[
https://issues.apache.org/jira/browse/ATLAS-5388?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Paresh Devalia updated ATLAS-5388:
----------------------------------
Description:
h2. Problem Statement
{{rest-notification-webapp}} checks auth using an admin privilege
({{{}service-notification-post{}}}). The URL topic ({{{}ATLAS_HOOK{}}},
{{{}ATLAS_ENTITIES{}}}) is not used in the auth decision.
So today:
* A user with notification permission can POST to any topic
* Hook accounts cannot be limited to one topic (e.g. hive-bridge →
{{ATLAS_HOOK}} only)
* Ranger has no {{notification-topic}} resource to create topic policies
*
h2. Affected Endpoint
{code:java}
POST http://<host>:41000/rest/api/atlas/v2/notification/topic/\{topicName}
{code}
* {{topicName}} examples: {{{}ATLAS_HOOK{}}}, {{ATLAS_ENTITIES}}
Root cause
||Area||Today||
|Request type|{{AtlasAdminAccessRequest}}|
|Privilege|{{SERVICE_NOTIFICATION_POST}}|
|Topic used in auth?|No — {{topicName}} ignored|
|Ranger|No {{notification-topic}} in service-def|
{code:java}
verifyAccess(new AtlasAdminAccessRequest(SERVICE_NOTIFICATION_POST), ...){code}
was:
h2. Problem Statement
REST hook notification ingress (rest-notification-webapp, port 41000)
authorizes POST requests using an *admin-shaped* privilege
({{{}service-notification-post{}}}) via {{{}AtlasAdminAccessRequest{}}}. The
{{topicName}} URL path parameter (e.g. {{{}ATLAS_HOOK{}}},
{{{}ATLAS_ENTITIES{}}}) is used for Kafka routing.
This creates a security and policy-model gap:
* Authorization cannot enforce least privilege per notification topic
* A caller granted admin notification permission can POST to *any* topic
* Hook service accounts cannot be scoped to a single topic (e.g. {{hivehook}}
→ {{ATLAS_HOOK}} only)
* No first-class resource type {{notification-topic}} exists for Ranger policy
modeling
* Privilege {{service-notification-post}} was never properly wired in Ranger
Atlas service-def
h2. Security Impact
* Violates principle of least privilege for hook/service accounts
* Inconsistent with entity/type authorization model (which is resource-scoped)
* REST notification APIs as potentially allowing unauthorized message injection
* Production Ranger deployments cannot create topic-scoped policies until
Ranger plugin is updated (follow-up)
h2. Affected Endpoint
{code:java}
POST http://<host>:41000/rest/api/atlas/v2/notification/topic/\{topicName}
{code}
* {{topicName}} examples: {{{}ATLAS_HOOK{}}}, {{ATLAS_ENTITIES}}
h2. Root Cause
||Area||Before (broken design)||
|Request type|{{AtlasAdminAccessRequest}}|
|Privilege checked|{{SERVICE_NOTIFICATION_POST}}
({{{}service-notification-post{}}})|
|Topic in auth decision|*No* — {{topicName}} ignored|
|Simple policy section|No {{notificationPermissions}} in
{{atlas-simple-authz-policy.json}}|
|Ranger resource type|No {{notification-topic}} in service-def|
*Authorization call in NotificationREST:*
{code}
verifyAccess(new AtlasAdminAccessRequest(SERVICE_NOTIFICATION_POST), ...)
{code}
> Topic-scoped authorization for REST notification POST (POST_NOTIFICATION +
> AtlasNotificationRequest)
> ----------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5388
> URL: https://issues.apache.org/jira/browse/ATLAS-5388
> Project: Atlas
> Issue Type: Bug
> Components: atlas-core
> Affects Versions: 3.0.0
> Reporter: Umesh Patil
> Assignee: Umesh Patil
> Priority: Major
>
> h2. Problem Statement
> {{rest-notification-webapp}} checks auth using an admin privilege
> ({{{}service-notification-post{}}}). The URL topic ({{{}ATLAS_HOOK{}}},
> {{{}ATLAS_ENTITIES{}}}) is not used in the auth decision.
> So today:
> * A user with notification permission can POST to any topic
> * Hook accounts cannot be limited to one topic (e.g. hive-bridge →
> {{ATLAS_HOOK}} only)
> * Ranger has no {{notification-topic}} resource to create topic policies
>
> *
> h2. Affected Endpoint
>
> {code:java}
> POST http://<host>:41000/rest/api/atlas/v2/notification/topic/\{topicName}
> {code}
>
> * {{topicName}} examples: {{{}ATLAS_HOOK{}}}, {{ATLAS_ENTITIES}}
>
> Root cause
> ||Area||Today||
> |Request type|{{AtlasAdminAccessRequest}}|
> |Privilege|{{SERVICE_NOTIFICATION_POST}}|
> |Topic used in auth?|No — {{topicName}} ignored|
> |Ranger|No {{notification-topic}} in service-def|
>
> {code:java}
> verifyAccess(new AtlasAdminAccessRequest(SERVICE_NOTIFICATION_POST),
> ...){code}
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
