[
https://issues.apache.org/jira/browse/PHOENIX-3756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15954146#comment-15954146
]
James Taylor commented on PHOENIX-3756:
---------------------------------------
Patch looks good to me, but maybe one possible issue: is there a possibility
that the AccessDeniedException would be further down the cause chain?
{code}
+ } catch (PhoenixIOException e) {
+ if (e.getCause() instanceof
AccessDeniedException) {
+ // Pass
+ logger.warn("Could not check for
Phoenix SYSTEM tables, assuming they exist and are properly configured");
+ success = true;
+ } else {
+ initializationException = e;
+ }
+ return null;
{code}
If so, would it be better to use {{if (Throwables.getRootCause(e) instanceof
AccessDeniedException}} or {{if (ExceptionUtils.getRootCause() instanceof
AccessDeniedException)}}?
> Users lacking ADMIN on 'SYSTEM' HBase namespace can't connect to Phoenix
> ------------------------------------------------------------------------
>
> Key: PHOENIX-3756
> URL: https://issues.apache.org/jira/browse/PHOENIX-3756
> Project: Phoenix
> Issue Type: Bug
> Reporter: Josh Elser
> Assignee: Josh Elser
> Fix For: 4.11.0
>
> Attachments: PHOENIX-3756.001.patch, PHOENIX-3756.002.patch,
> PHOENIX-3756.003.patch, PHOENIX-3756.004.patch
>
>
> Follow-on from PHOENIX-3652:
> The fix provided in PHOENIX-3652 addressed the default situation where users
> would need ADMIN on the default HBase namespace. However, when
> {{phoenix.schema.isNamespaceMappingEnabled=true}} and Phoenix creates its
> system tables in the {{SYSTEM}} HBase namespace, unprivileged users (those
> lacking ADMIN on {{SYSTEM}}) still cannot connect to Phoenix.
> The root-cause is essentially the same: the code tries to fetch the
> {{NamespaceDescriptor}} for the {{SYSTEM}} namespace which requires the ADMIN
> permission.
> https://github.com/apache/phoenix/blob/8093d10f1a481101d6c93fdf0744ff15ec48f4aa/phoenix-core/src/main/java/org/apache/phoenix/query/ConnectionQueryServicesImpl.java#L1017-L1037
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
