Return-Path: 
 <issues-return-141525-apmail-hbase-issues-archive=hbase.apache.org@hbase.apache.org>
X-Original-To: apmail-hbase-issues-archive@www.apache.org
Delivered-To: apmail-hbase-issues-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 9C8A51080B
	for <apmail-hbase-issues-archive@www.apache.org>;
 Sat, 29 Mar 2014 10:13:34 +0000 (UTC)
Received: (qmail 69081 invoked by uid 500); 29 Mar 2014 10:13:33 -0000
Delivered-To: apmail-hbase-issues-archive@hbase.apache.org
Received: (qmail 68904 invoked by uid 500); 29 Mar 2014 10:13:29 -0000
Mailing-List: contact issues-help@hbase.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:issues-help@hbase.apache.org>
List-Unsubscribe: <mailto:issues-unsubscribe@hbase.apache.org>
List-Post: <mailto:issues@hbase.apache.org>
List-Id: <issues.hbase.apache.org>
Delivered-To: mailing list issues@hbase.apache.org
Received: (qmail 68385 invoked by uid 99); 29 Mar 2014 10:13:23 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 29 Mar 2014 10:13:23 +0000
Date: Sat, 29 Mar 2014 10:13:22 +0000 (UTC)
From: "Ted Yu (JIRA)" <jira@apache.org>
To: issues@hbase.apache.org
Message-ID: <JIRA.12704298.1396025216181.29832.1396088002816@arcas>
In-Reply-To: <JIRA.12704298.1396025216181@arcas>
References: <JIRA.12704298.1396025216181@arcas>
Subject: [jira] [Updated] (HBASE-10863) Scan doesn't return rows for user
 who has authorization by visibility label
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


     [ https://issues.apache.org/jira/browse/HBASE-10863?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ted Yu updated HBASE-10863:
---------------------------

    Attachment: 10863-v2.txt

Patch v2 adopts review comments and was verified to work in a secure deployment.

> Scan doesn't return rows for user who has authorization by visibility label
> ---------------------------------------------------------------------------
>
>                 Key: HBASE-10863
>                 URL: https://issues.apache.org/jira/browse/HBASE-10863
>             Project: HBase
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 0.98.0
>            Reporter: Ted Yu
>            Assignee: Ted Yu
>             Fix For: 0.98.1, 0.99.0
>
>         Attachments: 10863-v1.txt, 10863-v2.txt
>
>
> *In secure deployment* of 0.98 tip, I did:
> as user hbase:
> {code}
> add_labels 'A'
> create 'tb', 'f1'
> put 'tb', 'row', 'f1:q', 'v1', {VISIBILITY=>'A'}
> set_auths 'oozie', ['A']
> {code}
> as user oozie:
> {code}
> hbase(main):001:0> scan 'tb', { AUTHORIZATIONS => ['A']}
> ROW                                          COLUMN+CELL
> 0 row(s) in 0.1030 seconds
> {code}
> Here is my config:
> {code}
>   <property>
>     <name>hfile.format.version</name>
>     <value>3</value>
>   </property>
>   <property>
>    <name>hbase.coprocessor.master.classes</name>
>    <value>org.apache.hadoop.hbase.security.visibility.VisibilityController</value>
>   </property>
>   <property>
>    <name>hbase.coprocessor.region.classes</name>
>    <value>org.apache.hadoop.hbase.security.visibility.VisibilityController</value>
>   </property>
>   <property>
>    <name>hbase.regionserver.scan.visibility.label.generator.class</name>
>    <value>org.apache.hadoop.hbase.security.visibility.DefaultScanLabelGenerator</value>
>   </property>
> {code}



--
This message was sent by Atlassian JIRA
(v6.2#6252)