hbase-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jieshan Bean (JIRA)" <j...@apache.org>
Subject [jira] [Created] (HBASE-8213) global authorization may lose efficacy
Date Thu, 28 Mar 2013 09:41:15 GMT
Jieshan Bean created HBASE-8213:

             Summary: global authorization may lose efficacy 
                 Key: HBASE-8213
                 URL: https://issues.apache.org/jira/browse/HBASE-8213
             Project: HBase
          Issue Type: Bug
            Reporter: Jieshan Bean
            Priority: Critical

It depends on the order of which region be opened first.  
Suppose we have one 1 regionserver and only 1 user region REGION-A on this server, _acl_ region
was on another regionserver. _acl_ was opened a few seconds before REGION-A.
The global authorization data read from Zookeeper was overwritten by the data read from configuration.
  private TableAuthManager(ZooKeeperWatcher watcher, Configuration conf)
      throws IOException {
    this.conf = conf;
    this.zkperms = new ZKPermissionWatcher(watcher, this, conf);
    try {
	  // Read global authorization data from zookeeper. 
    } catch (KeeperException ke) {
      LOG.error("ZooKeeper initialization failed", ke);
    // It will overwrite globalCache.
    // initialize global permissions based on configuration
    globalCache = initGlobal(conf);

This issue can be easily reproduced by below steps:
1. Start a cluster with 3 regionservers.
2. Create a new table T1.
3. grant a new user USER-A with global authorization.
4. Kill 1 regionserver RS3 and switch balance off.
5. Start regionserver RS3.
6. Assign region T1 to RS3.
7. Put data with user USER-A.

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

View raw message