Merge pull request #34848 from deads2k/rbac-16-fix-authorization-filter

Automatic merge from submit-queue you can be authorized and have a failure Fix the authorization filter to allow you through and to avoid showing internal errors to users when authorization failed.

Merge pull request #34848 from deads2k/rbac-16-fix-authorization-filter
b988eed2 · Kubernetes Submit Queue · GitHub · c32a0533 · a8b47149 · b988eed2
Commit b988eed2 authored Oct 15, 2016 by Kubernetes Submit Queue Committed by GitHub Oct 15, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 7 additions and 6 deletions

authorization.go pkg/apiserver/filters/authorization.go +7 -6

No files found.
--- a/pkg/apiserver/filters/authorization.go
+++ b/pkg/apiserver/filters/authorization.go
@@ -40,16 +40,17 @@ func WithAuthorization(handler http.Handler, getAttribs RequestAttributeGetter, 
 			return
 		}
 		authorized, reason, err := a.Authorize(attrs)
-		if err != nil {
-			internalError(w, req, err)
+		if authorized {
+			handler.ServeHTTP(w, req)
 			return
 		}
-		if !authorized {
-			glog.V(4).Infof("Forbidden: %#v, Reason: %s", req.RequestURI, reason)
-			forbidden(w, req)
+		if err != nil {
+			internalError(w, req, err)
 			return
 		}
-		handler.ServeHTTP(w, req)
+
+		glog.V(4).Infof("Forbidden: %#v, Reason: %s", req.RequestURI, reason)
+		forbidden(w, req)
 	})
 }