org.apache.hadoop.hbase.security.access

Class AccessControlUtil

java.lang.Object

org.apache.hadoop.hbase.security.access.AccessControlUtil

@InterfaceAudience.Private
public class AccessControlUtil
extends Object

Since:

2.0.0

Method Summary

Modifier and Type	Method and Description
static AccessControlProtos.GetUserPermissionsResponse	buildGetUserPermissionsResponse(List<UserPermission> permissions) Converts the permissions list into a protocol buffer GetUserPermissionsResponse
static AccessControlProtos.GrantRequest	buildGrantRequest(String username, boolean mergeExistingPermissions, AccessControlProtos.Permission.Action... actions) Create a request to grant user global permissions.
static AccessControlProtos.GrantRequest	buildGrantRequest(String username, String namespace, boolean mergeExistingPermissions, AccessControlProtos.Permission.Action... actions) Create a request to grant user namespace permissions.
static AccessControlProtos.GrantRequest	buildGrantRequest(String username, TableName tableName, byte[] family, byte[] qualifier, boolean mergeExistingPermissions, AccessControlProtos.Permission.Action... actions) Create a request to grant user table permissions.
static AccessControlProtos.RevokeRequest	buildRevokeRequest(String username, AccessControlProtos.Permission.Action... actions) Create a request to revoke user global permissions.
static AccessControlProtos.RevokeRequest	buildRevokeRequest(String username, String namespace, AccessControlProtos.Permission.Action... actions) Create a request to revoke user namespace permissions.
static AccessControlProtos.RevokeRequest	buildRevokeRequest(String username, TableName tableName, byte[] family, byte[] qualifier, AccessControlProtos.Permission.Action... actions) Create a request to revoke user table permissions.
static List<UserPermission>	getUserPermissions(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol) Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.
static List<UserPermission>	getUserPermissions(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, byte[] namespace) Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.
static List<UserPermission>	getUserPermissions(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, byte[] namespace, String userName) Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.
static List<UserPermission>	getUserPermissions(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, String userName) Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.
static List<UserPermission>	getUserPermissions(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, TableName t) Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.
static List<UserPermission>	getUserPermissions(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, TableName t, byte[] columnFamily, byte[] columnQualifier, String userName) Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.
static void	grant(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, String userShortName, boolean mergeExistingPermissions, Permission.Action... actions) Deprecated. Use Admin.grant(UserPermission, boolean) instead.
static void	grant(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, String userShortName, String namespace, boolean mergeExistingPermissions, Permission.Action... actions) Deprecated. Use Admin.grant(UserPermission, boolean) instead.
static void	grant(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, String userShortName, TableName tableName, byte[] f, byte[] q, boolean mergeExistingPermissions, Permission.Action... actions) Deprecated. Use Admin.grant(UserPermission, boolean) instead.
static boolean	hasPermission(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, TableName tableName, byte[] columnFamily, byte[] columnQualifier, String userName, Permission.Action[] actions) Deprecated. Use Admin.hasUserPermissions(String, List) instead.
static void	revoke(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, String userShortName, Permission.Action... actions) Deprecated. Use Admin.revoke(UserPermission) instead.
static void	revoke(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, String userShortName, String namespace, Permission.Action... actions) Deprecated. Use Admin.revoke(UserPermission) instead.
static void	revoke(RpcController controller, AccessControlProtos.AccessControlService.BlockingInterface protocol, String userShortName, TableName tableName, byte[] f, byte[] q, Permission.Action... actions) Deprecated. Use Admin.revoke(UserPermission) instead.
static Permission	toPermission(AccessControlProtos.Permission proto) Converts a Permission proto to a client Permission object.
static org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,Permission>	toPermission(AccessControlProtos.UsersAndPermissions proto) Convert a protobuf UserTablePermissions to a ListMultimap<Username, Permission>
static AccessControlProtos.Permission	toPermission(Permission perm) Convert a client Permission to a Permission proto
static Permission.Action	toPermissionAction(AccessControlProtos.Permission.Action action) Converts a Permission.Action proto to a client Permission.Action object.
static AccessControlProtos.Permission.Action	toPermissionAction(Permission.Action action) Convert a client Permission.Action to a Permission.Action proto
static Permission.Action[]	toPermissionActions(List<AccessControlProtos.Permission.Action> protoActions) Converts a list of Permission.Action proto to an array of client Permission.Action objects.
static TablePermission	toTablePermission(AccessControlProtos.TablePermission proto) Converts a TablePermission proto to a client TablePermission object.
static UserPermission	toUserPermission(AccessControlProtos.UserPermission proto) Converts a user permission proto to a client user permission object.
static org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,UserPermission>	toUserPermission(AccessControlProtos.UsersAndPermissions proto) Convert a protobuf UserTablePermissions to a ListMultimap<Username, UserPermission>
static AccessControlProtos.UserPermission	toUserPermission(UserPermission perm) Convert a client user permission to a user permission proto
static org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,Permission>	toUsersAndPermissions(AccessControlProtos.UsersAndPermissions proto)
static AccessControlProtos.UsersAndPermissions	toUsersAndPermissions(org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,Permission> perms)
static AccessControlProtos.UsersAndPermissions	toUsersAndPermissions(String user, Permission perms)
static AccessControlProtos.UsersAndPermissions	toUserTablePermissions(org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,UserPermission> perm) Convert a ListMultimap<String, TablePermission> where key is username to a protobuf UserPermission

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

buildGrantRequest

public static AccessControlProtos.GrantRequest buildGrantRequest(String username,
                                                                 TableName tableName,
                                                                 byte[] family,
                                                                 byte[] qualifier,
                                                                 boolean mergeExistingPermissions,
                                                                 AccessControlProtos.Permission.Action... actions)

Create a request to grant user table permissions.

Parameters:

username - the short user name who to grant permissions

tableName - optional table name the permissions apply

family - optional column family

qualifier - optional qualifier

actions - the permissions to be granted

Returns:

A AccessControlProtos GrantRequest

buildGrantRequest

public static AccessControlProtos.GrantRequest buildGrantRequest(String username,
                                                                 String namespace,
                                                                 boolean mergeExistingPermissions,
                                                                 AccessControlProtos.Permission.Action... actions)

Create a request to grant user namespace permissions.

Parameters:

username - the short user name who to grant permissions

namespace - optional table name the permissions apply

actions - the permissions to be granted

Returns:

A AccessControlProtos GrantRequest

buildRevokeRequest

public static AccessControlProtos.RevokeRequest buildRevokeRequest(String username,
                                                                   AccessControlProtos.Permission.Action... actions)

Create a request to revoke user global permissions.

Parameters:

username - the short user name whose permissions to be revoked

actions - the permissions to be revoked

Returns:

A AccessControlProtos RevokeRequest

buildRevokeRequest

public static AccessControlProtos.RevokeRequest buildRevokeRequest(String username,
                                                                   String namespace,
                                                                   AccessControlProtos.Permission.Action... actions)

Create a request to revoke user namespace permissions.

Parameters:

username - the short user name whose permissions to be revoked

namespace - optional table name the permissions apply

actions - the permissions to be revoked

Returns:

A AccessControlProtos RevokeRequest

buildGrantRequest

public static AccessControlProtos.GrantRequest buildGrantRequest(String username,
                                                                 boolean mergeExistingPermissions,
                                                                 AccessControlProtos.Permission.Action... actions)

Create a request to grant user global permissions.

Parameters:

username - the short user name who to grant permissions

actions - the permissions to be granted

Returns:

A AccessControlProtos GrantRequest

toUsersAndPermissions

public static AccessControlProtos.UsersAndPermissions toUsersAndPermissions(String user,
                                                                            Permission perms)

toUsersAndPermissions

public static AccessControlProtos.UsersAndPermissions toUsersAndPermissions(org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,Permission> perms)

toUsersAndPermissions

public static org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,Permission> toUsersAndPermissions(AccessControlProtos.UsersAndPermissions proto)

toTablePermission

public static TablePermission toTablePermission(AccessControlProtos.TablePermission proto)

Converts a TablePermission proto to a client TablePermission object.

Parameters:

proto - the protobuf TablePermission

Returns:

the converted TablePermission

toPermission

public static Permission toPermission(AccessControlProtos.Permission proto)

Converts a Permission proto to a client Permission object.

Parameters:

proto - the protobuf Permission

Returns:

the converted Permission

toPermission

public static AccessControlProtos.Permission toPermission(Permission perm)

Convert a client Permission to a Permission proto

Parameters:

perm - the client Permission

Returns:

the protobuf Permission

toPermissionActions

public static Permission.Action[] toPermissionActions(List<AccessControlProtos.Permission.Action> protoActions)

Converts a list of Permission.Action proto to an array of client Permission.Action objects.

Parameters:

protoActions - the list of protobuf Actions

Returns:

the converted array of Actions

toPermissionAction

public static Permission.Action toPermissionAction(AccessControlProtos.Permission.Action action)

Converts a Permission.Action proto to a client Permission.Action object.

Parameters:

action - the protobuf Action

Returns:

the converted Action

toPermissionAction

public static AccessControlProtos.Permission.Action toPermissionAction(Permission.Action action)

Convert a client Permission.Action to a Permission.Action proto

Parameters:

action - the client Action

Returns:

the protobuf Action

toUserPermission

public static AccessControlProtos.UserPermission toUserPermission(UserPermission perm)

Convert a client user permission to a user permission proto

Parameters:

perm - the client UserPermission

Returns:

the protobuf UserPermission

buildGetUserPermissionsResponse

public static AccessControlProtos.GetUserPermissionsResponse buildGetUserPermissionsResponse(List<UserPermission> permissions)

Converts the permissions list into a protocol buffer GetUserPermissionsResponse

toUserPermission

public static UserPermission toUserPermission(AccessControlProtos.UserPermission proto)

Converts a user permission proto to a client user permission object.

Parameters:

proto - the protobuf UserPermission

Returns:

the converted UserPermission

toUserTablePermissions

public static AccessControlProtos.UsersAndPermissions toUserTablePermissions(org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,UserPermission> perm)

Convert a ListMultimap<String, TablePermission> where key is username to a protobuf UserPermission

Parameters:

perm - the list of user and table permissions

Returns:

the protobuf UserTablePermissions

grant

@Deprecated
public static void grant(RpcController controller,
                                     AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                     String userShortName,
                                     boolean mergeExistingPermissions,
                                     Permission.Action... actions)
                              throws ServiceException

Deprecated. Use Admin.grant(UserPermission, boolean) instead.

A utility used to grant a user global permissions.

It's also called by the shell, in case you want to find references.

Parameters:

protocol - the AccessControlService protocol proxy

userShortName - the short name of the user to grant permissions

actions - the permissions to be granted

Throws:

ServiceException

grant

@Deprecated
public static void grant(RpcController controller,
                                     AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                     String userShortName,
                                     TableName tableName,
                                     byte[] f,
                                     byte[] q,
                                     boolean mergeExistingPermissions,
                                     Permission.Action... actions)
                              throws ServiceException

Deprecated. Use Admin.grant(UserPermission, boolean) instead.

A utility used to grant a user table permissions. The permissions will be for a table table/column family/qualifier.

It's also called by the shell, in case you want to find references.

Parameters:

protocol - the AccessControlService protocol proxy

userShortName - the short name of the user to grant permissions

tableName - optional table name

f - optional column family

q - optional qualifier

actions - the permissions to be granted

Throws:

ServiceException

grant

@Deprecated
public static void grant(RpcController controller,
                                     AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                     String userShortName,
                                     String namespace,
                                     boolean mergeExistingPermissions,
                                     Permission.Action... actions)
                              throws ServiceException

Deprecated. Use Admin.grant(UserPermission, boolean) instead.

A utility used to grant a user namespace permissions.

It's also called by the shell, in case you want to find references.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

namespace - the short name of the user to grant permissions

actions - the permissions to be granted

Throws:

ServiceException

revoke

@Deprecated
public static void revoke(RpcController controller,
                                      AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                      String userShortName,
                                      Permission.Action... actions)
                               throws ServiceException

Deprecated. Use Admin.revoke(UserPermission) instead.

A utility used to revoke a user's global permissions.

It's also called by the shell, in case you want to find references.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

userShortName - the short name of the user to revoke permissions

actions - the permissions to be revoked

Throws:

ServiceException - on failure

revoke

@Deprecated
public static void revoke(RpcController controller,
                                      AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                      String userShortName,
                                      TableName tableName,
                                      byte[] f,
                                      byte[] q,
                                      Permission.Action... actions)
                               throws ServiceException

Deprecated. Use Admin.revoke(UserPermission) instead.

A utility used to revoke a user's table permissions. The permissions will be for a table/column family/qualifier.

It's also called by the shell, in case you want to find references.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

userShortName - the short name of the user to revoke permissions

tableName - optional table name

f - optional column family

q - optional qualifier

actions - the permissions to be revoked

Throws:

ServiceException - on failure

revoke

@Deprecated
public static void revoke(RpcController controller,
                                      AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                      String userShortName,
                                      String namespace,
                                      Permission.Action... actions)
                               throws ServiceException

Deprecated. Use Admin.revoke(UserPermission) instead.

A utility used to revoke a user's namespace permissions.

It's also called by the shell, in case you want to find references.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

userShortName - the short name of the user to revoke permissions

namespace - optional table name

actions - the permissions to be revoked

Throws:

ServiceException - on failure

getUserPermissions

@Deprecated
public static List<UserPermission> getUserPermissions(RpcController controller,
                                                                  AccessControlProtos.AccessControlService.BlockingInterface protocol)
                                                           throws ServiceException

Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.

A utility used to get user's global permissions.

It's also called by the shell, in case you want to find references.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

Throws:

ServiceException - on failure

getUserPermissions

@Deprecated
public static List<UserPermission> getUserPermissions(RpcController controller,
                                                                  AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                                                  String userName)
                                                           throws ServiceException

Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.

A utility used to get user's global permissions based on the specified user name.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

userName - User name, if empty then all user permissions will be retrieved.

Throws:

ServiceException

getUserPermissions

@Deprecated
public static List<UserPermission> getUserPermissions(RpcController controller,
                                                                  AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                                                  TableName t)
                                                           throws ServiceException

Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.

A utility used to get user table permissions.

It's also called by the shell, in case you want to find references.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

t - optional table name

Throws:

ServiceException

getUserPermissions

@Deprecated
public static List<UserPermission> getUserPermissions(RpcController controller,
                                                                  AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                                                  TableName t,
                                                                  byte[] columnFamily,
                                                                  byte[] columnQualifier,
                                                                  String userName)
                                                           throws ServiceException

Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.

A utility used to get user table permissions based on the column family, column qualifier and user name.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

t - optional table name

columnFamily - Column family

columnQualifier - Column qualifier

userName - User name, if empty then all user permissions will be retrieved.

Throws:

ServiceException

getUserPermissions

@Deprecated
public static List<UserPermission> getUserPermissions(RpcController controller,
                                                                  AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                                                  byte[] namespace)
                                                           throws ServiceException

Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.

A utility used to get permissions for selected namespace.

It's also called by the shell, in case you want to find references.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

namespace - name of the namespace

Throws:

ServiceException

getUserPermissions

@Deprecated
public static List<UserPermission> getUserPermissions(RpcController controller,
                                                                  AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                                                  byte[] namespace,
                                                                  String userName)
                                                           throws ServiceException

Deprecated. Use Admin.getUserPermissions(GetUserPermissionsRequest) instead.

A utility used to get permissions for selected namespace based on the specified user name.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

namespace - name of the namespace

userName - User name, if empty then all user permissions will be retrieved.

Throws:

ServiceException

hasPermission

@Deprecated
public static boolean hasPermission(RpcController controller,
                                                AccessControlProtos.AccessControlService.BlockingInterface protocol,
                                                TableName tableName,
                                                byte[] columnFamily,
                                                byte[] columnQualifier,
                                                String userName,
                                                Permission.Action[] actions)
                                         throws ServiceException

Deprecated. Use Admin.hasUserPermissions(String, List) instead.

Validates whether specified user has permission to perform actions on the mentioned table, column family or column qualifier.

Parameters:

controller - RpcController

protocol - the AccessControlService protocol proxy

tableName - Table name, it shouldn't be null or empty.

columnFamily - The column family. Optional argument, can be empty. If empty then validation will happen at table level.

columnQualifier - The column qualifier. Optional argument, can be empty. If empty then validation will happen at table and column family level. columnQualifier will not be considered if columnFamily is passed as null or empty.

userName - User name, it shouldn't be null or empty.

actions - Actions

Returns:

true if access allowed, otherwise false

Throws:

ServiceException

toUserPermission

public static org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,UserPermission> toUserPermission(AccessControlProtos.UsersAndPermissions proto)

Convert a protobuf UserTablePermissions to a ListMultimap<Username, UserPermission>

Parameters:

proto - the proto UsersAndPermissions

Returns:

a ListMultimap with user and its permissions

toPermission

public static org.apache.hbase.thirdparty.com.google.common.collect.ListMultimap<String,Permission> toPermission(AccessControlProtos.UsersAndPermissions proto)

Convert a protobuf UserTablePermissions to a ListMultimap<Username, Permission>

Parameters:

proto - the proto UsersAndPermissions

Returns:

a ListMultimap with user and its permissions

buildRevokeRequest

public static AccessControlProtos.RevokeRequest buildRevokeRequest(String username,
                                                                   TableName tableName,
                                                                   byte[] family,
                                                                   byte[] qualifier,
                                                                   AccessControlProtos.Permission.Action... actions)

Create a request to revoke user table permissions.

Parameters:

username - the short user name whose permissions to be revoked

tableName - optional table name the permissions apply

family - optional column family

qualifier - optional qualifier

actions - the permissions to be revoked

Returns:

A AccessControlProtos RevokeRequest