Uploaded image for project: 'HBase'
  1. HBase
  2. HBASE-19318

MasterRpcServices#getSecurityCapabilities explicitly checks for the HBase AccessController implementation

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Critical
    • Resolution: Fixed
    • None
    • 2.0.0-beta-1, 2.0.0
    • master, security
    • None
    • Reviewed
    • Fixes an issue with loading customer coprocessor endpoint implementations inside of the HBase Master which breaks Apache Ranger.

    Description

      Sharmadha brought a failure to my attention trying to use Ranger with HBase 2.0 where the grant command was erroring out unexpectedly. The cluster had the Ranger-specific coprocessors deployed, per what was previously working on the HBase 1.1 line.

      After some digging, I found that the the Master is actually making a check explicitly for a Coprocessor that has the name org.apache.hadoop.hbase.security.access.AccessController (short name or full name), instead of looking for a deployed coprocessor which can be assigned to AccessController (which is what Ranger does). We have the CoprocessorHost methods to do the latter already implemented; it strikes me that we just accidentally used the wrong method in MasterRpcServices.

      Attachments

        1. HBASE-19318.001.branch-2.patch
          14 kB
          Josh Elser
        2. HBASE-19318.002.branch-2.patch
          14 kB
          Josh Elser

        Issue Links

          Activity

            People

              elserj Josh Elser
              sharmadhas Sharmadha S
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: