ATLAS-5365: Missing SERVICE_NOTIFICATION_POST authorization on rest-notification NotificationREST POST /topic/{topicName}.

rest-notification-webapp/src/main/java/org/apache/atlas/notification/rest/web/rest/NotificationREST.java

@@ -21,6 +21,9 @@
 import com.fasterxml.jackson.databind.node.ArrayNode;
 import org.apache.atlas.AtlasConfiguration;
 import org.apache.atlas.AtlasErrorCode;
+import org.apache.atlas.authorize.AtlasAdminAccessRequest;
+import org.apache.atlas.authorize.AtlasAuthorizationUtils;
+import org.apache.atlas.authorize.AtlasPrivilege;
 import org.apache.atlas.exception.AtlasBaseException;
 import org.apache.atlas.hook.AtlasHook;
 import org.apache.atlas.kafka.KafkaNotification;
@@ -88,6 +91,8 @@ public NotificationREST(NotificationInterface notificationInterface) {
     public void handleNotifications(@PathParam("topicName") String topicName, @Context HttpServletRequest request) throws AtlasBaseException, IOException {
         LOG.debug("Handling notifications for topic {}", topicName);
 
+        AtlasAuthorizationUtils.verifyAccess(new AtlasAdminAccessRequest(AtlasPrivilege.SERVICE_NOTIFICATION_POST), "post on rest notification service");
+
         if (!TOPICS.contains(topicName)) {
             throw new AtlasBaseException(AtlasErrorCode.INVALID_TOPIC_NAME, topicName);
         }

rest-notification-webapp/src/main/webapp/WEB-INF/web.xml

@@ -31,10 +31,6 @@
         <servlet-class>
             com.sun.jersey.spi.spring.container.servlet.SpringServlet
         </servlet-class>
-        <init-param>
-            <param-name>com.sun.jersey.config.property.packages</param-name>
-            <param-value>org.apache.atlas.notification.rest</param-value>
-        </init-param>
         <init-param>
             <param-name>com.sun.jersey.api.json.POJOMappingFeature</param-name>
             <param-value>true</param-value>

server-common/pom.xml

@@ -60,6 +60,10 @@
             <groupId>com.sun.jersey</groupId>
             <artifactId>jersey-core</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.sun.jersey</groupId>
+            <artifactId>jersey-server</artifactId>
+        </dependency>
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>

webapp/src/main/java/org/apache/atlas/web/errors/AllExceptionMapper.java → server-common/src/main/java/org/apache/atlas/server/common/errors/AllExceptionMapper.java

@@ -16,7 +16,7 @@
  * limitations under the License.
  */
 
-package org.apache.atlas.web.errors;
+package org.apache.atlas.server.common.errors;
 
 import org.springframework.stereotype.Component;
 

webapp/src/main/java/org/apache/atlas/web/errors/AtlasBaseExceptionMapper.java → server-common/src/main/java/org/apache/atlas/server/common/errors/AtlasBaseExceptionMapper.java

@@ -16,7 +16,7 @@
  * limitations under the License.
  */
 
-package org.apache.atlas.web.errors;
+package org.apache.atlas.server.common.errors;
 
 import org.apache.atlas.AtlasErrorCode;
 import org.apache.atlas.exception.AtlasBaseException;

webapp/src/main/java/org/apache/atlas/web/errors/ExceptionMapperUtil.java → server-common/src/main/java/org/apache/atlas/server/common/errors/ExceptionMapperUtil.java

@@ -15,7 +15,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.atlas.web.errors;
+package org.apache.atlas.server.common.errors;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -28,16 +28,16 @@ private ExceptionMapperUtil() {
     }
 
     @SuppressWarnings("UnusedParameters")
-    protected static String formatErrorMessage(long id, Exception exception) {
+    public static String formatErrorMessage(long id, Exception exception) {
         return String.format("There was an error processing your request. It has been logged (ID %016x).", id);
     }
 
-    protected static void logException(long id, Exception exception) {
+    public static void logException(long id, Exception exception) {
         LOGGER.error(formatLogMessage(id, exception), exception);
     }
 
     @SuppressWarnings("UnusedParameters")
-    protected static String formatLogMessage(long id, Throwable exception) {
+    public static String formatLogMessage(long id, Throwable exception) {
         return String.format("Error handling a request: %016x", id);
     }
 }

webapp/src/main/java/org/apache/atlas/web/errors/NotFoundExceptionMapper.java → server-common/src/main/java/org/apache/atlas/server/common/errors/NotFoundExceptionMapper.java

@@ -15,7 +15,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.apache.atlas.web.errors;
+package org.apache.atlas.server.common.errors;
 
 import org.apache.atlas.exception.NotFoundException;
 import org.springframework.stereotype.Component;

webapp/src/test/java/org/apache/atlas/web/errors/AllExceptionMapperTest.java

@@ -18,6 +18,7 @@
 
 package org.apache.atlas.web.errors;
 
+import org.apache.atlas.server.common.errors.AllExceptionMapper;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
 

webapp/src/test/java/org/apache/atlas/web/errors/AtlasBaseExceptionMapperTest.java

@@ -20,6 +20,7 @@
 
 import org.apache.atlas.AtlasErrorCode;
 import org.apache.atlas.exception.AtlasBaseException;
+import org.apache.atlas.server.common.errors.AtlasBaseExceptionMapper;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
 
@@ -63,4 +64,17 @@ public void testToResponse() {
             assertTrue(true);
         }
     }
+
+    @Test
+    public void testUnauthorizedAccessResponse() {
+        AtlasBaseException testException = new AtlasBaseException(
+                AtlasErrorCode.UNAUTHORIZED_ACCESS, "testuser", "post on rest notification service");
+
+        Response response = atlasBaseExceptionMapper.toResponse(testException);
+
+        assertEquals(response.getStatus(), Response.Status.FORBIDDEN.getStatusCode());
+        String entity = (String) response.getEntity();
+        assertTrue(entity.contains("ATLAS-403-00-001"));
+        assertTrue(entity.contains("not authorized to perform post on rest notification service"));
+    }
 }

webapp/src/test/java/org/apache/atlas/web/errors/ExceptionMapperUtilTest.java

@@ -18,6 +18,7 @@
 
 package org.apache.atlas.web.errors;
 
+import org.apache.atlas.server.common.errors.ExceptionMapperUtil;
 import org.testng.annotations.Test;
 
 import static org.testng.Assert.assertNotNull;

webapp/src/test/java/org/apache/atlas/web/errors/NotFoundExceptionMapperTest.java

@@ -19,6 +19,7 @@
 package org.apache.atlas.web.errors;
 
 import org.apache.atlas.exception.NotFoundException;
+import org.apache.atlas.server.common.errors.NotFoundExceptionMapper;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;