPORT), "patches");

AtlasPatches ret = patchManager.getAllPatches();

LOG.debug("<== AdminResource.getAtlasPatches()");
Expand All @@ -1098,13 +1122,17 @@ public AtlasPatches getAtlasPatches() {
@Path("/tasks")
@Produces(Servlets.JSON_MEDIA_TYPE)
public List<AtlasTask> getTaskStatus(@QueryParam("guids") List<String> guids) throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_PURGE), "tasks");

return CollectionUtils.isNotEmpty(guids) ? taskManagement.getByGuids(guids) : taskManagement.getAll();
}

@DELETE
@Path("/tasks")
@Produces(Servlets.JSON_MEDIA_TYPE)
public void deleteTask(@QueryParam("guids") List<String> guids) throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_PURGE), "delete tasks");

if (CollectionUtils.isNotEmpty(guids)) {
taskManagement.deleteByGuids(guids);
}
Expand All @@ -1113,7 +1141,9 @@ public void deleteTask(@QueryParam("guids") List<String> guids) throws AtlasBase
@GET
@Path("/debug/metrics")
@Produces(MediaType.APPLICATION_JSON)
public Map<String, DebugMetrics> getDebugMetrics() {
public Map<String, DebugMetrics> getDebugMetrics() throws AtlasBaseException {
AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.ADMIN_EXPORT), "debug metrics");

return debugMetricsRESTSink.getMetrics();
}

Expand Down
Loading
Loading