001/* 002 * Licensed to the Apache Software Foundation (ASF) under one 003 * or more contributor license agreements. See the NOTICE file 004 * distributed with this work for additional information 005 * regarding copyright ownership. The ASF licenses this file 006 * to you under the Apache License, Version 2.0 (the 007 * "License"); you may not use this file except in compliance 008 * with the License. You may obtain a copy of the License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, software 013 * distributed under the License is distributed on an "AS IS" BASIS, 014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 015 * See the License for the specific language governing permissions and 016 * limitations under the License. 017 */ 018package org.apache.hadoop.hbase.security.access; 019 020import com.google.protobuf.ByteString; 021import com.google.protobuf.RpcController; 022import com.google.protobuf.ServiceException; 023import java.util.ArrayList; 024import java.util.Collection; 025import java.util.List; 026import java.util.Map; 027import org.apache.commons.lang3.StringUtils; 028import org.apache.hadoop.hbase.HConstants; 029import org.apache.hadoop.hbase.TableName; 030import org.apache.hadoop.hbase.client.Admin; 031import org.apache.hadoop.hbase.protobuf.ProtobufUtil; 032import org.apache.hadoop.hbase.protobuf.generated.AccessControlProtos; 033import org.apache.hadoop.hbase.protobuf.generated.AccessControlProtos.AccessControlService; 034import org.apache.hadoop.hbase.protobuf.generated.AccessControlProtos.GetUserPermissionsResponse; 035import org.apache.hadoop.hbase.util.ByteStringer; 036import org.apache.hadoop.hbase.util.Bytes; 037import org.apache.yetus.audience.InterfaceAudience; 038 039import org.apache.hbase.thirdparty.com.google.common.collect.ArrayListMultimap; 040import org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap; 041import org.apache.hbase.thirdparty.com.google.common.collect.Lists; 042 043@InterfaceAudience.Private 044public class AccessControlUtil { 045 private AccessControlUtil() { 046 } 047 048 /** 049 * Create a request to grant user table permissions. 050 * @param username the short user name who to grant permissions 051 * @param tableName optional table name the permissions apply 052 * @param family optional column family 053 * @param qualifier optional qualifier 054 * @param actions the permissions to be granted 055 * @return A {@link AccessControlProtos} GrantRequest 056 */ 057 public static AccessControlProtos.GrantRequest buildGrantRequest(String username, 058 TableName tableName, byte[] family, byte[] qualifier, boolean mergeExistingPermissions, 059 AccessControlProtos.Permission.Action... actions) { 060 AccessControlProtos.Permission.Builder ret = AccessControlProtos.Permission.newBuilder(); 061 AccessControlProtos.TablePermission.Builder permissionBuilder = 062 AccessControlProtos.TablePermission.newBuilder(); 063 for (AccessControlProtos.Permission.Action a : actions) { 064 permissionBuilder.addAction(a); 065 } 066 if (tableName == null) { 067 throw new NullPointerException("TableName cannot be null"); 068 } 069 permissionBuilder.setTableName(ProtobufUtil.toProtoTableName(tableName)); 070 071 if (family != null) { 072 permissionBuilder.setFamily(ByteStringer.wrap(family)); 073 } 074 if (qualifier != null) { 075 permissionBuilder.setQualifier(ByteStringer.wrap(qualifier)); 076 } 077 ret.setType(AccessControlProtos.Permission.Type.Table).setTablePermission(permissionBuilder); 078 return AccessControlProtos.GrantRequest.newBuilder() 079 .setUserPermission(AccessControlProtos.UserPermission.newBuilder() 080 .setUser(ByteString.copyFromUtf8(username)).setPermission(ret)) 081 .setMergeExistingPermissions(mergeExistingPermissions).build(); 082 } 083 084 /** 085 * Create a request to grant user namespace permissions. 086 * @param username the short user name who to grant permissions 087 * @param namespace optional table name the permissions apply 088 * @param actions the permissions to be granted 089 * @return A {@link AccessControlProtos} GrantRequest 090 */ 091 public static AccessControlProtos.GrantRequest buildGrantRequest(String username, 092 String namespace, boolean mergeExistingPermissions, 093 AccessControlProtos.Permission.Action... actions) { 094 AccessControlProtos.Permission.Builder ret = AccessControlProtos.Permission.newBuilder(); 095 AccessControlProtos.NamespacePermission.Builder permissionBuilder = 096 AccessControlProtos.NamespacePermission.newBuilder(); 097 for (AccessControlProtos.Permission.Action a : actions) { 098 permissionBuilder.addAction(a); 099 } 100 if (namespace != null) { 101 permissionBuilder.setNamespaceName(ByteString.copyFromUtf8(namespace)); 102 } 103 ret.setType(AccessControlProtos.Permission.Type.Namespace) 104 .setNamespacePermission(permissionBuilder); 105 return AccessControlProtos.GrantRequest.newBuilder() 106 .setUserPermission(AccessControlProtos.UserPermission.newBuilder() 107 .setUser(ByteString.copyFromUtf8(username)).setPermission(ret)) 108 .setMergeExistingPermissions(mergeExistingPermissions).build(); 109 } 110 111 /** 112 * Create a request to revoke user global permissions. 113 * @param username the short user name whose permissions to be revoked 114 * @param actions the permissions to be revoked 115 * @return A {@link AccessControlProtos} RevokeRequest 116 */ 117 public static AccessControlProtos.RevokeRequest buildRevokeRequest(String username, 118 AccessControlProtos.Permission.Action... actions) { 119 AccessControlProtos.Permission.Builder ret = AccessControlProtos.Permission.newBuilder(); 120 AccessControlProtos.GlobalPermission.Builder permissionBuilder = 121 AccessControlProtos.GlobalPermission.newBuilder(); 122 for (AccessControlProtos.Permission.Action a : actions) { 123 permissionBuilder.addAction(a); 124 } 125 ret.setType(AccessControlProtos.Permission.Type.Global).setGlobalPermission(permissionBuilder); 126 return AccessControlProtos.RevokeRequest.newBuilder() 127 .setUserPermission(AccessControlProtos.UserPermission.newBuilder() 128 .setUser(ByteString.copyFromUtf8(username)).setPermission(ret)) 129 .build(); 130 } 131 132 /** 133 * Create a request to revoke user namespace permissions. 134 * @param username the short user name whose permissions to be revoked 135 * @param namespace optional table name the permissions apply 136 * @param actions the permissions to be revoked 137 * @return A {@link AccessControlProtos} RevokeRequest 138 */ 139 public static AccessControlProtos.RevokeRequest buildRevokeRequest(String username, 140 String namespace, AccessControlProtos.Permission.Action... actions) { 141 AccessControlProtos.Permission.Builder ret = AccessControlProtos.Permission.newBuilder(); 142 AccessControlProtos.NamespacePermission.Builder permissionBuilder = 143 AccessControlProtos.NamespacePermission.newBuilder(); 144 for (AccessControlProtos.Permission.Action a : actions) { 145 permissionBuilder.addAction(a); 146 } 147 if (namespace != null) { 148 permissionBuilder.setNamespaceName(ByteString.copyFromUtf8(namespace)); 149 } 150 ret.setType(AccessControlProtos.Permission.Type.Namespace) 151 .setNamespacePermission(permissionBuilder); 152 return AccessControlProtos.RevokeRequest.newBuilder() 153 .setUserPermission(AccessControlProtos.UserPermission.newBuilder() 154 .setUser(ByteString.copyFromUtf8(username)).setPermission(ret)) 155 .build(); 156 } 157 158 /** 159 * Create a request to grant user global permissions. 160 * @param username the short user name who to grant permissions 161 * @param actions the permissions to be granted 162 * @return A {@link AccessControlProtos} GrantRequest 163 */ 164 public static AccessControlProtos.GrantRequest buildGrantRequest(String username, 165 boolean mergeExistingPermissions, AccessControlProtos.Permission.Action... actions) { 166 AccessControlProtos.Permission.Builder ret = AccessControlProtos.Permission.newBuilder(); 167 AccessControlProtos.GlobalPermission.Builder permissionBuilder = 168 AccessControlProtos.GlobalPermission.newBuilder(); 169 for (AccessControlProtos.Permission.Action a : actions) { 170 permissionBuilder.addAction(a); 171 } 172 ret.setType(AccessControlProtos.Permission.Type.Global).setGlobalPermission(permissionBuilder); 173 return AccessControlProtos.GrantRequest.newBuilder() 174 .setUserPermission(AccessControlProtos.UserPermission.newBuilder() 175 .setUser(ByteString.copyFromUtf8(username)).setPermission(ret)) 176 .setMergeExistingPermissions(mergeExistingPermissions).build(); 177 } 178 179 public static AccessControlProtos.UsersAndPermissions toUsersAndPermissions(String user, 180 Permission perms) { 181 return AccessControlProtos.UsersAndPermissions.newBuilder() 182 .addUserPermissions(AccessControlProtos.UsersAndPermissions.UserPermissions.newBuilder() 183 .setUser(ByteString.copyFromUtf8(user)).addPermissions(toPermission(perms)).build()) 184 .build(); 185 } 186 187 public static AccessControlProtos.UsersAndPermissions 188 toUsersAndPermissions(ListMultimap<String, Permission> perms) { 189 AccessControlProtos.UsersAndPermissions.Builder builder = 190 AccessControlProtos.UsersAndPermissions.newBuilder(); 191 for (Map.Entry<String, Collection<Permission>> entry : perms.asMap().entrySet()) { 192 AccessControlProtos.UsersAndPermissions.UserPermissions.Builder userPermBuilder = 193 AccessControlProtos.UsersAndPermissions.UserPermissions.newBuilder(); 194 userPermBuilder.setUser(ByteString.copyFromUtf8(entry.getKey())); 195 for (Permission perm : entry.getValue()) { 196 userPermBuilder.addPermissions(toPermission(perm)); 197 } 198 builder.addUserPermissions(userPermBuilder.build()); 199 } 200 return builder.build(); 201 } 202 203 public static ListMultimap<String, Permission> 204 toUsersAndPermissions(AccessControlProtos.UsersAndPermissions proto) { 205 ListMultimap<String, Permission> result = ArrayListMultimap.create(); 206 for (AccessControlProtos.UsersAndPermissions.UserPermissions userPerms : proto 207 .getUserPermissionsList()) { 208 String user = userPerms.getUser().toStringUtf8(); 209 for (AccessControlProtos.Permission perm : userPerms.getPermissionsList()) { 210 result.put(user, toPermission(perm)); 211 } 212 } 213 return result; 214 } 215 216 /** 217 * Converts a TablePermission proto to a client TablePermission object. 218 * @param proto the protobuf TablePermission 219 * @return the converted TablePermission 220 */ 221 public static TablePermission toTablePermission(AccessControlProtos.TablePermission proto) { 222 Permission.Action[] actions = toPermissionActions(proto.getActionList()); 223 if (!proto.hasTableName()) { 224 throw new IllegalStateException("TableName cannot be empty"); 225 } 226 TableName table = ProtobufUtil.toTableName(proto.getTableName()); 227 byte[] family = null; 228 byte[] qualifier = null; 229 if (proto.hasFamily()) { 230 family = proto.getFamily().toByteArray(); 231 } 232 if (proto.hasQualifier()) { 233 qualifier = proto.getQualifier().toByteArray(); 234 } 235 return new TablePermission(table, family, qualifier, actions); 236 } 237 238 /** 239 * Converts a Permission proto to a client Permission object. 240 * @param proto the protobuf Permission 241 * @return the converted Permission 242 */ 243 public static Permission toPermission(AccessControlProtos.Permission proto) { 244 if (proto.getType() == AccessControlProtos.Permission.Type.Global) { 245 AccessControlProtos.GlobalPermission perm = proto.getGlobalPermission(); 246 Permission.Action[] actions = toPermissionActions(perm.getActionList()); 247 return Permission.newBuilder().withActions(actions).build(); 248 } 249 if (proto.getType() == AccessControlProtos.Permission.Type.Namespace) { 250 AccessControlProtos.NamespacePermission perm = proto.getNamespacePermission(); 251 Permission.Action[] actions = toPermissionActions(perm.getActionList()); 252 if (!proto.hasNamespacePermission()) { 253 throw new IllegalStateException("Namespace must not be empty in NamespacePermission"); 254 } 255 return Permission.newBuilder(perm.getNamespaceName().toStringUtf8()).withActions(actions) 256 .build(); 257 } 258 if (proto.getType() == AccessControlProtos.Permission.Type.Table) { 259 AccessControlProtos.TablePermission perm = proto.getTablePermission(); 260 Permission.Action[] actions = toPermissionActions(perm.getActionList()); 261 if (!perm.hasTableName()) { 262 throw new IllegalStateException("TableName cannot be empty"); 263 } 264 TableName table = ProtobufUtil.toTableName(perm.getTableName()); 265 byte[] family = null; 266 byte[] qualifier = null; 267 if (perm.hasFamily()) { 268 family = perm.getFamily().toByteArray(); 269 } 270 if (perm.hasQualifier()) { 271 qualifier = perm.getQualifier().toByteArray(); 272 } 273 return Permission.newBuilder(table).withFamily(family).withQualifier(qualifier) 274 .withActions(actions).build(); 275 } 276 throw new IllegalStateException("Unrecognize Perm Type: " + proto.getType()); 277 } 278 279 /** 280 * Convert a client Permission to a Permission proto 281 * @param perm the client Permission 282 * @return the protobuf Permission 283 */ 284 public static AccessControlProtos.Permission toPermission(Permission perm) { 285 AccessControlProtos.Permission.Builder ret = AccessControlProtos.Permission.newBuilder(); 286 if (perm instanceof NamespacePermission) { 287 NamespacePermission namespace = (NamespacePermission) perm; 288 ret.setType(AccessControlProtos.Permission.Type.Namespace); 289 AccessControlProtos.NamespacePermission.Builder builder = 290 AccessControlProtos.NamespacePermission.newBuilder(); 291 builder.setNamespaceName(ByteString.copyFromUtf8(namespace.getNamespace())); 292 Permission.Action[] actions = perm.getActions(); 293 if (actions != null) { 294 for (Permission.Action a : actions) { 295 builder.addAction(toPermissionAction(a)); 296 } 297 } 298 ret.setNamespacePermission(builder); 299 } else if (perm instanceof TablePermission) { 300 TablePermission table = (TablePermission) perm; 301 ret.setType(AccessControlProtos.Permission.Type.Table); 302 AccessControlProtos.TablePermission.Builder builder = 303 AccessControlProtos.TablePermission.newBuilder(); 304 builder.setTableName(ProtobufUtil.toProtoTableName(table.getTableName())); 305 if (table.hasFamily()) { 306 builder.setFamily(ByteStringer.wrap(table.getFamily())); 307 } 308 if (table.hasQualifier()) { 309 builder.setQualifier(ByteStringer.wrap(table.getQualifier())); 310 } 311 Permission.Action[] actions = perm.getActions(); 312 if (actions != null) { 313 for (Permission.Action a : actions) { 314 builder.addAction(toPermissionAction(a)); 315 } 316 } 317 ret.setTablePermission(builder); 318 } else { 319 // perm instanceof GlobalPermission 320 ret.setType(AccessControlProtos.Permission.Type.Global); 321 AccessControlProtos.GlobalPermission.Builder builder = 322 AccessControlProtos.GlobalPermission.newBuilder(); 323 Permission.Action[] actions = perm.getActions(); 324 if (actions != null) { 325 for (Permission.Action a : actions) { 326 builder.addAction(toPermissionAction(a)); 327 } 328 } 329 ret.setGlobalPermission(builder); 330 } 331 return ret.build(); 332 } 333 334 /** 335 * Converts a list of Permission.Action proto to an array of client Permission.Action objects. 336 * @param protoActions the list of protobuf Actions 337 * @return the converted array of Actions 338 */ 339 public static Permission.Action[] 340 toPermissionActions(List<AccessControlProtos.Permission.Action> protoActions) { 341 Permission.Action[] actions = new Permission.Action[protoActions.size()]; 342 for (int i = 0; i < protoActions.size(); i++) { 343 actions[i] = toPermissionAction(protoActions.get(i)); 344 } 345 return actions; 346 } 347 348 /** 349 * Converts a Permission.Action proto to a client Permission.Action object. 350 * @param action the protobuf Action 351 * @return the converted Action 352 */ 353 public static Permission.Action toPermissionAction(AccessControlProtos.Permission.Action action) { 354 switch (action) { 355 case READ: 356 return Permission.Action.READ; 357 case WRITE: 358 return Permission.Action.WRITE; 359 case EXEC: 360 return Permission.Action.EXEC; 361 case CREATE: 362 return Permission.Action.CREATE; 363 case ADMIN: 364 return Permission.Action.ADMIN; 365 } 366 throw new IllegalArgumentException("Unknown action value " + action.name()); 367 } 368 369 /** 370 * Convert a client Permission.Action to a Permission.Action proto 371 * @param action the client Action 372 * @return the protobuf Action 373 */ 374 public static AccessControlProtos.Permission.Action toPermissionAction(Permission.Action action) { 375 switch (action) { 376 case READ: 377 return AccessControlProtos.Permission.Action.READ; 378 case WRITE: 379 return AccessControlProtos.Permission.Action.WRITE; 380 case EXEC: 381 return AccessControlProtos.Permission.Action.EXEC; 382 case CREATE: 383 return AccessControlProtos.Permission.Action.CREATE; 384 case ADMIN: 385 return AccessControlProtos.Permission.Action.ADMIN; 386 } 387 throw new IllegalArgumentException("Unknown action value " + action.name()); 388 } 389 390 /** 391 * Convert a client user permission to a user permission proto 392 * @param perm the client UserPermission 393 * @return the protobuf UserPermission 394 */ 395 public static AccessControlProtos.UserPermission toUserPermission(UserPermission perm) { 396 return AccessControlProtos.UserPermission.newBuilder() 397 .setUser(ByteString.copyFromUtf8(perm.getUser())) 398 .setPermission(toPermission(perm.getPermission())).build(); 399 } 400 401 /** 402 * Converts the permissions list into a protocol buffer GetUserPermissionsResponse 403 */ 404 public static GetUserPermissionsResponse 405 buildGetUserPermissionsResponse(final List<UserPermission> permissions) { 406 GetUserPermissionsResponse.Builder builder = GetUserPermissionsResponse.newBuilder(); 407 for (UserPermission perm : permissions) { 408 builder.addUserPermission(toUserPermission(perm)); 409 } 410 return builder.build(); 411 } 412 413 /** 414 * Converts a user permission proto to a client user permission object. 415 * @param proto the protobuf UserPermission 416 * @return the converted UserPermission 417 */ 418 public static UserPermission toUserPermission(AccessControlProtos.UserPermission proto) { 419 return new UserPermission(proto.getUser().toStringUtf8(), toPermission(proto.getPermission())); 420 } 421 422 /** 423 * Convert a ListMultimap<String, TablePermission> where key is username to a protobuf 424 * UserPermission 425 * @param perm the list of user and table permissions 426 * @return the protobuf UserTablePermissions 427 */ 428 public static AccessControlProtos.UsersAndPermissions 429 toUserTablePermissions(ListMultimap<String, UserPermission> perm) { 430 AccessControlProtos.UsersAndPermissions.Builder builder = 431 AccessControlProtos.UsersAndPermissions.newBuilder(); 432 for (Map.Entry<String, Collection<UserPermission>> entry : perm.asMap().entrySet()) { 433 AccessControlProtos.UsersAndPermissions.UserPermissions.Builder userPermBuilder = 434 AccessControlProtos.UsersAndPermissions.UserPermissions.newBuilder(); 435 userPermBuilder.setUser(ByteString.copyFromUtf8(entry.getKey())); 436 for (UserPermission userPerm : entry.getValue()) { 437 userPermBuilder.addPermissions(toPermission(userPerm.getPermission())); 438 } 439 builder.addUserPermissions(userPermBuilder.build()); 440 } 441 return builder.build(); 442 } 443 444 /** 445 * A utility used to grant a user global permissions. 446 * <p> 447 * It's also called by the shell, in case you want to find references. 448 * @param protocol the AccessControlService protocol proxy 449 * @param userShortName the short name of the user to grant permissions 450 * @param actions the permissions to be granted n * @deprecated Use 451 * {@link Admin#grant(UserPermission, boolean)} instead. 452 */ 453 @Deprecated 454 public static void grant(RpcController controller, 455 AccessControlService.BlockingInterface protocol, String userShortName, 456 boolean mergeExistingPermissions, Permission.Action... actions) throws ServiceException { 457 List<AccessControlProtos.Permission.Action> permActions = 458 Lists.newArrayListWithCapacity(actions.length); 459 for (Permission.Action a : actions) { 460 permActions.add(toPermissionAction(a)); 461 } 462 AccessControlProtos.GrantRequest request = 463 buildGrantRequest(userShortName, mergeExistingPermissions, 464 permActions.toArray(new AccessControlProtos.Permission.Action[actions.length])); 465 protocol.grant(controller, request); 466 } 467 468 /** 469 * A utility used to grant a user table permissions. The permissions will be for a table 470 * table/column family/qualifier. 471 * <p> 472 * It's also called by the shell, in case you want to find references. 473 * @param protocol the AccessControlService protocol proxy 474 * @param userShortName the short name of the user to grant permissions 475 * @param tableName optional table name 476 * @param f optional column family 477 * @param q optional qualifier 478 * @param actions the permissions to be granted n * @deprecated Use 479 * {@link Admin#grant(UserPermission, boolean)} instead. 480 */ 481 @Deprecated 482 public static void grant(RpcController controller, 483 AccessControlService.BlockingInterface protocol, String userShortName, TableName tableName, 484 byte[] f, byte[] q, boolean mergeExistingPermissions, Permission.Action... actions) 485 throws ServiceException { 486 List<AccessControlProtos.Permission.Action> permActions = 487 Lists.newArrayListWithCapacity(actions.length); 488 for (Permission.Action a : actions) { 489 permActions.add(toPermissionAction(a)); 490 } 491 AccessControlProtos.GrantRequest request = 492 buildGrantRequest(userShortName, tableName, f, q, mergeExistingPermissions, 493 permActions.toArray(new AccessControlProtos.Permission.Action[actions.length])); 494 protocol.grant(controller, request); 495 } 496 497 /** 498 * A utility used to grant a user namespace permissions. 499 * <p> 500 * It's also called by the shell, in case you want to find references. 501 * @param controller RpcController 502 * @param protocol the AccessControlService protocol proxy 503 * @param namespace the short name of the user to grant permissions 504 * @param actions the permissions to be granted n * @deprecated Use 505 * {@link Admin#grant(UserPermission, boolean)} instead. 506 */ 507 @Deprecated 508 public static void grant(RpcController controller, 509 AccessControlService.BlockingInterface protocol, String userShortName, String namespace, 510 boolean mergeExistingPermissions, Permission.Action... actions) throws ServiceException { 511 List<AccessControlProtos.Permission.Action> permActions = 512 Lists.newArrayListWithCapacity(actions.length); 513 for (Permission.Action a : actions) { 514 permActions.add(toPermissionAction(a)); 515 } 516 AccessControlProtos.GrantRequest request = 517 buildGrantRequest(userShortName, namespace, mergeExistingPermissions, 518 permActions.toArray(new AccessControlProtos.Permission.Action[actions.length])); 519 protocol.grant(controller, request); 520 } 521 522 /** 523 * A utility used to revoke a user's global permissions. 524 * <p> 525 * It's also called by the shell, in case you want to find references. 526 * @param controller RpcController 527 * @param protocol the AccessControlService protocol proxy 528 * @param userShortName the short name of the user to revoke permissions 529 * @param actions the permissions to be revoked 530 * @throws ServiceException on failure 531 * @deprecated Use {@link Admin#revoke(UserPermission)} instead. 532 */ 533 @Deprecated 534 public static void revoke(RpcController controller, 535 AccessControlService.BlockingInterface protocol, String userShortName, 536 Permission.Action... actions) throws ServiceException { 537 List<AccessControlProtos.Permission.Action> permActions = 538 Lists.newArrayListWithCapacity(actions.length); 539 for (Permission.Action a : actions) { 540 permActions.add(toPermissionAction(a)); 541 } 542 AccessControlProtos.RevokeRequest request = buildRevokeRequest(userShortName, 543 permActions.toArray(new AccessControlProtos.Permission.Action[actions.length])); 544 protocol.revoke(controller, request); 545 } 546 547 /** 548 * A utility used to revoke a user's table permissions. The permissions will be for a table/column 549 * family/qualifier. 550 * <p> 551 * It's also called by the shell, in case you want to find references. 552 * @param controller RpcController 553 * @param protocol the AccessControlService protocol proxy 554 * @param userShortName the short name of the user to revoke permissions 555 * @param tableName optional table name 556 * @param f optional column family 557 * @param q optional qualifier 558 * @param actions the permissions to be revoked 559 * @throws ServiceException on failure 560 * @deprecated Use {@link Admin#revoke(UserPermission)} instead. 561 */ 562 @Deprecated 563 public static void revoke(RpcController controller, 564 AccessControlService.BlockingInterface protocol, String userShortName, TableName tableName, 565 byte[] f, byte[] q, Permission.Action... actions) throws ServiceException { 566 List<AccessControlProtos.Permission.Action> permActions = 567 Lists.newArrayListWithCapacity(actions.length); 568 for (Permission.Action a : actions) { 569 permActions.add(toPermissionAction(a)); 570 } 571 AccessControlProtos.RevokeRequest request = buildRevokeRequest(userShortName, tableName, f, q, 572 permActions.toArray(new AccessControlProtos.Permission.Action[actions.length])); 573 protocol.revoke(controller, request); 574 } 575 576 /** 577 * A utility used to revoke a user's namespace permissions. 578 * <p> 579 * It's also called by the shell, in case you want to find references. 580 * @param controller RpcController 581 * @param protocol the AccessControlService protocol proxy 582 * @param userShortName the short name of the user to revoke permissions 583 * @param namespace optional table name 584 * @param actions the permissions to be revoked 585 * @throws ServiceException on failure 586 * @deprecated Use {@link Admin#revoke(UserPermission)} instead. 587 */ 588 @Deprecated 589 public static void revoke(RpcController controller, 590 AccessControlService.BlockingInterface protocol, String userShortName, String namespace, 591 Permission.Action... actions) throws ServiceException { 592 List<AccessControlProtos.Permission.Action> permActions = 593 Lists.newArrayListWithCapacity(actions.length); 594 for (Permission.Action a : actions) { 595 permActions.add(toPermissionAction(a)); 596 } 597 AccessControlProtos.RevokeRequest request = buildRevokeRequest(userShortName, namespace, 598 permActions.toArray(new AccessControlProtos.Permission.Action[actions.length])); 599 protocol.revoke(controller, request); 600 } 601 602 /** 603 * A utility used to get user's global permissions. 604 * <p> 605 * It's also called by the shell, in case you want to find references. 606 * @param controller RpcController 607 * @param protocol the AccessControlService protocol proxy 608 * @throws ServiceException on failure 609 * @deprecated Use {@link Admin#getUserPermissions(GetUserPermissionsRequest)} instead. 610 */ 611 @Deprecated 612 public static List<UserPermission> getUserPermissions(RpcController controller, 613 AccessControlService.BlockingInterface protocol) throws ServiceException { 614 return getUserPermissions(controller, protocol, HConstants.EMPTY_STRING); 615 } 616 617 /** 618 * A utility used to get user's global permissions based on the specified user name. 619 * @param controller RpcController 620 * @param protocol the AccessControlService protocol proxy 621 * @param userName User name, if empty then all user permissions will be retrieved. n 622 * * @deprecated Use {@link Admin#getUserPermissions(GetUserPermissionsRequest)} 623 * instead. 624 */ 625 @Deprecated 626 public static List<UserPermission> getUserPermissions(RpcController controller, 627 AccessControlService.BlockingInterface protocol, String userName) throws ServiceException { 628 AccessControlProtos.GetUserPermissionsRequest.Builder builder = 629 AccessControlProtos.GetUserPermissionsRequest.newBuilder(); 630 builder.setType(AccessControlProtos.Permission.Type.Global); 631 if (!StringUtils.isEmpty(userName)) { 632 builder.setUserName(ByteString.copyFromUtf8(userName)); 633 } 634 635 AccessControlProtos.GetUserPermissionsRequest request = builder.build(); 636 AccessControlProtos.GetUserPermissionsResponse response = 637 protocol.getUserPermissions(controller, request); 638 List<UserPermission> perms = new ArrayList<>(response.getUserPermissionCount()); 639 for (AccessControlProtos.UserPermission perm : response.getUserPermissionList()) { 640 perms.add(toUserPermission(perm)); 641 } 642 return perms; 643 } 644 645 /** 646 * A utility used to get user table permissions. 647 * <p> 648 * It's also called by the shell, in case you want to find references. 649 * @param controller RpcController 650 * @param protocol the AccessControlService protocol proxy 651 * @param t optional table name n * @deprecated Use 652 * {@link Admin#getUserPermissions(GetUserPermissionsRequest)} instead. 653 */ 654 @Deprecated 655 public static List<UserPermission> getUserPermissions(RpcController controller, 656 AccessControlService.BlockingInterface protocol, TableName t) throws ServiceException { 657 return getUserPermissions(controller, protocol, t, null, null, HConstants.EMPTY_STRING); 658 } 659 660 /** 661 * A utility used to get user table permissions based on the column family, column qualifier and 662 * user name. 663 * @param controller RpcController 664 * @param protocol the AccessControlService protocol proxy 665 * @param t optional table name 666 * @param columnFamily Column family 667 * @param columnQualifier Column qualifier 668 * @param userName User name, if empty then all user permissions will be retrieved. n 669 * * @deprecated Use 670 * {@link Admin#getUserPermissions(GetUserPermissionsRequest)} instead. 671 */ 672 @Deprecated 673 public static List<UserPermission> getUserPermissions(RpcController controller, 674 AccessControlService.BlockingInterface protocol, TableName t, byte[] columnFamily, 675 byte[] columnQualifier, String userName) throws ServiceException { 676 AccessControlProtos.GetUserPermissionsRequest.Builder builder = 677 AccessControlProtos.GetUserPermissionsRequest.newBuilder(); 678 if (t != null) { 679 builder.setTableName(ProtobufUtil.toProtoTableName(t)); 680 } 681 if (Bytes.len(columnFamily) > 0) { 682 builder.setColumnFamily(ByteString.copyFrom(columnFamily)); 683 } 684 if (Bytes.len(columnQualifier) > 0) { 685 builder.setColumnQualifier(ByteString.copyFrom(columnQualifier)); 686 } 687 if (!StringUtils.isEmpty(userName)) { 688 builder.setUserName(ByteString.copyFromUtf8(userName)); 689 } 690 691 builder.setType(AccessControlProtos.Permission.Type.Table); 692 AccessControlProtos.GetUserPermissionsRequest request = builder.build(); 693 AccessControlProtos.GetUserPermissionsResponse response = 694 protocol.getUserPermissions(controller, request); 695 List<UserPermission> perms = new ArrayList<>(response.getUserPermissionCount()); 696 for (AccessControlProtos.UserPermission perm : response.getUserPermissionList()) { 697 perms.add(toUserPermission(perm)); 698 } 699 return perms; 700 } 701 702 /** 703 * A utility used to get permissions for selected namespace. 704 * <p> 705 * It's also called by the shell, in case you want to find references. 706 * @param controller RpcController 707 * @param protocol the AccessControlService protocol proxy 708 * @param namespace name of the namespace n * @deprecated Use 709 * {@link Admin#getUserPermissions(GetUserPermissionsRequest)} instead. 710 */ 711 @Deprecated 712 public static List<UserPermission> getUserPermissions(RpcController controller, 713 AccessControlService.BlockingInterface protocol, byte[] namespace) throws ServiceException { 714 return getUserPermissions(controller, protocol, namespace, HConstants.EMPTY_STRING); 715 } 716 717 /** 718 * A utility used to get permissions for selected namespace based on the specified user name. 719 * @param controller RpcController 720 * @param protocol the AccessControlService protocol proxy 721 * @param namespace name of the namespace 722 * @param userName User name, if empty then all user permissions will be retrieved. n 723 * * @deprecated Use {@link Admin#getUserPermissions(GetUserPermissionsRequest)} 724 * instead. 725 */ 726 @Deprecated 727 public static List<UserPermission> getUserPermissions(RpcController controller, 728 AccessControlService.BlockingInterface protocol, byte[] namespace, String userName) 729 throws ServiceException { 730 AccessControlProtos.GetUserPermissionsRequest.Builder builder = 731 AccessControlProtos.GetUserPermissionsRequest.newBuilder(); 732 if (namespace != null) { 733 builder.setNamespaceName(ByteStringer.wrap(namespace)); 734 } 735 if (!StringUtils.isEmpty(userName)) { 736 builder.setUserName(ByteString.copyFromUtf8(userName)); 737 } 738 builder.setType(AccessControlProtos.Permission.Type.Namespace); 739 AccessControlProtos.GetUserPermissionsRequest request = builder.build(); 740 AccessControlProtos.GetUserPermissionsResponse response = 741 protocol.getUserPermissions(controller, request); 742 List<UserPermission> perms = new ArrayList<>(response.getUserPermissionCount()); 743 for (AccessControlProtos.UserPermission perm : response.getUserPermissionList()) { 744 perms.add(toUserPermission(perm)); 745 } 746 return perms; 747 } 748 749 /** 750 * Validates whether specified user has permission to perform actions on the mentioned table, 751 * column family or column qualifier. 752 * @param controller RpcController 753 * @param protocol the AccessControlService protocol proxy 754 * @param tableName Table name, it shouldn't be null or empty. 755 * @param columnFamily The column family. Optional argument, can be empty. If empty then 756 * validation will happen at table level. 757 * @param columnQualifier The column qualifier. Optional argument, can be empty. If empty then 758 * validation will happen at table and column family level. columnQualifier 759 * will not be considered if columnFamily is passed as null or empty. 760 * @param userName User name, it shouldn't be null or empty. 761 * @param actions Actions 762 * @return true if access allowed, otherwise false n * @deprecated Use 763 * {@link Admin#hasUserPermissions(String, List)} instead. 764 */ 765 @Deprecated 766 public static boolean hasPermission(RpcController controller, 767 AccessControlService.BlockingInterface protocol, TableName tableName, byte[] columnFamily, 768 byte[] columnQualifier, String userName, Permission.Action[] actions) throws ServiceException { 769 AccessControlProtos.TablePermission.Builder tablePermissionBuilder = 770 AccessControlProtos.TablePermission.newBuilder(); 771 tablePermissionBuilder 772 .setTableName(org.apache.hadoop.hbase.protobuf.ProtobufUtil.toProtoTableName(tableName)); 773 if (Bytes.len(columnFamily) > 0) { 774 tablePermissionBuilder.setFamily(ByteStringer.wrap(columnFamily)); 775 } 776 if (Bytes.len(columnQualifier) > 0) { 777 tablePermissionBuilder.setQualifier(ByteString.copyFrom(columnQualifier)); 778 } 779 for (Permission.Action a : actions) { 780 tablePermissionBuilder.addAction(toPermissionAction(a)); 781 } 782 AccessControlProtos.HasPermissionRequest request = AccessControlProtos.HasPermissionRequest 783 .newBuilder().setTablePermission(tablePermissionBuilder) 784 .setUserName(ByteString.copyFromUtf8(userName)).build(); 785 AccessControlProtos.HasPermissionResponse response = 786 protocol.hasPermission(controller, request); 787 return response.getHasPermission(); 788 } 789 790 /** 791 * Convert a protobuf UserTablePermissions to a ListMultimap<Username, UserPermission> 792 * @param proto the proto UsersAndPermissions 793 * @return a ListMultimap with user and its permissions 794 */ 795 public static ListMultimap<String, UserPermission> 796 toUserPermission(AccessControlProtos.UsersAndPermissions proto) { 797 ListMultimap<String, UserPermission> userPermission = ArrayListMultimap.create(); 798 AccessControlProtos.UsersAndPermissions.UserPermissions userPerm; 799 for (int i = 0; i < proto.getUserPermissionsCount(); i++) { 800 userPerm = proto.getUserPermissions(i); 801 String username = userPerm.getUser().toStringUtf8(); 802 for (int j = 0; j < userPerm.getPermissionsCount(); j++) { 803 userPermission.put(username, 804 new UserPermission(username, toPermission(userPerm.getPermissions(j)))); 805 } 806 } 807 return userPermission; 808 } 809 810 /** 811 * Convert a protobuf UserTablePermissions to a ListMultimap<Username, Permission> 812 * @param proto the proto UsersAndPermissions 813 * @return a ListMultimap with user and its permissions 814 */ 815 public static ListMultimap<String, Permission> 816 toPermission(AccessControlProtos.UsersAndPermissions proto) { 817 ListMultimap<String, Permission> perms = ArrayListMultimap.create(); 818 AccessControlProtos.UsersAndPermissions.UserPermissions userPerm; 819 for (int i = 0; i < proto.getUserPermissionsCount(); i++) { 820 userPerm = proto.getUserPermissions(i); 821 String username = userPerm.getUser().toStringUtf8(); 822 for (int j = 0; j < userPerm.getPermissionsCount(); j++) { 823 perms.put(username, toPermission(userPerm.getPermissions(j))); 824 } 825 } 826 return perms; 827 } 828 829 /** 830 * Create a request to revoke user table permissions. 831 * @param username the short user name whose permissions to be revoked 832 * @param tableName optional table name the permissions apply 833 * @param family optional column family 834 * @param qualifier optional qualifier 835 * @param actions the permissions to be revoked 836 * @return A {@link AccessControlProtos} RevokeRequest 837 */ 838 public static AccessControlProtos.RevokeRequest buildRevokeRequest(String username, 839 TableName tableName, byte[] family, byte[] qualifier, 840 AccessControlProtos.Permission.Action... actions) { 841 AccessControlProtos.Permission.Builder ret = AccessControlProtos.Permission.newBuilder(); 842 AccessControlProtos.TablePermission.Builder permissionBuilder = 843 AccessControlProtos.TablePermission.newBuilder(); 844 for (AccessControlProtos.Permission.Action a : actions) { 845 permissionBuilder.addAction(a); 846 } 847 if (tableName != null) { 848 permissionBuilder.setTableName(ProtobufUtil.toProtoTableName(tableName)); 849 } 850 if (family != null) { 851 permissionBuilder.setFamily(ByteStringer.wrap(family)); 852 } 853 if (qualifier != null) { 854 permissionBuilder.setQualifier(ByteStringer.wrap(qualifier)); 855 } 856 ret.setType(AccessControlProtos.Permission.Type.Table).setTablePermission(permissionBuilder); 857 return AccessControlProtos.RevokeRequest.newBuilder() 858 .setUserPermission(AccessControlProtos.UserPermission.newBuilder() 859 .setUser(ByteString.copyFromUtf8(username)).setPermission(ret)) 860 .build(); 861 } 862}