[
https://issues.apache.org/jira/browse/PHOENIX-5269?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16836877#comment-16836877
]
Hadoop QA commented on PHOENIX-5269:
------------------------------------
{color:red}-1 overall{color}. Here are the results of testing the latest
attachment
http://issues.apache.org/jira/secure/attachment/12968350/PHOENIX-5269-4.14-HBase-1.4.v2.patch
against 4.14-HBase-1.4 branch at commit
700c6436984f23c0a9783e3ea37dd1251b824528.
ATTACHMENT ID: 12968350
{color:green}+1 @author{color}. The patch does not contain any @author
tags.
{color:red}-1 tests included{color}. The patch doesn't appear to include
any new or modified tests.
Please justify why no new tests are needed for this
patch.
Also please list what manual steps were performed to
verify this patch.
{color:green}+1 javac{color}. The applied patch does not increase the
total number of javac compiler warnings.
{color:green}+1 release audit{color}. The applied patch does not increase
the total number of release audit warnings.
{color:red}-1 lineLengths{color}. The patch introduces the following lines
longer than 100:
+
if(cp.getClass().getName().equals(org.apache.hadoop.hbase.security.access.AccessController.class.getName()))
{
+ List<UserPermission> userPermissions = User.runAsLoginUser(new
PrivilegedExceptionAction<List<UserPermission>>() {
+ private void getUserDefinedPermissions(final TableName tableName, final
List<UserPermission> userPermissions) throws IOException{
+ try (Connection connection =
ConnectionFactory.createConnection(env.getConfiguration())) {
+ if
(service.getClass().getName().equals(org.apache.hadoop.hbase.security.access.AccessController.class.getName()))
{
+
getUserPermsFromUserDefinedAccessController(userPermissions, connection,
(AccessControlService.Interface) service);
+ if(hbaseAccessControllerEnabled &&
accessChecker.getAuthManager().userHasAccess(user, table, action)) {
+ if(hbaseAccessControllerEnabled &&
accessChecker.getAuthManager().groupHasAccess(group, table, action)) {
{color:red}-1 core tests{color}. The patch failed these unit tests:
org.apache.phoenix.hbase.index.covered.TestCoveredColumnIndexCodec
Test results:
https://builds.apache.org/job/PreCommit-PHOENIX-Build/2574//testReport/
Console output:
https://builds.apache.org/job/PreCommit-PHOENIX-Build/2574//console
This message is automatically generated.
> PhoenixAccessController should use AccessChecker instead of
> AccessControlClient for permission checks
> -----------------------------------------------------------------------------------------------------
>
> Key: PHOENIX-5269
> URL: https://issues.apache.org/jira/browse/PHOENIX-5269
> Project: Phoenix
> Issue Type: Bug
> Affects Versions: 4.14.1, 4.14.2
> Reporter: Andrew Purtell
> Assignee: Kiran Kumar Maturi
> Priority: Critical
> Attachments: PHOENIX-5269-4.14-HBase-1.4.patch,
> PHOENIX-5269-4.14-HBase-1.4.v1.patch, PHOENIX-5269-4.14-HBase-1.4.v2.patch
>
>
> PhoenixAccessController should use AccessChecker instead of
> AccessControlClient for permission checks.
> In HBase, every RegionServer's AccessController maintains a local cache of
> permissions. At startup time they are initialized from the ACL table.
> Whenever the ACL table is changed (via grant or revoke) the AC on the ACL
> table "broadcasts" the change via zookeeper, which updates the cache. This is
> performed and managed by TableAuthManager but is exposed as API by
> AccessChecker. AccessChecker is the result of a refactor that was committed
> as far back as branch-1.4 I believe.
> Phoenix implements its own access controller and is using the client API
> AccessControlClient instead. AccessControlClient does not cache nor use the
> ZK-based cache update mechanism, because it is designed for client side use.
> The use of AccessControlClient instead of AccessChecker is not scalable.
> Every permissions check will trigger a remote RPC to the ACL table, which is
> generally going to be a single region hosted on a single RegionServer.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
