NGDATA/hbase-indexer — pull request #47 by whoschek (2014-05-15 21:08:40+00:00)
Title: CDH-19024: Only require extra HBase table permission grants when table n...

...ame spec is a regex (but not when it is a literal)

In our integration tests we found a regression in secure mode (kerberos) in hbase-indexer-1.5 wrt. hbase-indexer-1.3. With hbase-indexer-1.5 and without the attached fix the user would have to go into the shell "hbase shell" and type something like:

grant 'systest' 'A'

This was not required in hbase-indexer-1.3. Otherwise the code would error out like so:

{code}
Exception in thread "main" java.lang.RuntimeException: Error occurred fetching hbase tables
at com.ngdata.hbaseindexer.mr.HBaseIndexingOptions.evaluateScan(HBaseIndexingOptions.java:184)
at com.ngdata.hbaseindexer.mr.HBaseIndexingOptions.evaluate(HBaseIndexingOptions.java:132)
at com.ngdata.hbaseindexer.mr.HBaseIndexerArgumentParser.parseArgs(HBaseIndexerArgumentParser.java:518)
at com.ngdata.hbaseindexer.mr.HBaseMapReduceIndexerTool.run(HBaseMapReduceIndexerTool.java:81)
at com.ngdata.hbaseindexer.mr.HBaseMapReduceIndexerTool.run(HBaseMapReduceIndexerTool.java:76)
at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:70)
at com.ngdata.hbaseindexer.mr.HBaseMapReduceIndexerTool.main(HBaseMapReduceIndexerTool.java:70)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.apache.hadoop.util.RunJar.main(RunJar.java:212)
Caused by: org.apache.hadoop.hbase.ipc.RemoteWithExtrasException(org.apache.hadoop.hbase.security.AccessDeniedException): org.apache.hadoop.hbase.security.AccessDeniedException: Insufficient permissions for user 'systest' (global, action=ADMIN)
at org.apache.hadoop.hbase.security.access.AccessController.requireGlobalPermission(AccessController.java:442)
at org.apache.hadoop.hbase.security.access.AccessController.preGetTableDescriptors(AccessController.java:1767)
at org.apache.hadoop.hbase.master.MasterCoprocessorHost.preGetTableDescriptors(MasterCoprocessorHost.java:1532)
at org.apache.hadoop.hbase.master.HMaster.getTableDescriptors(HMaster.java:2568)
at org.apache.hadoop.hbase.protobuf.generated.MasterProtos$MasterService$2.callBlockingMethod(MasterProtos.java:40438)
at org.apache.hadoop.hbase.ipc.RpcServer.call(RpcServer.java:2012)
at org.apache.hadoop.hbase.ipc.CallRunner.run(CallRunner.java:98)
at org.apache.hadoop.hbase.ipc.FifoRpcScheduler$1.run(FifoRpcScheduler.java:73)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
at java.util.concurrent.FutureTask.run(FutureTask.java:262)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:744)

at org.apache.hadoop.hbase.ipc.RpcClient.call(RpcClient.java:1450)
at org.apache.hadoop.hbase.ipc.RpcClient.callBlockingMethod(RpcClient.java:1654)
at org.apache.hadoop.hbase.ipc.RpcClient$BlockingRpcChannelImplementation.callBlockingMethod(RpcClient.java:1712)
at org.apache.hadoop.hbase.protobuf.generated.MasterProtos$MasterService$BlockingStub.getTableDescriptors(MasterProtos.java:42525)
at org.apache.hadoop.hbase.client.HConnectionManager$HConnectionImplementation$5.getTableDescriptors(HConnectionManager.java:2138)
at org.apache.hadoop.hbase.client.HConnectionManager$HConnectionImplementation.listTables(HConnectionManager.java:2593)
at org.apache.hadoop.hbase.client.HBaseAdmin.listTables(HBaseAdmin.java:307)
at org.apache.hadoop.hbase.client.HBaseAdmin.listTables(HBaseAdmin.java:320)
at org.apache.hadoop.hbase.client.HBaseAdmin.listTables(HBaseAdmin.java:338)
at com.ngdata.hbaseindexer.mr.HBaseIndexingOptions.evaluateScan(HBaseIndexingOptions.java:182)
... 11 more
{code}

In addition, this could be seen as a security problem because overly broad access to HBase must now be granted to users even though such a grant should not be required for a literal table name (and wasn't required in hbase-indexer-1.3).