Examples with Action org.apache.hadoop.hbase.security.access.Permission.Action used on opensource projects

Example 11 with Action

use of org.apache.hadoop.hbase.security.access.Permission.Action in project hbase by apache.

the class AccessChecker method hasUserPermission.

/**
 * Authorizes that if the current user has the given permissions.
 * @param user Active user to which authorization checks should be applied
 * @param request Request type
 * @param permission Actions being requested
 * @return True if the user has the specific permission
 */
public boolean hasUserPermission(User user, String request, Permission permission) {
    if (permission instanceof TablePermission) {
        TablePermission tPerm = (TablePermission) permission;
        for (Permission.Action action : permission.getActions()) {
            AuthResult authResult = permissionGranted(request, user, action, tPerm.getTableName(), tPerm.getFamily(), tPerm.getQualifier());
            AccessChecker.logResult(authResult);
            if (!authResult.isAllowed()) {
                return false;
            }
        }
    } else if (permission instanceof NamespacePermission) {
        NamespacePermission nsPerm = (NamespacePermission) permission;
        AuthResult authResult;
        for (Action action : nsPerm.getActions()) {
            if (getAuthManager().authorizeUserNamespace(user, nsPerm.getNamespace(), action)) {
                authResult = AuthResult.allow(request, "Namespace action allowed", user, action, null, null);
            } else {
                authResult = AuthResult.deny(request, "Namespace action denied", user, action, null, null);
            }
            AccessChecker.logResult(authResult);
            if (!authResult.isAllowed()) {
                return false;
            }
        }
    } else {
        AuthResult authResult;
        for (Permission.Action action : permission.getActions()) {
            if (getAuthManager().authorizeUserGlobal(user, action)) {
                authResult = AuthResult.allow(request, "Global action allowed", user, action, null, null);
            } else {
                authResult = AuthResult.deny(request, "Global action denied", user, action, null, null);
            }
            AccessChecker.logResult(authResult);
            if (!authResult.isAllowed()) {
                return false;
            }
        }
    }
    return true;
}

Example 12 with Action

use of org.apache.hadoop.hbase.security.access.Permission.Action in project hbase by apache.

the class AccessChecker method requirePermission.

/**
 * Authorizes that the current user has any of the given permissions for the
 * given table, column family and column qualifier.
 *
 * @param user Active user to which authorization checks should be applied
 * @param request Request type
 * @param tableName Table requested
 * @param family    Column family requested
 * @param qualifier Column qualifier requested
 * @param filterUser User name to be filtered from permission as requested
 * @param permissions Actions being requested
 * @throws IOException if obtaining the current user fails
 * @throws AccessDeniedException if user has no authorization
 */
public void requirePermission(User user, String request, TableName tableName, byte[] family, byte[] qualifier, String filterUser, Action... permissions) throws IOException {
    AuthResult result = null;
    for (Action permission : permissions) {
        if (authManager.authorizeUserTable(user, tableName, family, qualifier, permission)) {
            result = AuthResult.allow(request, "Table permission granted", user, permission, tableName, family, qualifier);
            break;
        } else {
            // rest of the world
            result = AuthResult.deny(request, "Insufficient permissions", user, permission, tableName, family, qualifier);
        }
    }
    result.getParams().addExtraParam("filterUser", filterUser);
    logResult(result);
    if (!result.isAllowed()) {
        throw new AccessDeniedException("Insufficient permissions " + result.toContextString());
    }
}

Example 13 with Action

use of org.apache.hadoop.hbase.security.access.Permission.Action in project hbase by apache.

the class AccessChecker method requireAccess.

/**
 * Authorizes that the current user has any of the given permissions to access the table.
 *
 * @param user Active user to which authorization checks should be applied
 * @param request Request type.
 * @param tableName   Table requested
 * @param permissions Actions being requested
 * @throws IOException if obtaining the current user fails
 * @throws AccessDeniedException if user has no authorization
 */
public void requireAccess(User user, String request, TableName tableName, Action... permissions) throws IOException {
    AuthResult result = null;
    for (Action permission : permissions) {
        if (authManager.accessUserTable(user, tableName, permission)) {
            result = AuthResult.allow(request, "Table permission granted", user, permission, tableName, null, null);
            break;
        } else {
            // rest of the world
            result = AuthResult.deny(request, "Insufficient permissions", user, permission, tableName, null, null);
        }
    }
    logResult(result);
    if (!result.isAllowed()) {
        throw new AccessDeniedException("Insufficient permissions " + result.toContextString());
    }
}

Example 14 with Action

use of org.apache.hadoop.hbase.security.access.Permission.Action in project hbase by apache.

the class AccessChecker method requireTablePermission.

/**
 * Authorizes that the current user has any of the given permissions for the
 * given table, column family and column qualifier.
 *
 * @param user Active user to which authorization checks should be applied
 * @param request Request type
 * @param tableName Table requested
 * @param family    Column family param
 * @param qualifier Column qualifier param
 * @throws IOException           if obtaining the current user fails
 * @throws AccessDeniedException if user has no authorization
 */
public void requireTablePermission(User user, String request, TableName tableName, byte[] family, byte[] qualifier, Action... permissions) throws IOException {
    AuthResult result = null;
    for (Action permission : permissions) {
        if (authManager.authorizeUserTable(user, tableName, permission)) {
            result = AuthResult.allow(request, "Table permission granted", user, permission, tableName, null, null);
            result.getParams().setFamily(family).setQualifier(qualifier);
            break;
        } else {
            // rest of the world
            result = AuthResult.deny(request, "Insufficient permissions", user, permission, tableName, family, qualifier);
            result.getParams().setFamily(family).setQualifier(qualifier);
        }
    }
    logResult(result);
    if (!result.isAllowed()) {
        throw new AccessDeniedException("Insufficient permissions " + result.toContextString());
    }
}

Example 15 with Action

use of org.apache.hadoop.hbase.security.access.Permission.Action in project hbase by apache.

the class AccessChecker method requireNamespacePermission.

/**
 * Checks that the user has the given global or namespace permission.
 * @param user Active user to which authorization checks should be applied
 * @param request Request type
 * @param namespace Name space as requested
 * @param filterUser User name to be filtered from permission as requested
 * @param permissions Actions being requested
 */
public void requireNamespacePermission(User user, String request, String namespace, String filterUser, Action... permissions) throws IOException {
    AuthResult result = null;
    for (Action permission : permissions) {
        if (authManager.authorizeUserNamespace(user, namespace, permission)) {
            result = AuthResult.allow(request, "Namespace permission granted", user, permission, namespace);
            break;
        } else {
            // rest of the world
            result = AuthResult.deny(request, "Insufficient permissions", user, permission, namespace);
        }
    }
    result.getParams().addExtraParam("filterUser", filterUser);
    logResult(result);
    if (!result.isAllowed()) {
        throw new AccessDeniedException("Insufficient permissions " + result.toContextString());
    }
}