[ACCUMULO-1318] Allow granting System.GRANT permission

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.7.0
• Component/s: master, tserver
• Labels: release_notes security
• Assignee: Josh Elser
• Reporter: Christopher Tubbs
• Created: 18/Apr/13 15:43
• Updated: 06/Mar/15 21:46
• Resolved: 06/Mar/15 21:05

Description

With the addition of pluggable authentication/authorizor/permissions handler modules (ACCUMULO-259), it seems we should rely more on these modules to set their policy for who has which permissions.

As such, I don't believe we should continue to constrain the System.GRANT permission, so that it is held only by the root user. This is an especially important consideration for ACCUMULO-1300, because in that ticket, there will always be a "local" root user, but there's no reason that should be the de-facto account that manages other users' permissions from.

Issue Links

• is related to: ACCUMULO-1319 Remove root username prompt from init