Method Detail

• close

  public void close()

  Specified by:

  close in interface Closeable

  Specified by:

  close in interface AutoCloseable

• getZKPermissionWatcher

  public ZKPermissionWatcher getZKPermissionWatcher()

• refreshTableCacheFromWritable

  public void refreshTableCacheFromWritable(TableName table,
                                   byte[] data)
                                     throws IOException

  Throws:

  IOException

• refreshNamespaceCacheFromWritable

  public void refreshNamespaceCacheFromWritable(String namespace,
                                       byte[] data)
                                         throws IOException

  Throws:

  IOException

• authorize

  public boolean authorize(User user,
                  Permission.Action action)

  Authorize a global permission based on ACLs for the given user and the user's groups.

  Parameters:

  user -

  action -

  Returns:

  true if known and authorized, false otherwise

• authorize

  public boolean authorize(User user,
                  TableName table,
                  Cell cell,
                  Permission.Action action)

  Authorize a user for a given KV. This is called from AccessControlFilter.

• authorize

  public boolean authorize(User user,
                  String namespace,
                  Permission.Action action)

• authorizeUser

  public boolean authorizeUser(User user,
                      TableName table,
                      byte[] family,
                      Permission.Action action)

  Checks authorization to a given table and column family for a user, based on the stored user permissions.

  Parameters:

  user -

  table -

  family -

  action -

  Returns:

  true if known and authorized, false otherwise

• authorizeUser

  public boolean authorizeUser(User user,
                      TableName table,
                      byte[] family,
                      byte[] qualifier,
                      Permission.Action action)

• userHasAccess

  public boolean userHasAccess(User user,
                      TableName table,
                      Permission.Action action)

  Checks if the user has access to the full table or at least a family/qualifier for the specified action.

  Parameters:

  user -

  table -

  action -

  Returns:

  true if the user has access to the table, false otherwise

• authorizeGroup

  public boolean authorizeGroup(String groupName,
                       Permission.Action action)

  Checks global authorization for a given action for a group, based on the stored permissions.

• authorizeGroup

  public boolean authorizeGroup(String groupName,
                       TableName table,
                       byte[] family,
                       byte[] qualifier,
                       Permission.Action action)

  Checks authorization to a given table, column family and column for a group, based on the stored permissions.

  Parameters:

  groupName -

  table -

  family -

  qualifier -

  action -

  Returns:

  true if known and authorized, false otherwise

• groupHasAccess

  public boolean groupHasAccess(String groupName,
                       TableName table,
                       Permission.Action action)

  Checks if the user has access to the full table or at least a family/qualifier for the specified action.

  Parameters:

  groupName -

  table -

  action -

  Returns:

  true if the group has access to the table, false otherwise

• authorize

  public boolean authorize(User user,
                  TableName table,
                  byte[] family,
                  byte[] qualifier,
                  Permission.Action action)

• hasAccess

  public boolean hasAccess(User user,
                  TableName table,
                  Permission.Action action)

• authorize

  public boolean authorize(User user,
                  TableName table,
                  byte[] family,
                  Permission.Action action)

• matchPermission

  public boolean matchPermission(User user,
                        TableName table,
                        byte[] family,
                        Permission.Action action)

  Returns true if the given user has a TablePermission matching up to the column family portion of a permission. Note that this permission may be scoped to a given column qualifier and does not guarantee that authorize() on the same column family would return true.

• matchPermission

  public boolean matchPermission(User user,
                        TableName table,
                        byte[] family,
                        byte[] qualifier,
                        Permission.Action action)

• removeNamespace

  public void removeNamespace(byte[] ns)

• removeTable

  public void removeTable(TableName table)

• setTableUserPermissions

  public void setTableUserPermissions(String username,
                             TableName table,
                             List<TablePermission> perms)

  Overwrites the existing permission set for a given user for a table, and triggers an update for zookeeper synchronization.

  Parameters:

  username -

  table -

  perms -

• setTableGroupPermissions

  public void setTableGroupPermissions(String group,
                              TableName table,
                              List<TablePermission> perms)

  Overwrites the existing permission set for a group and triggers an update for zookeeper synchronization.

  Parameters:

  group -

  table -

  perms -

• setNamespaceUserPermissions

  public void setNamespaceUserPermissions(String username,
                                 String namespace,
                                 List<TablePermission> perms)

  Overwrites the existing permission set for a given user for a table, and triggers an update for zookeeper synchronization.

  Parameters:

  username -

  namespace -

  perms -

• setNamespaceGroupPermissions

  public void setNamespaceGroupPermissions(String group,
                                  String namespace,
                                  List<TablePermission> perms)

  Overwrites the existing permission set for a group and triggers an update for zookeeper synchronization.

  Parameters:

  group -

  namespace -

  perms -

• writeTableToZooKeeper

  public void writeTableToZooKeeper(TableName table,
                           org.apache.hadoop.hbase.security.access.TableAuthManager.PermissionCache<TablePermission> tablePerms)

• writeNamespaceToZooKeeper

  public void writeNamespaceToZooKeeper(String namespace,
                               org.apache.hadoop.hbase.security.access.TableAuthManager.PermissionCache<TablePermission> tablePerms)

• getMTime

  public long getMTime()

• getOrCreate

  public static TableAuthManager getOrCreate(ZooKeeperWatcher watcher,
                             org.apache.hadoop.conf.Configuration conf)
                                      throws IOException

  Returns a TableAuthManager from the cache. If not cached, constructs a new one. Returned instance should be released back by calling release(TableAuthManager).

  Throws:

  IOException

• getTotalRefCount

  public static int getTotalRefCount()

• release

  public static void release(TableAuthManager instance)

  Releases the resources for the given TableAuthManager if the reference count is down to 0.

  Parameters:

  instance - TableAuthManager to be released