[HBASE-12087] [0.98] Changing the default setting of hbase.security.access.early_out to true

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.98.6
• Fix Version/s: 0.98.7
• Hadoop Flags: Reviewed

Release Note

Prior to 0.98.0 if a user was not granted access to a column family or partial access (qualifier grants), then the AccessController would immediately throw back an AccessDeniedException. This behavior was changed in 0.98.0. Instead, scanners will return result sets only including cells for which the user has access. If the user has no permissions on any cell then the scanner will return the empty result set. Code expecting an AccessDeniedException if the user has no access may not function as intended.

This change introduces a configuration setting which restores the pre-0.98.0 behavior.

If you would prefer the new behavior, this can be configured globally via site configuration or per table using HTableDescriptor#setConfiguration. The setting is AccessControlConstants.CF_ATTRIBUTE_EARLY_OUT ("hbase.security.access.early_out"), a boolean. Set to "false" and scanners will return result sets only including cells for which the user has access without throwing an AccessDeniedException.

• Assignee: Srikanth Srungarapu
• Reporter: Srikanth Srungarapu
• Created: 24/Sep/14 19:41
• Updated: 20/Nov/15 11:54
• Resolved: 26/Sep/14 20:46

Description

From the mailing list conversation:
Problem:

• 98 with default early out = false and hfile v2 will always give the
  "Permission Denied" instead of the "0 rows" that you expect since the early
  out is false
• 98 with default early out = false and hfile v3 will always give the "0
  rows"