[
https://issues.apache.org/jira/browse/HBASE-12346?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14184772#comment-14184772
]
Anoop Sam John commented on HBASE-12346:
----------------------------------------
We have EnforcingScanLabelGenerator which will always give back the user's auth
labels and ignore whatever passed in Scan Authorizations. Even if the scan
passes a subset of user's auth labels, that is ignored and will assign all user
auths. And this is not the default impl
DefaultScanLabelGenerator when passing no Authorizations in Scan, give back no
results.
I am more inclined towards doing what this jira proposes. That looks easy for
use. We can have stack of ScanLabelGenerator and achieve what user wants. But a
default behaving the said would be more user friendly IMO.
I was also thinking on this some time back and make things easier. What do
you say Andy?
> Scan's default auths behavior under Visibility labels
> -----------------------------------------------------
>
> Key: HBASE-12346
> URL: https://issues.apache.org/jira/browse/HBASE-12346
> Project: HBase
> Issue Type: Bug
> Components: API, security
> Affects Versions: 0.98.7, 0.99.1
> Reporter: Jerry He
> Attachments: HBASE-12346-master.patch
>
>
> In Visibility Labels security, a set of labels (auths) are administered and
> associated with a user.
> A user can normally only see cell data during scan that are part of the
> user's label set (auths).
> Scan uses setAuthorizations to indicates its wants to use the auths to access
> the cells.
> Similarly in the shell:
> {code}
> scan 'table1', AUTHORIZATIONS => ['private']
> {code}
> But it is a surprise to find that setAuthorizations seems to be 'mandatory'
> in the default visibility label security setting. Every scan needs to
> setAuthorizations before the scan can get any cells even the cells are under
> the labels the request user is part of.
> The following steps will illustrate the issue:
> Run as superuser.
> {code}
> 1. create a visibility label called 'private'
> 2. create 'table1'
> 3. put into 'table1' data and label the data as 'private'
> 4. set_auths 'user1', 'private'
> 5. grant 'user1', 'RW', 'table1'
> {code}
> Run as 'user1':
> {code}
> 1. scan 'table1'
> This show no cells.
> 2. scan 'table1', scan 'table1', AUTHORIZATIONS => ['private']
> This will show all the data.
> {code}
> I am not sure if this is expected by design or a bug.
> But a more reasonable, more client application backward compatible, and less
> surprising default behavior should probably look like this:
> A scan's default auths, if its Authorizations attributes is not set
> explicitly, should be all the auths the request user is administered and
> allowed on the server.
> If scan.setAuthorizations is used, then the server further filter the auths
> during scan: use the input auths minus what is not in user's label set on the
> server.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
