[GitHub] [phoenix] ss77892 commented on a change in pull request #1339: PHOENIX-6579 ACL check doesn't honor the namespace mapping for mapped…

[GitBox <gi...@apache.org>]

ss77892 commented on a change in pull request #1339:
URL: https://github.com/apache/phoenix/pull/1339#discussion_r737631189



##########
File path: phoenix-core/src/main/java/org/apache/phoenix/coprocessor/PhoenixAccessController.java
##########
@@ -481,7 +481,8 @@ public void preIndexUpdate(ObserverContext<PhoenixMetaDataControllerEnvironment>
                     for (MasterObserver service : getAccessControllers()) {
                         // Use AccessControlClient API's if the accessController is an instance of org.apache.hadoop.hbase.security.access.AccessController
                         if (service.getClass().getName().equals(org.apache.hadoop.hbase.security.access.AccessController.class.getName())) {
-                            userPermissions.addAll(AccessControlClient.getUserPermissions(connection, tableName.getNameAsString()));
+                            userPermissions.addAll(AccessControlClient.getUserPermissions(connection,

Review comment:
       That was an interesting finding. We are using HBase AccessController to check whether we have permissions. The funny thing is that it uses regexp inside and it may incorrectly work with the Phoenix tables. For example: the user has access to TEST schema, but doesn't have access to the 'default' one. trying to access default:TEST.TEST table the access will be granted because he already has access to TEST:TEST. We have to check the full table name to avoid such cases. 




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@phoenix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org