org.apache.hadoop.hbase.security.access

Class TableAuthManager

java.lang.Object

org.apache.hadoop.hbase.security.access.TableAuthManager

All Implemented Interfaces:

Closeable, AutoCloseable

@InterfaceAudience.Private
public class TableAuthManager
extends Object
implements Closeable

Performs authorization checks for a given user's assigned permissions

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
private static class	TableAuthManager.PermissionCache<T extends Permission>

Field Summary

Fields

Modifier and Type	Field and Description
private org.apache.hadoop.conf.Configuration	conf
private TableAuthManager.PermissionCache<Permission>	globalCache Cache of global permissions
private static org.slf4j.Logger	LOG
private static Map<ZKWatcher,TableAuthManager>	managerMap
private AtomicLong	mtime
private ConcurrentSkipListMap<String,TableAuthManager.PermissionCache<TablePermission>>	nsCache
private static Map<TableAuthManager,Integer>	refCount
private ConcurrentSkipListMap<TableName,TableAuthManager.PermissionCache<TablePermission>>	tableCache
private ZKPermissionWatcher	zkperms

Constructor Summary

Constructors

Modifier	Constructor and Description
private	TableAuthManager(ZKWatcher watcher, org.apache.hadoop.conf.Configuration conf)

Method Summary

Modifier and Type	Method and Description
private boolean	authorize(List<Permission> perms, Permission.Action action) Authorizes a global permission
private boolean	authorize(List<TablePermission> perms, String namespace, Permission.Action action)
private boolean	authorize(List<TablePermission> perms, TableName table, byte[] family, byte[] qualifier, Permission.Action action)
boolean	authorize(User user, Permission.Action action) Authorize a global permission based on ACLs for the given user and the user's groups.
boolean	authorize(User user, String namespace, Permission.Action action)
boolean	authorize(User user, TableName table, byte[] family, byte[] qualifier, Permission.Action action)
boolean	authorize(User user, TableName table, byte[] family, Permission.Action action)
boolean	authorize(User user, TableName table, Cell cell, Permission.Action action) Authorize a user for a given KV.
boolean	authorizeGroup(String groupName, Permission.Action action) Checks global authorization for a given action for a group, based on the stored permissions.
boolean	authorizeGroup(String groupName, TableName table, byte[] family, byte[] qualifier, Permission.Action action) Checks authorization to a given table, column family and column for a group, based on the stored permissions.
boolean	authorizeUser(User user, TableName table, byte[] family, byte[] qualifier, Permission.Action action)
boolean	authorizeUser(User user, TableName table, byte[] family, Permission.Action action) Checks authorization to a given table and column family for a user, based on the stored user permissions.
void	close()
long	getMTime()
private TableAuthManager.PermissionCache<TablePermission>	getNamespacePermissions(String namespace)
static TableAuthManager	getOrCreate(ZKWatcher watcher, org.apache.hadoop.conf.Configuration conf) Returns a TableAuthManager from the cache.
private TableAuthManager.PermissionCache<TablePermission>	getTablePermissions(TableName table)
static int	getTotalRefCount()
ZKPermissionWatcher	getZKPermissionWatcher()
boolean	groupHasAccess(String groupName, TableName table, Permission.Action action) Checks if the user has access to the full table or at least a family/qualifier for the specified action.
private boolean	hasAccess(List<TablePermission> perms, TableName table, Permission.Action action)
boolean	hasAccess(User user, TableName table, Permission.Action action)
private TableAuthManager.PermissionCache<Permission>	initGlobal(org.apache.hadoop.conf.Configuration conf) Returns a new PermissionCache initialized with permission assignments from the hbase.superuser configuration key.
boolean	matchPermission(User user, TableName table, byte[] family, byte[] qualifier, Permission.Action action)
boolean	matchPermission(User user, TableName table, byte[] family, Permission.Action action) Returns true if the given user has a TablePermission matching up to the column family portion of a permission.
void	refreshNamespaceCacheFromWritable(String namespace, byte[] data)
void	refreshTableCacheFromWritable(TableName table, byte[] data)
static void	release(TableAuthManager instance) Releases the resources for the given TableAuthManager if the reference count is down to 0.
void	removeNamespace(byte[] ns)
void	removeTable(TableName table)
void	setNamespaceGroupPermissions(String group, String namespace, List<TablePermission> perms) Overwrites the existing permission set for a group and triggers an update for zookeeper synchronization.
void	setNamespaceUserPermissions(String username, String namespace, List<TablePermission> perms) Overwrites the existing permission set for a given user for a table, and triggers an update for zookeeper synchronization.
void	setTableGroupPermissions(String group, TableName table, List<TablePermission> perms) Overwrites the existing permission set for a group and triggers an update for zookeeper synchronization.
void	setTableUserPermissions(String username, TableName table, List<TablePermission> perms) Overwrites the existing permission set for a given user for a table, and triggers an update for zookeeper synchronization.
private void	updateGlobalCache(org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,TablePermission> userPerms) Updates the internal global permissions cache
private void	updateNsCache(String namespace, org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,TablePermission> tablePerms) Updates the internal permissions cache for a single table, splitting the permissions listed into separate caches for users and groups to optimize group lookups.
private void	updateTableCache(TableName table, org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,TablePermission> tablePerms) Updates the internal permissions cache for a single table, splitting the permissions listed into separate caches for users and groups to optimize group lookups.
boolean	userHasAccess(User user, TableName table, Permission.Action action) Checks if the user has access to the full table or at least a family/qualifier for the specified action.
void	writeNamespaceToZooKeeper(String namespace, TableAuthManager.PermissionCache<TablePermission> tablePerms)
void	writeTableToZooKeeper(TableName table, TableAuthManager.PermissionCache<TablePermission> tablePerms)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOG

private static final org.slf4j.Logger LOG

globalCache

private volatile TableAuthManager.PermissionCache<Permission> globalCache

Cache of global permissions

tableCache

private ConcurrentSkipListMap<TableName,TableAuthManager.PermissionCache<TablePermission>> tableCache

nsCache

private ConcurrentSkipListMap<String,TableAuthManager.PermissionCache<TablePermission>> nsCache

conf

private org.apache.hadoop.conf.Configuration conf

zkperms

private ZKPermissionWatcher zkperms

mtime

private final AtomicLong mtime

managerMap

private static Map<ZKWatcher,TableAuthManager> managerMap

refCount

private static Map<TableAuthManager,Integer> refCount

Constructor Detail

TableAuthManager

private TableAuthManager(ZKWatcher watcher,
                         org.apache.hadoop.conf.Configuration conf)
                  throws IOException

Throws:

IOException

Method Detail

close

public void close()

Specified by:

close in interface Closeable

Specified by:

close in interface AutoCloseable

initGlobal

private TableAuthManager.PermissionCache<Permission> initGlobal(org.apache.hadoop.conf.Configuration conf)
                                                         throws IOException

Returns a new PermissionCache initialized with permission assignments from the hbase.superuser configuration key.

Throws:

IOException

getZKPermissionWatcher

public ZKPermissionWatcher getZKPermissionWatcher()

refreshTableCacheFromWritable

public void refreshTableCacheFromWritable(TableName table,
                                          byte[] data)
                                   throws IOException

Throws:

IOException

refreshNamespaceCacheFromWritable

public void refreshNamespaceCacheFromWritable(String namespace,
                                              byte[] data)
                                       throws IOException

Throws:

IOException

updateGlobalCache

private void updateGlobalCache(org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,TablePermission> userPerms)

Updates the internal global permissions cache

Parameters:

userPerms -

updateTableCache

private void updateTableCache(TableName table,
                              org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,TablePermission> tablePerms)

Updates the internal permissions cache for a single table, splitting the permissions listed into separate caches for users and groups to optimize group lookups.

Parameters:

table -

tablePerms -

updateNsCache

private void updateNsCache(String namespace,
                           org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,TablePermission> tablePerms)

Updates the internal permissions cache for a single table, splitting the permissions listed into separate caches for users and groups to optimize group lookups.

Parameters:

namespace -

tablePerms -

getTablePermissions

private TableAuthManager.PermissionCache<TablePermission> getTablePermissions(TableName table)

getNamespacePermissions

private TableAuthManager.PermissionCache<TablePermission> getNamespacePermissions(String namespace)

authorize

private boolean authorize(List<Permission> perms,
                          Permission.Action action)

Authorizes a global permission

Parameters:

perms -

action -

Returns:

true if authorized, false otherwise

authorize

public boolean authorize(User user,
                         Permission.Action action)

Authorize a global permission based on ACLs for the given user and the user's groups.

Parameters:

user -

action -

Returns:

true if known and authorized, false otherwise

authorize

private boolean authorize(List<TablePermission> perms,
                          TableName table,
                          byte[] family,
                          byte[] qualifier,
                          Permission.Action action)

hasAccess

private boolean hasAccess(List<TablePermission> perms,
                          TableName table,
                          Permission.Action action)

authorize

public boolean authorize(User user,
                         TableName table,
                         Cell cell,
                         Permission.Action action)

Authorize a user for a given KV. This is called from AccessControlFilter.

authorize

public boolean authorize(User user,
                         String namespace,
                         Permission.Action action)

authorize

private boolean authorize(List<TablePermission> perms,
                          String namespace,
                          Permission.Action action)

authorizeUser

public boolean authorizeUser(User user,
                             TableName table,
                             byte[] family,
                             Permission.Action action)

Checks authorization to a given table and column family for a user, based on the stored user permissions.

Parameters:

user -

table -

family -

action -

Returns:

true if known and authorized, false otherwise

authorizeUser

public boolean authorizeUser(User user,
                             TableName table,
                             byte[] family,
                             byte[] qualifier,
                             Permission.Action action)

userHasAccess

public boolean userHasAccess(User user,
                             TableName table,
                             Permission.Action action)

Checks if the user has access to the full table or at least a family/qualifier for the specified action.

Parameters:

user -

table -

action -

Returns:

true if the user has access to the table, false otherwise

authorizeGroup

public boolean authorizeGroup(String groupName,
                              Permission.Action action)

Checks global authorization for a given action for a group, based on the stored permissions.

authorizeGroup

public boolean authorizeGroup(String groupName,
                              TableName table,
                              byte[] family,
                              byte[] qualifier,
                              Permission.Action action)

Checks authorization to a given table, column family and column for a group, based on the stored permissions.

Parameters:

groupName -

table -

family -

qualifier -

action -

Returns:

true if known and authorized, false otherwise

groupHasAccess

public boolean groupHasAccess(String groupName,
                              TableName table,
                              Permission.Action action)

Checks if the user has access to the full table or at least a family/qualifier for the specified action.

Parameters:

groupName -

table -

action -

Returns:

true if the group has access to the table, false otherwise

authorize

public boolean authorize(User user,
                         TableName table,
                         byte[] family,
                         byte[] qualifier,
                         Permission.Action action)

hasAccess

public boolean hasAccess(User user,
                         TableName table,
                         Permission.Action action)

authorize

public boolean authorize(User user,
                         TableName table,
                         byte[] family,
                         Permission.Action action)

matchPermission

public boolean matchPermission(User user,
                               TableName table,
                               byte[] family,
                               Permission.Action action)

Returns true if the given user has a TablePermission matching up to the column family portion of a permission. Note that this permission may be scoped to a given column qualifier and does not guarantee that authorize() on the same column family would return true.

matchPermission

public boolean matchPermission(User user,
                               TableName table,
                               byte[] family,
                               byte[] qualifier,
                               Permission.Action action)

removeNamespace

public void removeNamespace(byte[] ns)

removeTable

public void removeTable(TableName table)

setTableUserPermissions

public void setTableUserPermissions(String username,
                                    TableName table,
                                    List<TablePermission> perms)

Overwrites the existing permission set for a given user for a table, and triggers an update for zookeeper synchronization.

Parameters:

username -

table -

perms -

setTableGroupPermissions

public void setTableGroupPermissions(String group,
                                     TableName table,
                                     List<TablePermission> perms)

Overwrites the existing permission set for a group and triggers an update for zookeeper synchronization.

Parameters:

group -

table -

perms -

setNamespaceUserPermissions

public void setNamespaceUserPermissions(String username,
                                        String namespace,
                                        List<TablePermission> perms)

Overwrites the existing permission set for a given user for a table, and triggers an update for zookeeper synchronization.

Parameters:

username -

namespace -

perms -

setNamespaceGroupPermissions

public void setNamespaceGroupPermissions(String group,
                                         String namespace,
                                         List<TablePermission> perms)

Overwrites the existing permission set for a group and triggers an update for zookeeper synchronization.

Parameters:

group -

namespace -

perms -

writeTableToZooKeeper

public void writeTableToZooKeeper(TableName table,
                                  TableAuthManager.PermissionCache<TablePermission> tablePerms)

writeNamespaceToZooKeeper

public void writeNamespaceToZooKeeper(String namespace,
                                      TableAuthManager.PermissionCache<TablePermission> tablePerms)

getMTime

public long getMTime()

getOrCreate

public static TableAuthManager getOrCreate(ZKWatcher watcher,
                                           org.apache.hadoop.conf.Configuration conf)
                                    throws IOException

Returns a TableAuthManager from the cache. If not cached, constructs a new one. Returned instance should be released back by calling release(TableAuthManager).

Throws:

IOException

getTotalRefCount

public static int getTotalRefCount()

release

public static void release(TableAuthManager instance)

Releases the resources for the given TableAuthManager if the reference count is down to 0.

Parameters:

instance - TableAuthManager to be released