如何杜绝 spark history server ui 的未授权访问? 2

package com.hundsun.broker;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.util.StringTokenizer;
/*
该类是一个简单的 servlet 安全过滤器，可以配置 spark history server web ui 使用该安全过滤器，以实现基本的访问控制
需要配合以下参数一起使用： 
  spark.ui.filters，spark.history.ui.acls.enable，
  spark.history.ui.admin.acls，spark.history.ui.admin.acls.groups
 */
public class BasicAuthenticationFilter implements Filter {
  /** Logger */
  private static final Logger LOG = LoggerFactory.getLogger(BasicAuthenticationFilter.class);
  private String username = "";
  private String password = "";
  private String realm = "Protected";
  /*
  该方法使用指定的参数初始化该安全过滤器
  具体参数包括：
    用户名 username
    密码 password
    安全域 realm
   */
  @Override
  public void init(FilterConfig filterConfig) throws ServletException {
    username = filterConfig.getInitParameter("username");
    password = filterConfig.getInitParameter("password");
    realm  = filterConfig.getInitParameter("realm");
    if ( StringUtils.isBlank( username ) ) {
      throw new ServletException( "No user provided in filter configuration" );
    }
    if ( StringUtils.isBlank( password ) ) {
      throw new ServletException( "No password provided in filter configuration" );
    }
    if ( StringUtils.isBlank( realm ) ) {
      throw new ServletException( "No realm provided in filter configuration" );
    }
  }
  /*
  该方法对 http 请求进行安全过滤，具体过滤逻辑是：
  检查 http header 中 Authorization 是否为 Basic，并提取 header 中的用户名和密码
  将 header 中提取的用户名和密码，跟初始化该过滤器时使用的用户名和密码进行对比，若一致则认证通过
  其他情况则认证失败
   */
  @Override
  public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
      throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) servletRequest;
    HttpServletResponse response = (HttpServletResponse) servletResponse;
    String authHeader = request.getHeader("Authorization");
    if (authHeader != null) {
      StringTokenizer st = new StringTokenizer(authHeader);
      if (st.hasMoreTokens()) {
        String basic = st.nextToken();
        if (basic.equalsIgnoreCase("Basic")) {
          try {
            String credentials = new String(Base64.decodeBase64(st.nextToken()), "UTF-8");
            LOG.debug("Credentials: " + credentials);
            int p = credentials.indexOf(":");
            if (p != -1) {
              String _username = credentials.substring(0, p).trim();
              String _password = credentials.substring(p + 1).trim();
              if (!username.equals(_username) || !password.equals(_password)) {
                unauthorized(response, "Bad credentials");
              }
              filterChain.doFilter(servletRequest, servletResponse);
            } else {
              unauthorized(response, "Invalid authentication token");
            }
          } catch (UnsupportedEncodingException e) {
            throw new Error("Couldn't retrieve authentication", e);
          }
        }
      }
    } else {
      unauthorized(response);
    }
  }
  @Override
  public void destroy() {
  }
  private void unauthorized(HttpServletResponse response, String message) throws IOException {
    response.setHeader("WWW-Authenticate", "Basic realm=\"" + realm + "\"");
    response.sendError(401, message);
  }
  private void unauthorized(HttpServletResponse response) throws IOException {
    unauthorized(response, "Unauthorized");
  }
}

//通过以下配置项开启了 shs ui 的认证 - 使用自定义认证过滤器
spark.ui.filters=org.apache.spark.deploy.yarn.YarnProxyRedirectFilter,com.hundsun.broker.BasicAuthenticationFilter
spark.com.hundsun.broker.BasicAuthenticationFilter.param.username=spark
spark.com.hundsun.broker.BasicAuthenticationFilter.param.password=spark
spark.com.hundsun.broker.BasicAuthenticationFilter.param.realm=spark
//通过以下配置项，开启 shs ui 的访问控制列表 acl
spark.history.ui.acls.enable=true
spark.history.ui.admin.acls=spark
spark.history.ui.admin.acls.groups=spark

org.apache.spark.ui.HttpSecurityFilter#doFilter
org.apache.spark.internal.config.UI#UI_FILTERS
org.apache.spark.scheduler.cluster.YarnSchedulerBackend#addWebUIFilter