Apache
/
hbase
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HBASE-12098 User granted namespace table create permissions can't create a table (Srikanth Srungarapu)

This commit is contained in:
Matteo Bertozzi 2014-09-30 19:10:00 +01:00
parent f719b57f76
commit 469bfdf95a
2 changed files with 36 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hbase-server/src/main/java/org/apache/hadoop/hbase/security/access/AccessController.java
View File

@ -485,7 +485,8 @@ public class AccessController extends BaseMasterAndRegionObserver
private void requireGlobalPermission(String request, Action perm, TableName tableName,
Map<byte[], ? extends Collection<byte[]>> familyMap) throws IOException {
User user = getActiveUser();
if (authManager.authorize(user, perm)) {
if (authManager.authorize(user, perm) || (tableName != null &&
authManager.authorize(user, tableName.getNamespaceAsString(), perm))) {
logResult(AuthResult.allow(request, "Global check allowed", user, perm, tableName, familyMap));
} else {
logResult(AuthResult.deny(request, "Global check failed", user, perm, tableName, familyMap));

39
hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestNamespaceCommands.java
View File

@ -22,11 +22,17 @@ import static org.junit.Assert.assertTrue;
import java.util.List;
import com.google.common.collect.ListMultimap;
import com.google.protobuf.BlockingRpcChannel;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.HBaseTestingUtility;
import org.apache.hadoop.hbase.HColumnDescriptor;
import org.apache.hadoop.hbase.HConstants;
import org.apache.hadoop.hbase.MediumTests;
import org.apache.hadoop.hbase.HTableDescriptor;
import org.apache.hadoop.hbase.NamespaceDescriptor;
import org.apache.hadoop.hbase.MediumTests;
import org.apache.hadoop.hbase.TableName;
import org.apache.hadoop.hbase.client.Get;
import org.apache.hadoop.hbase.client.HTable;
import org.apache.hadoop.hbase.client.Result;
@ -38,14 +44,15 @@ import org.apache.hadoop.hbase.protobuf.generated.AccessControlProtos.AccessCont
import org.apache.hadoop.hbase.security.User;
import org.apache.hadoop.hbase.security.access.Permission.Action;
import org.apache.hadoop.hbase.util.Bytes;
import org.junit.AfterClass;
import org.junit.BeforeClass;
import org.junit.Test;
import org.junit.experimental.categories.Category;
import com.google.common.collect.ListMultimap;
import com.google.protobuf.BlockingRpcChannel;
import java.util.List;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
@Category(MediumTests.class)
public class TestNamespaceCommands extends SecureTestUtil {
@ -64,6 +71,9 @@ public class TestNamespaceCommands extends SecureTestUtil {
// user with permission on namespace for testing all operations.
private static User USER_NSP_WRITE;
private static String TEST_TABLE = TestNamespace + ":testtable";
private static byte[] TEST_FAMILY = Bytes.toBytes("f1");
@BeforeClass
public static void beforeClass() throws Exception {
conf = UTIL.getConfiguration();
@ -85,7 +95,7 @@ public class TestNamespaceCommands extends SecureTestUtil {
UTIL.getHBaseAdmin().createNamespace(NamespaceDescriptor.create(TestNamespace).build());
grantOnNamespace(UTIL, USER_NSP_WRITE.getShortName(),
TestNamespace, Permission.Action.WRITE);
TestNamespace, Permission.Action.WRITE, Permission.Action.CREATE);
}
@AfterClass
@ -189,4 +199,23 @@ public class TestNamespaceCommands extends SecureTestUtil {
verifyAllowed(revokeAction, SUPERUSER);
verifyDenied(revokeAction, USER_CREATE, USER_RW);
}
@Test
public void testCreateTableWithNamespace() throws Exception {
AccessTestAction createTable = new AccessTestAction() {
@Override
public Object run() throws Exception {
HTableDescriptor htd = new HTableDescriptor(TableName.valueOf(TEST_TABLE));
htd.addFamily(new HColumnDescriptor(TEST_FAMILY));
ACCESS_CONTROLLER.preCreateTable(ObserverContext.createAndPrepare(CP_ENV, null), htd, null);
return null;
}
};
// Only users with create permissions on namespace should be able to create a new table
verifyAllowed(createTable, SUPERUSER, USER_NSP_WRITE);
// all others should be denied
verifyDenied(createTable, USER_CREATE, USER_RW);
}
}