[
https://issues.apache.org/jira/browse/HBASE-11077?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13986124#comment-13986124
]
Andrew Purtell edited comment on HBASE-11077 at 4/30/14 9:42 PM:
-----------------------------------------------------------------
bq. I think early_out should be set to true by default, so that it is least
surprise to the admin.
Then we break compatibility from 0.98.1 to 0.98.2. And, cell ACLs become
largely useless, since we early out at CF checks, they can't grant exception
access unless using the cell-first strategy, which has the drawback of
requiring the cell grant access.
bq. I think early_out should be set to true by default, so that it is least
surprise to the admin.
Check out the other subtask and let's figure out what makes sense for 0.99+.
It's not a trivial discussion.
was (Author: apurtell):
bq. I think early_out should be set to true by default, so that it is least
surprise to the admin.
Then we break compatibility from 0.98.1 to 0.98.2.
bq. I think early_out should be set to true by default, so that it is least
surprise to the admin.
Check out the other subtask and let's figure out what makes sense for 0.99+.
It's not a trivial discussion.
> [AccessController] Restore compatible early-out access denial
> -------------------------------------------------------------
>
> Key: HBASE-11077
> URL: https://issues.apache.org/jira/browse/HBASE-11077
> Project: HBase
> Issue Type: Sub-task
> Reporter: Andrew Purtell
> Assignee: Andrew Purtell
> Priority: Critical
> Fix For: 0.99.0, 0.98.2
>
> Attachments: HBASE-11077.patch, HBASE-11077.patch, HBASE-11077.patch,
> HBASE-11077.patch
>
>
> See parent for the whole story.
> For 0.98, to start, just put back the early out that was removed in 0.98.0
> and allow it to be overridden with a table attribute.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
