[HBASE-5352] ACL improvements

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.92.1, 0.94.0
• Component/s: security
• Assignee: Unassigned
• Reporter: Enis Soztutar
• Created: 08/Feb/12 01:43
• Updated: 12/Jun/22 20:18
• Resolved: 29/Apr/14 21:12

Description

In this issue I would like to open discussion for a few minor ACL related improvements. The proposed changes are as follows:

1. Introduce something like AccessControllerProtocol.checkPermissions(Permission[] permissions) API, so that clients can check access rights before carrying out the operations. We need this kind of operation for HCATALOG-245, which introduces authorization providers for hbase over hcat. We cannot use getUserPermissions() since it requires ADMIN permissions on the global/table level.
2. getUserPermissions(tableName)/grant/revoke and drop/modify table operations should not check for global CREATE/ADMIN rights, but table CREATE/ADMIN rights. The reasoning is that if a user is able to admin or read from a table, she should be able to read the table's permissions. We can choose whether we want only READ or ADMIN permissions for getUserPermission(). Since we check for global permissions first for table permissions, configuring table access using global permissions will continue to work.
3. Grant/Revoke global permissions - HBASE-5342 (included for completeness)

From all 3, we may want to backport the first one to 0.92 since without it, Hive/Hcatalog cannot use Hbase's authorization mechanism effectively.

I will create subissues and convert HBASE-5342 to a subtask when we get some feedback, and opinions for going further.

Issue Links

• is part of: HBASE-6098 ACL design changes
• is part of: HBASE-6101 Ensure Observers cover all relevant RPC and lifecycle code paths
• is part of: HBASE-6096 AccessController v2

Sub-Tasks

• Introduce AccessControllerProtocol.checkPermissions(Permission[] permissons) API: Closed
• Table mutation operations should check table level rights, not global rights: Closed
• Grant/Revoke global permissions: Closed
• Delete table/column should delete stored permissions on -acl- table: Closed
• Fix ACL "Admin" Table inconsistent permission check: Closed
• preCheckAndPut/Delete() checks for READ when also a WRITE is performed: Closed
• Admin operations on a table should be authorized against table permissions instead of global permissions.: Closed
• Authorize flush, split, compact operations in AccessController: Closed
• ACL Corrections for AccessControllerProtocol apis: Closed
• Grant on META not taking effect: Closed
• Apply ACLs to new bulk load hooks: Closed
• TABLE ADMIN should be allowed to relocate regions: Closed
• Avoid unnecessary flush & compact on Meta in admin.rb.: Closed
• Compact can skip the security access control: Closed
• Do not allow user to disable or drop ACL table: Closed