[HBASE-17472] Correct the semantic of permission grant

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.0, 2.0.0
• Fix Version/s: 1.4.0, 2.0.0
• Component/s: Admin
• Hadoop Flags: Incompatible change, Reviewed

Release Note

Before this patch, later granted permissions will override previous granted permissions, and previous granted permissions LOST. this issue re-define grant semantic: for master branch, later granted permissions will merge with previous granted permissions. for branch-1.4, grant keep override behavior for compatibility purpose, and a grant with mergeExistingPermission flag provided.

• Assignee: Zheng Hu
• Reporter: Zheng Hu
• Created: 16/Jan/17 04:15
• Updated: 14/Feb/18 01:59
• Resolved: 20/Feb/17 12:37

Description

Currently, HBase grant operation has following semantic:

hbase(main):019:0> grant 'hbase_tst', 'RW', 'ycsb'
0 row(s) in 0.0960 seconds

hbase(main):020:0> user_permission 'ycsb'
User                                                         Namespace,Table,Family,Qualifier:Permission                                                                                                                                                                                                                                               
 hbase_tst                                                   default,ycsb,,: [Permission:actions=READ,WRITE]                                                                                                                                                                                                           
1 row(s) in 0.0550 seconds

hbase(main):021:0> grant 'hbase_tst', 'CA', 'ycsb'
0 row(s) in 0.0820 seconds

hbase(main):022:0> user_permission 'ycsb'
User                                                         Namespace,Table,Family,Qualifier:Permission                                                                                                                                       
 hbase_tst                                                   default,ycsb,,: [Permission: actions=CREATE,ADMIN]                                                                                                                                
1 row(s) in 0.0490 seconds

Later permission will replace previous granted permissions, which confused most of HBase administrator.

It's seems more reasonable that HBase merge multiple granted permission.

Issue Links

• links to: Review Link

Sub-Tasks

• Add a flag for grant ruby shell command to merge existing permissions.: Open