sure, created JIRA HBASE-13619. Regards, Abhishek
-----Original Message----- From: Andrew Purtell [mailto:[email protected]] Sent: 04 May 2015 22:41 To: [email protected] Subject: Re: CreateTableHandler: postCreateTableHanler coprocessor runs as RemoteRpcUser privileged action. I think at this point we can't change the behavior, that would be a regression. Could be better documented. We can include advice on using User.runAsLoginUser. Would you like to file an issue for the documentation improvement? On Mon, May 4, 2015 at 5:14 AM, abhishek kr <[email protected]> wrote: > Hi, > We have a custom written coprocessor for CreateTableHandler which does > some hdfs related stuff in postCreateTableHandler, and it was working > fine till HBASE-11886 got merged. It seems that post HBASE-11886 > merge, our coprocessor code is getting executed with remote rpc user > privileges instead of master privileges: > // --START-- > this.activeUser.runAs(new PrivilegedExceptionAction<Void>() { > @Override > public Void run() throws Exception { > cpHost.postCreateTableHandler(hTableDescriptor, newRegions); > return null; > } > }); > // --END-- > > As per HBASE-11886, these changes were done to handle table ACL > related issue , however it does this by reducing the default > privileges coprocessor runs under. > We can get around this by using User.runAsLoginUser in our coprocessor > code but I think by default coprocessors should continue to run with > master/region server identity and HBASE-11886 can be handled in some > other way, for example using InheritedThreadLocal for RequestContext, > as suggested in comments by Anoop in HBASE-11886, pls let us know ur > views on this, thanks. > > > Regards, > Abhishek > > -- Best regards, - Andy Problems worthy of attack prove their worth by hitting back. - Piet Hein (via Tom White)
