From issues-return-7049-archive-asf-public=cust-asf.ponee.io@phoenix.apache.org Fri May 24 19:02:02 2019 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by mx-eu-01.ponee.io (Postfix) with SMTP id B29B0180671 for ; Fri, 24 May 2019 21:02:01 +0200 (CEST) Received: (qmail 43809 invoked by uid 500); 24 May 2019 19:02:01 -0000 Mailing-List: contact issues-help@phoenix.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@phoenix.apache.org Delivered-To: mailing list issues@phoenix.apache.org Received: (qmail 43799 invoked by uid 99); 24 May 2019 19:02:01 -0000 Received: from mailrelay1-us-west.apache.org (HELO mailrelay1-us-west.apache.org) (209.188.14.139) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 24 May 2019 19:02:01 +0000 Received: from jira-lw-us.apache.org (unknown [207.244.88.139]) by mailrelay1-us-west.apache.org (ASF Mail Server at mailrelay1-us-west.apache.org) with ESMTP id 7BB95E2B51 for ; Fri, 24 May 2019 19:02:00 +0000 (UTC) Received: from jira-lw-us.apache.org (localhost [127.0.0.1]) by jira-lw-us.apache.org (ASF Mail Server at jira-lw-us.apache.org) with ESMTP id 38AF425814 for ; Fri, 24 May 2019 19:02:00 +0000 (UTC) Date: Fri, 24 May 2019 19:02:00 +0000 (UTC) From: "Hudson (JIRA)" To: issues@phoenix.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (PHOENIX-5269) PhoenixAccessController should use AccessChecker instead of AccessControlClient for permission checks MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/PHOENIX-5269?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16847834#comment-16847834 ] Hudson commented on PHOENIX-5269: --------------------------------- FAILURE: Integrated in Jenkins build Phoenix-4.x-HBase-1.4 #147 (See [https://builds.apache.org/job/Phoenix-4.x-HBase-1.4/147/]) PHOENIX-5269 PhoenixAccessController should use AccessChecker instead of (monani.mihir: rev f8ee79b0dca210884f3c6a441a44326240bc864c) * (add) phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionsCacheIT.java * (edit) phoenix-core/src/main/java/org/apache/phoenix/coprocessor/PhoenixAccessController.java * (edit) pom.xml > PhoenixAccessController should use AccessChecker instead of AccessControlClient for permission checks > ----------------------------------------------------------------------------------------------------- > > Key: PHOENIX-5269 > URL: https://issues.apache.org/jira/browse/PHOENIX-5269 > Project: Phoenix > Issue Type: Bug > Affects Versions: 4.14.1, 4.14.2 > Reporter: Andrew Purtell > Assignee: Kiran Kumar Maturi > Priority: Critical > Fix For: 4.15.0, 4.14.2 > > Attachments: PHOENIX-5269-4.14-HBase-1.4.patch, PHOENIX-5269-4.14-HBase-1.4.v1.patch, PHOENIX-5269-4.14-HBase-1.4.v2.patch, PHOENIX-5269.4.14-HBase-1.4.v3.patch, PHOENIX-5269.4.14-HBase-1.4.v4.patch, PHOENIX-5269.4.x-HBase-1.4.v1.patch, PHOENIX-5269.4.x-HBase-1.5.v1.patch > > > PhoenixAccessController should use AccessChecker instead of AccessControlClient for permission checks. > In HBase, every RegionServer's AccessController maintains a local cache of permissions. At startup time they are initialized from the ACL table. Whenever the ACL table is changed (via grant or revoke) the AC on the ACL table "broadcasts" the change via zookeeper, which updates the cache. This is performed and managed by TableAuthManager but is exposed as API by AccessChecker. AccessChecker is the result of a refactor that was committed as far back as branch-1.4 I believe. > Phoenix implements its own access controller and is using the client API AccessControlClient instead. AccessControlClient does not cache nor use the ZK-based cache update mechanism, because it is designed for client side use. > The use of AccessControlClient instead of AccessChecker is not scalable. Every permissions check will trigger a remote RPC to the ACL table, which is generally going to be a single region hosted on a single RegionServer. -- This message was sent by Atlassian JIRA (v7.6.3#76005)