[
https://issues.apache.org/jira/browse/HBASE-13275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14385090#comment-14385090
]
Jerry He commented on HBASE-13275:
----------------------------------
The reasoning and arguments are good.
Looked through the latest patch (not thorough review).
In the VisibilityController, should these be unconditional too?
{noformat}
@Override
public void preModifyTable(ObserverContext<MasterCoprocessorEnvironment> ctx,
TableName tableName, HTableDescriptor htd) throws IOException {
+ if (!authorizationEnabled) {
+ return;
+ }
if (LABELS_TABLE_NAME.equals(tableName)) {
throw new ConstraintException("Cannot alter " + LABELS_TABLE_NAME);
}
@@ -208,6 +221,9 @@ public class VisibilityController extends
BaseMasterAndRegionObserver implements
@Override
public void preAddColumn(ObserverContext<MasterCoprocessorEnvironment> ctx,
TableName tableName,
HColumnDescriptor column) throws IOException {
+ if (!authorizationEnabled) {
+ return;
+ }
if (LABELS_TABLE_NAME.equals(tableName)) {
throw new ConstraintException("Cannot alter " + LABELS_TABLE_NAME);
}
@@ -216,6 +232,9 @@ public class VisibilityController extends
BaseMasterAndRegionObserver implements
@Override
public void preModifyColumn(ObserverContext<MasterCoprocessorEnvironment>
ctx,
TableName tableName, HColumnDescriptor descriptor) throws IOException {
+ if (!authorizationEnabled) {
+ return;
+ }
if (LABELS_TABLE_NAME.equals(tableName)) {
throw new ConstraintException("Cannot alter " + LABELS_TABLE_NAME);
}
@@ -224,6 +243,9 @@ public class VisibilityController extends
BaseMasterAndRegionObserver implements
@Override
public void preDeleteColumn(ObserverContext<MasterCoprocessorEnvironment>
ctx,
TableName tableName, byte[] c) throws IOException {
+ if (!authorizationEnabled) {
+ return;
+ }
if (LABELS_TABLE_NAME.equals(tableName)) {
throw new ConstraintException("Cannot alter " + LABELS_TABLE_NAME);
}
@@ -232,6 +254,9 @@ public class VisibilityController extends
BaseMasterAndRegionObserver implements
@Override
public void preDisableTable(ObserverContext<MasterCoprocessorEnvironment>
ctx, TableName tableName)
throws IOException {
+ if (!authorizationEnabled) {
+ return;
+ }
if (LABELS_TABLE_NAME.equals(tableName)) {
throw new ConstraintException("Cannot disable " + LABELS_TABLE_NAME);
}
{noformat}
> Setting hbase.security.authorization to false does not disable authorization
> ----------------------------------------------------------------------------
>
> Key: HBASE-13275
> URL: https://issues.apache.org/jira/browse/HBASE-13275
> Project: HBase
> Issue Type: Bug
> Reporter: William Watson
> Assignee: Andrew Purtell
> Fix For: 2.0.0, 1.0.1, 1.1.0, 0.98.13
>
> Attachments: HBASE-13275.patch, HBASE-13275.patch
>
>
> According to the docs provided by Cloudera (we're not running Cloudera, BTW),
> this is the list of configs to enable authorization in HBase:
> {code}
> <property>
> <name>hbase.security.authorization</name>
> <value>true</value>
> </property>
> <property>
> <name>hbase.coprocessor.master.classes</name>
> <value>org.apache.hadoop.hbase.security.access.AccessController</value>
> </property>
> <property>
> <name>hbase.coprocessor.region.classes</name>
>
> <value>org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController</value>
> </property>
> {code}
> We wanted to then disable authorization but simply setting
> hbase.security.authorization to false did not disable the authorization
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
