hbase-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Andrew Purtell (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (HBASE-12087) [0.98] Changing the default setting of hbase.security.access.early_out to true
Date Fri, 26 Sep 2014 20:46:34 GMT

     [ https://issues.apache.org/jira/browse/HBASE-12087?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Andrew Purtell updated HBASE-12087:
-----------------------------------
      Resolution: Fixed
    Release Note: 
Prior to 0.98.0 if a user was not granted access to a column family or partial access (qualifier
grants), then the AccessController would immediately throw back an AccessDeniedException.
This behavior was changed in 0.98.0. Instead, scanners will return result sets only including
cells for which the user has access. If the user has no permissions on any cell then the scanner
will return the empty result set. Code expecting an AccessDeniedException if the user has
no access may not function as intended.

This change introduces a configuration setting which restores the pre-0.98.0 behavior. 

If you would prefer the new behavior, this can be configured globally via site configuration
or per table using HTableDescriptor#setConfiguration. The setting is AccessControlConstants.CF_ATTRIBUTE_EARLY_OUT
("hbase.security.access.early_out"), a boolean. Set to "false" and scanners will return result
sets only including cells for which the user has access without throwing an AccessDeniedException.
    Hadoop Flags: Reviewed
          Status: Resolved  (was: Patch Available)

Pushed v2 to 0.98 

> [0.98] Changing the default setting of hbase.security.access.early_out to true
> ------------------------------------------------------------------------------
>
>                 Key: HBASE-12087
>                 URL: https://issues.apache.org/jira/browse/HBASE-12087
>             Project: HBase
>          Issue Type: Bug
>    Affects Versions: 0.98.6
>            Reporter: Srikanth Srungarapu
>            Assignee: Srikanth Srungarapu
>            Priority: Minor
>             Fix For: 0.98.7
>
>         Attachments: HBASE-12087.patch, HBASE-12087_v2.patch
>
>
> From the mailing list conversation:
> Problem:
> - 98 with default early out = false and hfile v2 will always give the
> "Permission Denied" instead of the "0 rows" that you expect since the early
> out is false
>  - 98 with default early out = false and hfile v3 will always give the "0
> rows"



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message