XMLWordPrintableJSON

Details

    • Sub-task
    • Status: Closed
    • Blocker
    • Resolution: Fixed
    • None
    • 0.98.0, 0.95.2
    • None
    • None
    • Reviewed
    • Hide
      This patch introduces security privileges to create, alter or drop namespaces. When security is enabled only global admin is allowed to do such operations. Richer namespace privileges will be introduced in HBASE-9206.
      Show
      This patch introduces security privileges to create, alter or drop namespaces. When security is enabled only global admin is allowed to do such operations. Richer namespace privileges will be introduced in HBASE-9206 .

    Description

      This task adds the security piece to the namespace feature. The work related to migration of the existing acl table to the new namespace is remaining and will be completed in the follow up patch. Permissions can be granted to a namespace by the hbase admin, by appending '@' to the namespace name. A user with write or admin permissions on a given namespace can create tables in that namespace. The other privileges (R, X, C ) do not have any special meaning w.r.t namespaces. Any users of hbase can list tables in a namespace.

      The following commands can only be executed by HBase admins.
      1. Grant privileges for user on Namespace.
      2. Revoke privileges for user on Namespace

      Grant Command:
      hbase> grant 'tenant-A' 'W' '@N1'
      In the above example, the command will grant the user 'tenant-A' write privileges for a namespace named "N1".

      Revoke Command:

      hbase> revoke 'tenant-A''@N1'
      In the above example, the command will revoke all privileges from user 'tenant-A' for namespace named "N1".

      Lets see an example on how privileges work with namespaces.

      User "Mike" request for a namespace named "hbase_perf" with the hbase admin.
      whoami: hbase
      hbase shell >> namespace_create 'hbase_perf'
      hbase shell >> grant 'mike', 'W', '@hbase_perf'
      Mike creates two tables "table20" and "table50" in the above workspace.
      whoami: mike
      hbase shell >> create 'hbase_perf.table20', 'family1'
      hbase shell >> create 'hbase_perf.table50', 'family1'

      Note: As Mike was able to create tables 'hbase_perf.table20', 'hbase_perf.table50', he becomes the owner of those tables.
      This means he has "RWXCA" perms on those tables.
      Another team member of Mike, Alice wants also to share the same workspace "hbase_perf". HBase admin grants Alice also permission to create tables in "hbase_perf" namespace.
      whoami: hbase
      hbase shell >> grant 'alice', 'W', '@hbase_perf'
      Now Alice can create new tables under "hbase_perf" namespace, but cannot read,write,alter,delete existing tables in the namespace.

      whoami: alice
      hbase shell >> namespace_list_tables 'hbase_perf'
      hbase_perf.table20
      hbase_perf.table50
      hbase shell >> scan 'hbase_perf.table20'
      AccessDeniedException

      If Alice wants to read or write to existing tables in the "hbase_perf" namespace, hbase admins need to explicitly grant permission.

      whoami: hbase
      hbase shell >> grant 'alice', 'RW', 'hbase_perf.table20'
      hbase shell >> grant 'alice', 'RW', 'hbase_perf.table50'

      Attachments

        1. 8409_095.txt
          370 kB
          Michael Stack
        2. 8409-addendum.patch
          9 kB
          Devaraj Das
        3. HBASE-8049_trunk.patch
          32 kB
          Vandana Ayyalasomayajula
        4. HBASE-8409_2.patch
          393 kB
          Francis Christopher Liu
        5. HBASE-8409_3.patch
          395 kB
          Francis Christopher Liu
        6. HBASE-8409_4.patch
          394 kB
          Francis Christopher Liu
        7. TestNamespaceUpgrade.tgz
          10 kB
          Francis Christopher Liu

        Issue Links

          Activity

            People

              avandana Vandana Ayyalasomayajula
              toffer Francis Christopher Liu
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: