[PHOENIX-3756] Users lacking ADMIN on 'SYSTEM' HBase namespace can't connect to Phoenix

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.11.0
• Assignee: Josh Elser
• Reporter: Josh Elser
• Created: 30/Mar/17 18:58
• Updated: 22/Mar/18 07:21
• Resolved: 05/Apr/17 22:38

Description

Follow-on from PHOENIX-3652:

The fix provided in PHOENIX-3652 addressed the default situation where users would need ADMIN on the default HBase namespace. However, when phoenix.schema.isNamespaceMappingEnabled=true and Phoenix creates its system tables in the SYSTEM HBase namespace, unprivileged users (those lacking ADMIN on SYSTEM) still cannot connect to Phoenix.

The root-cause is essentially the same: the code tries to fetch the NamespaceDescriptor for the SYSTEM namespace which requires the ADMIN permission.

https://github.com/apache/phoenix/blob/8093d10f1a481101d6c93fdf0744ff15ec48f4aa/phoenix-core/src/main/java/org/apache/phoenix/query/ConnectionQueryServicesImpl.java#L1017-L1037

Issue Links

• is duplicated by: PHOENIX-2717 Unable to login if no "create" permission in HBase
• is related to: PHOENIX-3652 Users who do not have global access to hbase cluster can't connect to phoenix
• relates to: PHOENIX-3833 Create system schema fails on namespace-mapping table for unprivileged user.