[HBASE-13275] Setting hbase.security.authorization to false does not disable authorization

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.1, 1.1.0, 0.98.12, 2.0.0
• Component/s: security
• Hadoop Flags: Reviewed

Release Note

Prior to this change the configuration setting 'hbase.security.authorization' had no effect if security coprocessor were installed. The act of installing the security coprocessors was assumed to indicate active authorizaton was desired and required. Now it is possible to install the security coprocessors yet have them operate in a passive state with active authorization disabled by setting 'hbase.security.authorization' to false. This can be useful but is probably not what you want. For more information, consult the Security section of the HBase online manual.

'hbase.security.authorization' defaults to true for backwards comptatible behavior.

• Assignee: Andrew Kyle Purtell
• Reporter: William Watson
• Created: 18/Mar/15 19:36
• Updated: 22/Dec/15 06:34
• Resolved: 10/Apr/15 05:09

Description

According to the docs provided by Cloudera (we're not running Cloudera, BTW), this is the list of configs to enable authorization in HBase:

<property>
     <name>hbase.security.authorization</name>
     <value>true</value>
</property>
<property>
     <name>hbase.coprocessor.master.classes</name>
     <value>org.apache.hadoop.hbase.security.access.AccessController</value>
</property>
<property>
     <name>hbase.coprocessor.region.classes</name>
     <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
</property>

We wanted to then disable authorization but simply setting hbase.security.authorization to false did not disable the authorization

Sub-Tasks

• Document the implications of installing security coprocessors with hbase.security.authorization as false: Closed