Return-Path: X-Original-To: apmail-hbase-issues-archive@www.apache.org Delivered-To: apmail-hbase-issues-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id A3399173CC for ; Sat, 28 Mar 2015 03:30:53 +0000 (UTC) Received: (qmail 83747 invoked by uid 500); 28 Mar 2015 03:30:53 -0000 Delivered-To: apmail-hbase-issues-archive@hbase.apache.org Received: (qmail 83695 invoked by uid 500); 28 Mar 2015 03:30:53 -0000 Mailing-List: contact issues-help@hbase.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list issues@hbase.apache.org Received: (qmail 83680 invoked by uid 99); 28 Mar 2015 03:30:53 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 28 Mar 2015 03:30:53 +0000 Date: Sat, 28 Mar 2015 03:30:53 +0000 (UTC) From: "Jerry He (JIRA)" To: issues@hbase.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (HBASE-13275) Setting hbase.security.authorization to false does not disable authorization MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/HBASE-13275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14385090#comment-14385090 ] Jerry He commented on HBASE-13275: ---------------------------------- The reasoning and arguments are good. Looked through the latest patch (not thorough review). In the VisibilityController, should these be unconditional too? {noformat} @Override public void preModifyTable(ObserverContext ctx, TableName tableName, HTableDescriptor htd) throws IOException { + if (!authorizationEnabled) { + return; + } if (LABELS_TABLE_NAME.equals(tableName)) { throw new ConstraintException("Cannot alter " + LABELS_TABLE_NAME); } @@ -208,6 +221,9 @@ public class VisibilityController extends BaseMasterAndRegionObserver implements @Override public void preAddColumn(ObserverContext ctx, TableName tableName, HColumnDescriptor column) throws IOException { + if (!authorizationEnabled) { + return; + } if (LABELS_TABLE_NAME.equals(tableName)) { throw new ConstraintException("Cannot alter " + LABELS_TABLE_NAME); } @@ -216,6 +232,9 @@ public class VisibilityController extends BaseMasterAndRegionObserver implements @Override public void preModifyColumn(ObserverContext ctx, TableName tableName, HColumnDescriptor descriptor) throws IOException { + if (!authorizationEnabled) { + return; + } if (LABELS_TABLE_NAME.equals(tableName)) { throw new ConstraintException("Cannot alter " + LABELS_TABLE_NAME); } @@ -224,6 +243,9 @@ public class VisibilityController extends BaseMasterAndRegionObserver implements @Override public void preDeleteColumn(ObserverContext ctx, TableName tableName, byte[] c) throws IOException { + if (!authorizationEnabled) { + return; + } if (LABELS_TABLE_NAME.equals(tableName)) { throw new ConstraintException("Cannot alter " + LABELS_TABLE_NAME); } @@ -232,6 +254,9 @@ public class VisibilityController extends BaseMasterAndRegionObserver implements @Override public void preDisableTable(ObserverContext ctx, TableName tableName) throws IOException { + if (!authorizationEnabled) { + return; + } if (LABELS_TABLE_NAME.equals(tableName)) { throw new ConstraintException("Cannot disable " + LABELS_TABLE_NAME); } {noformat} > Setting hbase.security.authorization to false does not disable authorization > ---------------------------------------------------------------------------- > > Key: HBASE-13275 > URL: https://issues.apache.org/jira/browse/HBASE-13275 > Project: HBase > Issue Type: Bug > Reporter: William Watson > Assignee: Andrew Purtell > Fix For: 2.0.0, 1.0.1, 1.1.0, 0.98.13 > > Attachments: HBASE-13275.patch, HBASE-13275.patch > > > According to the docs provided by Cloudera (we're not running Cloudera, BTW), this is the list of configs to enable authorization in HBase: > {code} > > hbase.security.authorization > true > > > hbase.coprocessor.master.classes > org.apache.hadoop.hbase.security.access.AccessController > > > hbase.coprocessor.region.classes > org.apache.hadoop.hbase.security.token.TokenProvider,org.apache.hadoop.hbase.security.access.AccessController > > {code} > We wanted to then disable authorization but simply setting hbase.security.authorization to false did not disable the authorization -- This message was sent by Atlassian JIRA (v6.3.4#6332)