You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@accumulo.apache.org by "David Medinets (Created) (JIRA)" <ji...@apache.org> on 2012/01/22 00:55:39 UTC
[jira] [Created] (ACCUMULO-343) Using non-existant visibility with
command-line insert should display error message.
Using non-existant visibility with command-line insert should display error message.
------------------------------------------------------------------------------------
Key: ACCUMULO-343
URL: https://issues.apache.org/jira/browse/ACCUMULO-343
Project: Accumulo
Issue Type: Improvement
Reporter: David Medinets
Priority: Minor
When I inserted a record with a visibility label that was undefined, nothing happens. These are the steps I followed:
{noformat}
$ start the command line client.
> createtable test
test> insert florida george age 50 -l readable
test> scan
{noformat}
Notice that there are no error messages or inserted records. Now let's define the visibility label and try again.
{noformat}
test> setauths -u root -s readable
test> insert florida george age 50 -l readable
test> scan
florida george:age [readable] 50
{noformat}
Once the visibility is defined, the record is properly inserted.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (ACCUMULO-343) Using non-existant visibility with
command-line insert should display error message.
Posted by "John Vines (Resolved) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ACCUMULO-343?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
John Vines resolved ACCUMULO-343.
---------------------------------
Resolution: Won't Fix
We do not keep any sort of list of visibilities, so this is not a possibility. Furthermore there is no definition of visibilities, so there is no such thing as defined and undefined visibilities, so it's not possible.
The closest thing to what you want to do is probably achieved via the visibility constraint. This constraint prevents a user from insert any piece of data that they cannot view themselves. However, it still leaves them the possibility of inserting a record with a visibility they can see, but do not hold the authorizations for every visibility present. Check out the README.visibility for an example of it (I think that's the readme name).
> Using non-existant visibility with command-line insert should display error message.
> ------------------------------------------------------------------------------------
>
> Key: ACCUMULO-343
> URL: https://issues.apache.org/jira/browse/ACCUMULO-343
> Project: Accumulo
> Issue Type: Improvement
> Reporter: David Medinets
> Priority: Minor
>
> When I inserted a record with a visibility label that was undefined, nothing happens. These are the steps I followed:
> {noformat}
> $ start the command line client.
> > createtable test
> test> insert florida george age 50 -l readable
> test> scan
> {noformat}
> Notice that there are no error messages or inserted records. Now let's define the visibility label and try again.
> {noformat}
> test> setauths -u root -s readable
> test> insert florida george age 50 -l readable
> test> scan
> florida george:age [readable] 50
> {noformat}
> Once the visibility is defined, the record is properly inserted.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ACCUMULO-343) Using non-existant visibility
with command-line insert should display error message.
Posted by "David Medinets (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ACCUMULO-343?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13190590#comment-13190590 ]
David Medinets commented on ACCUMULO-343:
-----------------------------------------
In for a penny ... I've run through all of the examples and the user manual but I managed to misunderstand what was happening with the setauths command and visibility labels.
Can examples using no visibility labels (i.e., no -l option on the insert) be added to README.visibility for completeness? If there are no visibility labels is that equivalent to "public" so that anyone can see it?
Please add something like "Accumulo does not keep sort of list of visibilities. Furthermore there is no definition of visibilities, so there is no such thing as defined and undefined visibilities. This might lead to an issue with misspelled visibility labels. Keep this in mind when debugging a misbehaving application." somewhere in the README.visibility file.
Can you add a few scan examples to the "Inserting data with visibilities" section? For example,
{noformat}
# Clear authorizations
test> setauths -c
test> scan
# no records are displayed because no authorizations are set and all records in the test table have visibility labels.
test> scan -s broccoli
21 21:56:40,121 [shell.Shell] ERROR: java.lang.RuntimeException: org.apache.accumulo.core.client.AccumuloSecurityException: Error BAD_AUTHORIZATIONS - The user does not have the specified authorizations assigned
test> setauths -s apple
test> scan
# no records are displayed because the one record in the table needs both "apple" and "carrot" authorizations due to the visibility label.
test> setauths -s apple,carrot
test> scan
florida george:age [(apple&carrot)|broccoli|spinach] 50
test> setauths -s broccoli
test> scan
florida george:age [(apple&carrot)|broccoli|spinach] 50
test> setauths -s apple,carrot,broccoli
# If you have several authorizations, you can use the scan command to display only specific authorizations.
test> scan -s broccoli
florida george:age [(apple&carrot)|broccoli|spinach] 50
# Of course, the visibility logic is still applied, therefore you must specify both apple and carrot
test> scan -s apple,carrot
florida george:age [(apple&carrot)|broccoli|spinach] 50
{noformat}
Is there any way to set the VisibilityConstraint as a default constraint for all tables?
> Using non-existant visibility with command-line insert should display error message.
> ------------------------------------------------------------------------------------
>
> Key: ACCUMULO-343
> URL: https://issues.apache.org/jira/browse/ACCUMULO-343
> Project: Accumulo
> Issue Type: Improvement
> Reporter: David Medinets
> Priority: Minor
>
> When I inserted a record with a visibility label that was undefined, nothing happens. These are the steps I followed:
> {noformat}
> $ start the command line client.
> > createtable test
> test> insert florida george age 50 -l readable
> test> scan
> {noformat}
> Notice that there are no error messages or inserted records. Now let's define the visibility label and try again.
> {noformat}
> test> setauths -u root -s readable
> test> insert florida george age 50 -l readable
> test> scan
> florida george:age [readable] 50
> {noformat}
> Once the visibility is defined, the record is properly inserted.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Issue Comment Edited] (ACCUMULO-343) Using non-existant
visibility with command-line insert should display error message.
Posted by "John Vines (Issue Comment Edited) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ACCUMULO-343?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13190593#comment-13190593 ]
John Vines edited comment on ACCUMULO-343 at 1/22/12 3:29 AM:
--------------------------------------------------------------
I'm definately all for clarifying the READMEs, it's nice to get a fresh pair of eyes on them and finding the issues.
We do not currently have a mechanism in place for default constraints, nor do we plan to. However, you should be able to set a system-wide constraint, either via the site.xml file or via the same command in the example, but sans -t <tablename>. However, I put emphasis as should as we recently stumbled across some issues with constraints (I believe tickets 320-325). Most of them deal with operating at the various site/system/table levels of configuration so you may not be seeing this behavior in 1.4. I believe the biggest problem you will have with this in 1.4 and below is that the only way to disable a higher level constraint (e.g. disable a site constraint for a single table) is by putting in a new constraint for that numeration. This is because constraints are (currently) numerated and replacing that constraint # with a blank one will result in an error.
tldr; Yes, you can set them at the system level or in the site.xml file which will have it belong to all tables, but you will probably have issues disabling the constraint for a specific table.
I hope I was clear in explaining that, it is a bit late on my part. Let me know if you need any clarification.
was (Author: jvines):
I'm definately all for clarifying the READMEs, it's nice to get a fresh pair of eyes on them and finding the issues.
We do not currently have a mechanism in place for default constraints, nor do we plan to. However, you should be able to set a system-wide constraint, either via the site.xml file or via the same command in the example, but sans -t <tablename>. However, I put emphasis as should as we recently stumbled across some issues with constraints (I believe 320-325). Most of them deal with operating at the various site/system/table levels of configuration so you may not be seeing this behavior in 1.4. I believe the biggest problem you will have with this in 1.4 and below is that the only way to disable a higher level constraint (e.g. disable a site constraint for a single table) is by putting in a new constraint for that numeration. This is because constraints are (currently) numerated and replacing that constraint # with a blank one will result in an error.
tldr; Yes, you can set them at the system level or in the site.xml file which will have it belong to all tables, but you will probably have issues disabling the constraint for a specific table.
I hope I was clear in explaining that, it is a bit late on my part. Let me know if you need any clarification.
> Using non-existant visibility with command-line insert should display error message.
> ------------------------------------------------------------------------------------
>
> Key: ACCUMULO-343
> URL: https://issues.apache.org/jira/browse/ACCUMULO-343
> Project: Accumulo
> Issue Type: Improvement
> Reporter: David Medinets
> Priority: Minor
>
> When I inserted a record with a visibility label that was undefined, nothing happens. These are the steps I followed:
> {noformat}
> $ start the command line client.
> > createtable test
> test> insert florida george age 50 -l readable
> test> scan
> {noformat}
> Notice that there are no error messages or inserted records. Now let's define the visibility label and try again.
> {noformat}
> test> setauths -u root -s readable
> test> insert florida george age 50 -l readable
> test> scan
> florida george:age [readable] 50
> {noformat}
> Once the visibility is defined, the record is properly inserted.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (ACCUMULO-343) Using non-existant visibility
with command-line insert should display error message.
Posted by "John Vines (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/ACCUMULO-343?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13190593#comment-13190593 ]
John Vines commented on ACCUMULO-343:
-------------------------------------
I'm definately all for clarifying the READMEs, it's nice to get a fresh pair of eyes on them and finding the issues.
We do not currently have a mechanism in place for default constraints, nor do we plan to. However, you should be able to set a system-wide constraint, either via the site.xml file or via the same command in the example, but sans -t <tablename>. However, I put emphasis as should as we recently stumbled across some issues with constraints (I believe 320-325). Most of them deal with operating at the various site/system/table levels of configuration so you may not be seeing this behavior in 1.4. I believe the biggest problem you will have with this in 1.4 and below is that the only way to disable a higher level constraint (e.g. disable a site constraint for a single table) is by putting in a new constraint for that numeration. This is because constraints are (currently) numerated and replacing that constraint # with a blank one will result in an error.
tldr; Yes, you can set them at the system level or in the site.xml file which will have it belong to all tables, but you will probably have issues disabling the constraint for a specific table.
I hope I was clear in explaining that, it is a bit late on my part. Let me know if you need any clarification.
> Using non-existant visibility with command-line insert should display error message.
> ------------------------------------------------------------------------------------
>
> Key: ACCUMULO-343
> URL: https://issues.apache.org/jira/browse/ACCUMULO-343
> Project: Accumulo
> Issue Type: Improvement
> Reporter: David Medinets
> Priority: Minor
>
> When I inserted a record with a visibility label that was undefined, nothing happens. These are the steps I followed:
> {noformat}
> $ start the command line client.
> > createtable test
> test> insert florida george age 50 -l readable
> test> scan
> {noformat}
> Notice that there are no error messages or inserted records. Now let's define the visibility label and try again.
> {noformat}
> test> setauths -u root -s readable
> test> insert florida george age 50 -l readable
> test> scan
> florida george:age [readable] 50
> {noformat}
> Once the visibility is defined, the record is properly inserted.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira