[
https://issues.apache.org/jira/browse/HDFS-6826?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Arun Suresh updated HDFS-6826:
------------------------------
Attachment: HDFS-6826.10.patch
Uploading a new patch (.10.patch)
The patch, now rebased with trunk, is based on [~daryn]'s patch which [~tucu00]
had fleshed out (v9)
It addresses [~jnp] and [~sureshms]'s concerns as follows :
# It splits the Authorization into two parts. The {{INodeAttributeProvider}}
can be subclassed so that the implementation can decide what the
AclFeatures/Permissions/user/group etc are returned for an INode
# It also allows the implementer to specify an {{AccessControlEnforcer}} (by
overriding the {{getExternalAccessControlEnforcer()}} method in the
{{INodeAttributeProvider}} implementation). This can be used to override the
{{checPermission}} functionality of the {{FsPermissionChecker}}
# It plugin is invoked when a client does a *getfacl* / *ls*, and thereby
ensures it displays what is expected. which I guess was [~atm]'s concern
# The Plugin is not invoked in the set Acl /permission path. This is fine for
our purposes. But if you guys think it is important, I can provide a fix for
that (possibly follow-up JIRA ?).
Do let me know what you guys think. and If you feel its the right approach, I
can proceed to fix it up some more.
> Plugin interface to enable delegation of HDFS authorization assertions
> ----------------------------------------------------------------------
>
> Key: HDFS-6826
> URL: https://issues.apache.org/jira/browse/HDFS-6826
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: security
> Affects Versions: 2.4.1
> Reporter: Alejandro Abdelnur
> Assignee: Arun Suresh
> Attachments: HDFS-6826-idea.patch, HDFS-6826-idea2.patch,
> HDFS-6826-permchecker.patch, HDFS-6826.10.patch, HDFS-6826v3.patch,
> HDFS-6826v4.patch, HDFS-6826v5.patch, HDFS-6826v6.patch, HDFS-6826v7.1.patch,
> HDFS-6826v7.2.patch, HDFS-6826v7.3.patch, HDFS-6826v7.4.patch,
> HDFS-6826v7.5.patch, HDFS-6826v7.6.patch, HDFS-6826v7.patch,
> HDFS-6826v8.patch, HDFS-6826v9.patch,
> HDFSPluggableAuthorizationProposal-v2.pdf,
> HDFSPluggableAuthorizationProposal.pdf
>
>
> When Hbase data, HiveMetaStore data or Search data is accessed via services
> (Hbase region servers, HiveServer2, Impala, Solr) the services can enforce
> permissions on corresponding entities (databases, tables, views, columns,
> search collections, documents). It is desirable, when the data is accessed
> directly by users accessing the underlying data files (i.e. from a MapReduce
> job), that the permission of the data files map to the permissions of the
> corresponding data entity (i.e. table, column family or search collection).
> To enable this we need to have the necessary hooks in place in the NameNode
> to delegate authorization to an external system that can map HDFS
> files/directories to data entities and resolve their permissions based on the
> data entities permissions.
> I’ll be posting a design proposal in the next few days.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
