Mailing-List: contact hdfs-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: hdfs-issues@hadoop.apache.org
Date: Fri, 15 Aug 2014 00:05:19 +0000 (UTC)
From: "Alejandro Abdelnur (JIRA)" <jira@apache.org>
To: hdfs-issues@hadoop.apache.org
Message-ID: <JIRA.12732213.1407294771273.3672.1408061119604@arcas>
In-Reply-To: <JIRA.12732213.1407294771273@arcas>
References: <JIRA.12732213.1407294771273@arcas>
Subject: [jira] [Updated] (HDFS-6826) Plugin interface to enable delegation
 of HDFS authorization assertions
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


     [ https://issues.apache.org/jira/browse/HDFS-6826?page=3Dcom.atlassian=
.jira.plugin.system.issuetabpanels:all-tabpanel ]

Alejandro Abdelnur updated HDFS-6826:
-------------------------------------

    Attachment: HDFS-6826-idea2.patch

attach is new POC where the FsPermissionChecker has been made an interface,=
 the original one renamed to DefaultFsPermissionChecker and the plugin crea=
tes a permission checker instance. (the patch is bigger because of the rena=
me, when committing an svn move would be done to preserve history of the pe=
rmission checker)

then the plugin can do both, replace authz info and replace the permission =
check logic.

I've also remove the refresh() call from the plugin. this means that the pl=
ugin does not provide for  means to make external call during a filesystem =
operation. A proper plugin impl should fetch all authz info async from fs o=
perations.

> Plugin interface to enable delegation of HDFS authorization assertions
> ----------------------------------------------------------------------
>
>                 Key: HDFS-6826
>                 URL: https://issues.apache.org/jira/browse/HDFS-6826
>             Project: Hadoop HDFS
>          Issue Type: New Feature
>          Components: security
>    Affects Versions: 2.4.1
>            Reporter: Alejandro Abdelnur
>            Assignee: Alejandro Abdelnur
>         Attachments: HDFS-6826-idea.patch, HDFS-6826-idea2.patch, HDFSPlu=
ggableAuthorizationProposal.pdf
>
>
> When Hbase data, HiveMetaStore data or Search data is accessed via servic=
es (Hbase region servers, HiveServer2, Impala, Solr) the services can enfor=
ce permissions on corresponding entities (databases, tables, views, columns=
, search collections, documents). It is desirable, when the data is accesse=
d directly by users accessing the underlying data files (i.e. from a MapRed=
uce job), that the permission of the data files map to the permissions of t=
he corresponding data entity (i.e. table, column family or search collectio=
n).
> To enable this we need to have the necessary hooks in place in the NameNo=
de to delegate authorization to an external system that can map HDFS files/=
directories to data entities and resolve their permissions based on the dat=
a entities permissions.
> I=E2=80=99ll be posting a design proposal in the next few days.


--
This message was sent by Atlassian JIRA
(v6.2#6252)