Mailing-List: contact issues-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Date: Mon, 24 Jul 2017 04:53:02 +0000 (UTC)
From: "Anoop Sam John (JIRA)" <jira@apache.org>
To: issues@hbase.apache.org
Message-ID: <JIRA.13089311.1500818235000.312597.1500871982227@Atlassian.JIRA>
In-Reply-To: <JIRA.13089311.1500818235000@Atlassian.JIRA>
References: <JIRA.13089311.1500818235000@Atlassian.JIRA> <JIRA.13089311.1500818235293@jira-lw-us.apache.org>
Subject: [jira] [Commented] (HBASE-18437) Revoke access permissions of a
 user from a table does not work as expected
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Mon, 24 Jul 2017 04:53:10 -0000


    [ https://issues.apache.org/jira/browse/HBASE-18437?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16097942#comment-16097942 ] 

Anoop Sam John commented on HBASE-18437:
----------------------------------------

Seems like the Actions passed in the revoke API is not at all considered in server side. Its been PBed to server.  There just creating a Delete and that will end up deleting the table's user permission cells.  Here as passing only one action, it is supposed to upsert a new cell (RK : TableName, CF : fixedCF, Qualifier :User) with remaining permission(s)

> Revoke access permissions of a user from a table does not work as expected
> --------------------------------------------------------------------------
>
>                 Key: HBASE-18437
>                 URL: https://issues.apache.org/jira/browse/HBASE-18437
>             Project: HBase
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 1.1.12
>            Reporter: Ashish Singhi
>            Assignee: Ashish Singhi
>
> A table for which a user was granted 'RW' permission. Now when we want to revoke its 'W' permission only, code removes the user itself from that table permissions.
> Below is the test code which reproduces the issue.
> {noformat}
> @Test(timeout = 180000)
>   public void testRevokeOnlySomePerms() throws Throwable {
>     TableName name = TableName.valueOf("testAgain");
>     HTableDescriptor htd = new HTableDescriptor(name);
>     HColumnDescriptor hcd = new HColumnDescriptor("cf");
>     htd.addFamily(hcd);
>     createTable(TEST_UTIL, htd);
>     TEST_UTIL.waitUntilAllRegionsAssigned(name);
>     try (Connection conn = ConnectionFactory.createConnection(conf)) {
>       AccessControlClient.grant(conn, name, USER_RO.getShortName(), null, null, Action.READ, Action.WRITE);
>       ListMultimap<String, TablePermission> tablePermissions = AccessControlLists.getTablePermissions(conf, name);
>       // hbase user and USER_RO has permis
>       assertEquals(2, tablePermissions.size());
>       AccessControlClient.revoke(conn, name, USER_RO.getShortName(), null, null, Action.WRITE);
>       tablePermissions = AccessControlLists.getTablePermissions(conf, name);
>       List<TablePermission> userPerm = tablePermissions.get(USER_RO.getShortName());
>       assertEquals(1, userPerm.size());
>     } finally {
>       deleteTable(TEST_UTIL, name);
>     }
>   }
> {noformat}


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)