[HBASE-19483] Add proper privilege check for rsgroup commands

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.1, 2.0.0-beta-1, 2.0.0
• Component/s: rsgroup, security
• Hadoop Flags: Incompatible change, Reviewed

Release Note

This JIRA aims at refactoring AccessController, using ACL as core library in CPs.
1. Stripping out a public class AccessChecker from AccessController, using ACL as core library in CPs. AccessChecker don't have any dependency on anything CP related. Create it's instance from other CPS.
2. Change the default value of hbase.security.authorization to false.
3. Don't use CP hooks to check access in RSGroup. Use the access checker instance directly in functions of RSGroupAdminServiceImpl.

• Assignee: Guangxu Cheng
• Reporter: Ted Yu
• Created: 11/Dec/17 00:41
• Updated: 01/Feb/19 20:20
• Resolved: 11/Jan/18 19:01

Description

Currently list_rsgroups command can be executed by any user.

This is inconsistent with other list commands such as list_peers and list_peer_configs.

We should add proper privilege check for list_rsgroups command.

privilege check should be added for get_table_rsgroup / get_server_rsgroup / get_rsgroup commands.

Issue Links

• is related to: HBASE-19518 Moving the bulk load hooks to SecureBulkLoadEndpoint
• links to: Review Board (master)