Apache
/
hadoop
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
hadoop/hadoop-hdds/docs/content/security/SecurityAcls.md

3.7 KiB
Raw Blame History

title date weight summary
Ozone ACLs 2019-April-03 6 Native ACL support provides ACL functionality without Ranger integration.

Ozone supports a set of native ACLs. These ACLs cane be used independently or along with Ranger. If Apache Ranger is enabled, then ACL will be checked first with Ranger and then Ozone's internal ACLs will be evaluated.

Ozone ACLs are a super set of Posix and S3 ACLs.

The general format of an ACL is object:who:rights.

Where an object can be:

  1. Volume - An Ozone volume. e.g. /volume
  2. Bucket - An Ozone bucket. e.g. /volume/bucket
  3. Key - An object key or an object. e.g. /volume/bucket/key
  4. Prefix - A path prefix for a specific key. e.g. /volume/bucket/prefix1/prefix2

Where a who can be:

  1. User - A user in the Kerberos domain. User like in Posix world can be named or unnamed.
  2. Group - A group in the Kerberos domain. Group also like in Posix world can be named or unnamed.
  3. World - All authenticated users in the Kerberos domain. This maps to others in the Posix domain.
  4. Anonymous - Ignore the user field completely. This is an extension to the Posix semantics, This is needed for S3 protocol, where we express that we have no way of knowing who the user is or we don't care.
A S3 user accesing Ozone via AWS v4 signature protocol will be translated to the appropriate Kerberos user by Ozone Manager.

Where a right can be:

  1. Create – This ACL provides a user the ability to create buckets in a volume and keys in a bucket. Please note: Under Ozone, Only admins can create volumes.
  2. List – This ACL allows listing of buckets and keys. This ACL is attached to the volume and buckets which allow listing of the child objects. Please note: The user and admins can list the volumes owned by the user.
  3. Delete – Allows the user to delete a volume, bucket or key.
  4. Read – Allows the user to read the metadata of a Volume and Bucket and data stream and metadata of a key(object).
  5. Write - Allows the user to write the metadata of a Volume and Bucket and allows the user to overwrite an existing ozone key(object).
  6. Read_ACL – Allows a user to read the ACL on a specific object.
  7. Write_ACL – Allows a user to write the ACL on a specific object.

Ozone Native ACL APIs Work in progress

The ACLs can be manipulated by a set of APIs supported by Ozone. The APIs supported are:

  1. SetAcl – This API will take user principal, the name of the object, type of the object and a list of ACLs.

  2. GetAcl – This API will take the name of an ozone object and type of the object and will return a list of ACLs.

  3. RemoveAcl - It is possible that we might support an API called RemoveACL as a convenience API, but in reality it is just a GetACL followed by SetACL with an etag to avoid conflicts.