[jira] [Commented] (PHOENIX-2717) Unable to login if no "create" permission in HBase

["James Taylor (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/PHOENIX-2717?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15176504#comment-15176504 ] 

James Taylor commented on PHOENIX-2717:
---------------------------------------

The code there can be updated to use the PhoenixRuntime.getTable() method instead of the try/catch. If the table.getTimeStamp() < MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP, then the TableAlreadyExistsException catch branch logic would be used. Otherwise the NewerTableAlreadyExistsException catch branch would be used. Is there also an "alter" permission for Ranger, as the upgrades that get done in the TableAlreadyExistsException would fall into that category IMO. It'd be nice if not everyone who's able to connect can trigger that logic (as it means that an upgrade from one version to another is occurring).

Would you be up for providing a patch, [~mathias.kluba]?

> Unable to login if no "create" permission in HBase
> --------------------------------------------------
>
>                 Key: PHOENIX-2717
>                 URL: https://issues.apache.org/jira/browse/PHOENIX-2717
>             Project: Phoenix
>          Issue Type: Bug
>    Affects Versions: 4.4.0
>         Environment: HDP 2.3.4
>            Reporter: mathias kluba
>            Priority: Blocker
>
> I'm using HBase with Ranger, but I guess that we could have the same issue with internal HBase permission system.
> When I try to connect to "hbase" using phoenix client, it crashes because of "Access Denied" exception.
> The phoenix client try to create the SYSTEM.CATALOG table (and other SYSTEM tables) and catch only 2 exceptions :
> NewerTableAlreadyExistsException and TableAlreadyExistsException 
> It doesn't catch the "access denied" exception.
> https://github.com/apache/phoenix/blob/master/phoenix-core/src/main/java/org/apache/phoenix/query/ConnectionQueryServicesImpl.java#L2279
> In the end, I'm not able to connect to HBase using Phoenix for read purpose, I don't need to be able to create these SYSTEM tables...
> I think that the code is a little bit dirty: it should check the existence of the table instead of trying to create it and catch exception.
> I have a workaround for now: I grant the "create" permission in Ranger for "SYSTEM.*" tables: they already exist before the user try to connect, so it's not a problem to give them this access.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)