[
https://issues.apache.org/jira/browse/HBASE-8409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13737326#comment-13737326
]
Francis Liu commented on HBASE-8409:
------------------------------------
[[email protected]] missed this comment. Thought I should address it.
{quote}
The ability to create tables within a namespace should require ADMIN or CREATE
grants on the namespace.
{quote}
Yep this is how it behaves.
{quote}
(Isn't it confusing to be able to create tables if you have WRITE access on a
namespace but not CREATE? CREATE has no meaning?)
{quote}
The model we were going for was similar to unix directories. Write privilege on
a directory allows you to create files/dirs in it. Yeah CREATE has no meaning
in this case.
{quote}
Any user permissions granted on a namespace authorize to all tables in the
namespace.
{quote}
It seems RWCXA may potentially be not enough to express the types of privileges
we want to enforce on a namespace. As there are privileges that we want
inherited (RWXCA) and there are privileges that apply only to namespaces (list,
modify metadata, etc).
I'll create a separate jira to address all the namespace privileges. And we can
stick with the two existing basic privileges for now?
> Security support for namespaces
> -------------------------------
>
> Key: HBASE-8409
> URL: https://issues.apache.org/jira/browse/HBASE-8409
> Project: HBase
> Issue Type: Sub-task
> Reporter: Francis Liu
> Assignee: Vandana Ayyalasomayajula
> Priority: Blocker
> Fix For: 0.98.0, 0.95.2
>
> Attachments: HBASE-8049_trunk.patch, HBASE-8409_2.patch,
> HBASE-8409_3.patch, TestNamespaceUpgrade.tgz
>
>
> This task adds the security piece to the namespace feature. The work related
> to migration of the existing acl table to the new namespace is remaining and
> will be completed in the follow up patch. Permissions can be granted to a
> namespace by the hbase admin, by appending '@' to the namespace name. A user
> with write or admin permissions on a given namespace can create tables in
> that namespace. The other privileges (R, X, C ) do not have any special
> meaning w.r.t namespaces. Any users of hbase can list tables in a namespace.
>
> The following commands can only be executed by HBase admins.
> 1. Grant privileges for user on Namespace.
> 2. Revoke privileges for user on Namespace
> Grant Command:
> hbase> grant 'tenant-A' 'W' '@N1'
> In the above example, the command will grant the user 'tenant-A' write
> privileges for a namespace named "N1".
> Revoke Command:
> hbase> revoke 'tenant-A''@N1'
> In the above example, the command will revoke all privileges from user
> 'tenant-A' for namespace named "N1".
> Lets see an example on how privileges work with namespaces.
>
> User "Mike" request for a namespace named "hbase_perf" with the hbase admin.
> whoami: hbase
> hbase shell >> namespace_create 'hbase_perf'
> hbase shell >> grant 'mike', 'W', '@hbase_perf'
> Mike creates two tables "table20" and "table50" in the above workspace.
> whoami: mike
> hbase shell >> create 'hbase_perf.table20', 'family1'
> hbase shell >> create 'hbase_perf.table50', 'family1'
> Note: As Mike was able to create tables 'hbase_perf.table20',
> 'hbase_perf.table50', he becomes the owner of those tables.
> This means he has "RWXCA" perms on those tables.
> Another team member of Mike, Alice wants also to share the same workspace
> "hbase_perf". HBase admin grants Alice also permission to create tables in
> "hbase_perf" namespace.
> whoami: hbase
> hbase shell >> grant 'alice', 'W', '@hbase_perf'
> Now Alice can create new tables under "hbase_perf" namespace, but cannot
> read,write,alter,delete existing tables in the namespace.
>
> whoami: alice
> hbase shell >> namespace_list_tables 'hbase_perf'
> hbase_perf.table20
> hbase_perf.table50
> hbase shell >> scan 'hbase_perf.table20'
> AccessDeniedException
>
> If Alice wants to read or write to existing tables in the "hbase_perf"
> namespace, hbase admins need to explicitly grant permission.
>
> whoami: hbase
> hbase shell >> grant 'alice', 'RW', 'hbase_perf.table20'
> hbase shell >> grant 'alice', 'RW', 'hbase_perf.table50'
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
