Field Detail

• LOG

  private static final org.apache.commons.logging.Log LOG

• instance

  private static TableAuthManager instance

• globalCache

  private volatile TableAuthManager.PermissionCache<Permission> globalCache

  Cache of global permissions

• tableCache

  private ConcurrentSkipListMap<TableName,TableAuthManager.PermissionCache<TablePermission>> tableCache

• nsCache

  private ConcurrentSkipListMap<String,TableAuthManager.PermissionCache<TablePermission>> nsCache

• conf

  private org.apache.hadoop.conf.Configuration conf

• zkperms

  private ZKPermissionWatcher zkperms

• mtime

  private AtomicLong mtime

• managerMap

  static Map<ZooKeeperWatcher,TableAuthManager> managerMap

Constructor Detail

• TableAuthManager

  private TableAuthManager(ZooKeeperWatcher watcher,
                  org.apache.hadoop.conf.Configuration conf)
                    throws IOException

  Throws:

  IOException

Method Detail

• initGlobal

  private TableAuthManager.PermissionCache<Permission> initGlobal(org.apache.hadoop.conf.Configuration conf)
                                                           throws IOException

  Returns a new PermissionCache initialized with permission assignments from the hbase.superuser configuration key.

  Throws:

  IOException

• getZKPermissionWatcher

  public ZKPermissionWatcher getZKPermissionWatcher()

• refreshTableCacheFromWritable

  public void refreshTableCacheFromWritable(TableName table,
                                   byte[] data)
                                     throws IOException

  Throws:

  IOException

• refreshNamespaceCacheFromWritable

  public void refreshNamespaceCacheFromWritable(String namespace,
                                       byte[] data)
                                         throws IOException

  Throws:

  IOException

• updateGlobalCache

  private void updateGlobalCache(com.google.common.collect.ListMultimap<String,TablePermission> userPerms)

  Updates the internal global permissions cache

  Parameters:

  userPerms -

• updateTableCache

  private void updateTableCache(TableName table,
                      com.google.common.collect.ListMultimap<String,TablePermission> tablePerms)

  Updates the internal permissions cache for a single table, splitting the permissions listed into separate caches for users and groups to optimize group lookups.

  Parameters:

  table -

  tablePerms -

• updateNsCache

  private void updateNsCache(String namespace,
                   com.google.common.collect.ListMultimap<String,TablePermission> tablePerms)

  Updates the internal permissions cache for a single table, splitting the permissions listed into separate caches for users and groups to optimize group lookups.

  Parameters:

  namespace -

  tablePerms -

• getTablePermissions

  private TableAuthManager.PermissionCache<TablePermission> getTablePermissions(TableName table)

• getNamespacePermissions

  private TableAuthManager.PermissionCache<TablePermission> getNamespacePermissions(String namespace)

• authorize

  private boolean authorize(List<Permission> perms,
                  Permission.Action action)

  Authorizes a global permission

  Parameters:

  perms -

  action -

  Returns:

  true if authorized, false otherwise

• authorize

  public boolean authorize(User user,
                  Permission.Action action)

  Authorize a global permission based on ACLs for the given user and the user's groups.

  Parameters:

  user -

  action -

  Returns:

  true if known and authorized, false otherwise

• authorize

  private boolean authorize(List<TablePermission> perms,
                  TableName table,
                  byte[] family,
                  byte[] qualifier,
                  Permission.Action action)

• hasAccess

  private boolean hasAccess(List<TablePermission> perms,
                  TableName table,
                  Permission.Action action)

• authorize

  public boolean authorize(User user,
                  TableName table,
                  Cell cell,
                  Permission.Action action)

  Authorize a user for a given KV. This is called from AccessControlFilter.

• authorize

  public boolean authorize(User user,
                  String namespace,
                  Permission.Action action)

• authorize

  private boolean authorize(List<TablePermission> perms,
                  String namespace,
                  Permission.Action action)

• authorizeUser

  public boolean authorizeUser(User user,
                      TableName table,
                      byte[] family,
                      Permission.Action action)

  Checks authorization to a given table and column family for a user, based on the stored user permissions.

  Parameters:

  user -

  table -

  family -

  action -

  Returns:

  true if known and authorized, false otherwise

• authorizeUser

  public boolean authorizeUser(User user,
                      TableName table,
                      byte[] family,
                      byte[] qualifier,
                      Permission.Action action)

• userHasAccess

  public boolean userHasAccess(User user,
                      TableName table,
                      Permission.Action action)

  Checks if the user has access to the full table or at least a family/qualifier for the specified action.

  Parameters:

  user -

  table -

  action -

  Returns:

  true if the user has access to the table, false otherwise

• authorizeGroup

  public boolean authorizeGroup(String groupName,
                       Permission.Action action)

  Checks global authorization for a given action for a group, based on the stored permissions.

• authorizeGroup

  public boolean authorizeGroup(String groupName,
                       TableName table,
                       byte[] family,
                       byte[] qualifier,
                       Permission.Action action)

  Checks authorization to a given table, column family and column for a group, based on the stored permissions.

  Parameters:

  groupName -

  table -

  family -

  qualifier -

  action -

  Returns:

  true if known and authorized, false otherwise

• groupHasAccess

  public boolean groupHasAccess(String groupName,
                       TableName table,
                       Permission.Action action)

  Checks if the user has access to the full table or at least a family/qualifier for the specified action.

  Parameters:

  groupName -

  table -

  action -

  Returns:

  true if the group has access to the table, false otherwise

• authorize

  public boolean authorize(User user,
                  TableName table,
                  byte[] family,
                  byte[] qualifier,
                  Permission.Action action)

• hasAccess

  public boolean hasAccess(User user,
                  TableName table,
                  Permission.Action action)

• authorize

  public boolean authorize(User user,
                  TableName table,
                  byte[] family,
                  Permission.Action action)

• matchPermission

  public boolean matchPermission(User user,
                        TableName table,
                        byte[] family,
                        Permission.Action action)

  Returns true if the given user has a TablePermission matching up to the column family portion of a permission. Note that this permission may be scoped to a given column qualifier and does not guarantee that authorize() on the same column family would return true.

• matchPermission

  public boolean matchPermission(User user,
                        TableName table,
                        byte[] family,
                        byte[] qualifier,
                        Permission.Action action)

• removeNamespace

  public void removeNamespace(byte[] ns)

• removeTable

  public void removeTable(TableName table)

• setTableUserPermissions

  public void setTableUserPermissions(String username,
                             TableName table,
                             List<TablePermission> perms)

  Overwrites the existing permission set for a given user for a table, and triggers an update for zookeeper synchronization.

  Parameters:

  username -

  table -

  perms -

• setTableGroupPermissions

  public void setTableGroupPermissions(String group,
                              TableName table,
                              List<TablePermission> perms)

  Overwrites the existing permission set for a group and triggers an update for zookeeper synchronization.

  Parameters:

  group -

  table -

  perms -

• setNamespaceUserPermissions

  public void setNamespaceUserPermissions(String username,
                                 String namespace,
                                 List<TablePermission> perms)

  Overwrites the existing permission set for a given user for a table, and triggers an update for zookeeper synchronization.

  Parameters:

  username -

  namespace -

  perms -

• setNamespaceGroupPermissions

  public void setNamespaceGroupPermissions(String group,
                                  String namespace,
                                  List<TablePermission> perms)

  Overwrites the existing permission set for a group and triggers an update for zookeeper synchronization.

  Parameters:

  group -

  namespace -

  perms -

• writeTableToZooKeeper

  public void writeTableToZooKeeper(TableName table,
                           TableAuthManager.PermissionCache<TablePermission> tablePerms)

• writeNamespaceToZooKeeper

  public void writeNamespaceToZooKeeper(String namespace,
                               TableAuthManager.PermissionCache<TablePermission> tablePerms)

• getMTime

  public long getMTime()

• get

  public static TableAuthManager get(ZooKeeperWatcher watcher,
                     org.apache.hadoop.conf.Configuration conf)
                              throws IOException

  Throws:

  IOException