You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@hbase.apache.org by Simon Mottram <Si...@cucumber.co.nz> on 2019/09/03 00:59:24 UTC
Equivalent of Row Level Security for HBase
Hi
I'm a Java developer, very new to HBase and could use some directions
I'm working on a project where we have a combination of sparse
data columns (1000's) with added headaches of multi-tenancy/row level
security. Initially the database will be small but in the near/medium
future will expand to millions. Hbase looks great for sparse nature of
the the back end and looks perfect for the expected data load but I
need to check that we can support the customer's
security requirements.
Shared Data
===========
Each record in the table must be secured but it could be multiple
tenants for a record. Think 'shared' data.
So for example if you had 3 records
record1, some data columns
record2, some data columns, not all shared with record1
record3, some data columns, not all same as 1 and 2
We need
userGroup1 to be able to see record1 and record2
userGroup2 to be able to see record2 and record3
How would you handle this in HBase? Off the top of my head We could:
1) use a Table per user group and do UNION queries, I have strong
reservations about performance here as a fundamental reason for the
system is to perform aggregations such as averages, standard deviations
etc across the data. Think userGroups = bunches of
statisticians/scientists. Also the sparse data structure will make
unions problematic I think.
2) 'Row' level security. Can we customise the ACL system to allow the
equivalent of multiple tenants per record?
3) None of the above ?
Best Regards
Simon
Re: Equivalent of Row Level Security for HBase
Posted by Simon Mottram <Si...@cucumber.co.nz>.
Hi Reid
Thanks very much for taking the time to reply.
It looks as if you can give multiple users permissions on the cell
level which would seem to open the door to effective RLS. It would
mean having to set ACL on each cell individually which is a bit clunky
but sounds like it's a good way to go if there's no 'cleaner'
alternative.
Cell Visibility also looks good, so I can do something like:
CellVisibility is an expression that can contain visibility labels
combined with logical operators AND(&), OR(|) and NOT(!)
For example, to label the cell to be accessible by a user who is
granted either ‘private’ or ‘topsecrete’ label,
put.setCellVisibility(new CellVisibility(“userGroup1|userGroup2”))
Good to have a backstop, thanks!
S
On Tue, 2019-09-03 at 02:44 +0000, Reid Chan wrote:
> HBase has `Cell` level ACL which is much more fine-grained than `Row`
> level, I think it may suit your need.
>
> There's also one feature --- Visibility Labels:
> http://hbase.apache.org/book.html#hbase.visibility.labels, you might
> want to take a shot.
>
>
>
>
> --------------------------
>
> Best regards,
> R.C
>
>
>
> ________________________________________
> From: Simon Mottram <Si...@cucumber.co.nz>
> Sent: 03 September 2019 08:59
> To: user@hbase.apache.org
> Subject: Equivalent of Row Level Security for HBase
>
> Hi
>
> I'm a Java developer, very new to HBase and could use some directions
>
> I'm working on a project where we have a combination of sparse
> data columns (1000's) with added headaches of multi-tenancy/row level
> security. Initially the database will be small but in the near/medium
> future will expand to millions. Hbase looks great for sparse nature
> of
> the the back end and looks perfect for the expected data load but I
> need to check that we can support the customer's
> security requirements.
>
> Shared Data
> ===========
> Each record in the table must be secured but it could be multiple
> tenants for a record. Think 'shared' data.
>
> So for example if you had 3 records
>
> record1, some data columns
> record2, some data columns, not all shared with record1
> record3, some data columns, not all same as 1 and 2
>
> We need
> userGroup1 to be able to see record1 and record2
> userGroup2 to be able to see record2 and record3
>
> How would you handle this in HBase? Off the top of my head We could:
>
> 1) use a Table per user group and do UNION queries, I have strong
> reservations about performance here as a fundamental reason for the
> system is to perform aggregations such as averages, standard
> deviations
> etc across the data. Think userGroups = bunches of
> statisticians/scientists. Also the sparse data structure will make
> unions problematic I think.
>
> 2) 'Row' level security. Can we customise the ACL system to allow the
> equivalent of multiple tenants per record?
>
> 3) None of the above ?
>
>
> Best Regards
>
> Simon
Re: Equivalent of Row Level Security for HBase
Posted by Reid Chan <re...@outlook.com>.
HBase has `Cell` level ACL which is much more fine-grained than `Row` level, I think it may suit your need.
There's also one feature --- Visibility Labels: http://hbase.apache.org/book.html#hbase.visibility.labels, you might want to take a shot.
--------------------------
Best regards,
R.C
________________________________________
From: Simon Mottram <Si...@cucumber.co.nz>
Sent: 03 September 2019 08:59
To: user@hbase.apache.org
Subject: Equivalent of Row Level Security for HBase
Hi
I'm a Java developer, very new to HBase and could use some directions
I'm working on a project where we have a combination of sparse
data columns (1000's) with added headaches of multi-tenancy/row level
security. Initially the database will be small but in the near/medium
future will expand to millions. Hbase looks great for sparse nature of
the the back end and looks perfect for the expected data load but I
need to check that we can support the customer's
security requirements.
Shared Data
===========
Each record in the table must be secured but it could be multiple
tenants for a record. Think 'shared' data.
So for example if you had 3 records
record1, some data columns
record2, some data columns, not all shared with record1
record3, some data columns, not all same as 1 and 2
We need
userGroup1 to be able to see record1 and record2
userGroup2 to be able to see record2 and record3
How would you handle this in HBase? Off the top of my head We could:
1) use a Table per user group and do UNION queries, I have strong
reservations about performance here as a fundamental reason for the
system is to perform aggregations such as averages, standard deviations
etc across the data. Think userGroups = bunches of
statisticians/scientists. Also the sparse data structure will make
unions problematic I think.
2) 'Row' level security. Can we customise the ACL system to allow the
equivalent of multiple tenants per record?
3) None of the above ?
Best Regards
Simon