[
https://issues.apache.org/jira/browse/HBASE-12644?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14237426#comment-14237426
]
ramkrishna.s.vasudevan commented on HBASE-12644:
------------------------------------------------
[~jerryhe]
Thanks for the patch. So for the automatic way of updation to happen can we now
change this addition of super users to the start() of VC as part of
RegionServerObserver itself then? I think that would make sense rather than
calling every time during region open intialization? But even if it is part of
region we could still have a contains check before adding, but what would make
more sense?
> Visibility Labels: issue with storing super users in labels table
> -----------------------------------------------------------------
>
> Key: HBASE-12644
> URL: https://issues.apache.org/jira/browse/HBASE-12644
> Project: HBase
> Issue Type: Bug
> Components: security
> Affects Versions: 0.98.8, 0.99.2
> Reporter: Jerry He
> Assignee: Jerry He
> Fix For: 1.0.0, 0.98.9
>
> Attachments: HBASE-12644-master.patch
>
>
> Super users have all the permissions for ACL and Visibility labels.
> They are defined in hbase-site.xml.
> Currently in VisibilityController, we persist super user with their system
> permission in hbase:labels.
> This makes change in super user difficult.
> There are two issues:
> In the current DefaultVisibilityLabelServiceImpl.addSystemLabel, we only add
> super user when we initially create the 'system' label.
> No additional update after that even if super user changed. See code for
> details.
>
> Additionally, there is no mechanism to remove any super user from the labels
> table.
>
> We probably should not persist super users in the labels table.
> They are in hbase-site.xml and can just stay in labelsCache and used from
> labelsCache after retrieval by Visibility Controller.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
