[HBASE-7123] Refactor internal methods in AccessController

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Component/s: security
• Assignee: Unassigned
• Reporter: Andrew Kyle Purtell
• Created: 08/Nov/12 01:12
• Updated: 15/Jun/22 00:18
• Resolved: 15/Jun/22 00:18

Description

The authorize(), permissionGranted(), and requirePermission() methods in AccessController have organically grown as both the HBase client API and the AccessController itself have evolved, and now have several problems:

• Code duplication (minor)

• Unused variants (minor)

• Signatures optimized for checking certain operations that have a familyMap. Unfortunately different operations have different ideas of what type a familyMap should be. This leads to runtime type checking and the need to convert one family map to another (e.g. Map<byte[], NavigableMap<byte[],Object>> to Map<byte[], Set<byte[]>> (That kind of conversion code in a hot path hurts to look at.) There are too many Java collection type combinations floating around. Some of this should be approached at the client API level too, for example with HBASE-7114.

• Only one Permission.Action can be checked at a time. We should really convert these into a bitmap if multiple actions need checking and pass that around instead.

Issue Links

• incorporates: HBASE-11095 Add ip restriction in user permissions
• is related to: HBASE-7114 Increment does not extend Mutation but probably should
• is related to: HBASE-8358 Add delete permission separate from full write permissions