IGNITE-22844 control.sh --consistency repair permissions fixes

[maksaska]

Intro:
Currently 'Read Repair' task performed for the chosen partitions by control.sh requires CACHE_READ and CACHE PUT permissions in addition to ADMIN_OPS. Thus, to perform the comand control.sh --consistency repair the one needs all 3 permissions.

There is no point to have additional CACHE_READ and CACHE_PUT permissions to perform the operation, as they are useless for the task itself, and introduces security risk, by allowing the user to manipulate the cache in parallel.

The solution would be to substitute user's security context with the context of the cluster node that performs the command. The former is used for the ADMIN_OPS permission check and the latter is used for cache. This will ease the requirement for the users to perform control.sh --consistency repair without introducing any additional security risk.

What have I changed:

• As the task logic proceeds with cache reads after initial authorization, we switch the user SecurityContext to a random node SecurityContext
• Additional tests for users with ADMIN_OPS only. Those should be able to start control.sh --consistency repair command with no authorization error relates to CACHE_READ and CACHE_PUT

---

Thank you for submitting the pull request to the Apache Ignite.

In order to streamline the review of the contribution
we ask you to ensure the following steps have been taken:

The Contribution Checklist

• There is a single JIRA ticket related to the pull request.
• The web-link to the pull request is attached to the JIRA ticket.
• The JIRA ticket has the Patch Available state.
• The pull request body describes changes that have been made.
  The description explains WHAT and WHY was made instead of HOW.
• The pull request title is treated as the final commit message.
  The following pattern must be used: IGNITE-XXXX Change summary where XXXX - number of JIRA issue.
• A reviewer has been mentioned through the JIRA comments
  (see the Maintainers list)
• The pull request has been checked by the Teamcity Bot and
  the green visa attached to the JIRA ticket (see TC.Bot: Check PR)

Notes

• How to Contribute
• Coding abbreviation rules
• Coding Guidelines
• Apache Ignite Teamcity Bot

If you need any help, please email [email protected] or ask anу advice on http://asf.slack.com #ignite channel.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud