AccessControlLists (Apache HBase 1.2.12 API)

java.lang.Object
- org.apache.hadoop.hbase.security.access.AccessControlLists

@InterfaceAudience.Private
public class AccessControlLists
extends Object

Maintains lists of permission grants to users and groups to allow for authorization checks by AccessController.

Access control lists are stored in an "internal" metadata table named _acl_. Each table's permission grants are stored as a separate row, keyed by the table name. KeyValues for permissions assignments are stored in one of the formats:

 Key                      Desc
 --------                 --------
 user                     table level permissions for a user [R=read, W=write]
 group                    table level permissions for a group
 user,family              column family level permissions for a user
 group,family             column family level permissions for a group
 user,family,qualifier    column qualifier level permissions for a user
 group,family,qualifier   column qualifier level permissions for a group

All values are encoded as byte arrays containing the codes from the org.apache.hadoop.hbase.security.access.TablePermission.Action enum.

Field Summary

Fields
Modifier and Type	Field and Description
`static byte[]`	`ACL_GLOBAL_NAME`
`static char`	`ACL_KEY_DELIMITER` Delimiter to separate user, column family, and qualifier in _acl_ table info: column keys
`static byte[]`	`ACL_LIST_FAMILY`
`static String`	`ACL_LIST_FAMILY_STR` Column family used to store ACL grants
`static TableName`	`ACL_TABLE_NAME` Internal storage table for access control lists
`static byte`	`ACL_TAG_TYPE` KV tag to store per cell access control lists
`private static org.apache.commons.logging.Log`	`LOG`
`static char`	`NAMESPACE_PREFIX`

Constructor Summary

Constructors
Constructor and Description

AccessControlLists()

Constructors
Constructor and Description
`AccessControlLists()`

Method Summary

Methods
Modifier and Type	Method and Description
`(package private) static void`	`addUserPermission(org.apache.hadoop.conf.Configuration conf, UserPermission userPerm)` Stores a new user permission grant in the access control lists table.
`(package private) static void`	`createACLTable(MasterServices master)` Create the ACL table
`static byte[]`	`fromNamespaceEntry(byte[] namespace)`
`static String`	`fromNamespaceEntry(String namespace)`
`static List<Permission>`	`getCellPermissionsForUser(User user, Cell cell)`
`(package private) static com.google.common.collect.ListMultimap<String,TablePermission>`	`getNamespacePermissions(org.apache.hadoop.conf.Configuration conf, String namespace)`
`(package private) static com.google.common.collect.ListMultimap<String,TablePermission>`	`getPermissions(org.apache.hadoop.conf.Configuration conf, byte[] entryName)` Reads user permission assignments stored in the `l:` column family of the first table row in `_acl_`.
`(package private) static com.google.common.collect.ListMultimap<String,TablePermission>`	`getTablePermissions(org.apache.hadoop.conf.Configuration conf, TableName tableName)`
`(package private) static List<UserPermission>`	`getUserNamespacePermissions(org.apache.hadoop.conf.Configuration conf, String namespace)`
`(package private) static List<UserPermission>`	`getUserPermissions(org.apache.hadoop.conf.Configuration conf, byte[] entryName)`
`(package private) static List<UserPermission>`	`getUserTablePermissions(org.apache.hadoop.conf.Configuration conf, TableName tableName)` Returns the currently granted permissions for a given table as a list of user plus associated permissions.
`(package private) static boolean`	`isAclRegion(Region region)` Returns `true` if the given region is part of the `_acl_` metadata table.
`(package private) static boolean`	`isAclTable(HTableDescriptor desc)` Returns `true` if the given table is `_acl_` metadata table.
`static boolean`	`isNamespaceEntry(byte[] entryName)`
`static boolean`	`isNamespaceEntry(String entryName)`
`(package private) static Map<byte[],com.google.common.collect.ListMultimap<String,TablePermission>>`	`loadAll(org.apache.hadoop.conf.Configuration conf)` Load all permissions from the region server holding `_acl_`, primarily intended for testing purposes.
`(package private) static Map<byte[],com.google.common.collect.ListMultimap<String,TablePermission>>`	`loadAll(Region aclRegion)` Loads all of the permission grants stored in a region of the `_acl_` table.
`private static Pair<String,TablePermission>`	`parsePermissionRecord(byte[] entryName, Cell kv)`
`private static com.google.common.collect.ListMultimap<String,TablePermission>`	`parsePermissions(byte[] entryName, Result result)`
`static com.google.common.collect.ListMultimap<String,TablePermission>`	`readPermissions(byte[] data, org.apache.hadoop.conf.Configuration conf)` Reads a set of permissions as `Writable` instances from the input stream.
`(package private) static void`	`removeNamespacePermissions(org.apache.hadoop.conf.Configuration conf, String namespace)` Remove specified namespace from the acl table.
`(package private) static void`	`removeTablePermissions(org.apache.hadoop.conf.Configuration conf, TableName tableName)` Remove specified table from the _acl_ table.
`(package private) static void`	`removeTablePermissions(org.apache.hadoop.conf.Configuration conf, TableName tableName, byte[] column)` Remove specified table column from the acl table.
`(package private) static void`	`removeUserPermission(org.apache.hadoop.conf.Configuration conf, UserPermission userPerm)` Removes a previously granted permission from the stored access control lists.
`static byte[]`	`toNamespaceEntry(byte[] namespace)`
`static String`	`toNamespaceEntry(String namespace)`
`(package private) static byte[]`	`userPermissionKey(UserPermission userPerm)` Build qualifier key from user permission: username username,family username,family,qualifier
`(package private) static byte[]`	`userPermissionRowKey(UserPermission userPerm)`
`static byte[]`	`writePermissionsAsBytes(com.google.common.collect.ListMultimap<String,TablePermission> perms, org.apache.hadoop.conf.Configuration conf)` Writes a set of permissions as `Writable` instances and returns the resulting byte array.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail
- ACL_TABLE_NAME
```
public static final TableName ACL_TABLE_NAME
```
  Internal storage table for access control lists
- ACL_GLOBAL_NAME
```
public static final byte[] ACL_GLOBAL_NAME
```
- ACL_LIST_FAMILY_STR
```
public static final String ACL_LIST_FAMILY_STR
```
  Column family used to store ACL grants
  
  See Also:
  Constant Field Values
- ACL_LIST_FAMILY
```
public static final byte[] ACL_LIST_FAMILY
```
- ACL_TAG_TYPE
```
public static final byte ACL_TAG_TYPE
```
  KV tag to store per cell access control lists
  
  See Also:
  Constant Field Values
- NAMESPACE_PREFIX
```
public static final char NAMESPACE_PREFIX
```
  See Also:
  Constant Field Values
- ACL_KEY_DELIMITER
```
public static final char ACL_KEY_DELIMITER
```
  Delimiter to separate user, column family, and qualifier in _acl_ table info: column keys
  
  See Also:
  Constant Field Values
- LOG
```
private static final org.apache.commons.logging.Log LOG
```

Constructor Detail
- AccessControlLists
```
public AccessControlLists()
```

Method Detail

createACLTable

static void createACLTable(MasterServices master)
                    throws IOException

Create the ACL table

Parameters:: master -
Throws:: IOException

addUserPermission
```
static void addUserPermission(org.apache.hadoop.conf.Configuration conf,
                     UserPermission userPerm)
                       throws IOException
```
Stores a new user permission grant in the access control lists table.

Parameters:
conf - the configuration
userPerm - the details of the permission to be granted

Throws:

IOException - in the case of an error accessing the metadata table

removeUserPermission
```
static void removeUserPermission(org.apache.hadoop.conf.Configuration conf,
                        UserPermission userPerm)
                          throws IOException
```
Removes a previously granted permission from the stored access control lists. The TablePermission being removed must exactly match what is stored -- no wildcard matching is attempted. Ie, if user "bob" has been granted "READ" access to the "data" table, but only to column family plus qualifier "info:colA", then trying to call this method with only user "bob" and the table name "data" (but without specifying the column qualifier "info:colA") will have no effect.

Parameters:
conf - the configuration
userPerm - the details of the permission to be revoked

Throws:

IOException - if there is an error accessing the metadata table

removeTablePermissions

static void removeTablePermissions(org.apache.hadoop.conf.Configuration conf,
                          TableName tableName)
                            throws IOException

Remove specified table from the _acl_ table.

Throws:: IOException

removeNamespacePermissions

static void removeNamespacePermissions(org.apache.hadoop.conf.Configuration conf,
                              String namespace)
                                throws IOException

Remove specified namespace from the acl table.

Throws:: IOException

removeTablePermissions

static void removeTablePermissions(org.apache.hadoop.conf.Configuration conf,
                          TableName tableName,
                          byte[] column)
                            throws IOException

Remove specified table column from the acl table.

Throws:: IOException

userPermissionRowKey

static byte[] userPermissionRowKey(UserPermission userPerm)

userPermissionKey
```
static byte[] userPermissionKey(UserPermission userPerm)
```
Build qualifier key from user permission: username username,family username,family,qualifier

isAclRegion
```
static boolean isAclRegion(Region region)
```
Returns true if the given region is part of the _acl_ metadata table.

isAclTable
```
static boolean isAclTable(HTableDescriptor desc)
```
Returns true if the given table is _acl_ metadata table.

loadAll

static Map<byte[],com.google.common.collect.ListMultimap<String,TablePermission>> loadAll(Region aclRegion)
                                                                                   throws IOException

Loads all of the permission grants stored in a region of the _acl_ table.

Parameters:: aclRegion -
Returns:: a map of the permissions for this table.
Throws:: IOException

loadAll

static Map<byte[],com.google.common.collect.ListMultimap<String,TablePermission>> loadAll(org.apache.hadoop.conf.Configuration conf)
                                                                                   throws IOException

Load all permissions from the region server holding _acl_, primarily intended for testing purposes.

Throws:: IOException

getTablePermissions

static com.google.common.collect.ListMultimap<String,TablePermission> getTablePermissions(org.apache.hadoop.conf.Configuration conf,
                                                                                 TableName tableName)
                                                                                   throws IOException

Throws:: IOException

getNamespacePermissions

static com.google.common.collect.ListMultimap<String,TablePermission> getNamespacePermissions(org.apache.hadoop.conf.Configuration conf,
                                                                                     String namespace)
                                                                                       throws IOException

Throws:: IOException

getPermissions

static com.google.common.collect.ListMultimap<String,TablePermission> getPermissions(org.apache.hadoop.conf.Configuration conf,
                                                                            byte[] entryName)
                                                                              throws IOException

Reads user permission assignments stored in the l: column family of the first table row in _acl_.

See class documentation for the key structure used for storage.

Throws:: IOException

getUserTablePermissions

static List<UserPermission> getUserTablePermissions(org.apache.hadoop.conf.Configuration conf,
                                           TableName tableName)
                                             throws IOException

Returns the currently granted permissions for a given table as a list of user plus associated permissions.

Throws:: IOException

getUserNamespacePermissions

static List<UserPermission> getUserNamespacePermissions(org.apache.hadoop.conf.Configuration conf,
                                               String namespace)
                                                 throws IOException

Throws:: IOException

getUserPermissions

static List<UserPermission> getUserPermissions(org.apache.hadoop.conf.Configuration conf,
                                      byte[] entryName)
                                        throws IOException

Throws:: IOException

parsePermissions

private static com.google.common.collect.ListMultimap<String,TablePermission> parsePermissions(byte[] entryName,
                                                                              Result result)

parsePermissionRecord

private static Pair<String,TablePermission> parsePermissionRecord(byte[] entryName,
                                                 Cell kv)

writePermissionsAsBytes

public static byte[] writePermissionsAsBytes(com.google.common.collect.ListMultimap<String,TablePermission> perms,
                             org.apache.hadoop.conf.Configuration conf)

Writes a set of permissions as Writable instances and returns the resulting byte array. Writes a set of permission [user: table permission]

readPermissions

public static com.google.common.collect.ListMultimap<String,TablePermission> readPermissions(byte[] data,
                                                                             org.apache.hadoop.conf.Configuration conf)
                                                                                      throws DeserializationException

Reads a set of permissions as Writable instances from the input stream.

Throws:: DeserializationException

isNamespaceEntry

public static boolean isNamespaceEntry(String entryName)

isNamespaceEntry

public static boolean isNamespaceEntry(byte[] entryName)

toNamespaceEntry

public static String toNamespaceEntry(String namespace)

fromNamespaceEntry

public static String fromNamespaceEntry(String namespace)

toNamespaceEntry

public static byte[] toNamespaceEntry(byte[] namespace)

fromNamespaceEntry

public static byte[] fromNamespaceEntry(byte[] namespace)

getCellPermissionsForUser

public static List<Permission> getCellPermissionsForUser(User user,
                                         Cell cell)
                                                  throws IOException

Throws:: IOException

Class AccessControlLists

Field Summary

Constructor Summary

Method Summary

Methods inherited from class java.lang.Object

Field Detail

ACL_TABLE_NAME

ACL_GLOBAL_NAME

ACL_LIST_FAMILY_STR

ACL_LIST_FAMILY

ACL_TAG_TYPE

NAMESPACE_PREFIX

ACL_KEY_DELIMITER

LOG

Constructor Detail

AccessControlLists

Method Detail

createACLTable

addUserPermission

removeUserPermission

removeTablePermissions

removeNamespacePermissions

removeTablePermissions

userPermissionRowKey

userPermissionKey

isAclRegion

isAclTable

loadAll

loadAll

getTablePermissions

getNamespacePermissions

getPermissions

getUserTablePermissions

getUserNamespacePermissions

getUserPermissions

parsePermissions

parsePermissionRecord

writePermissionsAsBytes

readPermissions

isNamespaceEntry

isNamespaceEntry

toNamespaceEntry

fromNamespaceEntry

toNamespaceEntry

fromNamespaceEntry

getCellPermissionsForUser