[ https://issues.apache.org/jira/browse/HBASE-24184?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Guanghao Zhang resolved HBASE-24184. ------------------------------------ Fix Version/s: 1.7.0 Resolution: Fixed Merged to branch-1. Thanks [~tangtianhang] for contributing. > Backport HBASE-23896 to branch-1: Snapshot owner cannot delete snapshot when > ACL is enabled and Kerberos is not enabled > ----------------------------------------------------------------------------------------------------------------------- > > Key: HBASE-24184 > URL: https://issues.apache.org/jira/browse/HBASE-24184 > Project: HBase > Issue Type: Bug > Components: snapshots > Reporter: tianhang tang > Assignee: tianhang tang > Priority: Minor > Fix For: 1.7.0 > > > For the owner of snapshots(not global admin user), currently list_snapshots > returns empty if i just use simple acls for authorization but not use > authentication. > The code in AccessController.preListSnapshot: > {code:java} > if (SnapshotDescriptionUtils.isSnapshotOwner(snapshot, user)) { > // list it, if user is the owner of snapshot > AuthResult result = AuthResult.allow("listSnapshot " + snapshot.getName(), > "Snapshot owner check allowed", user, null, null, null); > accessChecker.logResult(result); > }{code} > And SnapshotManager.takeSnapshotInternal: > {code:java} > if (User.isHBaseSecurityEnabled(master.getConfiguration()) && user != null) { > builder.setOwner(user.getShortName()); > } > {code} > User.isHBaseSecurityEnabled: > {code:java} > public static boolean isHBaseSecurityEnabled(Configuration conf) { > return "kerberos".equalsIgnoreCase(conf.get(HBASE_SECURITY_CONF_KEY)); > } > {code} > So i think the logic of setOwner is used for authorization, not > authentication, SnapshotManager should not only setOwner when > hbase.security.authentication = kerberos, which cause listSnapshots returns > empty when i just use simple acls. -- This message was sent by Atlassian Jira (v8.3.4#803005)