You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@phoenix.apache.org by td...@apache.org on 2019/04/08 23:46:42 UTC
[phoenix] branch 4.x-HBase-1.2 updated: PHOENIX-5230 Fix
ChangePermissionsIT and TableDDLPermissionIT on master (addendum)
This is an automated email from the ASF dual-hosted git repository.
tdsilva pushed a commit to branch 4.x-HBase-1.2
in repository https://gitbox.apache.org/repos/asf/phoenix.git
The following commit(s) were added to refs/heads/4.x-HBase-1.2 by this push:
new 240e1d3 PHOENIX-5230 Fix ChangePermissionsIT and TableDDLPermissionIT on master (addendum)
240e1d3 is described below
commit 240e1d354b8c363b96202ff65e20a4e0d4b827ab
Author: Thomas D'Silva <td...@apache.org>
AuthorDate: Mon Apr 8 16:45:52 2019 -0700
PHOENIX-5230 Fix ChangePermissionsIT and TableDDLPermissionIT on master (addendum)
---
PHOENIX-5206-v2.patch | 33 -
PHOENIX-5219.patch | 47 -
PHOENIX-5230-4.x-HBase-1.3.patch | 1510 -------------------
PHOENIX-5230.patch | 1521 --------------------
add.patch | 87 --
diff.patch | 999 -------------
phoenix-assembly/pom.xml~ | 127 --
phoenix-client/pom.xml~ | 383 -----
.../tool/ParameterizedPhoenixCanaryToolIT.java~ | 280 ----
pom.xml~ | 1086 --------------
take2.patch | 207 ---
test_failures.patch | 1085 --------------
workin.patch | 620 --------
13 files changed, 7985 deletions(-)
diff --git a/PHOENIX-5206-v2.patch b/PHOENIX-5206-v2.patch
deleted file mode 100644
index ec6c9f3..0000000
--- a/PHOENIX-5206-v2.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3868b5da401f13a33242bb7edaf727fb2fe23a5e Mon Sep 17 00:00:00 2001
-From: Thomas D'Silva <td...@apache.org>
-Date: Fri, 22 Mar 2019 15:33:13 -0700
-Subject: [PATCH] PHOENIX-5206 Ignore failing PhoenixTracingEndToEndIT tests
-
----
- .../src/it/java/org/apache/phoenix/trace/PhoenixTracingEndToEndIT.java | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/trace/PhoenixTracingEndToEndIT.java b/phoenix-core/src/it/java/org/apache/phoenix/trace/PhoenixTracingEndToEndIT.java
-index 03510dc4f..610195aec 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/trace/PhoenixTracingEndToEndIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/trace/PhoenixTracingEndToEndIT.java
-@@ -41,6 +41,7 @@ import org.apache.phoenix.jdbc.PhoenixConnection;
- import org.apache.phoenix.trace.TraceReader.SpanInfo;
- import org.apache.phoenix.trace.TraceReader.TraceHolder;
- import org.junit.Before;
-+import org.junit.Ignore;
- import org.junit.Test;
-
- import com.google.common.collect.ImmutableMap;
-@@ -48,7 +49,7 @@ import com.google.common.collect.ImmutableMap;
- /**
- * Test that the logging sink stores the expected metrics/stats
- */
--
-+@Ignore("Will need to revisit for new HDFS/HBase/HTrace, broken on 5.x")
- public class PhoenixTracingEndToEndIT extends BaseTracingTestIT {
-
- private static final Log LOG = LogFactory.getLog(PhoenixTracingEndToEndIT.class);
---
-2.15.1
-
diff --git a/PHOENIX-5219.patch b/PHOENIX-5219.patch
deleted file mode 100644
index 0099a2e..0000000
--- a/PHOENIX-5219.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From e773a24925f219646a7c40111b0d4144ee66e022 Mon Sep 17 00:00:00 2001
-From: Thomas D'Silva <td...@apache.org>
-Date: Thu, 28 Mar 2019 16:36:30 -0700
-Subject: [PATCH] Fix ConcurrentMutationsIT testLockUntilMVCCAdvanced and
- testRowLockDuringPreBatchMutateWhenIndexed failures on the master branch
-
----
- .../src/main/java/org/apache/phoenix/hbase/index/Indexer.java | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/phoenix-core/src/main/java/org/apache/phoenix/hbase/index/Indexer.java b/phoenix-core/src/main/java/org/apache/phoenix/hbase/index/Indexer.java
-index 8c5184a8c..c34ffd2e0 100644
---- a/phoenix-core/src/main/java/org/apache/phoenix/hbase/index/Indexer.java
-+++ b/phoenix-core/src/main/java/org/apache/phoenix/hbase/index/Indexer.java
-@@ -33,6 +33,7 @@ import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
- import org.apache.hadoop.conf.Configuration;
- import org.apache.hadoop.hbase.Cell;
-+import org.apache.hadoop.hbase.CellUtil;
- import org.apache.hadoop.hbase.CoprocessorEnvironment;
- import org.apache.hadoop.hbase.HConstants;
- import org.apache.hadoop.hbase.HConstants.OperationStatusCode;
-@@ -424,7 +425,6 @@ public class Indexer implements RegionObserver, RegionCoprocessor {
- ReplayWrite replayWrite = this.builder.getReplayWrite(firstMutation);
- boolean resetTimeStamp = replayWrite == null;
- long now = EnvironmentEdgeManager.currentTimeMillis();
-- byte[] byteNow = Bytes.toBytes(now);
- for (int i = 0; i < miniBatchOp.size(); i++) {
- Mutation m = miniBatchOp.getOperation(i);
- // skip this mutation if we aren't enabling indexing
-@@ -436,10 +436,9 @@ public class Indexer implements RegionObserver, RegionCoprocessor {
- // Unless we're replaying edits to rebuild the index, we update the time stamp
- // of the data table to prevent overlapping time stamps (which prevents index
- // inconsistencies as this case isn't handled correctly currently).
-- for (List<Cell> family : m.getFamilyCellMap().values()) {
-- List<KeyValue> familyKVs = KeyValueUtil.ensureKeyValues(family);
-- for (KeyValue kv : familyKVs) {
-- setTimeStamp(kv, byteNow);
-+ for (List<Cell> cells : m.getFamilyCellMap().values()) {
-+ for (Cell cell : cells) {
-+ CellUtil.setTimestamp(cell, now);
- }
- }
- }
---
-2.15.1
-
diff --git a/PHOENIX-5230-4.x-HBase-1.3.patch b/PHOENIX-5230-4.x-HBase-1.3.patch
deleted file mode 100644
index d5d1eab..0000000
--- a/PHOENIX-5230-4.x-HBase-1.3.patch
+++ /dev/null
@@ -1,1510 +0,0 @@
-From 7ebc59a37516c88d94d3889cd695e6ee5b67f3fc Mon Sep 17 00:00:00 2001
-From: Thomas D'Silva <td...@apache.org>
-Date: Thu, 4 Apr 2019 16:34:24 -0700
-Subject: [PATCH] PHOENIX-5230 Fix ChangePermissionsIT and TableDDLPermissionIT
- on master
-
----
- .../apache/phoenix/end2end/BasePermissionsIT.java | 661 ++++++++++++++++++---
- .../phoenix/end2end/ChangePermissionsIT.java | 294 ---------
- .../phoenix/end2end/PermissionNSDisabledIT.java | 15 +
- .../phoenix/end2end/PermissionNSEnabledIT.java | 16 +
- .../phoenix/end2end/SystemTablePermissionsIT.java | 131 ----
- .../phoenix/end2end/TableDDLPermissionsIT.java | 232 --------
- .../tool/ParameterizedPhoenixCanaryToolIT.java | 1 -
- 7 files changed, 606 insertions(+), 744 deletions(-)
- delete mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
- create mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSDisabledIT.java
- create mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSEnabledIT.java
- delete mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
- delete mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-index 932ce9f1e..c85d32262 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-@@ -16,61 +16,67 @@
- */
- package org.apache.phoenix.end2end;
-
--import static org.junit.Assert.assertEquals;
--import static org.junit.Assert.assertFalse;
--import static org.junit.Assert.assertNotNull;
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.io.IOException;
--import java.lang.reflect.UndeclaredThrowableException;
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.PreparedStatement;
--import java.sql.ResultSet;
--import java.sql.SQLException;
--import java.sql.Statement;
--import java.util.Arrays;
--import java.util.Collection;
--import java.util.Collections;
--import java.util.HashSet;
--import java.util.List;
--import java.util.Properties;
--import java.util.Set;
--
-+import com.google.common.base.Joiner;
-+import com.google.common.base.Throwables;
- import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
- import org.apache.hadoop.conf.Configuration;
- import org.apache.hadoop.hbase.AuthUtil;
- import org.apache.hadoop.hbase.HBaseTestingUtility;
- import org.apache.hadoop.hbase.HConstants;
-+import org.apache.hadoop.hbase.LocalHBaseCluster;
-+import org.apache.hadoop.hbase.NamespaceDescriptor;
- import org.apache.hadoop.hbase.TableName;
- import org.apache.hadoop.hbase.security.AccessDeniedException;
- import org.apache.hadoop.hbase.security.User;
- import org.apache.hadoop.hbase.security.access.AccessControlClient;
- import org.apache.hadoop.hbase.security.access.Permission;
-+import org.apache.phoenix.coprocessor.MetaDataProtocol;
- import org.apache.phoenix.jdbc.PhoenixConnection;
- import org.apache.phoenix.jdbc.PhoenixDatabaseMetaData;
- import org.apache.phoenix.jdbc.PhoenixStatement;
- import org.apache.phoenix.query.BaseTest;
- import org.apache.phoenix.query.QueryConstants;
- import org.apache.phoenix.query.QueryServices;
-+import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
-+import org.apache.phoenix.schema.TableNotFoundException;
- import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.After;
--import org.junit.BeforeClass;
--import org.junit.runner.RunWith;
--import org.junit.runners.Parameterized;
-+import org.apache.phoenix.util.SchemaUtil;
-+import org.junit.Before;
-+import org.junit.FixMethodOrder;
-+import org.junit.Test;
-+import org.junit.experimental.categories.Category;
-+import org.junit.runners.MethodSorters;
-
--import com.google.common.base.Joiner;
--import com.google.common.base.Throwables;
-+import java.io.IOException;
-+import java.lang.reflect.UndeclaredThrowableException;
-+import java.security.PrivilegedExceptionAction;
-+import java.sql.Connection;
-+import java.sql.DriverManager;
-+import java.sql.PreparedStatement;
-+import java.sql.ResultSet;
-+import java.sql.SQLException;
-+import java.sql.Statement;
-+import java.util.Arrays;
-+import java.util.Collections;
-+import java.util.HashSet;
-+import java.util.List;
-+import java.util.Properties;
-+import java.util.Set;
-+
-+import static org.junit.Assert.assertEquals;
-+import static org.junit.Assert.assertFalse;
-+import static org.junit.Assert.assertNotNull;
-+import static org.junit.Assert.assertTrue;
-+import static org.junit.Assert.fail;
-
--@RunWith(Parameterized.class)
-+@Category(NeedsOwnMiniClusterTest.class)
-+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
- public class BasePermissionsIT extends BaseTest {
-
- private static final Log LOG = LogFactory.getLog(BasePermissionsIT.class);
-
-- static String SUPERUSER;
-+ static String SUPERUSER = System.getProperty("user.name");
-
- static HBaseTestingUtility testUtil;
- static final Set<String> PHOENIX_SYSTEM_TABLES =
-@@ -97,8 +103,8 @@ public class BasePermissionsIT extends BaseTest {
- // Instead use org.apache.hadoop.hbase.security.User class for testing purposes.
-
- // Super User has all the access
-- User superUser1 = null;
-- User superUser2 = null;
-+ static User superUser1 = null;
-+ static User superUser2 = null;
-
- // Regular users are granted and revoked permissions as needed
- User regularUser1 = null;
-@@ -118,20 +124,22 @@ public class BasePermissionsIT extends BaseTest {
-
- boolean isNamespaceMapped;
-
-+ private String schemaName;
-+ private String tableName;
-+ private String fullTableName;
-+ private String idx1TableName;
-+ private String idx2TableName;
-+ private String idx3TableName;
-+ private String localIdx1TableName;
-+ private String view1TableName;
-+ private String view2TableName;
-+
- public BasePermissionsIT(final boolean isNamespaceMapped) throws Exception {
- this.isNamespaceMapped = isNamespaceMapped;
-+ this.tableName = generateUniqueName();
- }
-
-- @BeforeClass
-- public static void doSetup() throws Exception {
-- SUPERUSER = System.getProperty("user.name");
-- }
--
-- void startNewMiniCluster() throws Exception {
-- startNewMiniCluster(new Configuration());
-- }
--
-- void startNewMiniCluster(Configuration overrideConf) throws Exception{
-+ public static void doSetup(boolean isNamespaceMapped) throws Exception {
- if (null != testUtil) {
- testUtil.shutdownMiniCluster();
- testUtil = null;
-@@ -141,37 +149,45 @@ public class BasePermissionsIT extends BaseTest {
-
- Configuration config = testUtil.getConfiguration();
- enablePhoenixHBaseAuthorization(config);
-- configureNamespacesOnServer(config);
-- configureRandomHMasterPort(config);
-- if (overrideConf != null) {
-- config.addResource(overrideConf);
-- }
-+ configureNamespacesOnServer(config, isNamespaceMapped);
-+ config.setInt(HConstants.MASTER_INFO_PORT, -1);
-
- testUtil.startMiniCluster(1);
-- initializeUsers(testUtil.getConfiguration());
-- }
--
-- private void initializeUsers(Configuration configuration) {
--
-- superUser1 = User.createUserForTesting(configuration, SUPERUSER, new String[0]);
-- superUser2 = User.createUserForTesting(configuration, "superUser2", new String[0]);
--
-- regularUser1 = User.createUserForTesting(configuration, "regularUser1", new String[0]);
-- regularUser2 = User.createUserForTesting(configuration, "regularUser2", new String[0]);
-- regularUser3 = User.createUserForTesting(configuration, "regularUser3", new String[0]);
-- regularUser4 = User.createUserForTesting(configuration, "regularUser4", new String[0]);
--
-- groupUser = User.createUserForTesting(testUtil.getConfiguration(), "groupUser", new String[] {GROUP_SYSTEM_ACCESS});
--
-- unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser", new String[0]);
-+ superUser1 = User.createUserForTesting(config, SUPERUSER, new String[0]);
-+ superUser2 = User.createUserForTesting(config, "superUser2", new String[0]);
- }
-
-- private void configureRandomHMasterPort(Configuration config) {
-- // Avoid multiple clusters trying to bind the master's info port (16010)
-- config.setInt(HConstants.MASTER_INFO_PORT, -1);
-+ @Before
-+ public void setUp() {
-+ Configuration configuration = testUtil.getConfiguration();
-+
-+ regularUser1 = User.createUserForTesting(configuration, "regularUser1_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser2 = User.createUserForTesting(configuration, "regularUser2_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser3 = User.createUserForTesting(configuration, "regularUser3_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser4 = User.createUserForTesting(configuration, "regularUser4_"
-+ + generateUniqueName(), new String[0]);
-+
-+ groupUser = User.createUserForTesting(testUtil.getConfiguration(), "groupUser_"
-+ + generateUniqueName() , new String[] {GROUP_SYSTEM_ACCESS});
-+
-+ unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser_"
-+ + generateUniqueName(), new String[0]);
-+
-+ schemaName = generateUniqueName();
-+ tableName = generateUniqueName();
-+ fullTableName = schemaName + "." + tableName;
-+ idx1TableName = tableName + "_IDX1";
-+ idx2TableName = tableName + "_IDX2";
-+ idx3TableName = tableName + "_IDX3";
-+ localIdx1TableName = tableName + "_LIDX1";
-+ view1TableName = tableName + "_V1";
-+ view2TableName = tableName + "_V2";
- }
-
-- void enablePhoenixHBaseAuthorization(Configuration config) {
-+ private static void enablePhoenixHBaseAuthorization(Configuration config) {
- config.set("hbase.superuser", SUPERUSER + "," + "superUser2");
- config.set("hbase.security.authorization", Boolean.TRUE.toString());
- config.set("hbase.security.exec.permission.checks", Boolean.TRUE.toString());
-@@ -187,23 +203,10 @@ public class BasePermissionsIT extends BaseTest {
- config.set("hbase.regionserver.wal.codec", "org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec");
- }
-
-- void configureNamespacesOnServer(Configuration conf) {
-+ private static void configureNamespacesOnServer(Configuration conf, boolean isNamespaceMapped) {
- conf.set(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
- }
-
-- @Parameterized.Parameters(name = "isNamespaceMapped={0}") // name is used by failsafe as file name in reports
-- public static Collection<Boolean> data() {
-- return Arrays.asList(false, true);
-- }
--
-- @After
-- public void cleanup() throws Exception {
-- if (testUtil != null) {
-- testUtil.shutdownMiniCluster();
-- testUtil = null;
-- }
-- }
--
- public static HBaseTestingUtility getUtility(){
- return testUtil;
- }
-@@ -689,8 +692,8 @@ public class BasePermissionsIT extends BaseTest {
- }
- }
-
-- void verifyAllowed(User user, TableDDLPermissionsIT.AccessTestAction... actions) throws Exception {
-- for (TableDDLPermissionsIT.AccessTestAction action : actions) {
-+ void verifyAllowed(User user, AccessTestAction... actions) throws Exception {
-+ for (AccessTestAction action : actions) {
- try {
- Object obj = user.runAs(action);
- if (obj != null && obj instanceof List<?>) {
-@@ -716,8 +719,8 @@ public class BasePermissionsIT extends BaseTest {
- }
-
- /** This passes only if desired exception is caught for all users. */
-- <T> void verifyDenied(User user, Class<T> exception, TableDDLPermissionsIT.AccessTestAction... actions) throws Exception {
-- for (TableDDLPermissionsIT.AccessTestAction action : actions) {
-+ <T> void verifyDenied(User user, Class<T> exception, AccessTestAction... actions) throws Exception {
-+ for (AccessTestAction action : actions) {
- try {
- user.runAs(action);
- fail("Expected exception was not thrown for user '" + user.getShortName() + "'");
-@@ -761,4 +764,490 @@ public class BasePermissionsIT extends BaseTest {
- assertTrue("Exception contained unexpected message: '" + msg + "'",
- !msg.contains("is not the scanner owner"));
- }
-+
-+ @Test
-+ public void testSystemTablePermissions() throws Throwable {
-+ verifyAllowed(createTable(tableName), superUser1);
-+ verifyAllowed(readTable(tableName), superUser1);
-+
-+ Set<String> tables = getHBaseTables();
-+ if(isNamespaceMapped) {
-+ assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-+ tables.containsAll(PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES));
-+ } else {
-+ assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-+ tables.containsAll(PHOENIX_SYSTEM_TABLES));
-+ }
-+
-+ // Grant permission to the system tables for the unprivileged user
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ if(isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(),
-+ PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Permission.Action.EXEC, Permission.Action.READ);
-+ } else {
-+ grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES,
-+ Permission.Action.EXEC, Permission.Action.READ);
-+ }
-+ grantPermissions(regularUser1.getShortName(),
-+ Collections.singleton(tableName), Permission.Action.READ,Permission.Action.EXEC);
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception) e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+
-+ // Make sure that the unprivileged user can now read the table
-+ verifyAllowed(readTable(tableName), regularUser1);
-+ //This verification is added to test PHOENIX-5178
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override public Void run() throws Exception {
-+ try {
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(),"SYSTEM", Permission.Action.ADMIN);
-+ }
-+ return null;
-+ } catch (Throwable e) {
-+ throw new Exception(e);
-+ }
-+
-+ }
-+ });
-+ if(isNamespaceMapped) {
-+ verifyAllowed(new AccessTestAction() {
-+ @Override public Object run() throws Exception {
-+ Properties props = new Properties();
-+ props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-+ props.setProperty(PhoenixRuntime.CURRENT_SCN_ATTRIB, Long.toString(MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP));
-+ //Impersonate meta connection
-+ try (Connection metaConnection = DriverManager.getConnection(getUrl(), props);
-+ Statement stmt = metaConnection.createStatement()) {
-+ stmt.executeUpdate("CREATE SCHEMA IF NOT EXISTS SYSTEM");
-+ }catch(NewerSchemaAlreadyExistsException e){
-+
-+ }
-+ return null;
-+ }
-+ }, regularUser1);
-+ }
-+ }
-+
-+ private void grantSystemTableAccess(User superUser, User... users) throws Exception {
-+ for(User user : users) {
-+ if(isNamespaceMapped) {
-+ verifyAllowed(grantPermissions("RX", user, QueryConstants.SYSTEM_SCHEMA_NAME, true), superUser);
-+ } else {
-+ verifyAllowed(grantPermissions("RX", user, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser);
-+ }
-+ verifyAllowed(grantPermissions("RWX", user, SYSTEM_SEQUENCE_IDENTIFIER, false), superUser);
-+ verifyAllowed(grantPermissions("RWX", user, SYSTEM_MUTEX_IDENTIFIER, false), superUser);
-+ }
-+ }
-+
-+ private void revokeSystemTableAccess(User superUser, User... users) throws Exception {
-+ for(User user : users) {
-+ if(isNamespaceMapped) {
-+ verifyAllowed(revokePermissions(user, QueryConstants.SYSTEM_SCHEMA_NAME, true), superUser);
-+ } else {
-+ verifyAllowed(revokePermissions(user, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser);
-+ }
-+ verifyAllowed(revokePermissions(user, SYSTEM_SEQUENCE_IDENTIFIER, false), superUser);
-+ verifyAllowed(revokePermissions(user, SYSTEM_MUTEX_IDENTIFIER, false), superUser);
-+ }
-+ }
-+
-+ /**
-+ * Verify that READ and EXECUTE permissions are required on SYSTEM tables to get a Phoenix Connection
-+ * Tests grant revoke permissions per user 1. if NS enabled -> on namespace 2. If NS disabled -> on tables
-+ */
-+ @Test
-+ // this test needs to be run first
-+ public void aTestRXPermsReqdForPhoenixConn() throws Exception {
-+ if(isNamespaceMapped) {
-+ // NS is enabled, CQSI tries creating SYSCAT, we get NamespaceNotFoundException exception for "SYSTEM" NS
-+ // We create custom ADE and throw it (and ignore NamespaceNotFoundException)
-+ // This is because we didn't had CREATE perms to create "SYSTEM" NS
-+ verifyDenied(getConnectionAction(), AccessDeniedException.class, regularUser1);
-+ } else {
-+ // NS is disabled, CQSI tries creating SYSCAT, Two cases here
-+ // 1. First client ever --> Gets ADE, runs client server compatibility check again and gets TableNotFoundException since SYSCAT doesn't exist
-+ // 2. Any other client --> Gets ADE, runs client server compatibility check again and gets AccessDeniedException since it doesn't have EXEC perms
-+ verifyDenied(getConnectionAction(), TableNotFoundException.class, regularUser1);
-+ }
-+
-+ // Phoenix Client caches connection per user
-+ // If we grant permissions, get a connection and then revoke it, we can still get the cached connection
-+ // However it will fail for other read queries
-+ // Thus this test grants and revokes for 2 users, so that both functionality can be tested.
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2);
-+ verifyAllowed(getConnectionAction(), regularUser1);
-+ revokeSystemTableAccess(superUser1, regularUser2);
-+ verifyDenied(getConnectionAction(), AccessDeniedException.class, regularUser2);
-+ }
-+
-+ /**
-+ * Superuser grants admin perms to user1, who will in-turn grant admin perms to user2
-+ * Not affected with namespace props
-+ * Tests grant revoke permissions on per user global level
-+ */
-+ @Test
-+ public void testSuperUserCanChangePerms() throws Exception {
-+ // Grant System Table access to all users, else they can't create a Phoenix connection
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-+
-+ verifyAllowed(grantPermissions("A", regularUser1), superUser1);
-+
-+ verifyAllowed(readTableWithoutVerification(PhoenixDatabaseMetaData.SYSTEM_CATALOG), regularUser1);
-+ verifyAllowed(grantPermissions("A", regularUser2), regularUser1);
-+
-+ verifyAllowed(revokePermissions(regularUser1), superUser1);
-+ verifyDenied(grantPermissions("A", regularUser3), AccessDeniedException.class, regularUser1);
-+
-+ // Don't grant ADMIN perms to unprivilegedUser, thus unprivilegedUser is unable to control other permissions.
-+ verifyAllowed(getConnectionAction(), unprivilegedUser);
-+ verifyDenied(grantPermissions("ARX", regularUser4), AccessDeniedException.class, unprivilegedUser);
-+ }
-+
-+ /**
-+ * Test to verify READ permissions on table, indexes and views
-+ * Tests automatic grant revoke of permissions per user on a table
-+ */
-+ @Test
-+ public void testReadPermsOnTableIndexAndView() throws Exception {
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-+
-+ // Create new schema and grant CREATE permissions to a user
-+ if(isNamespaceMapped) {
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
-+ } else {
-+ verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(SchemaUtil.SCHEMA_FOR_DEFAULT_NAMESPACE), true), superUser1);
-+ }
-+
-+ // Create new table. Create indexes, views and view indexes on top of it. Verify the contents by querying it
-+ verifyAllowed(createTable(fullTableName), regularUser1);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, fullTableName), regularUser1);
-+ verifyAllowed(createLocalIndex(localIdx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx3TableName, view1TableName), regularUser1);
-+
-+ // RegularUser2 doesn't have any permissions. It can get a PhoenixConnection
-+ // However it cannot query table, indexes or views without READ perms
-+ verifyAllowed(getConnectionAction(), regularUser2);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName, idx1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(view1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-+
-+ // Grant READ permissions to RegularUser2 on the table
-+ // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
-+ // Granting permissions directly to index tables should fail
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + idx1TableName, false), AccessDeniedException.class, regularUser1);
-+ // Granting permissions directly to views should fail. We expect TableNotFoundException since VIEWS are not physical tables
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + view1TableName, false), TableNotFoundException.class, regularUser1);
-+
-+ // Verify that all other access are successful now
-+ verifyAllowed(readTable(fullTableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx1TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx2TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, localIdx1TableName), regularUser2);
-+ verifyAllowed(readTableWithoutVerification(schemaName + "." + idx1TableName), regularUser2);
-+ verifyAllowed(readTable(view1TableName), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName), regularUser2);
-+
-+ // Revoke READ permissions to RegularUser2 on the table
-+ // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-+ verifyAllowed(revokePermissions(regularUser2, fullTableName, false), regularUser1);
-+ // READ query should fail now
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-+ }
-+
-+ /**
-+ * Verifies permissions for users present inside a group
-+ */
-+ @Test
-+ public void testGroupUserPerms() throws Exception {
-+ if(isNamespaceMapped) {
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ }
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+
-+ // Grant SYSTEM table access to GROUP_SYSTEM_ACCESS and regularUser1
-+ verifyAllowed(grantPermissions("RX", GROUP_SYSTEM_ACCESS, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser1);
-+ grantSystemTableAccess(superUser1, regularUser1);
-+
-+ // Grant Permissions to Groups (Should be automatically applicable to all users inside it)
-+ verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyAllowed(readTable(fullTableName), groupUser);
-+
-+ // GroupUser is an admin and can grant perms to other users
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, fullTableName, false), groupUser);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-+
-+ // Revoke the perms and try accessing data again
-+ verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, groupUser);
-+ }
-+
-+ /**
-+ * Tests permissions for MultiTenant Tables and view index tables
-+ */
-+ @Test
-+ public void testMultiTenantTables() throws Exception {
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-+
-+ if(isNamespaceMapped) {
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
-+ } else {
-+ verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(SchemaUtil.SCHEMA_FOR_DEFAULT_NAMESPACE), true), superUser1);
-+ }
-+
-+ // Create MultiTenant Table (View Index Table should be automatically created)
-+ // At this point, the index table doesn't contain any data
-+ verifyAllowed(createMultiTenantTable(fullTableName), regularUser1);
-+
-+ // RegularUser2 doesn't have access yet, RegularUser1 should have RWXCA on the table
-+ verifyDenied(readMultiTenantTableWithoutIndex(fullTableName), AccessDeniedException.class, regularUser2);
-+
-+ // Grant perms to base table (Should propagate to View Index as well)
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
-+ // Try reading full table
-+ verifyAllowed(readMultiTenantTableWithoutIndex(fullTableName), regularUser2);
-+
-+ // Create tenant specific views on the table using tenant specific Phoenix Connection
-+ verifyAllowed(createView(view1TableName, fullTableName, "o1"), regularUser1);
-+ verifyAllowed(createView(view2TableName, fullTableName, "o2"), regularUser1);
-+
-+ // Create indexes on those views using tenant specific Phoenix Connection
-+ // It is not possible to create indexes on tenant specific views without tenant connection
-+ verifyAllowed(createIndex(idx1TableName, view1TableName, "o1"), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, view2TableName, "o2"), regularUser1);
-+
-+ // Read the tables as regularUser2, with and without the use of Index table
-+ // If perms are propagated correctly, then both of them should work
-+ // The test checks if the query plan uses the index table by searching for "_IDX_" string
-+ // _IDX_ is the prefix used with base table name to derieve the name of view index table
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName, "o1"), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithoutIndex(view2TableName, "o2"), regularUser2);
-+ }
-+
-+ /**
-+ * Grant RX permissions on the schema to regularUser1,
-+ * Creating view on a table with that schema by regularUser1 should be allowed
-+ */
-+ @Test
-+ public void testCreateViewOnTableWithRXPermsOnSchema() throws Exception {
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-+
-+ if(isNamespaceMapped) {
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, schemaName, true), superUser1);
-+ } else {
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, surroundWithDoubleQuotes(SchemaUtil.SCHEMA_FOR_DEFAULT_NAMESPACE), true), superUser1);
-+ }
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
-+ }
-+
-+ private void grantSystemTableAccess() throws Exception{
-+ try (Connection conn = getConnection()) {
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Permission.Action.READ,
-+ Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-+ grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+
-+ } else {
-+ grantPermissions(regularUser1.getName(), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-+ grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM.SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ }
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ }
-+
-+ @Test
-+ public void testSchemaPermissions() throws Throwable{
-+ if (!isNamespaceMapped) { return; }
-+ try {
-+ grantSystemTableAccess();
-+ final String schemaName = "TEST_SCHEMA_PERMISSION";
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ AccessControlClient.grant(getUtility().getConnection(), regularUser1.getShortName(),
-+ Permission.Action.ADMIN);
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+ verifyAllowed(createSchema(schemaName), regularUser1);
-+ // Unprivileged user cannot drop a schema
-+ verifyDenied(dropSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(createSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-+
-+ verifyAllowed(dropSchema(schemaName), regularUser1);
-+ } finally {
-+ revokeAll();
-+ }
-+ }
-+
-+ @Test
-+ public void testAutomaticGrantWithIndexAndView() throws Throwable {
-+ final String schema = "TEST_INDEX_VIEW";
-+ final String tableName = "TABLE_DDL_PERMISSION_IT";
-+ final String phoenixTableName = schema + "." + tableName;
-+ final String indexName1 = tableName + "_IDX1";
-+ final String indexName2 = tableName + "_IDX2";
-+ final String lIndexName1 = tableName + "_LIDX1";
-+ final String viewName1 = schema+"."+tableName + "_V1";
-+ final String viewName2 = schema+"."+tableName + "_V2";
-+ final String viewName3 = schema+"."+tableName + "_V3";
-+ final String viewName4 = schema+"."+tableName + "_V4";
-+ final String viewIndexName1 = tableName + "_VIDX1";
-+ final String viewIndexName2 = tableName + "_VIDX2";
-+ grantSystemTableAccess();
-+ try {
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ verifyAllowed(createSchema(schema), superUser1);
-+ //Neded Global ADMIN for flush operation during drop table
-+ AccessControlClient.grant(getUtility().getConnection(),regularUser1.getName(), Permission.Action.ADMIN);
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getName(), schema, Permission.Action.CREATE);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), schema, Permission.Action.CREATE);
-+
-+ } else {
-+ grantPermissions(regularUser1.getName(),
-+ NamespaceDescriptor.DEFAULT_NAMESPACE.getName(), Permission.Action.CREATE);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS),
-+ NamespaceDescriptor.DEFAULT_NAMESPACE.getName(), Permission.Action.CREATE);
-+
-+ }
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+
-+ verifyAllowed(createTable(phoenixTableName), regularUser1);
-+ verifyAllowed(createIndex(indexName1, phoenixTableName), regularUser1);
-+ verifyAllowed(createView(viewName1, phoenixTableName), regularUser1);
-+ verifyAllowed(createLocalIndex(lIndexName1, phoenixTableName), regularUser1);
-+ verifyAllowed(createIndex(viewIndexName1, viewName1), regularUser1);
-+ verifyAllowed(createIndex(viewIndexName2, viewName1), regularUser1);
-+ verifyAllowed(createView(viewName4, viewName1), regularUser1);
-+ verifyAllowed(readTable(phoenixTableName), regularUser1);
-+
-+ verifyDenied(createIndex(indexName2, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(createView(viewName2, phoenixTableName),AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(createView(viewName3, viewName1), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(dropView(viewName1), AccessDeniedException.class, unprivilegedUser);
-+
-+ verifyDenied(dropIndex(indexName1, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(dropTable(phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(rebuildIndex(indexName1, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(addColumn(phoenixTableName, "val1"), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(dropColumn(phoenixTableName, "val"), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), AccessDeniedException.class, unprivilegedUser);
-+
-+ // Granting read permission to unprivileged user, now he should be able to create view but not index
-+ grantPermissions(unprivilegedUser.getShortName(),
-+ Collections.singleton(
-+ SchemaUtil.getPhysicalHBaseTableName(schema, tableName, isNamespaceMapped).getString()),
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS),
-+ Collections.singleton(
-+ SchemaUtil.getPhysicalHBaseTableName(schema, tableName, isNamespaceMapped).getString()),
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ verifyDenied(createIndex(indexName2, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyAllowed(createView(viewName2, phoenixTableName), unprivilegedUser);
-+ verifyAllowed(createView(viewName3, viewName1), unprivilegedUser);
-+
-+ // Grant create permission in namespace
-+ if (isNamespaceMapped) {
-+ grantPermissions(unprivilegedUser.getShortName(), schema, Permission.Action.CREATE);
-+ } else {
-+ grantPermissions(unprivilegedUser.getShortName(), NamespaceDescriptor.DEFAULT_NAMESPACE.getName(),
-+ Permission.Action.CREATE);
-+ }
-+
-+ // we should be able to read the data from another index as well to which we have not given any access to
-+ // this user
-+ verifyAllowed(readTable(phoenixTableName, indexName1), unprivilegedUser);
-+ verifyAllowed(readTable(phoenixTableName), regularUser1);
-+ verifyAllowed(rebuildIndex(indexName1, phoenixTableName), regularUser1);
-+ verifyAllowed(addColumn(phoenixTableName, "val1"), regularUser1);
-+ verifyAllowed(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), regularUser1);
-+ verifyAllowed(dropView(viewName1), regularUser1);
-+ verifyAllowed(dropView(viewName2), regularUser1);
-+ verifyAllowed(dropColumn(phoenixTableName, "val1"), regularUser1);
-+ verifyAllowed(dropIndex(indexName1, phoenixTableName), regularUser1);
-+ verifyAllowed(dropTable(phoenixTableName), regularUser1);
-+
-+ // check again with super users
-+ verifyAllowed(createTable(phoenixTableName), superUser2);
-+ verifyAllowed(createIndex(indexName1, phoenixTableName), superUser2);
-+ verifyAllowed(createView(viewName1, phoenixTableName), superUser2);
-+ verifyAllowed(readTable(phoenixTableName), superUser2);
-+ verifyAllowed(dropView(viewName1), superUser2);
-+ verifyAllowed(dropTable(phoenixTableName), superUser2);
-+
-+ } finally {
-+ revokeAll();
-+ }
-+ }
- }
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-deleted file mode 100644
-index 7f2964dee..000000000
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-+++ /dev/null
-@@ -1,294 +0,0 @@
--/*
-- * Licensed to the Apache Software Foundation (ASF) under one or more
-- * contributor license agreements. See the NOTICE file distributed with
-- * this work for additional information regarding copyright ownership.
-- * The ASF licenses this file to you under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
--
--import org.apache.commons.logging.Log;
--import org.apache.commons.logging.LogFactory;
--import org.apache.hadoop.hbase.security.AccessDeniedException;
--import org.apache.hadoop.hbase.security.User;
--import org.apache.phoenix.jdbc.PhoenixDatabaseMetaData;
--import org.apache.phoenix.query.QueryConstants;
--import org.apache.phoenix.schema.TableNotFoundException;
--import org.apache.phoenix.util.SchemaUtil;
--import org.junit.Test;
--import org.junit.experimental.categories.Category;
--
--/**
-- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
-- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class ChangePermissionsIT extends BasePermissionsIT {
--
-- private static final Log LOG = LogFactory.getLog(ChangePermissionsIT.class);
--
-- private static final String SCHEMA_NAME = "CHANGEPERMSSCHEMA";
-- private static final String TABLE_NAME =
-- ChangePermissionsIT.class.getSimpleName().toUpperCase();
-- private static final String FULL_TABLE_NAME = SCHEMA_NAME + "." + TABLE_NAME;
-- private static final String IDX1_TABLE_NAME = TABLE_NAME + "_IDX1";
-- private static final String IDX2_TABLE_NAME = TABLE_NAME + "_IDX2";
-- private static final String IDX3_TABLE_NAME = TABLE_NAME + "_IDX3";
-- private static final String LOCAL_IDX1_TABLE_NAME = TABLE_NAME + "_LIDX1";
-- private static final String VIEW1_TABLE_NAME = TABLE_NAME + "_V1";
-- private static final String VIEW2_TABLE_NAME = TABLE_NAME + "_V2";
--
-- public ChangePermissionsIT(boolean isNamespaceMapped) throws Exception {
-- super(isNamespaceMapped);
-- }
--
-- private void grantSystemTableAccess(User superUser, User... users) throws Exception {
-- for(User user : users) {
-- if(isNamespaceMapped) {
-- verifyAllowed(grantPermissions("RX", user, QueryConstants.SYSTEM_SCHEMA_NAME, true), superUser);
-- } else {
-- verifyAllowed(grantPermissions("RX", user, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser);
-- }
-- verifyAllowed(grantPermissions("RWX", user, SYSTEM_SEQUENCE_IDENTIFIER, false), superUser);
-- verifyAllowed(grantPermissions("RWX", user, SYSTEM_MUTEX_IDENTIFIER, false), superUser);
-- }
-- }
--
-- private void revokeSystemTableAccess(User superUser, User... users) throws Exception {
-- for(User user : users) {
-- if(isNamespaceMapped) {
-- verifyAllowed(revokePermissions(user, QueryConstants.SYSTEM_SCHEMA_NAME, true), superUser);
-- } else {
-- verifyAllowed(revokePermissions(user, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser);
-- }
-- verifyAllowed(revokePermissions(user, SYSTEM_SEQUENCE_IDENTIFIER, false), superUser);
-- verifyAllowed(revokePermissions(user, SYSTEM_MUTEX_IDENTIFIER, false), superUser);
-- }
-- }
--
-- /**
-- * Verify that READ and EXECUTE permissions are required on SYSTEM tables to get a Phoenix Connection
-- * Tests grant revoke permissions per user 1. if NS enabled -> on namespace 2. If NS disabled -> on tables
-- */
-- @Test
-- public void testRXPermsReqdForPhoenixConn() throws Exception {
--
-- startNewMiniCluster();
--
-- if(isNamespaceMapped) {
-- // NS is enabled, CQSI tries creating SYSCAT, we get NamespaceNotFoundException exception for "SYSTEM" NS
-- // We create custom ADE and throw it (and ignore NamespaceNotFoundException)
-- // This is because we didn't had CREATE perms to create "SYSTEM" NS
-- verifyDenied(getConnectionAction(), AccessDeniedException.class, regularUser1);
-- } else {
-- // NS is disabled, CQSI tries creating SYSCAT, Two cases here
-- // 1. First client ever --> Gets ADE, runs client server compatibility check again and gets TableNotFoundException since SYSCAT doesn't exist
-- // 2. Any other client --> Gets ADE, runs client server compatibility check again and gets AccessDeniedException since it doesn't have EXEC perms
-- verifyDenied(getConnectionAction(), TableNotFoundException.class, regularUser1);
-- }
--
-- // Phoenix Client caches connection per user
-- // If we grant permissions, get a connection and then revoke it, we can still get the cached connection
-- // However it will fail for other read queries
-- // Thus this test grants and revokes for 2 users, so that both functionality can be tested.
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2);
-- verifyAllowed(getConnectionAction(), regularUser1);
-- revokeSystemTableAccess(superUser1, regularUser2);
-- verifyDenied(getConnectionAction(), AccessDeniedException.class, regularUser2);
-- }
--
-- /**
-- * Superuser grants admin perms to user1, who will in-turn grant admin perms to user2
-- * Not affected with namespace props
-- * Tests grant revoke permissions on per user global level
-- */
-- @Test
-- public void testSuperUserCanChangePerms() throws Exception {
--
-- startNewMiniCluster();
--
-- // Grant System Table access to all users, else they can't create a Phoenix connection
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
--
-- verifyAllowed(grantPermissions("A", regularUser1), superUser1);
--
-- verifyAllowed(readTableWithoutVerification(PhoenixDatabaseMetaData.SYSTEM_CATALOG), regularUser1);
-- verifyAllowed(grantPermissions("A", regularUser2), regularUser1);
--
-- verifyAllowed(revokePermissions(regularUser1), superUser1);
-- verifyDenied(grantPermissions("A", regularUser3), AccessDeniedException.class, regularUser1);
--
-- // Don't grant ADMIN perms to unprivilegedUser, thus unprivilegedUser is unable to control other permissions.
-- verifyAllowed(getConnectionAction(), unprivilegedUser);
-- verifyDenied(grantPermissions("ARX", regularUser4), AccessDeniedException.class, unprivilegedUser);
-- }
--
-- /**
-- * Test to verify READ permissions on table, indexes and views
-- * Tests automatic grant revoke of permissions per user on a table
-- */
-- @Test
-- public void testReadPermsOnTableIndexAndView() throws Exception {
--
-- startNewMiniCluster();
--
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
--
-- // Create new schema and grant CREATE permissions to a user
-- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-- } else {
-- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(SchemaUtil.SCHEMA_FOR_DEFAULT_NAMESPACE), true), superUser1);
-- }
--
-- // Create new table. Create indexes, views and view indexes on top of it. Verify the contents by querying it
-- verifyAllowed(createTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createLocalIndex(LOCAL_IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX3_TABLE_NAME, VIEW1_TABLE_NAME), regularUser1);
--
-- // RegularUser2 doesn't have any permissions. It can get a PhoenixConnection
-- // However it cannot query table, indexes or views without READ perms
-- verifyAllowed(getConnectionAction(), regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(VIEW1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
--
-- // Grant READ permissions to RegularUser2 on the table
-- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-- // Granting permissions directly to index tables should fail
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + IDX1_TABLE_NAME, false), AccessDeniedException.class, regularUser1);
-- // Granting permissions directly to views should fail. We expect TableNotFoundException since VIEWS are not physical tables
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + VIEW1_TABLE_NAME, false), TableNotFoundException.class, regularUser1);
--
-- // Verify that all other access are successful now
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX2_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, LOCAL_IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(VIEW1_TABLE_NAME), regularUser2);
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME), regularUser2);
--
-- // Revoke READ permissions to RegularUser2 on the table
-- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(revokePermissions(regularUser2, FULL_TABLE_NAME, false), regularUser1);
-- // READ query should fail now
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
--
-- }
--
-- /**
-- * Verifies permissions for users present inside a group
-- */
-- @Test
-- public void testGroupUserPerms() throws Exception {
--
-- startNewMiniCluster();
--
-- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- }
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
--
-- // Grant SYSTEM table access to GROUP_SYSTEM_ACCESS and regularUser1
-- verifyAllowed(grantPermissions("RX", GROUP_SYSTEM_ACCESS, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser1);
-- grantSystemTableAccess(superUser1, regularUser1);
--
-- // Grant Permissions to Groups (Should be automatically applicable to all users inside it)
-- verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), groupUser);
--
-- // GroupUser is an admin and can grant perms to other users
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, FULL_TABLE_NAME, false), groupUser);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
--
-- // Revoke the perms and try accessing data again
-- verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, groupUser);
-- }
--
-- /**
-- * Tests permissions for MultiTenant Tables and view index tables
-- */
-- @Test
-- public void testMultiTenantTables() throws Exception {
--
-- startNewMiniCluster();
--
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
--
-- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-- } else {
-- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(SchemaUtil.SCHEMA_FOR_DEFAULT_NAMESPACE), true), superUser1);
-- }
--
-- // Create MultiTenant Table (View Index Table should be automatically created)
-- // At this point, the index table doesn't contain any data
-- verifyAllowed(createMultiTenantTable(FULL_TABLE_NAME), regularUser1);
--
-- // RegularUser2 doesn't have access yet, RegularUser1 should have RWXCA on the table
-- verifyDenied(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
--
-- // Grant perms to base table (Should propagate to View Index as well)
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-- // Try reading full table
-- verifyAllowed(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), regularUser2);
--
-- // Create tenant specific views on the table using tenant specific Phoenix Connection
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createView(VIEW2_TABLE_NAME, FULL_TABLE_NAME, "o2"), regularUser1);
--
-- // Create indexes on those views using tenant specific Phoenix Connection
-- // It is not possible to create indexes on tenant specific views without tenant connection
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, VIEW1_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, VIEW2_TABLE_NAME, "o2"), regularUser1);
--
-- // Read the tables as regularUser2, with and without the use of Index table
-- // If perms are propagated correctly, then both of them should work
-- // The test checks if the query plan uses the index table by searching for "_IDX_" string
-- // _IDX_ is the prefix used with base table name to derieve the name of view index table
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME, "o1"), regularUser2);
-- verifyAllowed(readMultiTenantTableWithoutIndex(VIEW2_TABLE_NAME, "o2"), regularUser2);
-- }
--
-- /**
-- * Grant RX permissions on the schema to regularUser1,
-- * Creating view on a table with that schema by regularUser1 should be allowed
-- */
-- @Test
-- public void testCreateViewOnTableWithRXPermsOnSchema() throws Exception {
--
-- startNewMiniCluster();
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
--
-- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, SCHEMA_NAME, true), superUser1);
-- } else {
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, surroundWithDoubleQuotes(SchemaUtil.SCHEMA_FOR_DEFAULT_NAMESPACE), true), superUser1);
-- }
--
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- }
--}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSDisabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSDisabledIT.java
-new file mode 100644
-index 000000000..2c9ffbb9f
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSDisabledIT.java
-@@ -0,0 +1,15 @@
-+package org.apache.phoenix.end2end;
-+
-+import org.junit.BeforeClass;
-+
-+public class PermissionNSDisabledIT extends BasePermissionsIT {
-+
-+ public PermissionNSDisabledIT() throws Exception {
-+ super(false);
-+ }
-+
-+ @BeforeClass
-+ public static void doSetup() throws Exception {
-+ BasePermissionsIT.doSetup(false);
-+ }
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSEnabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSEnabledIT.java
-new file mode 100644
-index 000000000..61e4df602
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSEnabledIT.java
-@@ -0,0 +1,16 @@
-+package org.apache.phoenix.end2end;
-+
-+import org.junit.BeforeClass;
-+
-+public class PermissionNSEnabledIT extends BasePermissionsIT {
-+
-+ public PermissionNSEnabledIT() throws Exception {
-+ super(true);
-+ }
-+
-+ @BeforeClass
-+ public static void doSetup() throws Exception {
-+ BasePermissionsIT.doSetup(true);
-+ }
-+
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-deleted file mode 100644
-index 6da970b99..000000000
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-+++ /dev/null
-@@ -1,131 +0,0 @@
--/*
-- * Licensed to the Apache Software Foundation (ASF) under one or more
-- * contributor license agreements. See the NOTICE file distributed with
-- * this work for additional information regarding copyright ownership.
-- * The ASF licenses this file to you under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
--
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.Statement;
--import java.util.Collections;
--import java.util.Properties;
--import java.util.Set;
--
--import org.apache.hadoop.hbase.security.access.Permission.Action;
--import org.apache.phoenix.coprocessor.MetaDataProtocol;
--import org.apache.phoenix.jdbc.PhoenixConnection;
--import org.apache.phoenix.query.QueryServices;
--import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
--import org.apache.phoenix.schema.NewerTableAlreadyExistsException;
--import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.Test;
--import org.junit.experimental.categories.Category;
--
--/**
-- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
-- * Uses HBase API directly to grant/revoke permissions
-- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class SystemTablePermissionsIT extends BasePermissionsIT {
--
-- private static final String TABLE_NAME =
-- SystemTablePermissionsIT.class.getSimpleName().toUpperCase();
--
-- public SystemTablePermissionsIT(boolean isNamespaceMapped) throws Exception {
-- super(isNamespaceMapped);
-- }
--
-- @Test
-- public void testSystemTablePermissions() throws Throwable {
--
-- startNewMiniCluster();
--
-- verifyAllowed(createTable(TABLE_NAME), superUser1);
-- verifyAllowed(readTable(TABLE_NAME), superUser1);
--
-- Set<String> tables = getHBaseTables();
-- if(isNamespaceMapped) {
-- assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-- tables.containsAll(PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES));
-- } else {
-- assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-- tables.containsAll(PHOENIX_SYSTEM_TABLES));
-- }
--
-- // Grant permission to the system tables for the unprivileged user
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- if(isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(),
-- PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.EXEC, Action.READ);
-- } else {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES,
-- Action.EXEC, Action.READ);
-- }
-- grantPermissions(regularUser1.getShortName(),
-- Collections.singleton(TABLE_NAME), Action.READ,Action.EXEC);
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception) e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
--
-- // Make sure that the unprivileged user can now read the table
-- verifyAllowed(readTable(TABLE_NAME), regularUser1);
-- //This verification is added to test PHOENIX-5178
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override public Void run() throws Exception {
-- try {
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(),"SYSTEM", Action.ADMIN);
-- }
-- return null;
-- } catch (Throwable e) {
-- throw new Exception(e);
-- }
--
-- }
-- });
-- if(isNamespaceMapped) {
-- verifyAllowed(new AccessTestAction() {
-- @Override public Object run() throws Exception {
-- Properties props = new Properties();
-- props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-- props.setProperty(PhoenixRuntime.CURRENT_SCN_ATTRIB, Long.toString(MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP));
-- //Impersonate meta connection
-- try (Connection metaConnection = DriverManager.getConnection(getUrl(), props);
-- Statement stmt = metaConnection.createStatement()) {
-- stmt.executeUpdate("CREATE SCHEMA IF NOT EXISTS SYSTEM");
-- }catch(NewerSchemaAlreadyExistsException e){
--
-- }
-- return null;
-- }
-- }, regularUser1);
-- }
-- }
--
--}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-deleted file mode 100644
-index d29056d00..000000000
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-+++ /dev/null
-@@ -1,232 +0,0 @@
--/*
-- * Licensed to the Apache Software Foundation (ASF) under one or more
-- * contributor license agreements. See the NOTICE file distributed with
-- * this work for additional information regarding copyright ownership.
-- * The ASF licenses this file to you under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
--
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.util.Collections;
--
--import org.apache.hadoop.hbase.AuthUtil;
--import org.apache.hadoop.hbase.NamespaceDescriptor;
--import org.apache.hadoop.hbase.security.AccessDeniedException;
--import org.apache.hadoop.hbase.security.access.AccessControlClient;
--import org.apache.hadoop.hbase.security.access.Permission.Action;
--import org.apache.phoenix.util.SchemaUtil;
--import org.junit.Test;
--import org.junit.experimental.categories.Category;
--
--/**
-- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
-- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class TableDDLPermissionsIT extends BasePermissionsIT {
--
-- public TableDDLPermissionsIT(boolean isNamespaceMapped) throws Exception {
-- super(isNamespaceMapped);
-- }
--
-- private void grantSystemTableAccess() throws Exception {
-- try (Connection conn = getConnection()) {
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.READ,
-- Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-- Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-- Action.READ, Action.EXEC);
-- // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
--
-- } else {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- }
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- }
--
-- @Test
-- public void testSchemaPermissions() throws Throwable{
--
-- if (!isNamespaceMapped) { return; }
-- try {
-- startNewMiniCluster();
-- grantSystemTableAccess();
-- final String schemaName = "TEST_SCHEMA_PERMISSION";
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- AccessControlClient.grant(getUtility().getConnection(), regularUser1.getShortName(),
-- Action.ADMIN);
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
-- verifyAllowed(createSchema(schemaName), regularUser1);
-- // Unprivileged user cannot drop a schema
-- verifyDenied(dropSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(createSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
--
-- verifyAllowed(dropSchema(schemaName), regularUser1);
-- } finally {
-- revokeAll();
-- }
-- }
--
-- @Test
-- public void testAutomaticGrantWithIndexAndView() throws Throwable {
-- startNewMiniCluster();
-- final String schema = "TEST_INDEX_VIEW";
-- final String tableName = "TABLE_DDL_PERMISSION_IT";
-- final String phoenixTableName = schema + "." + tableName;
-- final String indexName1 = tableName + "_IDX1";
-- final String indexName2 = tableName + "_IDX2";
-- final String lIndexName1 = tableName + "_LIDX1";
-- final String viewName1 = schema+"."+tableName + "_V1";
-- final String viewName2 = schema+"."+tableName + "_V2";
-- final String viewName3 = schema+"."+tableName + "_V3";
-- final String viewName4 = schema+"."+tableName + "_V4";
-- final String viewIndexName1 = tableName + "_VIDX1";
-- final String viewIndexName2 = tableName + "_VIDX2";
-- grantSystemTableAccess();
-- try {
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- verifyAllowed(createSchema(schema), superUser1);
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(), schema, Action.CREATE);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), schema, Action.CREATE);
--
-- } else {
-- grantPermissions(regularUser1.getShortName(),
-- NamespaceDescriptor.DEFAULT_NAMESPACE.getName(), Action.CREATE);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS),
-- NamespaceDescriptor.DEFAULT_NAMESPACE.getName(), Action.CREATE);
--
-- }
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
--
-- verifyAllowed(createTable(phoenixTableName), regularUser1);
-- verifyAllowed(createIndex(indexName1, phoenixTableName), regularUser1);
-- verifyAllowed(createView(viewName1, phoenixTableName), regularUser1);
-- verifyAllowed(createLocalIndex(lIndexName1, phoenixTableName), regularUser1);
-- verifyAllowed(createIndex(viewIndexName1, viewName1), regularUser1);
-- verifyAllowed(createIndex(viewIndexName2, viewName1), regularUser1);
-- verifyAllowed(createView(viewName4, viewName1), regularUser1);
-- verifyAllowed(readTable(phoenixTableName), regularUser1);
--
-- verifyDenied(createIndex(indexName2, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(createView(viewName2, phoenixTableName),AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(createView(viewName3, viewName1), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(dropView(viewName1), AccessDeniedException.class, unprivilegedUser);
--
-- verifyDenied(dropIndex(indexName1, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(dropTable(phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(rebuildIndex(indexName1, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(addColumn(phoenixTableName, "val1"), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(dropColumn(phoenixTableName, "val"), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), AccessDeniedException.class, unprivilegedUser);
--
-- // Granting read permission to unprivileged user, now he should be able to create view but not index
-- grantPermissions(unprivilegedUser.getShortName(),
-- Collections.singleton(
-- SchemaUtil.getPhysicalHBaseTableName(schema, tableName, isNamespaceMapped).getString()),
-- Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS),
-- Collections.singleton(
-- SchemaUtil.getPhysicalHBaseTableName(schema, tableName, isNamespaceMapped).getString()),
-- Action.READ, Action.EXEC);
-- verifyDenied(createIndex(indexName2, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyAllowed(createView(viewName2, phoenixTableName), unprivilegedUser);
-- verifyAllowed(createView(viewName3, viewName1), unprivilegedUser);
--
-- // Grant create permission in namespace
-- if (isNamespaceMapped) {
-- grantPermissions(unprivilegedUser.getShortName(), schema, Action.CREATE);
-- } else {
-- grantPermissions(unprivilegedUser.getShortName(), NamespaceDescriptor.DEFAULT_NAMESPACE.getName(),
-- Action.CREATE);
-- }
--
-- // we should be able to read the data from another index as well to which we have not given any access to
-- // this user
-- verifyAllowed(readTable(phoenixTableName, indexName1), unprivilegedUser);
--
-- verifyAllowed(readTable(phoenixTableName), regularUser1);
-- verifyAllowed(rebuildIndex(indexName1, phoenixTableName), regularUser1);
-- verifyAllowed(addColumn(phoenixTableName, "val1"), regularUser1);
-- verifyAllowed(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), regularUser1);
-- verifyAllowed(dropView(viewName1), regularUser1);
-- verifyAllowed(dropView(viewName2), regularUser1);
-- verifyAllowed(dropColumn(phoenixTableName, "val1"), regularUser1);
-- verifyAllowed(dropIndex(indexName1, phoenixTableName), regularUser1);
-- verifyAllowed(dropTable(phoenixTableName), regularUser1);
--
-- // check again with super users
-- verifyAllowed(createTable(phoenixTableName), superUser2);
-- verifyAllowed(createIndex(indexName1, phoenixTableName), superUser2);
-- verifyAllowed(createView(viewName1, phoenixTableName), superUser2);
-- verifyAllowed(readTable(phoenixTableName), superUser2);
-- verifyAllowed(dropView(viewName1), superUser2);
-- verifyAllowed(dropTable(phoenixTableName), superUser2);
--
-- } finally {
-- revokeAll();
-- }
-- }
--
--}
-diff --git a/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java b/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java
-index cefb456af..4e678f375 100644
---- a/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java
-+++ b/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java
-@@ -21,7 +21,6 @@ import com.google.common.collect.Maps;
- import com.google.gson.Gson;
- import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
--import org.apache.phoenix.end2end.ChangePermissionsIT;
- import org.apache.phoenix.end2end.NeedsOwnMiniClusterTest;
- import org.apache.phoenix.query.BaseTest;
- import org.apache.phoenix.query.QueryServices;
---
-2.15.1
-
diff --git a/PHOENIX-5230.patch b/PHOENIX-5230.patch
deleted file mode 100644
index e5cd3ae..0000000
--- a/PHOENIX-5230.patch
+++ /dev/null
@@ -1,1521 +0,0 @@
-From cf8bfa33d56bce6f41608a325d6566dbf51e56f6 Mon Sep 17 00:00:00 2001
-From: Thomas D'Silva <td...@apache.org>
-Date: Thu, 4 Apr 2019 16:34:24 -0700
-Subject: [PATCH] PHOENIX-5230 Fix ChangePermissionsIT and TableDDLPermissionIT
- on master
-
----
- .../apache/phoenix/end2end/BasePermissionsIT.java | 630 ++++++++++++++++++---
- .../phoenix/end2end/ChangePermissionsIT.java | 293 ----------
- .../phoenix/end2end/PermissionNSDisabledIT.java | 15 +
- .../phoenix/end2end/PermissionNSEnabledIT.java | 53 ++
- .../phoenix/end2end/SystemTablePermissionsIT.java | 131 -----
- .../phoenix/end2end/TableDDLPermissionsIT.java | 238 --------
- .../tool/ParameterizedPhoenixCanaryToolIT.java | 1 -
- 7 files changed, 610 insertions(+), 751 deletions(-)
- delete mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
- create mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSDisabledIT.java
- create mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSEnabledIT.java
- delete mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
- delete mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-index 81a68b455..57a176bf9 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-@@ -16,62 +16,66 @@
- */
- package org.apache.phoenix.end2end;
-
--import static org.junit.Assert.assertEquals;
--import static org.junit.Assert.assertFalse;
--import static org.junit.Assert.assertNotNull;
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.io.IOException;
--import java.lang.reflect.UndeclaredThrowableException;
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.PreparedStatement;
--import java.sql.ResultSet;
--import java.sql.SQLException;
--import java.sql.Statement;
--import java.util.Arrays;
--import java.util.Collection;
--import java.util.Collections;
--import java.util.HashSet;
--import java.util.List;
--import java.util.Properties;
--import java.util.Set;
--
-+import com.google.common.base.Joiner;
-+import com.google.common.base.Throwables;
- import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
- import org.apache.hadoop.conf.Configuration;
- import org.apache.hadoop.hbase.AuthUtil;
- import org.apache.hadoop.hbase.HBaseTestingUtility;
--import org.apache.hadoop.hbase.HConstants;
- import org.apache.hadoop.hbase.LocalHBaseCluster;
-+import org.apache.hadoop.hbase.NamespaceDescriptor;
- import org.apache.hadoop.hbase.TableName;
- import org.apache.hadoop.hbase.security.AccessDeniedException;
- import org.apache.hadoop.hbase.security.User;
- import org.apache.hadoop.hbase.security.access.AccessControlClient;
- import org.apache.hadoop.hbase.security.access.Permission;
-+import org.apache.phoenix.coprocessor.MetaDataProtocol;
- import org.apache.phoenix.jdbc.PhoenixConnection;
- import org.apache.phoenix.jdbc.PhoenixDatabaseMetaData;
- import org.apache.phoenix.jdbc.PhoenixStatement;
- import org.apache.phoenix.query.BaseTest;
- import org.apache.phoenix.query.QueryConstants;
- import org.apache.phoenix.query.QueryServices;
-+import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
-+import org.apache.phoenix.schema.TableNotFoundException;
- import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.After;
--import org.junit.BeforeClass;
--import org.junit.runner.RunWith;
--import org.junit.runners.Parameterized;
-+import org.apache.phoenix.util.SchemaUtil;
-+import org.junit.Before;
-+import org.junit.FixMethodOrder;
-+import org.junit.Test;
-+import org.junit.experimental.categories.Category;
-+import org.junit.runners.MethodSorters;
-
--import com.google.common.base.Joiner;
--import com.google.common.base.Throwables;
-+import java.io.IOException;
-+import java.lang.reflect.UndeclaredThrowableException;
-+import java.security.PrivilegedExceptionAction;
-+import java.sql.Connection;
-+import java.sql.DriverManager;
-+import java.sql.PreparedStatement;
-+import java.sql.ResultSet;
-+import java.sql.SQLException;
-+import java.sql.Statement;
-+import java.util.Arrays;
-+import java.util.Collections;
-+import java.util.HashSet;
-+import java.util.List;
-+import java.util.Properties;
-+import java.util.Set;
-
--@RunWith(Parameterized.class)
--public class BasePermissionsIT extends BaseTest {
-+import static org.junit.Assert.assertEquals;
-+import static org.junit.Assert.assertFalse;
-+import static org.junit.Assert.assertNotNull;
-+import static org.junit.Assert.assertTrue;
-+import static org.junit.Assert.fail;
-+
-+@Category(NeedsOwnMiniClusterTest.class)
-+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
-+public abstract class BasePermissionsIT extends BaseTest {
-
- private static final Log LOG = LogFactory.getLog(BasePermissionsIT.class);
-
-- static String SUPERUSER;
-+ static String SUPER_USER = System.getProperty("user.name");
-
- static HBaseTestingUtility testUtil;
- static final Set<String> PHOENIX_SYSTEM_TABLES =
-@@ -98,8 +102,8 @@ public class BasePermissionsIT extends BaseTest {
- // Instead use org.apache.hadoop.hbase.security.User class for testing purposes.
-
- // Super User has all the access
-- User superUser1 = null;
-- User superUser2 = null;
-+ static User superUser1 = null;
-+ static User superUser2 = null;
-
- // Regular users are granted and revoked permissions as needed
- User regularUser1 = null;
-@@ -119,20 +123,22 @@ public class BasePermissionsIT extends BaseTest {
-
- boolean isNamespaceMapped;
-
-+ private String schemaName;
-+ private String tableName;
-+ private String fullTableName;
-+ private String idx1TableName;
-+ private String idx2TableName;
-+ private String idx3TableName;
-+ private String localIdx1TableName;
-+ private String view1TableName;
-+ private String view2TableName;
-+
- public BasePermissionsIT(final boolean isNamespaceMapped) throws Exception {
- this.isNamespaceMapped = isNamespaceMapped;
-+ this.tableName = generateUniqueName();
- }
-
-- @BeforeClass
-- public static void doSetup() throws Exception {
-- SUPERUSER = System.getProperty("user.name");
-- }
--
-- void startNewMiniCluster() throws Exception {
-- startNewMiniCluster(new Configuration());
-- }
--
-- void startNewMiniCluster(Configuration overrideConf) throws Exception{
-+ public static void initCluster(boolean isNamespaceMapped) throws Exception {
- if (null != testUtil) {
- testUtil.shutdownMiniCluster();
- testUtil = null;
-@@ -142,38 +148,46 @@ public class BasePermissionsIT extends BaseTest {
-
- Configuration config = testUtil.getConfiguration();
- enablePhoenixHBaseAuthorization(config);
-- configureNamespacesOnServer(config);
-+ configureNamespacesOnServer(config, isNamespaceMapped);
- config.setBoolean(LocalHBaseCluster.ASSIGN_RANDOM_PORTS, true);
-- if (overrideConf != null) {
-- config.addResource(overrideConf);
-- }
-
- testUtil.startMiniCluster(1);
-- initializeUsers(testUtil.getConfiguration());
-+ superUser1 = User.createUserForTesting(config, SUPER_USER, new String[0]);
-+ superUser2 = User.createUserForTesting(config, "superUser2", new String[0]);
- }
-
-- private void initializeUsers(Configuration configuration) {
--
-- superUser1 = User.createUserForTesting(configuration, SUPERUSER, new String[0]);
-- superUser2 = User.createUserForTesting(configuration, "superUser2", new String[0]);
--
-- regularUser1 = User.createUserForTesting(configuration, "regularUser1", new String[0]);
-- regularUser2 = User.createUserForTesting(configuration, "regularUser2", new String[0]);
-- regularUser3 = User.createUserForTesting(configuration, "regularUser3", new String[0]);
-- regularUser4 = User.createUserForTesting(configuration, "regularUser4", new String[0]);
--
-- groupUser = User.createUserForTesting(testUtil.getConfiguration(), "groupUser", new String[] {GROUP_SYSTEM_ACCESS});
--
-- unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser", new String[0]);
-+ @Before
-+ public void initUsersAndTables() {
-+ Configuration configuration = testUtil.getConfiguration();
-+
-+ regularUser1 = User.createUserForTesting(configuration, "regularUser1_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser2 = User.createUserForTesting(configuration, "regularUser2_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser3 = User.createUserForTesting(configuration, "regularUser3_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser4 = User.createUserForTesting(configuration, "regularUser4_"
-+ + generateUniqueName(), new String[0]);
-+
-+ groupUser = User.createUserForTesting(testUtil.getConfiguration(), "groupUser_"
-+ + generateUniqueName() , new String[] {GROUP_SYSTEM_ACCESS});
-+
-+ unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser_"
-+ + generateUniqueName(), new String[0]);
-+
-+ schemaName = generateUniqueName();
-+ tableName = generateUniqueName();
-+ fullTableName = schemaName + "." + tableName;
-+ idx1TableName = tableName + "_IDX1";
-+ idx2TableName = tableName + "_IDX2";
-+ idx3TableName = tableName + "_IDX3";
-+ localIdx1TableName = tableName + "_LIDX1";
-+ view1TableName = tableName + "_V1";
-+ view2TableName = tableName + "_V2";
- }
-
-- private void configureRandomHMasterPort(Configuration config) {
-- // Avoid multiple clusters trying to bind the master's info port (16010)
-- config.setInt(HConstants.MASTER_INFO_PORT, 0);
-- }
--
-- void enablePhoenixHBaseAuthorization(Configuration config) {
-- config.set("hbase.superuser", SUPERUSER + "," + "superUser2");
-+ private static void enablePhoenixHBaseAuthorization(Configuration config) {
-+ config.set("hbase.superuser", SUPER_USER + "," + "superUser2");
- config.set("hbase.security.authorization", Boolean.TRUE.toString());
- config.set("hbase.security.exec.permission.checks", Boolean.TRUE.toString());
- config.set("hbase.coprocessor.master.classes",
-@@ -188,23 +202,10 @@ public class BasePermissionsIT extends BaseTest {
- config.set("hbase.regionserver.wal.codec", "org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec");
- }
-
-- void configureNamespacesOnServer(Configuration conf) {
-+ private static void configureNamespacesOnServer(Configuration conf, boolean isNamespaceMapped) {
- conf.set(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
- }
-
-- @Parameterized.Parameters(name = "isNamespaceMapped={0}") // name is used by failsafe as file name in reports
-- public static Collection<Boolean> data() {
-- return Arrays.asList(false, true);
-- }
--
-- @After
-- public void cleanup() throws Exception {
-- if (testUtil != null) {
-- testUtil.shutdownMiniCluster();
-- testUtil = null;
-- }
-- }
--
- public static HBaseTestingUtility getUtility(){
- return testUtil;
- }
-@@ -690,8 +691,8 @@ public class BasePermissionsIT extends BaseTest {
- }
- }
-
-- void verifyAllowed(User user, TableDDLPermissionsIT.AccessTestAction... actions) throws Exception {
-- for (TableDDLPermissionsIT.AccessTestAction action : actions) {
-+ void verifyAllowed(User user, AccessTestAction... actions) throws Exception {
-+ for (AccessTestAction action : actions) {
- try {
- Object obj = user.runAs(action);
- if (obj != null && obj instanceof List<?>) {
-@@ -717,8 +718,8 @@ public class BasePermissionsIT extends BaseTest {
- }
-
- /** This passes only if desired exception is caught for all users. */
-- <T> void verifyDenied(User user, Class<T> exception, TableDDLPermissionsIT.AccessTestAction... actions) throws Exception {
-- for (TableDDLPermissionsIT.AccessTestAction action : actions) {
-+ <T> void verifyDenied(User user, Class<T> exception, AccessTestAction... actions) throws Exception {
-+ for (AccessTestAction action : actions) {
- try {
- user.runAs(action);
- fail("Expected exception was not thrown for user '" + user.getShortName() + "'");
-@@ -762,4 +763,457 @@ public class BasePermissionsIT extends BaseTest {
- assertTrue("Exception contained unexpected message: '" + msg + "'",
- !msg.contains("is not the scanner owner"));
- }
-+
-+ @Test
-+ public void testSystemTablePermissions() throws Throwable {
-+ verifyAllowed(createTable(tableName), superUser1);
-+ verifyAllowed(readTable(tableName), superUser1);
-+
-+ Set<String> tables = getHBaseTables();
-+ if(isNamespaceMapped) {
-+ assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-+ tables.containsAll(PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES));
-+ } else {
-+ assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-+ tables.containsAll(PHOENIX_SYSTEM_TABLES));
-+ }
-+
-+ // Grant permission to the system tables for the unprivileged user
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ if(isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(),
-+ PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Permission.Action.EXEC, Permission.Action.READ);
-+ } else {
-+ grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES,
-+ Permission.Action.EXEC, Permission.Action.READ);
-+ }
-+ grantPermissions(regularUser1.getShortName(),
-+ Collections.singleton(tableName), Permission.Action.READ,Permission.Action.EXEC);
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception) e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+
-+ // Make sure that the unprivileged user can now read the table
-+ verifyAllowed(readTable(tableName), regularUser1);
-+ //This verification is added to test PHOENIX-5178
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override public Void run() throws Exception {
-+ try {
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(),"SYSTEM", Permission.Action.ADMIN);
-+ }
-+ return null;
-+ } catch (Throwable e) {
-+ throw new Exception(e);
-+ }
-+
-+ }
-+ });
-+ if(isNamespaceMapped) {
-+ verifyAllowed(new AccessTestAction() {
-+ @Override public Object run() throws Exception {
-+ Properties props = new Properties();
-+ props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-+ props.setProperty(PhoenixRuntime.CURRENT_SCN_ATTRIB, Long.toString(MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP));
-+ //Impersonate meta connection
-+ try (Connection metaConnection = DriverManager.getConnection(getUrl(), props);
-+ Statement stmt = metaConnection.createStatement()) {
-+ stmt.executeUpdate("CREATE SCHEMA IF NOT EXISTS SYSTEM");
-+ }catch(NewerSchemaAlreadyExistsException e){
-+
-+ }
-+ return null;
-+ }
-+ }, regularUser1);
-+ }
-+ }
-+
-+ private void grantSystemTableAccess(User superUser, User... users) throws Exception {
-+ for(User user : users) {
-+ if(isNamespaceMapped) {
-+ verifyAllowed(grantPermissions("RX", user, QueryConstants.SYSTEM_SCHEMA_NAME, true), superUser);
-+ } else {
-+ verifyAllowed(grantPermissions("RX", user, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser);
-+ }
-+ verifyAllowed(grantPermissions("RWX", user, SYSTEM_SEQUENCE_IDENTIFIER, false), superUser);
-+ verifyAllowed(grantPermissions("RWX", user, SYSTEM_MUTEX_IDENTIFIER, false), superUser);
-+ }
-+ }
-+
-+ private void revokeSystemTableAccess(User superUser, User... users) throws Exception {
-+ for(User user : users) {
-+ if(isNamespaceMapped) {
-+ verifyAllowed(revokePermissions(user, QueryConstants.SYSTEM_SCHEMA_NAME, true), superUser);
-+ } else {
-+ verifyAllowed(revokePermissions(user, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser);
-+ }
-+ verifyAllowed(revokePermissions(user, SYSTEM_SEQUENCE_IDENTIFIER, false), superUser);
-+ verifyAllowed(revokePermissions(user, SYSTEM_MUTEX_IDENTIFIER, false), superUser);
-+ }
-+ }
-+
-+ /**
-+ * Verify that READ and EXECUTE permissions are required on SYSTEM tables to get a Phoenix Connection
-+ * Tests grant revoke permissions per user 1. if NS enabled -> on namespace 2. If NS disabled -> on tables
-+ */
-+ @Test
-+ // this test needs to be run first
-+ public void aTestRXPermsReqdForPhoenixConn() throws Exception {
-+ if(isNamespaceMapped) {
-+ // NS is enabled, CQSI tries creating SYSCAT, we get NamespaceNotFoundException exception for "SYSTEM" NS
-+ // We create custom ADE and throw it (and ignore NamespaceNotFoundException)
-+ // This is because we didn't had CREATE perms to create "SYSTEM" NS
-+ verifyDenied(getConnectionAction(), AccessDeniedException.class, regularUser1);
-+ } else {
-+ // NS is disabled, CQSI tries creating SYSCAT, Two cases here
-+ // 1. First client ever --> Gets ADE, runs client server compatibility check again and gets TableNotFoundException since SYSCAT doesn't exist
-+ // 2. Any other client --> Gets ADE, runs client server compatibility check again and gets AccessDeniedException since it doesn't have EXEC perms
-+ verifyDenied(getConnectionAction(), TableNotFoundException.class, regularUser1);
-+ }
-+
-+ // Phoenix Client caches connection per user
-+ // If we grant permissions, get a connection and then revoke it, we can still get the cached connection
-+ // However it will fail for other read queries
-+ // Thus this test grants and revokes for 2 users, so that both functionality can be tested.
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2);
-+ verifyAllowed(getConnectionAction(), regularUser1);
-+ revokeSystemTableAccess(superUser1, regularUser2);
-+ verifyDenied(getConnectionAction(), AccessDeniedException.class, regularUser2);
-+ }
-+
-+ /**
-+ * Superuser grants admin perms to user1, who will in-turn grant admin perms to user2
-+ * Not affected with namespace props
-+ * Tests grant revoke permissions on per user global level
-+ */
-+ @Test
-+ public void testSuperUserCanChangePerms() throws Exception {
-+ // Grant System Table access to all users, else they can't create a Phoenix connection
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-+
-+ verifyAllowed(grantPermissions("A", regularUser1), superUser1);
-+
-+ verifyAllowed(readTableWithoutVerification(PhoenixDatabaseMetaData.SYSTEM_CATALOG), regularUser1);
-+ verifyAllowed(grantPermissions("A", regularUser2), regularUser1);
-+
-+ verifyAllowed(revokePermissions(regularUser1), superUser1);
-+ verifyDenied(grantPermissions("A", regularUser3), AccessDeniedException.class, regularUser1);
-+
-+ // Don't grant ADMIN perms to unprivilegedUser, thus unprivilegedUser is unable to control other permissions.
-+ verifyAllowed(getConnectionAction(), unprivilegedUser);
-+ verifyDenied(grantPermissions("ARX", regularUser4), AccessDeniedException.class, unprivilegedUser);
-+ }
-+
-+ /**
-+ * Test to verify READ permissions on table, indexes and views
-+ * Tests automatic grant revoke of permissions per user on a table
-+ */
-+ @Test
-+ public void testReadPermsOnTableIndexAndView() throws Exception {
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-+
-+ // Create new schema and grant CREATE permissions to a user
-+ if(isNamespaceMapped) {
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
-+ } else {
-+ verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
-+ }
-+
-+ // Create new table. Create indexes, views and view indexes on top of it. Verify the contents by querying it
-+ verifyAllowed(createTable(fullTableName), regularUser1);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, fullTableName), regularUser1);
-+ verifyAllowed(createLocalIndex(localIdx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx3TableName, view1TableName), regularUser1);
-+
-+ // RegularUser2 doesn't have any permissions. It can get a PhoenixConnection
-+ // However it cannot query table, indexes or views without READ perms
-+ verifyAllowed(getConnectionAction(), regularUser2);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName, idx1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(view1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-+
-+ // Grant READ permissions to RegularUser2 on the table
-+ // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
-+ // Granting permissions directly to index tables should fail
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + idx1TableName, false), AccessDeniedException.class, regularUser1);
-+ // Granting permissions directly to views should fail. We expect TableNotFoundException since VIEWS are not physical tables
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + view1TableName, false), TableNotFoundException.class, regularUser1);
-+
-+ // Verify that all other access are successful now
-+ verifyAllowed(readTable(fullTableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx1TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx2TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, localIdx1TableName), regularUser2);
-+ verifyAllowed(readTableWithoutVerification(schemaName + "." + idx1TableName), regularUser2);
-+ verifyAllowed(readTable(view1TableName), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName), regularUser2);
-+
-+ // Revoke READ permissions to RegularUser2 on the table
-+ // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-+ verifyAllowed(revokePermissions(regularUser2, fullTableName, false), regularUser1);
-+ // READ query should fail now
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-+ }
-+
-+ /**
-+ * Verifies permissions for users present inside a group
-+ */
-+ @Test
-+ public void testGroupUserPerms() throws Exception {
-+ if(isNamespaceMapped) {
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ }
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+
-+ // Grant SYSTEM table access to GROUP_SYSTEM_ACCESS and regularUser1
-+ verifyAllowed(grantPermissions("RX", GROUP_SYSTEM_ACCESS, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser1);
-+ grantSystemTableAccess(superUser1, regularUser1);
-+
-+ // Grant Permissions to Groups (Should be automatically applicable to all users inside it)
-+ verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyAllowed(readTable(fullTableName), groupUser);
-+
-+ // GroupUser is an admin and can grant perms to other users
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, fullTableName, false), groupUser);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-+
-+ // Revoke the perms and try accessing data again
-+ verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, groupUser);
-+ }
-+
-+ /**
-+ * Tests permissions for MultiTenant Tables and view index tables
-+ */
-+ @Test
-+ public void testMultiTenantTables() throws Exception {
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-+
-+ if(isNamespaceMapped) {
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
-+ } else {
-+ verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
-+ }
-+
-+ // Create MultiTenant Table (View Index Table should be automatically created)
-+ // At this point, the index table doesn't contain any data
-+ verifyAllowed(createMultiTenantTable(fullTableName), regularUser1);
-+
-+ // RegularUser2 doesn't have access yet, RegularUser1 should have RWXCA on the table
-+ verifyDenied(readMultiTenantTableWithoutIndex(fullTableName), AccessDeniedException.class, regularUser2);
-+
-+ // Grant perms to base table (Should propagate to View Index as well)
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
-+ // Try reading full table
-+ verifyAllowed(readMultiTenantTableWithoutIndex(fullTableName), regularUser2);
-+
-+ // Create tenant specific views on the table using tenant specific Phoenix Connection
-+ verifyAllowed(createView(view1TableName, fullTableName, "o1"), regularUser1);
-+ verifyAllowed(createView(view2TableName, fullTableName, "o2"), regularUser1);
-+
-+ // Create indexes on those views using tenant specific Phoenix Connection
-+ // It is not possible to create indexes on tenant specific views without tenant connection
-+ verifyAllowed(createIndex(idx1TableName, view1TableName, "o1"), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, view2TableName, "o2"), regularUser1);
-+
-+ // Read the tables as regularUser2, with and without the use of Index table
-+ // If perms are propagated correctly, then both of them should work
-+ // The test checks if the query plan uses the index table by searching for "_IDX_" string
-+ // _IDX_ is the prefix used with base table name to derieve the name of view index table
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName, "o1"), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithoutIndex(view2TableName, "o2"), regularUser2);
-+ }
-+
-+ /**
-+ * Grant RX permissions on the schema to regularUser1,
-+ * Creating view on a table with that schema by regularUser1 should be allowed
-+ */
-+ @Test
-+ public void testCreateViewOnTableWithRXPermsOnSchema() throws Exception {
-+ grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-+
-+ if(isNamespaceMapped) {
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, schemaName, true), superUser1);
-+ } else {
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
-+ }
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
-+ }
-+
-+ protected void grantSystemTableAccess() throws Exception{
-+ try (Connection conn = getConnection()) {
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Permission.Action.READ,
-+ Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-+ grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+
-+ } else {
-+ grantPermissions(regularUser1.getName(), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-+ grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM.SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ }
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ }
-+
-+ @Test
-+ public void testAutomaticGrantWithIndexAndView() throws Throwable {
-+ final String schema = "TEST_INDEX_VIEW";
-+ final String tableName = "TABLE_DDL_PERMISSION_IT";
-+ final String phoenixTableName = schema + "." + tableName;
-+ final String indexName1 = tableName + "_IDX1";
-+ final String indexName2 = tableName + "_IDX2";
-+ final String lIndexName1 = tableName + "_LIDX1";
-+ final String viewName1 = schema+"."+tableName + "_V1";
-+ final String viewName2 = schema+"."+tableName + "_V2";
-+ final String viewName3 = schema+"."+tableName + "_V3";
-+ final String viewName4 = schema+"."+tableName + "_V4";
-+ final String viewIndexName1 = tableName + "_VIDX1";
-+ final String viewIndexName2 = tableName + "_VIDX2";
-+ grantSystemTableAccess();
-+ try {
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ verifyAllowed(createSchema(schema), superUser1);
-+ //Neded Global ADMIN for flush operation during drop table
-+ AccessControlClient.grant(getUtility().getConnection(),regularUser1.getName(), Permission.Action.ADMIN);
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getName(), schema, Permission.Action.CREATE);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), schema, Permission.Action.CREATE);
-+
-+ } else {
-+ grantPermissions(regularUser1.getName(),
-+ NamespaceDescriptor.DEFAULT_NAMESPACE.getName(), Permission.Action.CREATE);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS),
-+ NamespaceDescriptor.DEFAULT_NAMESPACE.getName(), Permission.Action.CREATE);
-+
-+ }
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+
-+ verifyAllowed(createTable(phoenixTableName), regularUser1);
-+ verifyAllowed(createIndex(indexName1, phoenixTableName), regularUser1);
-+ verifyAllowed(createView(viewName1, phoenixTableName), regularUser1);
-+ verifyAllowed(createLocalIndex(lIndexName1, phoenixTableName), regularUser1);
-+ verifyAllowed(createIndex(viewIndexName1, viewName1), regularUser1);
-+ verifyAllowed(createIndex(viewIndexName2, viewName1), regularUser1);
-+ verifyAllowed(createView(viewName4, viewName1), regularUser1);
-+ verifyAllowed(readTable(phoenixTableName), regularUser1);
-+
-+ verifyDenied(createIndex(indexName2, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(createView(viewName2, phoenixTableName),AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(createView(viewName3, viewName1), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(dropView(viewName1), AccessDeniedException.class, unprivilegedUser);
-+
-+ verifyDenied(dropIndex(indexName1, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(dropTable(phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(rebuildIndex(indexName1, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(addColumn(phoenixTableName, "val1"), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(dropColumn(phoenixTableName, "val"), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), AccessDeniedException.class, unprivilegedUser);
-+
-+ // Granting read permission to unprivileged user, now he should be able to create view but not index
-+ grantPermissions(unprivilegedUser.getShortName(),
-+ Collections.singleton(
-+ SchemaUtil.getPhysicalHBaseTableName(schema, tableName, isNamespaceMapped).getString()),
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS),
-+ Collections.singleton(
-+ SchemaUtil.getPhysicalHBaseTableName(schema, tableName, isNamespaceMapped).getString()),
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ verifyDenied(createIndex(indexName2, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-+ verifyAllowed(createView(viewName2, phoenixTableName), unprivilegedUser);
-+ verifyAllowed(createView(viewName3, viewName1), unprivilegedUser);
-+
-+ // Grant create permission in namespace
-+ if (isNamespaceMapped) {
-+ grantPermissions(unprivilegedUser.getShortName(), schema, Permission.Action.CREATE);
-+ } else {
-+ grantPermissions(unprivilegedUser.getShortName(), NamespaceDescriptor.DEFAULT_NAMESPACE.getName(),
-+ Permission.Action.CREATE);
-+ }
-+
-+ // we should be able to read the data from another index as well to which we have not given any access to
-+ // this user
-+ verifyAllowed(readTable(phoenixTableName, indexName1), unprivilegedUser);
-+ verifyAllowed(readTable(phoenixTableName), regularUser1);
-+ verifyAllowed(rebuildIndex(indexName1, phoenixTableName), regularUser1);
-+ verifyAllowed(addColumn(phoenixTableName, "val1"), regularUser1);
-+ verifyAllowed(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), regularUser1);
-+ verifyAllowed(dropView(viewName1), regularUser1);
-+ verifyAllowed(dropView(viewName2), regularUser1);
-+ verifyAllowed(dropColumn(phoenixTableName, "val1"), regularUser1);
-+ verifyAllowed(dropIndex(indexName1, phoenixTableName), regularUser1);
-+ verifyAllowed(dropTable(phoenixTableName), regularUser1);
-+
-+ // check again with super users
-+ verifyAllowed(createTable(phoenixTableName), superUser2);
-+ verifyAllowed(createIndex(indexName1, phoenixTableName), superUser2);
-+ verifyAllowed(createView(viewName1, phoenixTableName), superUser2);
-+ verifyAllowed(readTable(phoenixTableName), superUser2);
-+ verifyAllowed(dropView(viewName1), superUser2);
-+ verifyAllowed(dropTable(phoenixTableName), superUser2);
-+
-+ } finally {
-+ revokeAll();
-+ }
-+ }
- }
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-deleted file mode 100644
-index 65f44c04f..000000000
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-+++ /dev/null
-@@ -1,293 +0,0 @@
--/*
-- * Licensed to the Apache Software Foundation (ASF) under one or more
-- * contributor license agreements. See the NOTICE file distributed with
-- * this work for additional information regarding copyright ownership.
-- * The ASF licenses this file to you under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
--
--import org.apache.commons.logging.Log;
--import org.apache.commons.logging.LogFactory;
--import org.apache.hadoop.hbase.security.AccessDeniedException;
--import org.apache.hadoop.hbase.security.User;
--import org.apache.phoenix.jdbc.PhoenixDatabaseMetaData;
--import org.apache.phoenix.query.QueryConstants;
--import org.apache.phoenix.schema.TableNotFoundException;
--import org.apache.phoenix.util.SchemaUtil;
--import org.junit.Test;
--import org.junit.experimental.categories.Category;
--
--/**
-- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
-- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class ChangePermissionsIT extends BasePermissionsIT {
--
-- private static final Log LOG = LogFactory.getLog(ChangePermissionsIT.class);
--
-- private static final String SCHEMA_NAME = "CHANGEPERMSSCHEMA";
-- private static final String TABLE_NAME =
-- ChangePermissionsIT.class.getSimpleName().toUpperCase();
-- private static final String FULL_TABLE_NAME = SCHEMA_NAME + "." + TABLE_NAME;
-- private static final String IDX1_TABLE_NAME = TABLE_NAME + "_IDX1";
-- private static final String IDX2_TABLE_NAME = TABLE_NAME + "_IDX2";
-- private static final String IDX3_TABLE_NAME = TABLE_NAME + "_IDX3";
-- private static final String LOCAL_IDX1_TABLE_NAME = TABLE_NAME + "_LIDX1";
-- private static final String VIEW1_TABLE_NAME = TABLE_NAME + "_V1";
-- private static final String VIEW2_TABLE_NAME = TABLE_NAME + "_V2";
--
-- public ChangePermissionsIT(boolean isNamespaceMapped) throws Exception {
-- super(isNamespaceMapped);
-- }
--
-- private void grantSystemTableAccess(User superUser, User... users) throws Exception {
-- for(User user : users) {
-- if(isNamespaceMapped) {
-- verifyAllowed(grantPermissions("RX", user, QueryConstants.SYSTEM_SCHEMA_NAME, true), superUser);
-- } else {
-- verifyAllowed(grantPermissions("RX", user, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser);
-- }
-- verifyAllowed(grantPermissions("RWX", user, SYSTEM_SEQUENCE_IDENTIFIER, false), superUser);
-- verifyAllowed(grantPermissions("RWX", user, SYSTEM_MUTEX_IDENTIFIER, false), superUser);
-- }
-- }
--
-- private void revokeSystemTableAccess(User superUser, User... users) throws Exception {
-- for(User user : users) {
-- if(isNamespaceMapped) {
-- verifyAllowed(revokePermissions(user, QueryConstants.SYSTEM_SCHEMA_NAME, true), superUser);
-- } else {
-- verifyAllowed(revokePermissions(user, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser);
-- }
-- verifyAllowed(revokePermissions(user, SYSTEM_SEQUENCE_IDENTIFIER, false), superUser);
-- verifyAllowed(revokePermissions(user, SYSTEM_MUTEX_IDENTIFIER, false), superUser);
-- }
-- }
--
-- /**
-- * Verify that READ and EXECUTE permissions are required on SYSTEM tables to get a Phoenix Connection
-- * Tests grant revoke permissions per user 1. if NS enabled -> on namespace 2. If NS disabled -> on tables
-- */
-- @Test
-- public void testRXPermsReqdForPhoenixConn() throws Exception {
--
-- startNewMiniCluster();
--
-- if(isNamespaceMapped) {
-- // NS is enabled, CQSI tries creating SYSCAT, we get NamespaceNotFoundException exception for "SYSTEM" NS
-- // We create custom ADE and throw it (and ignore NamespaceNotFoundException)
-- // This is because we didn't had CREATE perms to create "SYSTEM" NS
-- verifyDenied(getConnectionAction(), AccessDeniedException.class, regularUser1);
-- } else {
-- // NS is disabled, CQSI tries creating SYSCAT, Two cases here
-- // 1. First client ever --> Gets ADE, runs client server compatibility check again and gets TableNotFoundException since SYSCAT doesn't exist
-- // 2. Any other client --> Gets ADE, runs client server compatibility check again and gets AccessDeniedException since it doesn't have EXEC perms
-- verifyDenied(getConnectionAction(), TableNotFoundException.class, regularUser1);
-- }
--
-- // Phoenix Client caches connection per user
-- // If we grant permissions, get a connection and then revoke it, we can still get the cached connection
-- // However it will fail for other read queries
-- // Thus this test grants and revokes for 2 users, so that both functionality can be tested.
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2);
-- verifyAllowed(getConnectionAction(), regularUser1);
-- revokeSystemTableAccess(superUser1, regularUser2);
-- verifyDenied(getConnectionAction(), AccessDeniedException.class, regularUser2);
-- }
--
-- /**
-- * Superuser grants admin perms to user1, who will in-turn grant admin perms to user2
-- * Not affected with namespace props
-- * Tests grant revoke permissions on per user global level
-- */
-- @Test
-- public void testSuperUserCanChangePerms() throws Exception {
--
-- startNewMiniCluster();
--
-- // Grant System Table access to all users, else they can't create a Phoenix connection
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
--
-- verifyAllowed(grantPermissions("A", regularUser1), superUser1);
--
-- verifyAllowed(readTableWithoutVerification(PhoenixDatabaseMetaData.SYSTEM_CATALOG), regularUser1);
-- verifyAllowed(grantPermissions("A", regularUser2), regularUser1);
--
-- verifyAllowed(revokePermissions(regularUser1), superUser1);
-- verifyDenied(grantPermissions("A", regularUser3), AccessDeniedException.class, regularUser1);
--
-- // Don't grant ADMIN perms to unprivilegedUser, thus unprivilegedUser is unable to control other permissions.
-- verifyAllowed(getConnectionAction(), unprivilegedUser);
-- verifyDenied(grantPermissions("ARX", regularUser4), AccessDeniedException.class, unprivilegedUser);
-- }
--
-- /**
-- * Test to verify READ permissions on table, indexes and views
-- * Tests automatic grant revoke of permissions per user on a table
-- */
-- @Test
-- public void testReadPermsOnTableIndexAndView() throws Exception {
--
-- startNewMiniCluster();
--
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
--
-- // Create new schema and grant CREATE permissions to a user
-- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-- } else {
-- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
-- }
--
-- // Create new table. Create indexes, views and view indexes on top of it. Verify the contents by querying it
-- verifyAllowed(createTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createLocalIndex(LOCAL_IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX3_TABLE_NAME, VIEW1_TABLE_NAME), regularUser1);
--
-- // RegularUser2 doesn't have any permissions. It can get a PhoenixConnection
-- // However it cannot query table, indexes or views without READ perms
-- verifyAllowed(getConnectionAction(), regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(VIEW1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
--
-- // Grant READ permissions to RegularUser2 on the table
-- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-- // Granting permissions directly to index tables should fail
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + IDX1_TABLE_NAME, false), AccessDeniedException.class, regularUser1);
-- // Granting permissions directly to views should fail. We expect TableNotFoundException since VIEWS are not physical tables
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + VIEW1_TABLE_NAME, false), TableNotFoundException.class, regularUser1);
--
-- // Verify that all other access are successful now
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX2_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, LOCAL_IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(VIEW1_TABLE_NAME), regularUser2);
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME), regularUser2);
--
-- // Revoke READ permissions to RegularUser2 on the table
-- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(revokePermissions(regularUser2, FULL_TABLE_NAME, false), regularUser1);
-- // READ query should fail now
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
--
-- }
--
-- /**
-- * Verifies permissions for users present inside a group
-- */
-- @Test
-- public void testGroupUserPerms() throws Exception {
--
-- startNewMiniCluster();
--
-- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- }
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
--
-- // Grant SYSTEM table access to GROUP_SYSTEM_ACCESS and regularUser1
-- verifyAllowed(grantPermissions("RX", GROUP_SYSTEM_ACCESS, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser1);
-- grantSystemTableAccess(superUser1, regularUser1);
--
-- // Grant Permissions to Groups (Should be automatically applicable to all users inside it)
-- verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), groupUser);
--
-- // GroupUser is an admin and can grant perms to other users
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, FULL_TABLE_NAME, false), groupUser);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
--
-- // Revoke the perms and try accessing data again
-- verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, groupUser);
-- }
--
-- /**
-- * Tests permissions for MultiTenant Tables and view index tables
-- */
-- @Test
-- public void testMultiTenantTables() throws Exception {
--
-- startNewMiniCluster();
--
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
--
-- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-- } else {
-- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
-- }
--
-- // Create MultiTenant Table (View Index Table should be automatically created)
-- // At this point, the index table doesn't contain any data
-- verifyAllowed(createMultiTenantTable(FULL_TABLE_NAME), regularUser1);
--
-- // RegularUser2 doesn't have access yet, RegularUser1 should have RWXCA on the table
-- verifyDenied(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
--
-- // Grant perms to base table (Should propagate to View Index as well)
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-- // Try reading full table
-- verifyAllowed(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), regularUser2);
--
-- // Create tenant specific views on the table using tenant specific Phoenix Connection
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createView(VIEW2_TABLE_NAME, FULL_TABLE_NAME, "o2"), regularUser1);
--
-- // Create indexes on those views using tenant specific Phoenix Connection
-- // It is not possible to create indexes on tenant specific views without tenant connection
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, VIEW1_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, VIEW2_TABLE_NAME, "o2"), regularUser1);
--
-- // Read the tables as regularUser2, with and without the use of Index table
-- // If perms are propagated correctly, then both of them should work
-- // The test checks if the query plan uses the index table by searching for "_IDX_" string
-- // _IDX_ is the prefix used with base table name to derieve the name of view index table
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME, "o1"), regularUser2);
-- verifyAllowed(readMultiTenantTableWithoutIndex(VIEW2_TABLE_NAME, "o2"), regularUser2);
-- }
--
-- /**
-- * Grant RX permissions on the schema to regularUser1,
-- * Creating view on a table with that schema by regularUser1 should be allowed
-- */
-- @Test
-- public void testCreateViewOnTableWithRXPermsOnSchema() throws Exception {
--
-- startNewMiniCluster();
-- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
--
-- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, SCHEMA_NAME, true), superUser1);
-- } else {
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
-- }
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- }
--}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSDisabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSDisabledIT.java
-new file mode 100644
-index 000000000..82c567f43
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSDisabledIT.java
-@@ -0,0 +1,15 @@
-+package org.apache.phoenix.end2end;
-+
-+import org.junit.BeforeClass;
-+
-+public class PermissionNSDisabledIT extends BasePermissionsIT {
-+
-+ public PermissionNSDisabledIT() throws Exception {
-+ super(false);
-+ }
-+
-+ @BeforeClass
-+ public static void doSetup() throws Exception {
-+ BasePermissionsIT.initCluster(false);
-+ }
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSEnabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSEnabledIT.java
-new file mode 100644
-index 000000000..10cf5c1dd
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/PermissionNSEnabledIT.java
-@@ -0,0 +1,53 @@
-+package org.apache.phoenix.end2end;
-+
-+import org.apache.hadoop.hbase.security.AccessDeniedException;
-+import org.apache.hadoop.hbase.security.access.AccessControlClient;
-+import org.apache.hadoop.hbase.security.access.Permission;
-+import org.junit.BeforeClass;
-+import org.junit.Test;
-+
-+import java.security.PrivilegedExceptionAction;
-+
-+public class PermissionNSEnabledIT extends BasePermissionsIT {
-+
-+ public PermissionNSEnabledIT() throws Exception {
-+ super(true);
-+ }
-+
-+ @BeforeClass
-+ public static void doSetup() throws Exception {
-+ BasePermissionsIT.initCluster(true);
-+ }
-+
-+ @Test
-+ public void testSchemaPermissions() throws Throwable{
-+ try {
-+ grantSystemTableAccess();
-+ final String schemaName = "S_" + generateUniqueName();
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ AccessControlClient.grant(getUtility().getConnection(), regularUser1.getShortName(),
-+ Permission.Action.ADMIN);
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+ verifyAllowed(createSchema(schemaName), regularUser1);
-+ // Unprivileged user cannot drop a schema
-+ verifyDenied(dropSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(createSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-+
-+ verifyAllowed(dropSchema(schemaName), regularUser1);
-+ } finally {
-+ revokeAll();
-+ }
-+ }
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-deleted file mode 100644
-index 6da970b99..000000000
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-+++ /dev/null
-@@ -1,131 +0,0 @@
--/*
-- * Licensed to the Apache Software Foundation (ASF) under one or more
-- * contributor license agreements. See the NOTICE file distributed with
-- * this work for additional information regarding copyright ownership.
-- * The ASF licenses this file to you under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
--
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.Statement;
--import java.util.Collections;
--import java.util.Properties;
--import java.util.Set;
--
--import org.apache.hadoop.hbase.security.access.Permission.Action;
--import org.apache.phoenix.coprocessor.MetaDataProtocol;
--import org.apache.phoenix.jdbc.PhoenixConnection;
--import org.apache.phoenix.query.QueryServices;
--import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
--import org.apache.phoenix.schema.NewerTableAlreadyExistsException;
--import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.Test;
--import org.junit.experimental.categories.Category;
--
--/**
-- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
-- * Uses HBase API directly to grant/revoke permissions
-- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class SystemTablePermissionsIT extends BasePermissionsIT {
--
-- private static final String TABLE_NAME =
-- SystemTablePermissionsIT.class.getSimpleName().toUpperCase();
--
-- public SystemTablePermissionsIT(boolean isNamespaceMapped) throws Exception {
-- super(isNamespaceMapped);
-- }
--
-- @Test
-- public void testSystemTablePermissions() throws Throwable {
--
-- startNewMiniCluster();
--
-- verifyAllowed(createTable(TABLE_NAME), superUser1);
-- verifyAllowed(readTable(TABLE_NAME), superUser1);
--
-- Set<String> tables = getHBaseTables();
-- if(isNamespaceMapped) {
-- assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-- tables.containsAll(PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES));
-- } else {
-- assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-- tables.containsAll(PHOENIX_SYSTEM_TABLES));
-- }
--
-- // Grant permission to the system tables for the unprivileged user
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- if(isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(),
-- PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.EXEC, Action.READ);
-- } else {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES,
-- Action.EXEC, Action.READ);
-- }
-- grantPermissions(regularUser1.getShortName(),
-- Collections.singleton(TABLE_NAME), Action.READ,Action.EXEC);
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception) e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
--
-- // Make sure that the unprivileged user can now read the table
-- verifyAllowed(readTable(TABLE_NAME), regularUser1);
-- //This verification is added to test PHOENIX-5178
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override public Void run() throws Exception {
-- try {
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(),"SYSTEM", Action.ADMIN);
-- }
-- return null;
-- } catch (Throwable e) {
-- throw new Exception(e);
-- }
--
-- }
-- });
-- if(isNamespaceMapped) {
-- verifyAllowed(new AccessTestAction() {
-- @Override public Object run() throws Exception {
-- Properties props = new Properties();
-- props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-- props.setProperty(PhoenixRuntime.CURRENT_SCN_ATTRIB, Long.toString(MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP));
-- //Impersonate meta connection
-- try (Connection metaConnection = DriverManager.getConnection(getUrl(), props);
-- Statement stmt = metaConnection.createStatement()) {
-- stmt.executeUpdate("CREATE SCHEMA IF NOT EXISTS SYSTEM");
-- }catch(NewerSchemaAlreadyExistsException e){
--
-- }
-- return null;
-- }
-- }, regularUser1);
-- }
-- }
--
--}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-deleted file mode 100644
-index 37073c393..000000000
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-+++ /dev/null
-@@ -1,238 +0,0 @@
--/*
-- * Licensed to the Apache Software Foundation (ASF) under one or more
-- * contributor license agreements. See the NOTICE file distributed with
-- * this work for additional information regarding copyright ownership.
-- * The ASF licenses this file to you under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
--
--
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.util.Collections;
--
--import org.apache.hadoop.hbase.AuthUtil;
--import org.apache.hadoop.hbase.NamespaceDescriptor;
--import org.apache.hadoop.hbase.security.AccessDeniedException;
--import org.apache.hadoop.hbase.security.access.AccessControlClient;
--import org.apache.hadoop.hbase.security.access.Permission.Action;
--import org.apache.phoenix.util.SchemaUtil;
--import org.junit.Test;
--import org.junit.experimental.categories.Category;
--import org.junit.runner.RunWith;
--import org.junit.runners.Parameterized;
--
--/**
-- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
-- */
--@Category(NeedsOwnMiniClusterTest.class)
--@RunWith(Parameterized.class)
--public class TableDDLPermissionsIT extends BasePermissionsIT{
--
-- public TableDDLPermissionsIT(boolean isNamespaceMapped) throws Exception {
-- super(isNamespaceMapped);
-- }
--
-- private void grantSystemTableAccess() throws Exception{
--
-- try (Connection conn = getConnection()) {
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.READ,
-- Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-- Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-- Action.READ, Action.EXEC);
-- // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-- grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
--
-- } else {
-- grantPermissions(regularUser1.getName(), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-- grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM.SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- }
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- }
--
-- @Test
-- public void testSchemaPermissions() throws Throwable{
--
-- if (!isNamespaceMapped) { return; }
-- try {
-- startNewMiniCluster();
-- grantSystemTableAccess();
-- final String schemaName = "TEST_SCHEMA_PERMISSION";
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- AccessControlClient.grant(getUtility().getConnection(), regularUser1.getShortName(),
-- Action.ADMIN);
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
-- verifyAllowed(createSchema(schemaName), regularUser1);
-- // Unprivileged user cannot drop a schema
-- verifyDenied(dropSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(createSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
--
-- verifyAllowed(dropSchema(schemaName), regularUser1);
-- } finally {
-- revokeAll();
-- }
-- }
--
-- @Test
-- public void testAutomaticGrantWithIndexAndView() throws Throwable {
-- startNewMiniCluster();
-- final String schema = "TEST_INDEX_VIEW";
-- final String tableName = "TABLE_DDL_PERMISSION_IT";
-- final String phoenixTableName = schema + "." + tableName;
-- final String indexName1 = tableName + "_IDX1";
-- final String indexName2 = tableName + "_IDX2";
-- final String lIndexName1 = tableName + "_LIDX1";
-- final String viewName1 = schema+"."+tableName + "_V1";
-- final String viewName2 = schema+"."+tableName + "_V2";
-- final String viewName3 = schema+"."+tableName + "_V3";
-- final String viewName4 = schema+"."+tableName + "_V4";
-- final String viewIndexName1 = tableName + "_VIDX1";
-- final String viewIndexName2 = tableName + "_VIDX2";
-- grantSystemTableAccess();
-- try {
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- verifyAllowed(createSchema(schema), superUser1);
-- //Neded Global ADMIN for flush operation during drop table
-- AccessControlClient.grant(getUtility().getConnection(),regularUser1.getName(), Action.ADMIN);
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getName(), schema, Action.CREATE);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), schema, Action.CREATE);
--
-- } else {
-- grantPermissions(regularUser1.getName(),
-- NamespaceDescriptor.DEFAULT_NAMESPACE.getName(), Action.CREATE);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS),
-- NamespaceDescriptor.DEFAULT_NAMESPACE.getName(), Action.CREATE);
--
-- }
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
--
-- verifyAllowed(createTable(phoenixTableName), regularUser1);
-- verifyAllowed(createIndex(indexName1, phoenixTableName), regularUser1);
-- verifyAllowed(createView(viewName1, phoenixTableName), regularUser1);
-- verifyAllowed(createLocalIndex(lIndexName1, phoenixTableName), regularUser1);
-- verifyAllowed(createIndex(viewIndexName1, viewName1), regularUser1);
-- verifyAllowed(createIndex(viewIndexName2, viewName1), regularUser1);
-- verifyAllowed(createView(viewName4, viewName1), regularUser1);
-- verifyAllowed(readTable(phoenixTableName), regularUser1);
--
-- verifyDenied(createIndex(indexName2, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(createView(viewName2, phoenixTableName),AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(createView(viewName3, viewName1), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(dropView(viewName1), AccessDeniedException.class, unprivilegedUser);
--
-- verifyDenied(dropIndex(indexName1, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(dropTable(phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(rebuildIndex(indexName1, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(addColumn(phoenixTableName, "val1"), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(dropColumn(phoenixTableName, "val"), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), AccessDeniedException.class, unprivilegedUser);
--
-- // Granting read permission to unprivileged user, now he should be able to create view but not index
-- grantPermissions(unprivilegedUser.getShortName(),
-- Collections.singleton(
-- SchemaUtil.getPhysicalHBaseTableName(schema, tableName, isNamespaceMapped).getString()),
-- Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS),
-- Collections.singleton(
-- SchemaUtil.getPhysicalHBaseTableName(schema, tableName, isNamespaceMapped).getString()),
-- Action.READ, Action.EXEC);
-- verifyDenied(createIndex(indexName2, phoenixTableName), AccessDeniedException.class, unprivilegedUser);
-- verifyAllowed(createView(viewName2, phoenixTableName), unprivilegedUser);
-- verifyAllowed(createView(viewName3, viewName1), unprivilegedUser);
--
-- // Grant create permission in namespace
-- if (isNamespaceMapped) {
-- grantPermissions(unprivilegedUser.getShortName(), schema, Action.CREATE);
-- } else {
-- grantPermissions(unprivilegedUser.getShortName(), NamespaceDescriptor.DEFAULT_NAMESPACE.getName(),
-- Action.CREATE);
-- }
--
-- // we should be able to read the data from another index as well to which we have not given any access to
-- // this user
-- verifyAllowed(readTable(phoenixTableName, indexName1), unprivilegedUser);
-- verifyAllowed(readTable(phoenixTableName), regularUser1);
-- verifyAllowed(rebuildIndex(indexName1, phoenixTableName), regularUser1);
-- verifyAllowed(addColumn(phoenixTableName, "val1"), regularUser1);
-- verifyAllowed(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), regularUser1);
-- verifyAllowed(dropView(viewName1), regularUser1);
-- verifyAllowed(dropView(viewName2), regularUser1);
-- verifyAllowed(dropColumn(phoenixTableName, "val1"), regularUser1);
-- verifyAllowed(dropIndex(indexName1, phoenixTableName), regularUser1);
-- verifyAllowed(dropTable(phoenixTableName), regularUser1);
--
-- // check again with super users
-- verifyAllowed(createTable(phoenixTableName), superUser2);
-- verifyAllowed(createIndex(indexName1, phoenixTableName), superUser2);
-- verifyAllowed(createView(viewName1, phoenixTableName), superUser2);
-- verifyAllowed(readTable(phoenixTableName), superUser2);
-- verifyAllowed(dropView(viewName1), superUser2);
-- verifyAllowed(dropTable(phoenixTableName), superUser2);
--
-- } finally {
-- revokeAll();
-- }
-- }
--
--}
-diff --git a/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java b/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java
-index cefb456af..4e678f375 100644
---- a/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java
-+++ b/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java
-@@ -21,7 +21,6 @@ import com.google.common.collect.Maps;
- import com.google.gson.Gson;
- import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
--import org.apache.phoenix.end2end.ChangePermissionsIT;
- import org.apache.phoenix.end2end.NeedsOwnMiniClusterTest;
- import org.apache.phoenix.query.BaseTest;
- import org.apache.phoenix.query.QueryServices;
---
-2.15.1
-
diff --git a/add.patch b/add.patch
deleted file mode 100644
index 53a88ef..0000000
--- a/add.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 5c101c6c5cbc791e8115584169a273d92c1a820a Mon Sep 17 00:00:00 2001
-From: Thomas D'Silva <td...@apache.org>
-Date: Mon, 18 Mar 2019 14:35:07 -0700
-Subject: [PATCH] PHOENIX-5062 Create a new repo for the phoenix connectors
- (addendum)
-
----
- phoenix-assembly/pom.xml | 16 ----------------
- phoenix-client/pom.xml | 18 ------------------
- pom.xml | 5 -----
- 3 files changed, 39 deletions(-)
-
-diff --git a/phoenix-assembly/pom.xml b/phoenix-assembly/pom.xml
-index 4acffdb31..ac3642694 100644
---- a/phoenix-assembly/pom.xml
-+++ b/phoenix-assembly/pom.xml
-@@ -102,22 +102,6 @@
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-core</artifactId>
- </dependency>
-- <dependency>
-- <groupId>org.apache.phoenix</groupId>
-- <artifactId>phoenix-flume</artifactId>
-- </dependency>
-- <dependency>
-- <groupId>org.apache.phoenix</groupId>
-- <artifactId>phoenix-kafka</artifactId>
-- </dependency>
-- <dependency>
-- <groupId>org.apache.phoenix</groupId>
-- <artifactId>phoenix-pig</artifactId>
-- </dependency>
-- <dependency>
-- <groupId>org.apache.phoenix</groupId>
-- <artifactId>phoenix-spark</artifactId>
-- </dependency>
- <dependency>
- <groupId>org.apache.omid</groupId>
- <artifactId>omid-hbase-tools-hbase1.x</artifactId>
-diff --git a/phoenix-client/pom.xml b/phoenix-client/pom.xml
-index 4cf18d34f..8b4f778f0 100644
---- a/phoenix-client/pom.xml
-+++ b/phoenix-client/pom.xml
-@@ -361,23 +361,5 @@
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-core</artifactId>
- </dependency>
-- <dependency>
-- <groupId>org.apache.phoenix</groupId>
-- <artifactId>phoenix-flume</artifactId>
-- </dependency>
-- <dependency>
-- <groupId>org.apache.phoenix</groupId>
-- <artifactId>phoenix-pig</artifactId>
-- <exclusions>
-- <exclusion>
-- <groupId>org.apache.pig</groupId>
-- <artifactId>pig</artifactId>
-- </exclusion>
-- </exclusions>
-- </dependency>
-- <dependency>
-- <groupId>org.apache.phoenix</groupId>
-- <artifactId>phoenix-spark</artifactId>
-- </dependency>
- </dependencies>
- </project>
-diff --git a/pom.xml b/pom.xml
-index d8de18531..0e7b414f5 100644
---- a/pom.xml
-+++ b/pom.xml
-@@ -24,12 +24,7 @@
-
- <modules>
- <module>phoenix-core</module>
-- <module>phoenix-flume</module>
-- <module>phoenix-kafka</module>
-- <module>phoenix-pig</module>
- <module>phoenix-pherf</module>
-- <module>phoenix-spark</module>
-- <module>phoenix-hive</module>
- <module>phoenix-client</module>
- <module>phoenix-server</module>
- <module>phoenix-assembly</module>
---
-2.15.1
-
diff --git a/diff.patch b/diff.patch
deleted file mode 100644
index bd80451..0000000
--- a/diff.patch
+++ /dev/null
@@ -1,999 +0,0 @@
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-index 81a68b455..91c68e769 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-@@ -16,37 +16,16 @@
- */
- package org.apache.phoenix.end2end;
-
--import static org.junit.Assert.assertEquals;
--import static org.junit.Assert.assertFalse;
--import static org.junit.Assert.assertNotNull;
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.io.IOException;
--import java.lang.reflect.UndeclaredThrowableException;
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.PreparedStatement;
--import java.sql.ResultSet;
--import java.sql.SQLException;
--import java.sql.Statement;
--import java.util.Arrays;
--import java.util.Collection;
--import java.util.Collections;
--import java.util.HashSet;
--import java.util.List;
--import java.util.Properties;
--import java.util.Set;
--
-+import com.google.common.base.Joiner;
-+import com.google.common.base.Throwables;
-+import com.google.common.collect.Maps;
- import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
- import org.apache.hadoop.conf.Configuration;
- import org.apache.hadoop.hbase.AuthUtil;
--import org.apache.hadoop.hbase.HBaseTestingUtility;
--import org.apache.hadoop.hbase.HConstants;
- import org.apache.hadoop.hbase.LocalHBaseCluster;
- import org.apache.hadoop.hbase.TableName;
-+import org.apache.hadoop.hbase.regionserver.wal.WALRecoveryRegionPostOpenIT;
- import org.apache.hadoop.hbase.security.AccessDeniedException;
- import org.apache.hadoop.hbase.security.User;
- import org.apache.hadoop.hbase.security.access.AccessControlClient;
-@@ -58,22 +37,40 @@ import org.apache.phoenix.query.BaseTest;
- import org.apache.phoenix.query.QueryConstants;
- import org.apache.phoenix.query.QueryServices;
- import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.After;
-+import org.apache.phoenix.util.ReadOnlyProps;
- import org.junit.BeforeClass;
--import org.junit.runner.RunWith;
--import org.junit.runners.Parameterized;
-+import org.junit.experimental.categories.Category;
-
--import com.google.common.base.Joiner;
--import com.google.common.base.Throwables;
-+import java.io.IOException;
-+import java.lang.reflect.UndeclaredThrowableException;
-+import java.security.PrivilegedExceptionAction;
-+import java.sql.Connection;
-+import java.sql.DriverManager;
-+import java.sql.PreparedStatement;
-+import java.sql.ResultSet;
-+import java.sql.SQLException;
-+import java.sql.Statement;
-+import java.util.Arrays;
-+import java.util.Collections;
-+import java.util.HashSet;
-+import java.util.List;
-+import java.util.Map;
-+import java.util.Properties;
-+import java.util.Set;
-
--@RunWith(Parameterized.class)
-+import static org.junit.Assert.assertEquals;
-+import static org.junit.Assert.assertFalse;
-+import static org.junit.Assert.assertNotNull;
-+import static org.junit.Assert.assertTrue;
-+import static org.junit.Assert.fail;
-+
-+@Category(NeedsOwnMiniClusterTest.class)
- public class BasePermissionsIT extends BaseTest {
-
- private static final Log LOG = LogFactory.getLog(BasePermissionsIT.class);
-
- static String SUPERUSER;
-
-- static HBaseTestingUtility testUtil;
- static final Set<String> PHOENIX_SYSTEM_TABLES =
- new HashSet<>(Arrays.asList("SYSTEM.CATALOG", "SYSTEM.SEQUENCE", "SYSTEM.STATS",
- "SYSTEM.FUNCTION", "SYSTEM.MUTEX"));
-@@ -121,35 +118,30 @@ public class BasePermissionsIT extends BaseTest {
-
- public BasePermissionsIT(final boolean isNamespaceMapped) throws Exception {
- this.isNamespaceMapped = isNamespaceMapped;
-+ initializeUsers(getUtility().getConfiguration());
-+ grantSystemTableAccess();
- }
-
- @BeforeClass
- public static void doSetup() throws Exception {
- SUPERUSER = System.getProperty("user.name");
-- }
--
-- void startNewMiniCluster() throws Exception {
-- startNewMiniCluster(new Configuration());
-- }
--
-- void startNewMiniCluster(Configuration overrideConf) throws Exception{
-- if (null != testUtil) {
-- testUtil.shutdownMiniCluster();
-- testUtil = null;
-- }
-
-- testUtil = new HBaseTestingUtility();
-+ Map<String, String> serverProps = Maps.newHashMapWithExpectedSize(10);
-+ serverProps.put("hbase.coprocessor.region.classes", WALRecoveryRegionPostOpenIT.IndexTableFailingRegionObserver.class.getName());
-+ serverProps.put("hbase.superuser", SUPERUSER + "," + "superUser2");
-+ serverProps.put("hbase.security.authorization", Boolean.TRUE.toString());
-+ serverProps.put("hbase.security.exec.permission.checks", Boolean.TRUE.toString());
-+ serverProps.put("hbase.coprocessor.master.classes", "org.apache.hadoop.hbase.security.access.AccessController");
-+ serverProps.put("hbase.coprocessor.region.classes", "org.apache.hadoop.hbase.security.access.AccessController");
-+ serverProps.put("hbase.coprocessor.regionserver.classes", "org.apache.hadoop.hbase.security.access.AccessController");
-+ serverProps.put(QueryServices.PHOENIX_ACLS_ENABLED,"true");
-+ serverProps.put("hbase.regionserver.wal.codec", "org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec");
-+ serverProps.put(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(true));
-+ serverProps.put(LocalHBaseCluster.ASSIGN_RANDOM_PORTS, "true");
-
-- Configuration config = testUtil.getConfiguration();
-- enablePhoenixHBaseAuthorization(config);
-- configureNamespacesOnServer(config);
-- config.setBoolean(LocalHBaseCluster.ASSIGN_RANDOM_PORTS, true);
-- if (overrideConf != null) {
-- config.addResource(overrideConf);
-- }
--
-- testUtil.startMiniCluster(1);
-- initializeUsers(testUtil.getConfiguration());
-+ Map<String, String> clientProps = Collections.singletonMap(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(true));
-+ NUM_SLAVES_BASE = 1;
-+ setUpTestDriver(new ReadOnlyProps(serverProps.entrySet().iterator()), new ReadOnlyProps(clientProps.entrySet().iterator()));
- }
-
- private void initializeUsers(Configuration configuration) {
-@@ -162,52 +154,57 @@ public class BasePermissionsIT extends BaseTest {
- regularUser3 = User.createUserForTesting(configuration, "regularUser3", new String[0]);
- regularUser4 = User.createUserForTesting(configuration, "regularUser4", new String[0]);
-
-- groupUser = User.createUserForTesting(testUtil.getConfiguration(), "groupUser", new String[] {GROUP_SYSTEM_ACCESS});
-+ groupUser = User.createUserForTesting(getUtility().getConfiguration(), "groupUser", new String[] {GROUP_SYSTEM_ACCESS});
-
- unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser", new String[0]);
- }
-
-- private void configureRandomHMasterPort(Configuration config) {
-- // Avoid multiple clusters trying to bind the master's info port (16010)
-- config.setInt(HConstants.MASTER_INFO_PORT, 0);
-- }
--
-- void enablePhoenixHBaseAuthorization(Configuration config) {
-- config.set("hbase.superuser", SUPERUSER + "," + "superUser2");
-- config.set("hbase.security.authorization", Boolean.TRUE.toString());
-- config.set("hbase.security.exec.permission.checks", Boolean.TRUE.toString());
-- config.set("hbase.coprocessor.master.classes",
-- "org.apache.hadoop.hbase.security.access.AccessController");
-- config.set("hbase.coprocessor.region.classes",
-- "org.apache.hadoop.hbase.security.access.AccessController");
-- config.set("hbase.coprocessor.regionserver.classes",
-- "org.apache.hadoop.hbase.security.access.AccessController");
--
-- config.set(QueryServices.PHOENIX_ACLS_ENABLED,"true");
--
-- config.set("hbase.regionserver.wal.codec", "org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec");
-- }
--
-- void configureNamespacesOnServer(Configuration conf) {
-- conf.set(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-- }
--
-- @Parameterized.Parameters(name = "isNamespaceMapped={0}") // name is used by failsafe as file name in reports
-- public static Collection<Boolean> data() {
-- return Arrays.asList(false, true);
-- }
--
-- @After
-- public void cleanup() throws Exception {
-- if (testUtil != null) {
-- testUtil.shutdownMiniCluster();
-- testUtil = null;
-+ protected void grantSystemTableAccess() throws Exception{
-+ try (Connection conn = getConnection()) {
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Permission.Action.READ,
-+ Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-+ grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+
-+ } else {
-+ grantPermissions(regularUser1.getName(), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-+ grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM.SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ }
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
- }
- }
-
-- public static HBaseTestingUtility getUtility(){
-- return testUtil;
-- }
-+// @Parameterized.Parameters(name = "isNamespaceMapped={0}") // name is used by failsafe as file name in reports
-+// public static Collection<Boolean> data() {
-+// return Arrays.asList(false, true);
-+// }
-
- // Utility functions to grant permissions with HBase API
- void grantPermissions(String toUser, Set<String> tablesToGrant, Permission.Action... actions) throws Throwable {
-@@ -249,13 +246,9 @@ public class BasePermissionsIT extends BaseTest {
- return DriverManager.getConnection(getUrl(), getClientProperties(tenantId));
- }
-
-- protected static String getUrl() {
-- return "jdbc:phoenix:localhost:" + testUtil.getZkCluster().getClientPort() + ":/hbase";
-- }
--
- static Set<String> getHBaseTables() throws IOException {
- Set<String> tables = new HashSet<>();
-- for (TableName tn : testUtil.getHBaseAdmin().listTableNames()) {
-+ for (TableName tn : getUtility().getHBaseAdmin().listTableNames()) {
- tables.add(tn.getNameAsString());
- }
- return tables;
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-index 65f44c04f..f4637d07a 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-@@ -23,31 +23,36 @@ import org.apache.hadoop.hbase.security.User;
- import org.apache.phoenix.jdbc.PhoenixDatabaseMetaData;
- import org.apache.phoenix.query.QueryConstants;
- import org.apache.phoenix.schema.TableNotFoundException;
--import org.apache.phoenix.util.SchemaUtil;
- import org.junit.Test;
--import org.junit.experimental.categories.Category;
-
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class ChangePermissionsIT extends BasePermissionsIT {
-+public abstract class ChangePermissionsIT extends BasePermissionsIT {
-
- private static final Log LOG = LogFactory.getLog(ChangePermissionsIT.class);
-
-- private static final String SCHEMA_NAME = "CHANGEPERMSSCHEMA";
-- private static final String TABLE_NAME =
-- ChangePermissionsIT.class.getSimpleName().toUpperCase();
-- private static final String FULL_TABLE_NAME = SCHEMA_NAME + "." + TABLE_NAME;
-- private static final String IDX1_TABLE_NAME = TABLE_NAME + "_IDX1";
-- private static final String IDX2_TABLE_NAME = TABLE_NAME + "_IDX2";
-- private static final String IDX3_TABLE_NAME = TABLE_NAME + "_IDX3";
-- private static final String LOCAL_IDX1_TABLE_NAME = TABLE_NAME + "_LIDX1";
-- private static final String VIEW1_TABLE_NAME = TABLE_NAME + "_V1";
-- private static final String VIEW2_TABLE_NAME = TABLE_NAME + "_V2";
-+ private final String schemaName;
-+ private final String tableName;
-+ private final String fullTableName;
-+ private final String idx1TableName;
-+ private final String idx2TableName;
-+ private final String idx3TableName;
-+ private final String localIdx1TableName;
-+ private final String view1TableName;
-+ private final String view2TableName;
-
- public ChangePermissionsIT(boolean isNamespaceMapped) throws Exception {
- super(isNamespaceMapped);
-+ this.schemaName = generateUniqueName();
-+ this.tableName = generateUniqueName();
-+ this.fullTableName = schemaName + "." + tableName;
-+ this.idx1TableName = tableName + "_IDX1";
-+ this.idx2TableName = tableName + "_IDX2";
-+ this.idx3TableName = tableName + "_IDX3";
-+ this.localIdx1TableName = tableName + "_LIDX1";
-+ this.view1TableName = tableName + "_V1";
-+ this.view2TableName = tableName + "_V2";
- }
-
- private void grantSystemTableAccess(User superUser, User... users) throws Exception {
-@@ -80,9 +85,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testRXPermsReqdForPhoenixConn() throws Exception {
--
-- startNewMiniCluster();
--
- if(isNamespaceMapped) {
- // NS is enabled, CQSI tries creating SYSCAT, we get NamespaceNotFoundException exception for "SYSTEM" NS
- // We create custom ADE and throw it (and ignore NamespaceNotFoundException)
-@@ -112,9 +114,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testSuperUserCanChangePerms() throws Exception {
--
-- startNewMiniCluster();
--
- // Grant System Table access to all users, else they can't create a Phoenix connection
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-
-@@ -137,59 +136,56 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testReadPermsOnTableIndexAndView() throws Exception {
--
-- startNewMiniCluster();
--
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-
- // Create new schema and grant CREATE permissions to a user
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
- } else {
- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
- }
-
- // Create new table. Create indexes, views and view indexes on top of it. Verify the contents by querying it
-- verifyAllowed(createTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createLocalIndex(LOCAL_IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX3_TABLE_NAME, VIEW1_TABLE_NAME), regularUser1);
-+ verifyAllowed(createTable(fullTableName), regularUser1);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, fullTableName), regularUser1);
-+ verifyAllowed(createLocalIndex(localIdx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx3TableName, view1TableName), regularUser1);
-
- // RegularUser2 doesn't have any permissions. It can get a PhoenixConnection
- // However it cannot query table, indexes or views without READ perms
- verifyAllowed(getConnectionAction(), regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(VIEW1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName, idx1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(view1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-
- // Grant READ permissions to RegularUser2 on the table
- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
- // Granting permissions directly to index tables should fail
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + IDX1_TABLE_NAME, false), AccessDeniedException.class, regularUser1);
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + idx1TableName, false), AccessDeniedException.class, regularUser1);
- // Granting permissions directly to views should fail. We expect TableNotFoundException since VIEWS are not physical tables
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + VIEW1_TABLE_NAME, false), TableNotFoundException.class, regularUser1);
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + view1TableName, false), TableNotFoundException.class, regularUser1);
-
- // Verify that all other access are successful now
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX2_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, LOCAL_IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(VIEW1_TABLE_NAME), regularUser2);
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME), regularUser2);
-+ verifyAllowed(readTable(fullTableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx1TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx2TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, localIdx1TableName), regularUser2);
-+ verifyAllowed(readTableWithoutVerification(schemaName + "." + idx1TableName), regularUser2);
-+ verifyAllowed(readTable(view1TableName), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName), regularUser2);
-
- // Revoke READ permissions to RegularUser2 on the table
- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(revokePermissions(regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(revokePermissions(regularUser2, fullTableName, false), regularUser1);
- // READ query should fail now
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-
- }
-
-@@ -198,30 +194,27 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testGroupUserPerms() throws Exception {
--
-- startNewMiniCluster();
--
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
- }
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
-
- // Grant SYSTEM table access to GROUP_SYSTEM_ACCESS and regularUser1
- verifyAllowed(grantPermissions("RX", GROUP_SYSTEM_ACCESS, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser1);
- grantSystemTableAccess(superUser1, regularUser1);
-
- // Grant Permissions to Groups (Should be automatically applicable to all users inside it)
-- verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), groupUser);
-+ verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyAllowed(readTable(fullTableName), groupUser);
-
- // GroupUser is an admin and can grant perms to other users
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, FULL_TABLE_NAME, false), groupUser);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, fullTableName, false), groupUser);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-
- // Revoke the perms and try accessing data again
-- verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, groupUser);
-+ verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, groupUser);
- }
-
- /**
-@@ -229,45 +222,42 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testMultiTenantTables() throws Exception {
--
-- startNewMiniCluster();
--
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
- } else {
- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
- }
-
- // Create MultiTenant Table (View Index Table should be automatically created)
- // At this point, the index table doesn't contain any data
-- verifyAllowed(createMultiTenantTable(FULL_TABLE_NAME), regularUser1);
-+ verifyAllowed(createMultiTenantTable(fullTableName), regularUser1);
-
- // RegularUser2 doesn't have access yet, RegularUser1 should have RWXCA on the table
-- verifyDenied(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readMultiTenantTableWithoutIndex(fullTableName), AccessDeniedException.class, regularUser2);
-
- // Grant perms to base table (Should propagate to View Index as well)
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
- // Try reading full table
-- verifyAllowed(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithoutIndex(fullTableName), regularUser2);
-
- // Create tenant specific views on the table using tenant specific Phoenix Connection
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createView(VIEW2_TABLE_NAME, FULL_TABLE_NAME, "o2"), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName, "o1"), regularUser1);
-+ verifyAllowed(createView(view2TableName, fullTableName, "o2"), regularUser1);
-
- // Create indexes on those views using tenant specific Phoenix Connection
- // It is not possible to create indexes on tenant specific views without tenant connection
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, VIEW1_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, VIEW2_TABLE_NAME, "o2"), regularUser1);
-+ verifyAllowed(createIndex(idx1TableName, view1TableName, "o1"), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, view2TableName, "o2"), regularUser1);
-
- // Read the tables as regularUser2, with and without the use of Index table
- // If perms are propagated correctly, then both of them should work
- // The test checks if the query plan uses the index table by searching for "_IDX_" string
- // _IDX_ is the prefix used with base table name to derieve the name of view index table
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME, "o1"), regularUser2);
-- verifyAllowed(readMultiTenantTableWithoutIndex(VIEW2_TABLE_NAME, "o2"), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName, "o1"), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithoutIndex(view2TableName, "o2"), regularUser2);
- }
-
- /**
-@@ -276,18 +266,16 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testCreateViewOnTableWithRXPermsOnSchema() throws Exception {
--
-- startNewMiniCluster();
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, schemaName, true), superUser1);
- } else {
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
- verifyAllowed(grantPermissions("RX", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
- }
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
- }
- }
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSDisabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSDisabledIT.java
-new file mode 100644
-index 000000000..a7004cd31
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSDisabledIT.java
-@@ -0,0 +1,8 @@
-+package org.apache.phoenix.end2end;
-+
-+public class ChangePermissionsNSDisabledIT extends ChangePermissionsIT {
-+
-+ public ChangePermissionsNSDisabledIT() throws Exception {
-+ super(false);
-+ }
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSEnabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSEnabledIT.java
-new file mode 100644
-index 000000000..4d062fafa
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSEnabledIT.java
-@@ -0,0 +1,9 @@
-+package org.apache.phoenix.end2end;
-+
-+public class ChangePermissionsNSEnabledIT extends ChangePermissionsIT {
-+
-+ public ChangePermissionsNSEnabledIT() throws Exception {
-+ super(true);
-+ }
-+
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-deleted file mode 100644
-index 6da970b99..000000000
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-+++ /dev/null
-@@ -1,131 +0,0 @@
--/*
-- * Licensed to the Apache Software Foundation (ASF) under one or more
-- * contributor license agreements. See the NOTICE file distributed with
-- * this work for additional information regarding copyright ownership.
-- * The ASF licenses this file to you under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
--
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.Statement;
--import java.util.Collections;
--import java.util.Properties;
--import java.util.Set;
--
--import org.apache.hadoop.hbase.security.access.Permission.Action;
--import org.apache.phoenix.coprocessor.MetaDataProtocol;
--import org.apache.phoenix.jdbc.PhoenixConnection;
--import org.apache.phoenix.query.QueryServices;
--import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
--import org.apache.phoenix.schema.NewerTableAlreadyExistsException;
--import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.Test;
--import org.junit.experimental.categories.Category;
--
--/**
-- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
-- * Uses HBase API directly to grant/revoke permissions
-- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class SystemTablePermissionsIT extends BasePermissionsIT {
--
-- private static final String TABLE_NAME =
-- SystemTablePermissionsIT.class.getSimpleName().toUpperCase();
--
-- public SystemTablePermissionsIT(boolean isNamespaceMapped) throws Exception {
-- super(isNamespaceMapped);
-- }
--
-- @Test
-- public void testSystemTablePermissions() throws Throwable {
--
-- startNewMiniCluster();
--
-- verifyAllowed(createTable(TABLE_NAME), superUser1);
-- verifyAllowed(readTable(TABLE_NAME), superUser1);
--
-- Set<String> tables = getHBaseTables();
-- if(isNamespaceMapped) {
-- assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-- tables.containsAll(PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES));
-- } else {
-- assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-- tables.containsAll(PHOENIX_SYSTEM_TABLES));
-- }
--
-- // Grant permission to the system tables for the unprivileged user
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- if(isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(),
-- PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.EXEC, Action.READ);
-- } else {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES,
-- Action.EXEC, Action.READ);
-- }
-- grantPermissions(regularUser1.getShortName(),
-- Collections.singleton(TABLE_NAME), Action.READ,Action.EXEC);
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception) e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
--
-- // Make sure that the unprivileged user can now read the table
-- verifyAllowed(readTable(TABLE_NAME), regularUser1);
-- //This verification is added to test PHOENIX-5178
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override public Void run() throws Exception {
-- try {
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(),"SYSTEM", Action.ADMIN);
-- }
-- return null;
-- } catch (Throwable e) {
-- throw new Exception(e);
-- }
--
-- }
-- });
-- if(isNamespaceMapped) {
-- verifyAllowed(new AccessTestAction() {
-- @Override public Object run() throws Exception {
-- Properties props = new Properties();
-- props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-- props.setProperty(PhoenixRuntime.CURRENT_SCN_ATTRIB, Long.toString(MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP));
-- //Impersonate meta connection
-- try (Connection metaConnection = DriverManager.getConnection(getUrl(), props);
-- Statement stmt = metaConnection.createStatement()) {
-- stmt.executeUpdate("CREATE SCHEMA IF NOT EXISTS SYSTEM");
-- }catch(NewerSchemaAlreadyExistsException e){
--
-- }
-- return null;
-- }
-- }, regularUser1);
-- }
-- }
--
--}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-index 37073c393..fd4243082 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-@@ -17,115 +17,42 @@
- package org.apache.phoenix.end2end;
-
-
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.util.Collections;
--
- import org.apache.hadoop.hbase.AuthUtil;
- import org.apache.hadoop.hbase.NamespaceDescriptor;
- import org.apache.hadoop.hbase.security.AccessDeniedException;
- import org.apache.hadoop.hbase.security.access.AccessControlClient;
- import org.apache.hadoop.hbase.security.access.Permission.Action;
-+import org.apache.phoenix.coprocessor.MetaDataProtocol;
-+import org.apache.phoenix.query.QueryServices;
-+import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
-+import org.apache.phoenix.util.PhoenixRuntime;
- import org.apache.phoenix.util.SchemaUtil;
- import org.junit.Test;
- import org.junit.experimental.categories.Category;
--import org.junit.runner.RunWith;
--import org.junit.runners.Parameterized;
-+
-+import java.security.PrivilegedExceptionAction;
-+import java.sql.Connection;
-+import java.sql.DriverManager;
-+import java.sql.Statement;
-+import java.util.Collections;
-+import java.util.Properties;
-+import java.util.Set;
-+
-+import static org.junit.Assert.assertTrue;
-
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- */
--@Category(NeedsOwnMiniClusterTest.class)
--@RunWith(Parameterized.class)
--public class TableDDLPermissionsIT extends BasePermissionsIT{
-+public abstract class TableDDLPermissionsIT extends BasePermissionsIT{
-
- public TableDDLPermissionsIT(boolean isNamespaceMapped) throws Exception {
- super(isNamespaceMapped);
- }
-
-- private void grantSystemTableAccess() throws Exception{
--
-- try (Connection conn = getConnection()) {
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.READ,
-- Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-- Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-- Action.READ, Action.EXEC);
-- // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-- grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
--
-- } else {
-- grantPermissions(regularUser1.getName(), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-- grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM.SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- }
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- }
--
-- @Test
-- public void testSchemaPermissions() throws Throwable{
--
-- if (!isNamespaceMapped) { return; }
-- try {
-- startNewMiniCluster();
-- grantSystemTableAccess();
-- final String schemaName = "TEST_SCHEMA_PERMISSION";
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- AccessControlClient.grant(getUtility().getConnection(), regularUser1.getShortName(),
-- Action.ADMIN);
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
-- verifyAllowed(createSchema(schemaName), regularUser1);
-- // Unprivileged user cannot drop a schema
-- verifyDenied(dropSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(createSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
--
-- verifyAllowed(dropSchema(schemaName), regularUser1);
-- } finally {
-- revokeAll();
-- }
-- }
--
- @Test
- public void testAutomaticGrantWithIndexAndView() throws Throwable {
-- startNewMiniCluster();
-- final String schema = "TEST_INDEX_VIEW";
-- final String tableName = "TABLE_DDL_PERMISSION_IT";
-+ final String schema = generateUniqueName();
-+ final String tableName = generateUniqueName();
- final String phoenixTableName = schema + "." + tableName;
- final String indexName1 = tableName + "_IDX1";
- final String indexName2 = tableName + "_IDX2";
-@@ -136,7 +63,6 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
- final String viewName4 = schema+"."+tableName + "_V4";
- final String viewIndexName1 = tableName + "_VIDX1";
- final String viewIndexName2 = tableName + "_VIDX2";
-- grantSystemTableAccess();
- try {
- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
- @Override
-@@ -235,4 +161,79 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
- }
- }
-
-+ @Test
-+ public void testSystemTablePermissions() throws Throwable {
-+ final String tableName = generateUniqueName();
-+ verifyAllowed(createTable(tableName), superUser1);
-+ verifyAllowed(readTable(tableName), superUser1);
-+
-+ Set<String> tables = getHBaseTables();
-+ if(isNamespaceMapped) {
-+ assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-+ tables.containsAll(PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES));
-+ } else {
-+ assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-+ tables.containsAll(PHOENIX_SYSTEM_TABLES));
-+ }
-+
-+ // Grant permission to the system tables for the unprivileged user
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ if(isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(),
-+ PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.EXEC, Action.READ);
-+ } else {
-+ grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES,
-+ Action.EXEC, Action.READ);
-+ }
-+ grantPermissions(regularUser1.getShortName(),
-+ Collections.singleton(tableName), Action.READ,Action.EXEC);
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception) e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+
-+ // Make sure that the unprivileged user can now read the table
-+ verifyAllowed(readTable(tableName), regularUser1);
-+ //This verification is added to test PHOENIX-5178
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override public Void run() throws Exception {
-+ try {
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(),"SYSTEM", Action.ADMIN);
-+ }
-+ return null;
-+ } catch (Throwable e) {
-+ throw new Exception(e);
-+ }
-+
-+ }
-+ });
-+ if(isNamespaceMapped) {
-+ verifyAllowed(new AccessTestAction() {
-+ @Override public Object run() throws Exception {
-+ Properties props = new Properties();
-+ props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-+ props.setProperty(PhoenixRuntime.CURRENT_SCN_ATTRIB, Long.toString(MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP));
-+ //Impersonate meta connection
-+ try (Connection metaConnection = DriverManager.getConnection(getUrl(), props);
-+ Statement stmt = metaConnection.createStatement()) {
-+ stmt.executeUpdate("CREATE SCHEMA IF NOT EXISTS SYSTEM");
-+ }catch(NewerSchemaAlreadyExistsException e){
-+
-+ }
-+ return null;
-+ }
-+ }, regularUser1);
-+ }
-+ }
-+
- }
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSDisabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSDisabledIT.java
-new file mode 100644
-index 000000000..271baea27
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSDisabledIT.java
-@@ -0,0 +1,8 @@
-+package org.apache.phoenix.end2end;
-+
-+public class TableDDLPermissionsNSDisabledIT extends TableDDLPermissionsIT {
-+
-+ public TableDDLPermissionsNSDisabledIT() throws Exception {
-+ super(false);
-+ }
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSEnabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSEnabledIT.java
-new file mode 100644
-index 000000000..18053742c
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSEnabledIT.java
-@@ -0,0 +1,46 @@
-+package org.apache.phoenix.end2end;
-+
-+import org.apache.hadoop.hbase.security.AccessDeniedException;
-+import org.apache.hadoop.hbase.security.access.AccessControlClient;
-+import org.apache.hadoop.hbase.security.access.Permission;
-+import org.junit.Test;
-+
-+import java.security.PrivilegedExceptionAction;
-+
-+public class TableDDLPermissionsNSEnabledIT extends TableDDLPermissionsIT {
-+
-+ public TableDDLPermissionsNSEnabledIT() throws Exception {
-+ super(true);
-+ }
-+
-+ @Test
-+ public void testSchemaPermissions() throws Throwable{
-+ try {
-+ final String schemaName = "TEST_SCHEMA_PERMISSION";
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ AccessControlClient.grant(getUtility().getConnection(), regularUser1.getShortName(),
-+ Permission.Action.ADMIN);
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+ verifyAllowed(createSchema(schemaName), regularUser1);
-+ // Unprivileged user cannot drop a schema
-+ verifyDenied(dropSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(createSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-+
-+ verifyAllowed(dropSchema(schemaName), regularUser1);
-+ } finally {
-+ revokeAll();
-+ }
-+ }
-+}
diff --git a/phoenix-assembly/pom.xml~ b/phoenix-assembly/pom.xml~
deleted file mode 100644
index 4acffdb..0000000
--- a/phoenix-assembly/pom.xml~
+++ /dev/null
@@ -1,127 +0,0 @@
-<?xml version='1.0'?>
-<!--
-
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
-
--->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
- <modelVersion>4.0.0</modelVersion>
- <parent>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix</artifactId>
- <version>4.15.0-HBase-1.3-SNAPSHOT</version>
- </parent>
- <artifactId>phoenix-assembly</artifactId>
- <name>Phoenix Assembly</name>
- <description>Assemble Phoenix artifacts</description>
- <packaging>pom</packaging>
-
- <properties>
- <top.dir>${project.basedir}/..</top.dir>
- <maven.test.skip>true</maven.test.skip>
- <source.skip>true</source.skip>
- </properties>
-
- <build>
- <plugins>
- <!-- No jars created for this module -->
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-jar-plugin</artifactId>
- <executions>
- <execution>
- <id>default-jar</id>
- <phase>none</phase>
- <goals/>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <artifactId>maven-assembly-plugin</artifactId>
- <executions>
- <execution>
- <id>package-to-tar</id>
- <phase>package</phase>
- <goals>
- <goal>single</goal>
- </goals>
- <configuration>
- <finalName>phoenix-${project.version}</finalName>
- <attach>false</attach>
- <tarLongFileMode>gnu</tarLongFileMode>
- <appendAssemblyId>false</appendAssemblyId>
- <descriptors>
- <descriptor>src/build/package-to-tar-all.xml</descriptor>
- </descriptors>
- <tarLongFileMode>posix</tarLongFileMode>
- </configuration>
- </execution>
- <execution>
- <id>package-to-source-tar</id>
- <phase>package</phase>
- <goals>
- <goal>single</goal>
- </goals>
- <configuration>
- <finalName>phoenix-${project.version}-source</finalName>
- <attach>false</attach>
- <tarLongFileMode>gnu</tarLongFileMode>
- <appendAssemblyId>false</appendAssemblyId>
- <descriptors>
- <descriptor>src/build/src.xml</descriptor>
- </descriptors>
- <tarLongFileMode>posix</tarLongFileMode>
- </configuration>
- </execution>
- </executions>
- </plugin>
- </plugins>
- </build>
-
- <dependencies>
- <!-- Depend on all other internal projects -->
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-core</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-flume</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-kafka</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-pig</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-spark</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.omid</groupId>
- <artifactId>omid-hbase-tools-hbase1.x</artifactId>
- <version>${omid.version}</version>
- </dependency>
- </dependencies>
-</project>
diff --git a/phoenix-client/pom.xml~ b/phoenix-client/pom.xml~
deleted file mode 100644
index 4cf18d3..0000000
--- a/phoenix-client/pom.xml~
+++ /dev/null
@@ -1,383 +0,0 @@
-<?xml version='1.0'?>
-<!--
-
- Licensed to the Apache Software Foundation (ASF) under one
- or more contributor license agreements. See the NOTICE file
- distributed with this work for additional information
- regarding copyright ownership. The ASF licenses this file
- to you under the Apache License, Version 2.0 (the
- "License"); you may not use this file except in compliance
- with the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing,
- software distributed under the License is distributed on an
- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- KIND, either express or implied. See the License for the
- specific language governing permissions and limitations
- under the License.
-
--->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
- <modelVersion>4.0.0</modelVersion>
- <parent>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix</artifactId>
- <version>4.15.0-HBase-1.3-SNAPSHOT</version>
- </parent>
- <artifactId>phoenix-client</artifactId>
- <name>Phoenix Client</name>
- <description>Phoenix Client</description>
- <packaging>jar</packaging>
- <properties>
- <!-- Don't make a test-jar -->
- <maven.test.skip>true</maven.test.skip>
- <!-- Don't make a source-jar -->
- <source.skip>true</source.skip>
- <license.bundles.dependencies>true</license.bundles.dependencies>
- <top.dir>${project.basedir}/..</top.dir>
- <shaded.package>org.apache.phoenix.shaded</shaded.package>
-
- </properties>
-
- <build>
- <plugins>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-site-plugin</artifactId>
- <configuration>
- <skip>true</skip>
- </configuration>
- </plugin>
-
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-jar-plugin</artifactId>
- <configuration>
- <finalName>phoenix-${project.version}-client</finalName>
- </configuration>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-install-plugin</artifactId>
- <executions>
- <execution>
- <goals>
- <goal>install-file</goal>
- </goals>
- <id>default-install</id>
- <configuration>
- <skip>true</skip>
- </configuration>
- <phase>install</phase>
- </execution>
- </executions>
- <configuration>
- <file>${basedir}/target/phoenix-${project.version}-client.jar</file>
- <pomFile>${basedir}/pom.xml</pomFile>
- </configuration>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-shade-plugin</artifactId>
- <executions>
- <execution>
- <phase>package</phase>
- <goals>
- <goal>shade</goal>
- </goals>
- <configuration>
- <finalName>phoenix-${project.version}-client</finalName>
- <shadedArtifactAttached>false</shadedArtifactAttached>
- <promoteTransitiveDependencies>true</promoteTransitiveDependencies>
- <shadeTestJar>false</shadeTestJar>
- <transformers>
- <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
- <transformer
- implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
- <resource>csv-bulk-load-config.properties</resource>
- <file>
- ${project.basedir}/../config/csv-bulk-load-config.properties
- </file>
- </transformer>
- <transformer
- implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
- <resource>README.md</resource>
- <file>${project.basedir}/../README.md</file>
- </transformer>
- <transformer
- implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
- <resource>LICENSE.txt</resource>
- <file>${project.basedir}/../LICENSE</file>
- </transformer>
- <transformer
- implementation="org.apache.maven.plugins.shade.resource.IncludeResourceTransformer">
- <resource>NOTICE</resource>
- <file>${project.basedir}/../NOTICE</file>
- </transformer>
- </transformers>
- <artifactSet>
- <includes>
- <include>*:*</include>
- </includes>
- <excludes>
- <exclude>org.apache.phoenix:phoenix-client</exclude>
- <exclude>xom:xom</exclude>
- </excludes>
- </artifactSet>
- <filters>
- <filter>
- <artifact>*:*</artifact>
- <excludes>
- <exclude>META-INF/*.SF</exclude>
- <exclude>META-INF/*.DSA</exclude>
- <exclude>META-INF/*.RSA</exclude>
- <exclude>META-INF/license/*</exclude>
- <exclude>LICENSE.*</exclude>
- <exclude>NOTICE.*</exclude>
- </excludes>
- </filter>
- </filters>
-
- <relocations>
-
- <!-- COM relocation -->
- <relocation>
- <pattern>com.codahale</pattern>
- <shadedPattern>${shaded.package}.com.codahale</shadedPattern>
- </relocation>
- <relocation>
- <pattern>com.fasterxml</pattern>
- <shadedPattern>${shaded.package}.com.fasterxml</shadedPattern>
- </relocation>
- <relocation>
- <pattern>com.jamesmurty</pattern>
- <shadedPattern>${shaded.package}.com.jamesmurty</shadedPattern>
- </relocation>
- <relocation>
- <pattern>com.jcraft</pattern>
- <shadedPattern>${shaded.package}.com.jcraft</shadedPattern>
- </relocation>
- <relocation>
- <pattern>com.lmax</pattern>
- <shadedPattern>${shaded.package}.com.lmax</shadedPattern>
- </relocation>
- <relocation>
- <pattern>com.thoughtworks</pattern>
- <shadedPattern>${shaded.package}.com.thoughtworks</shadedPattern>
- </relocation>
- <relocation>
- <pattern>com.yammer</pattern>
- <shadedPattern>${shaded.package}.com.yammer</shadedPattern>
- </relocation>
-
- <!-- IO relocations -->
- <relocation>
- <pattern>io.netty</pattern>
- <shadedPattern>${shaded.package}.io.netty</shadedPattern>
- </relocation>
-
- <!-- ORG relocations -->
- <relocation>
- <pattern>org.antlr</pattern>
- <shadedPattern>${shaded.package}.org.antlr</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.aopalliance</pattern>
- <shadedPattern>${shaded.package}.org.aopalliance</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.codehaus</pattern>
- <shadedPattern>${shaded.package}.org.codehaus</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.fusesource</pattern>
- <shadedPattern>${shaded.package}.org.fusesource</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.hamcrest</pattern>
- <shadedPattern>${shaded.package}.org.hamcrest</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.hsqldb</pattern>
- <shadedPattern>${shaded.package}.org.hsqldb</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.iq80</pattern>
- <shadedPattern>${shaded.package}.org.iq80</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.jamon</pattern>
- <shadedPattern>${shaded.package}.org.jamon</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.jboss</pattern>
- <shadedPattern>${shaded.package}.org.jboss</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.jcodings</pattern>
- <shadedPattern>${shaded.package}.org.jcodings</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.jets3t</pattern>
- <shadedPattern>${shaded.package}.org.jets3t</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.joda</pattern>
- <shadedPattern>${shaded.package}.org.joda</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.joni</pattern>
- <shadedPattern>${shaded.package}.org.joni</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.junit</pattern>
- <shadedPattern>${shaded.package}.org.junit</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.kosmix</pattern>
- <shadedPattern>${shaded.package}.org.kosmix</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.mortbay</pattern>
- <shadedPattern>${shaded.package}.org.mortbay</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.objectweb</pattern>
- <shadedPattern>${shaded.package}.org.objectweb</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.stringtemplate</pattern>
- <shadedPattern>${shaded.package}.org.stringtemplate</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.tukaani</pattern>
- <shadedPattern>${shaded.package}.org.tukaani</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.znerd</pattern>
- <shadedPattern>${shaded.package}.org.znerd</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.avro</pattern>
- <shadedPattern>${shaded.package}.org.apache.avro</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.commons</pattern>
- <shadedPattern>${shaded.package}.org.apache.commons</shadedPattern>
- <excludes>
- <exclude>org.apache.commons.csv.**</exclude>
- <exclude>org.apache.commons.logging.**</exclude>
- <exclude>org.apache.commons.configuration.**</exclude>
- </excludes>
- </relocation>
- <relocation>
- <pattern>org.apache.directory</pattern>
- <shadedPattern>${shaded.package}.org.apache.directory</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.http</pattern>
- <shadedPattern>${shaded.package}.org.apache.http</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.jasper</pattern>
- <shadedPattern>${shaded.package}.org.apache.jasper</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.jute</pattern>
- <shadedPattern>${shaded.package}.org.apache.jute</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.mina</pattern>
- <shadedPattern>${shaded.package}.org.apache.mina</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.oro</pattern>
- <shadedPattern>${shaded.package}.org.apache.oro</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.taglibs</pattern>
- <shadedPattern>${shaded.package}.org.apache.taglibs</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.thrift</pattern>
- <shadedPattern>${shaded.package}.org.apache.thrift</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.tools</pattern>
- <shadedPattern>${shaded.package}.org.apache.tools</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.twill</pattern>
- <shadedPattern>${shaded.package}.org.apache.twill</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.velocity</pattern>
- <shadedPattern>${shaded.package}.org.apache.velocity</shadedPattern>
- </relocation>
- <relocation>
- <pattern>org.apache.zookeeper</pattern>
- <shadedPattern>${shaded.package}.org.apache.zookeeper</shadedPattern>
- </relocation>
-
- <!-- NET relocations -->
- <relocation>
- <pattern>net</pattern>
- <shadedPattern>${shaded.package}.net</shadedPattern>
- </relocation>
-
- <!-- Misc relocations -->
- <relocation>
- <pattern>antlr</pattern>
- <shadedPattern>${shaded.package}.antlr</shadedPattern>
- </relocation>
- <relocation>
- <pattern>it.unimi</pattern>
- <shadedPattern>${shaded.package}.it.unimi</shadedPattern>
- </relocation>
- <relocation>
- <pattern>jline</pattern>
- <shadedPattern>${shaded.package}.jline</shadedPattern>
- </relocation>
- <relocation>
- <pattern>junit</pattern>
- <shadedPattern>${shaded.package}.junit</shadedPattern>
- </relocation>
- </relocations>
- </configuration>
- </execution>
- </executions>
- </plugin>
- </plugins>
- </build>
-
- <dependencies>
- <!-- Depend on all other internal projects -->
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-core</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-flume</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-pig</artifactId>
- <exclusions>
- <exclusion>
- <groupId>org.apache.pig</groupId>
- <artifactId>pig</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-spark</artifactId>
- </dependency>
- </dependencies>
-</project>
diff --git a/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java~ b/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java~
deleted file mode 100644
index cefb456..0000000
--- a/phoenix-core/src/test/java/org/apache/phoenix/tool/ParameterizedPhoenixCanaryToolIT.java~
+++ /dev/null
@@ -1,280 +0,0 @@
-/*
-* Licensed to the Apache Software Foundation (ASF) under one
-* or more contributor license agreements. See the NOTICE file
-* distributed with this work for additional information
-* regarding copyright ownership. The ASF licenses this file
-* to you under the Apache License, Version 2.0 (the
-* "License"); you may not use this file except in compliance
-* with the License. You may obtain a copy of the License at
-*
-* http://www.apache.org/licenses/LICENSE-2.0
-*
-* Unless required by applicable law or agreed to in writing, software
-* distributed under the License is distributed on an "AS IS" BASIS,
-* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-* See the License for the specific language governing permissions and
-* limitations under the License.
-*/
-package org.apache.phoenix.tool;
-
-import com.google.common.collect.Maps;
-import com.google.gson.Gson;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.apache.phoenix.end2end.ChangePermissionsIT;
-import org.apache.phoenix.end2end.NeedsOwnMiniClusterTest;
-import org.apache.phoenix.query.BaseTest;
-import org.apache.phoenix.query.QueryServices;
-import org.apache.phoenix.util.ReadOnlyProps;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.experimental.categories.Category;
-import org.junit.runner.RunWith;
-import org.junit.runners.Parameterized;
-
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileReader;
-import java.io.FilenameFilter;
-import java.io.IOException;
-import java.io.InputStream;
-import java.sql.Connection;
-import java.sql.DriverManager;
-import java.sql.SQLException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Properties;
-
-import static org.apache.phoenix.tool.PhoenixCanaryTool.propFileName;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-
-@RunWith(Parameterized.class)
-@Category(NeedsOwnMiniClusterTest.class)
-public class ParameterizedPhoenixCanaryToolIT extends BaseTest {
-
- private static final Log logger = LogFactory.getLog(ParameterizedPhoenixCanaryToolIT.class);
- private static final String stdOutSink
- = "org.apache.phoenix.tool.PhoenixCanaryTool$StdOutSink";
- private static final String fileOutSink
- = "org.apache.phoenix.tool.PhoenixCanaryTool$FileOutSink";
-
- private static Map<String, String> serverProps = Maps.newHashMapWithExpectedSize(2);
- private static Map<String, String> clientProps = Maps.newHashMapWithExpectedSize(2);
- private static String connString = "";
- private static Properties canaryProp = new Properties();
- private static Connection connection = null;
- private boolean isNamespaceEnabled;
- private boolean isPositiveTestType;
- private List<String> cmd = new ArrayList<>();
- private String resultSinkOption;
- private ByteArrayOutputStream out = new ByteArrayOutputStream();
-
- public ParameterizedPhoenixCanaryToolIT(boolean isPositiveTestType,
- boolean isNamespaceEnabled, String resultSinkOption) {
- this.isPositiveTestType = isPositiveTestType;
- this.isNamespaceEnabled = isNamespaceEnabled;
- this.resultSinkOption = resultSinkOption;
- }
-
- @Parameterized.Parameters(name = "ParameterizedPhoenixCanaryToolIT_isPositiveTestType={0}," +
- "isNamespaceEnabled={1},resultSinkOption={2}")
- public static Collection parametersList() {
- return Arrays.asList(new Object[][] {
- {true, true, stdOutSink},
- {true, true, fileOutSink},
- {false, true, stdOutSink},
- {false, true, fileOutSink},
- {true, false, stdOutSink},
- {true, false, fileOutSink},
- {false, false, stdOutSink},
- {false, false, fileOutSink}
- });
- }
-
- @Before
- public void setup() throws Exception {
- String createSchema;
- String createTable;
-
- if(needsNewCluster()) {
- setClientSideNamespaceProperties();
- setServerSideNamespaceProperties();
- tearDownMiniClusterAsync(1);
- setUpTestDriver(new ReadOnlyProps(serverProps.entrySet().iterator()),
- new ReadOnlyProps(clientProps.entrySet().iterator()));
- logger.info("New cluster is spinned up with test parameters " +
- "isPositiveTestType" + this.isPositiveTestType +
- "isNamespaceEnabled" + this.isNamespaceEnabled +
- "resultSinkOption" + this.resultSinkOption);
- connString = BaseTest.getUrl();
- connection = getConnection();
- }
-
- if (this.isNamespaceEnabled) {
- createSchema = "CREATE SCHEMA IF NOT EXISTS TEST";
- connection.createStatement().execute(createSchema);
- }
- createTable = "CREATE TABLE IF NOT EXISTS TEST.PQSTEST " +
- "(mykey INTEGER NOT NULL PRIMARY KEY, mycolumn VARCHAR," +
- " insert_date TIMESTAMP)";
- connection.createStatement().execute(createTable);
- cmd.add("--constring");
- cmd.add(connString);
- cmd.add("--logsinkclass");
- cmd.add(this.resultSinkOption);
- if (this.resultSinkOption.contains(stdOutSink)) {
- System.setOut(new java.io.PrintStream(out));
- } else {
- loadCanaryPropertiesFile(canaryProp);
- }
- }
-
- private boolean needsNewCluster() {
- if (connection == null) {
- return true;
- }
- if (!clientProps.get(QueryServices.IS_SYSTEM_TABLE_MAPPED_TO_NAMESPACE)
- .equalsIgnoreCase(String.valueOf(this.isNamespaceEnabled))) {
- return true;
- }
- return false;
- }
-
- private void setClientSideNamespaceProperties() {
-
- clientProps.put(QueryServices.IS_SYSTEM_TABLE_MAPPED_TO_NAMESPACE,
- String.valueOf(this.isNamespaceEnabled));
-
- clientProps.put(QueryServices.IS_NAMESPACE_MAPPING_ENABLED,
- String.valueOf(this.isNamespaceEnabled));
- }
-
- private Connection getConnection() throws SQLException {
- Properties props = new Properties();
- props.setProperty(QueryServices.IS_SYSTEM_TABLE_MAPPED_TO_NAMESPACE,
- String.valueOf(this.isNamespaceEnabled));
-
- props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED,
- String.valueOf(this.isNamespaceEnabled));
- return DriverManager.getConnection(connString, props);
- }
-
- void setServerSideNamespaceProperties() {
- serverProps.put(QueryServices.IS_NAMESPACE_MAPPING_ENABLED,
- String.valueOf(this.isNamespaceEnabled));
- serverProps.put(QueryServices.IS_SYSTEM_TABLE_MAPPED_TO_NAMESPACE,
- String.valueOf(this.isNamespaceEnabled));
- }
-
- /*
- * This test runs in the test suit with
- * combination of parameters provided.
- * It tests the tool in positive type where test expects to pass
- * and negative type where test expects to fail.
- */
- @Test
- public void phoenixCanaryToolTest() throws SQLException, IOException {
- if (!isPositiveTestType) {
- dropTestTable();
- }
- PhoenixCanaryTool.main(cmd.toArray(new String[cmd.size()]));
- Boolean result = getAggregatedResult();
- if (isPositiveTestType) {
- assertTrue(result);
- } else {
- assertFalse(result);
- }
- }
-
- private Boolean getAggregatedResult() throws IOException {
- HashMap<String, Boolean> resultsMap;
- Boolean result = true;
- resultsMap = parsePublishedResults();
- for (Boolean b : resultsMap.values()) {
- result = result && b;
- }
- return result;
- }
-
- private HashMap<String, Boolean> parsePublishedResults() throws IOException {
- Gson parser = new Gson();
- CanaryTestResult[] results;
- HashMap<String, Boolean> resultsMap = new HashMap<>();
-
- if (this.resultSinkOption.contains(fileOutSink)) {
- File resultFile = getTestResultsFile();
- results = parser.fromJson(new FileReader(resultFile),
- CanaryTestResult[].class);
- } else {
- String result = out.toString();
- results = parser.fromJson(result, CanaryTestResult[].class);
- }
- for (CanaryTestResult r : results) {
- resultsMap.put(r.getTestName(), r.isSuccessful());
- }
- return resultsMap;
- }
-
- private File getTestResultsFile() {
- File[] files = getLogFileList();
- return files[0];
- }
-
- @After
- public void teardown() throws SQLException {
- if (this.isNamespaceEnabled) {
- dropTestTableAndSchema();
- } else {
- dropTestTable();
- }
- if (this.resultSinkOption.contains(fileOutSink)) {
- deleteResultSinkFile();
- }
- }
-
- private void deleteResultSinkFile() {
- File[] files = getLogFileList();
- for (final File file : files) {
- if (!file.delete()) {
- System.err.println("Can't remove " + file.getAbsolutePath());
- }
- }
- }
-
- private File[] getLogFileList() {
- File dir = new File(canaryProp.getProperty("file.location"));
- return dir.listFiles(new FilenameFilter() {
- @Override
- public boolean accept(File dir, String name) {
- return name.endsWith(".log");
- }
- });
- }
-
- private void loadCanaryPropertiesFile(Properties prop) {
- InputStream input = ClassLoader.getSystemResourceAsStream(propFileName);
- try {
- prop.load(input);
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
-
- private void dropTestTable() throws SQLException {
- String dropTable = "DROP TABLE IF EXISTS TEST.PQSTEST";
- connection.createStatement().execute(dropTable);
- }
-
- private void dropTestTableAndSchema() throws SQLException {
- dropTestTable();
- String dropSchema = "DROP SCHEMA IF EXISTS TEST";
- connection.createStatement().execute(dropSchema);
- }
-
-}
diff --git a/pom.xml~ b/pom.xml~
deleted file mode 100644
index d8de185..0000000
--- a/pom.xml~
+++ /dev/null
@@ -1,1086 +0,0 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
- <modelVersion>4.0.0</modelVersion>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix</artifactId>
- <version>4.15.0-HBase-1.3-SNAPSHOT</version>
- <packaging>pom</packaging>
- <name>Apache Phoenix</name>
- <description>A SQL layer over HBase</description>
-
- <licenses>
- <license>
- <name>The Apache Software License, Version 2.0</name>
- <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
- <distribution>repo</distribution>
- <comments/>
- </license>
- </licenses>
-
- <organization>
- <name>Apache Software Foundation</name>
- <url>http://www.apache.org</url>
- </organization>
-
- <modules>
- <module>phoenix-core</module>
- <module>phoenix-flume</module>
- <module>phoenix-kafka</module>
- <module>phoenix-pig</module>
- <module>phoenix-pherf</module>
- <module>phoenix-spark</module>
- <module>phoenix-hive</module>
- <module>phoenix-client</module>
- <module>phoenix-server</module>
- <module>phoenix-assembly</module>
- <module>phoenix-tracing-webapp</module>
- </modules>
-
- <repositories>
- <repository>
- <id>apache release</id>
- <url>https://repository.apache.org/content/repositories/releases/</url>
- </repository>
- </repositories>
-
- <parent>
- <groupId>org.apache</groupId>
- <artifactId>apache</artifactId>
- <version>14</version>
- </parent>
-
- <scm>
- <connection>scm:git:http://git-wip-us.apache.org/repos/asf/phoenix.git</connection>
- <url>https://git-wip-us.apache.org/repos/asf/phoenix.git</url>
- <developerConnection>scm:git:https://git-wip-us.apache.org/repos/asf/phoenix.git</developerConnection>
- </scm>
-
- <properties>
- <!-- General Properties -->
- <antlr-input.dir>src/main/antlr3</antlr-input.dir>
- <antlr-output.dir>target/generated-sources/antlr3</antlr-output.dir>
- <test.output.tofile>true</test.output.tofile>
- <top.dir>${project.basedir}</top.dir>
-
- <!-- Hadoop Versions -->
- <hbase.version>1.3.1</hbase.version>
- <hadoop-two.version>2.7.1</hadoop-two.version>
-
- <!-- Dependency versions -->
- <commons-cli.version>1.2</commons-cli.version>
- <hive.version>1.2.1</hive.version>
- <hadoop.version>2.7.1</hadoop.version>
- <pig.version>0.13.0</pig.version>
- <jackson.version>1.9.2</jackson.version>
- <antlr.version>3.5.2</antlr.version>
- <log4j.version>1.2.17</log4j.version>
- <disruptor.version>3.3.6</disruptor.version>
- <slf4j.version>1.6.4</slf4j.version>
- <protobuf-java.version>2.5.0</protobuf-java.version>
- <commons-io.version>2.1</commons-io.version>
- <commons-lang.version>2.5</commons-lang.version>
- <commons-logging.version>1.2</commons-logging.version>
- <commons-csv.version>1.0</commons-csv.version>
- <sqlline.version>1.2.0</sqlline.version>
- <guava.version>13.0.1</guava.version>
- <flume.version>1.4.0</flume.version>
- <kafka.version>0.9.0.0</kafka.version>
- <findbugs-annotations.version>1.3.9-1</findbugs-annotations.version>
- <jcip-annotations.version>1.0-1</jcip-annotations.version>
- <jline.version>2.11</jline.version>
- <snappy.version>0.3</snappy.version>
- <commons-codec.version>1.7</commons-codec.version>
- <htrace.version>3.1.0-incubating</htrace.version>
- <collections.version>3.2.2</collections.version>
- <!-- Do not change jodatime.version until HBASE-15199 is fixed -->
- <jodatime.version>1.6</jodatime.version>
- <joni.version>2.1.2</joni.version>
- <avatica.version>1.12.0</avatica.version>
- <jettyVersion>8.1.7.v20120910</jettyVersion>
- <tephra.version>0.15.0-incubating</tephra.version>
- <omid.version>1.0.0</omid.version>
- <spark.version>2.4.0</spark.version>
- <scala.version>2.11.8</scala.version>
- <scala.binary.version>2.11</scala.binary.version>
- <stream.version>2.9.5</stream.version>
- <i18n-util.version>1.0.4</i18n-util.version>
- <servlet.api.version>3.1.0</servlet.api.version>
- <!-- Test Dependencies -->
- <mockito-all.version>1.8.5</mockito-all.version>
- <junit.version>4.12</junit.version>
-
- <!-- Plugin versions -->
- <maven-eclipse-plugin.version>2.9</maven-eclipse-plugin.version>
- <maven-build-helper-plugin.version>1.9.1</maven-build-helper-plugin.version>
- <maven-surefire-plugin.version>2.20</maven-surefire-plugin.version>
- <maven-failsafe-plugin.version>2.20</maven-failsafe-plugin.version>
-
- <maven-dependency-plugin.version>2.1</maven-dependency-plugin.version>
- <maven.assembly.version>2.5.2</maven.assembly.version>
-
- <!-- Plugin options -->
- <numForkedUT>8</numForkedUT>
- <numForkedIT>7</numForkedIT>
- <it.failIfNoSpecifiedTests>false</it.failIfNoSpecifiedTests>
- <surefire.failIfNoSpecifiedTests>false</surefire.failIfNoSpecifiedTests>
-
- <!-- Set default encoding so multi-byte tests work correctly on the Mac -->
- <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
- <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
- <curator.version>2.12.0</curator.version>
-
- </properties>
-
- <build>
- <pluginManagement>
- <plugins>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-compiler-plugin</artifactId>
- <version>3.0</version>
- <configuration>
- <source>1.7</source>
- <target>1.7</target>
- </configuration>
- </plugin>
- <!--This plugin's configuration is used to store Eclipse m2e settings
- only. It has no influence on the Maven build itself. -->
- <plugin>
- <groupId>org.eclipse.m2e</groupId>
- <artifactId>lifecycle-mapping</artifactId>
- <version>1.0.0</version>
- <configuration>
- <lifecycleMappingMetadata>
- <pluginExecutions>
- <pluginExecution>
- <pluginExecutionFilter>
- <groupId>org.antlr</groupId>
- <artifactId>antlr3-maven-plugin</artifactId>
- <versionRange>[3.5,)</versionRange>
- <goals>
- <goal>antlr</goal>
- </goals>
- </pluginExecutionFilter>
- <action>
- <ignore />
- </action>
- </pluginExecution>
- </pluginExecutions>
- </lifecycleMappingMetadata>
- </configuration>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-install-plugin</artifactId>
- <version>2.5.2</version>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-eclipse-plugin</artifactId>
- <version>${maven-eclipse-plugin.version}</version>
- </plugin>
- <plugin>
- <artifactId>maven-assembly-plugin</artifactId>
- <version>${maven.assembly.version}</version>
- </plugin>
- <plugin>
- <groupId>org.apache.rat</groupId>
- <artifactId>apache-rat-plugin</artifactId>
- <!-- Avoid defining exclusions in pluginManagement as they are global.
- We already inherit some from the ASF parent pom. -->
- </plugin>
- <!-- We put slow-running tests into src/it and run them during the
- integration-test phase using the failsafe plugin. This way
- developers can run unit tests conveniently from the IDE or via
- "mvn package" from the command line without triggering time
- consuming integration tests. -->
- <plugin>
- <groupId>org.codehaus.mojo</groupId>
- <artifactId>build-helper-maven-plugin</artifactId>
- <version>${maven-build-helper-plugin.version}</version>
- <executions>
- <execution>
- <id>add-test-source</id>
- <phase>validate</phase>
- <goals>
- <goal>add-test-source</goal>
- </goals>
- <configuration>
- <sources>
- <source>${basedir}/src/it/java</source>
- </sources>
- </configuration>
- </execution>
- <execution>
- <id>add-test-resource</id>
- <phase>validate</phase>
- <goals>
- <goal>add-test-resource</goal>
- </goals>
- <configuration>
- <resources>
- <resource>
- <directory>${basedir}/src/it/resources</directory>
- </resource>
- </resources>
- </configuration>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-failsafe-plugin</artifactId>
- <version>${maven-failsafe-plugin.version}</version>
- <executions>
- <execution>
- <id>ParallelStatsEnabledTest</id>
- <configuration>
- <encoding>UTF-8</encoding>
- <forkCount>${numForkedIT}</forkCount>
- <runOrder>alphabetical</runOrder>
- <reuseForks>true</reuseForks>
- <runOrder>alphabetical</runOrder>
- <!--parallel>methods</parallel>
- <threadCount>20</threadCount-->
- <argLine>-Xmx2000m -XX:MaxPermSize=256m -Djava.security.egd=file:/dev/./urandom "-Djava.library.path=${hadoop.library.path}${path.separator}${java.library.path}" -XX:NewRatio=4 -XX:SurvivorRatio=8 -XX:+UseCompressedOops -XX:+UseConcMarkSweepGC -XX:+UseParNewGC -XX:+DisableExplicitGC -XX:+UseCMSInitiatingOccupancyOnly -XX:+CMSClassUnloadingEnabled -XX:+CMSScavengeBeforeRemark -XX:CMSInitiatingOccupancyFraction=68 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=./target/</ [...]
- <redirectTestOutputToFile>${test.output.tofile}</redirectTestOutputToFile>
- <shutdown>kill</shutdown>
- <testSourceDirectory>${basedir}/src/it/java</testSourceDirectory>
- <groups>org.apache.phoenix.end2end.ParallelStatsEnabledTest</groups>
- </configuration>
- <goals>
- <goal>integration-test</goal>
- <goal>verify</goal>
- </goals>
- </execution>
- <execution>
- <id>ParallelStatsDisabledTest</id>
- <configuration>
- <encoding>UTF-8</encoding>
- <forkCount>${numForkedIT}</forkCount>
- <runOrder>alphabetical</runOrder>
- <reuseForks>true</reuseForks>
- <runOrder>alphabetical</runOrder>
- <!--parallel>methods</parallel>
- <threadCount>20</threadCount-->
- <!-- We're intermittantly hitting this assertion when running in parallel:
- Caused by: java.lang.AssertionError: we should never remove a different context
- at org.apache.hadoop.hbase.regionserver.HRegion$RowLockContext.cleanUp(HRegion.java:5206)
- at org.apache.hadoop.hbase.regionserver.HRegion$RowLockImpl.release(HRegion.java:5246)
- at org.apache.phoenix.coprocessor.MetaDataEndpointImpl.doGetTable(MetaDataEndpointImpl.java:2898)
- at org.apache.phoenix.coprocessor.MetaDataEndpointImpl.doGetTable(MetaDataEndpointImpl.java:2835)
- at org.apache.phoenix.coprocessor.MetaDataEndpointImpl.getTable(MetaDataEndpointImpl.java:490) -->
- <!--enableAssertions>false</enableAssertions-->
- <argLine>-Xmx3000m -XX:MaxPermSize=256m -Djava.security.egd=file:/dev/./urandom "-Djava.library.path=${hadoop.library.path}${path.separator}${java.library.path}" -XX:NewRatio=4 -XX:SurvivorRatio=8 -XX:+UseCompressedOops -XX:+UseConcMarkSweepGC -XX:+UseParNewGC -XX:+DisableExplicitGC -XX:+UseCMSInitiatingOccupancyOnly -XX:+CMSClassUnloadingEnabled -XX:+CMSScavengeBeforeRemark -XX:CMSInitiatingOccupancyFraction=68 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=./target/</ [...]
- <redirectTestOutputToFile>${test.output.tofile}</redirectTestOutputToFile>
- <shutdown>kill</shutdown>
- <testSourceDirectory>${basedir}/src/it/java</testSourceDirectory>
- <groups>org.apache.phoenix.end2end.ParallelStatsDisabledTest</groups>
- </configuration>
- <goals>
- <goal>integration-test</goal>
- <goal>verify</goal>
- </goals>
- </execution>
- <execution>
- <id>HBaseManagedTimeTests</id>
- <configuration>
- <encoding>UTF-8</encoding>
- <forkCount>${numForkedIT}</forkCount>
- <runOrder>alphabetical</runOrder>
- <reuseForks>true</reuseForks>
- <argLine>-enableassertions -Xmx2000m -XX:MaxPermSize=128m -Djava.security.egd=file:/dev/./urandom "-Djava.library.path=${hadoop.library.path}${path.separator}${java.library.path}" -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=./target/</argLine>
- <redirectTestOutputToFile>${test.output.tofile}</redirectTestOutputToFile>
- <testSourceDirectory>${basedir}/src/it/java</testSourceDirectory>
- <groups>org.apache.phoenix.end2end.HBaseManagedTimeTest</groups>
- <shutdown>kill</shutdown>
- </configuration>
- <goals>
- <goal>integration-test</goal>
- <goal>verify</goal>
- </goals>
- </execution>
- <execution>
- <id>NeedTheirOwnClusterTests</id>
- <configuration>
- <encoding>UTF-8</encoding>
- <forkCount>${numForkedIT}</forkCount>
- <runOrder>alphabetical</runOrder>
- <reuseForks>false</reuseForks>
- <argLine>-enableassertions -Xmx2000m -XX:MaxPermSize=256m -Djava.security.egd=file:/dev/./urandom "-Djava.library.path=${hadoop.library.path}${path.separator}${java.library.path}" -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=./target/</argLine>
- <redirectTestOutputToFile>${test.output.tofile}</redirectTestOutputToFile>
- <testSourceDirectory>${basedir}/src/it/java</testSourceDirectory>
- <groups>org.apache.phoenix.end2end.NeedsOwnMiniClusterTest</groups>
- <shutdown>kill</shutdown>
- </configuration>
- <goals>
- <goal>integration-test</goal>
- <goal>verify</goal>
- </goals>
- </execution>
-<execution>
- <id>SplitSystemCatalogTests</id>
- <configuration>
- <encoding>UTF-8</encoding>
- <forkCount>${numForkedIT}</forkCount>
- <runOrder>alphabetical</runOrder>
- <reuseForks>false</reuseForks>
- <argLine>-enableassertions -Xmx2000m -XX:MaxPermSize=256m -Djava.security.egd=file:/dev/./urandom "-Djava.library.path=${hadoop.library.path}${path.separator}${java.library.path}" -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=./target/</argLine>
- <redirectTestOutputToFile>${test.output.tofile}</redirectTestOutputToFile>
- <testSourceDirectory>${basedir}/src/it/java</testSourceDirectory>
- <groups>org.apache.phoenix.end2end.SplitSystemCatalogTests</groups>
- <shutdown>kill</shutdown>
- </configuration>
- <goals>
- <goal>integration-test</goal>
- <goal>verify</goal>
- </goals>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <artifactId>maven-dependency-plugin</artifactId>
- <version>${maven-dependency-plugin.version}</version>
- <executions>
- <execution>
- <id>create-mrapp-generated-classpath</id>
- <phase>generate-test-resources</phase>
- <goals>
- <goal>build-classpath</goal>
- </goals>
- <configuration>
- <outputFile>${project.build.directory}/classes/mrapp-generated-classpath
- </outputFile>
- </configuration>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-shade-plugin</artifactId>
- <version>2.4.3</version>
- </plugin>
- <plugin>
- <!-- Allows us to get the apache-ds bundle artifacts -->
- <groupId>org.apache.felix</groupId>
- <artifactId>maven-bundle-plugin</artifactId>
- <version>2.5.3</version>
- </plugin>
- </plugins>
- </pluginManagement>
-
- <plugins>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-checkstyle-plugin</artifactId>
- <version>2.13</version>
- <executions>
- <execution>
- <id>validate</id>
- <phase>validate</phase>
- <configuration>
- <skip>true</skip>
- <configLocation>${top.dir}/src/main/config/checkstyle/checker.xml</configLocation>
- <suppressionsLocation>${top.dir}/src/main/config/checkstyle/suppressions.xml</suppressionsLocation>
- <consoleOutput>true</consoleOutput>
- <headerLocation>${top.dir}/src/main/config/checkstyle/header.txt</headerLocation>
- <failOnViolation><!--true-->false</failOnViolation>
- <includeTestSourceDirectory><!--true-->false</includeTestSourceDirectory>
- </configuration>
- <goals>
- <goal>check</goal>
- </goals>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-source-plugin</artifactId>
- <version>2.2.1</version>
- <executions>
- <execution>
- <id>attach-sources</id>
- <phase>prepare-package</phase>
- <goals>
- <goal>jar-no-fork</goal>
- </goals>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-javadoc-plugin</artifactId>
- <version>2.9</version>
- <configuration>
- <quiet>true</quiet>
- <links>
- <link>http://hbase.apache.org/apidocs/</link>
- </links>
- </configuration>
- <executions>
- <execution>
- <id>attach-javadocs</id>
- <goals>
- <!-- TODO turn back on javadocs - disabled now for testing -->
- <!-- <goal>jar</goal> -->
- </goals>
- <configuration>
- <additionalparam>${javadoc.opts}</additionalparam>
- </configuration>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-surefire-plugin</artifactId>
- <version>${maven-surefire-plugin.version}</version>
- <configuration>
- <forkCount>${numForkedUT}</forkCount>
- <reuseForks>true</reuseForks>
- <argLine>-enableassertions -Xmx2250m -XX:MaxPermSize=128m
- -Djava.security.egd=file:/dev/./urandom "-Djava.library.path=${hadoop.library.path}${path.separator}${java.library.path}" -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=./target/</argLine>
- <redirectTestOutputToFile>${test.output.tofile}</redirectTestOutputToFile>
- <shutdown>kill</shutdown>
- </configuration>
- </plugin>
- <!-- All projects create a test jar -->
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-jar-plugin</artifactId>
- <version>2.4</version>
- <executions>
- <execution>
- <phase>prepare-package
- </phase>
- <goals>
- <goal>test-jar</goal>
- </goals>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-site-plugin</artifactId>
- <version>3.7.1</version>
- </plugin>
- <plugin>
- <groupId>org.apache.rat</groupId>
- <artifactId>apache-rat-plugin</artifactId>
- <configuration>
- <excludes>
- <!-- Header on changelog isn't normal -->
- <exclude>CHANGES</exclude>
- <!-- IDE configuration -->
- <exclude>dev/phoenix.importorder</exclude>
- <!-- Release L&N -->
- <exclude>dev/release_files/LICENSE</exclude>
- <exclude>dev/release_files/NOTICE</exclude>
- <!-- Exclude data files for examples -->
- <exclude>docs/*.csv</exclude>
- <exclude>examples/*.csv</exclude>
- <!-- Exclude SQL files from rat. Sqlline 1.1.9 doesn't work with
- comments on the first line of a file. -->
- <exclude>examples/*.sql</exclude>
- <exclude>examples/pig/testdata</exclude>
- <!-- precommit? -->
- <exclude>**/patchprocess/**</exclude>
- <!-- Argparse is bundled to work around system Python version
- issues, compatibile with ALv2 -->
- <exclude>bin/argparse-1.4.0/argparse.py</exclude>
- <!-- Not our code -->
- <exclude>python/requests-kerberos/**</exclude>
- <exclude>python/phoenixdb/phoenixdb/avatica/proto/*</exclude>
- <exclude>python/phoenixdb/*.rst</exclude>
- <exclude>python/phoenixdb/ci/**</exclude>
- <exclude>python/phoenixdb/doc/*.rst</exclude>
- <exclude>python/phoenixdb/doc/conf.py</exclude>
- <exclude>python/phoenixdb/doc/Makefile</exclude>
- </excludes>
- </configuration>
- </plugin>
- <plugin>
- <!-- Allows us to get the apache-ds bundle artifacts -->
- <groupId>org.apache.felix</groupId>
- <artifactId>maven-bundle-plugin</artifactId>
- <extensions>true</extensions>
- <inherited>true</inherited>
- </plugin>
- </plugins>
- </build>
-
- <dependencyManagement>
- <dependencies>
- <!-- Intra-project dependencies -->
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-core</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-core</artifactId>
- <version>${project.version}</version>
- <classifier>tests</classifier>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-flume</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-kafka</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-pig</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-spark</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-queryserver</artifactId>
- <version>${project.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.phoenix</groupId>
- <artifactId>phoenix-queryserver-client</artifactId>
- <version>${project.version}</version>
- </dependency>
-
- <!-- HBase dependencies -->
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-annotations</artifactId>
- <version>${hbase.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-testing-util</artifactId>
- <version>${hbase.version}</version>
- <scope>test</scope>
- <optional>true</optional>
- <exclusions>
- <exclusion>
- <groupId>org.jruby</groupId>
- <artifactId>jruby-complete</artifactId>
- </exclusion>
- <exclusion>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-hdfs</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-it</artifactId>
- <version>${hbase.version}</version>
- <type>test-jar</type>
- <scope>test</scope>
- <exclusions>
- <exclusion>
- <groupId>org.jruby</groupId>
- <artifactId>jruby-complete</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-protocol</artifactId>
- <version>${hbase.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-common</artifactId>
- <version>${hbase.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-common</artifactId>
- <version>${hbase.version}</version>
- <type>test-jar</type>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-client</artifactId>
- <version>${hbase.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-client</artifactId>
- <version>${hbase.version}</version>
- <type>test-jar</type>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-server</artifactId>
- <version>${hbase.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-server</artifactId>
- <version>${hbase.version}</version>
- <type>test-jar</type>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-hadoop-compat</artifactId>
- <version>${hbase.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-hadoop-compat</artifactId>
- <version>${hbase.version}</version>
- <type>test-jar</type>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-hadoop2-compat</artifactId>
- <version>${hbase.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hbase</groupId>
- <artifactId>hbase-hadoop2-compat</artifactId>
- <version>${hbase.version}</version>
- <type>test-jar</type>
- <scope>test</scope>
- </dependency>
-
- <!-- Hadoop Dependencies -->
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-common</artifactId>
- <version>${hadoop-two.version}</version>
- <exclusions>
- <exclusion>
- <groupId>org.xerial.snappy</groupId>
- <artifactId>snappy-java</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-annotations</artifactId>
- <version>${hadoop-two.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-mapreduce-client-core</artifactId>
- <version>${hadoop-two.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-minicluster</artifactId>
- <version>${hadoop-two.version}</version>
- <optional>true</optional>
- <scope>test</scope>
- </dependency>
-
- <!-- Required for mini-cluster since hbase built against old version of hadoop -->
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-auth</artifactId>
- <version>${hadoop-two.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-mapreduce-client-common</artifactId>
- <version>${hadoop-two.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-mapreduce-client-jobclient</artifactId>
- <version>${hadoop-two.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-client</artifactId>
- <version>${hadoop-two.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-hdfs</artifactId>
- <version>${hadoop-two.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-hdfs</artifactId>
- <version>${hadoop-two.version}</version>
- <type>test-jar</type> <!-- this does not work which is typical for maven.-->
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-minikdc</artifactId>
- <version>${hadoop-two.version}</version>
- </dependency>
-
- <!-- General Dependencies -->
- <dependency>
- <groupId>org.apache.pig</groupId>
- <artifactId>pig</artifactId>
- <version>${pig.version}</version>
- <classifier>h2</classifier>
- <exclusions>
- <exclusion>
- <groupId>org.xerial.snappy</groupId>
- <artifactId>snappy-java</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.calcite.avatica</groupId>
- <artifactId>avatica</artifactId>
- <version>${avatica.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.calcite.avatica</groupId>
- <artifactId>avatica-core</artifactId>
- <version>${avatica.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.calcite.avatica</groupId>
- <artifactId>avatica-server</artifactId>
- <version>${avatica.version}</version>
- </dependency>
-
- <!-- Transaction dependencies -->
- <dependency>
- <groupId>org.apache.tephra</groupId>
- <artifactId>tephra-api</artifactId>
- <version>${tephra.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.tephra</groupId>
- <artifactId>tephra-core</artifactId>
- <version>${tephra.version}</version>
- <exclusions>
- <exclusion>
- <groupId>ch.qos.logback</groupId>
- <artifactId>logback-core</artifactId>
- </exclusion>
- <exclusion>
- <groupId>ch.qos.logback</groupId>
- <artifactId>logback-classic</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.tephra</groupId>
- <artifactId>tephra-core</artifactId>
- <type>test-jar</type>
- <version>${tephra.version}</version>
- <scope>test</scope>
- <exclusions>
- <exclusion>
- <groupId>ch.qos.logback</groupId>
- <artifactId>logback-core</artifactId>
- </exclusion>
- <exclusion>
- <groupId>ch.qos.logback</groupId>
- <artifactId>logback-classic</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.tephra</groupId>
- <artifactId>tephra-hbase-compat-1.3</artifactId>
- <version>${tephra.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.omid</groupId>
- <artifactId>omid-hbase-client-hbase1.x</artifactId>
- <version>${omid.version}</version>
- <exclusions>
- <exclusion>
- <groupId>org.testng</groupId>
- <artifactId>testng</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.omid</groupId>
- <artifactId>omid-hbase-coprocessor-hbase1.x</artifactId>
- <version>${omid.version}</version>
- <exclusions>
- <exclusion>
- <groupId>org.testng</groupId>
- <artifactId>testng</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.omid</groupId>
- <artifactId>omid-tso-server-hbase1.x</artifactId>
- <version>${omid.version}</version>
- <exclusions>
- <exclusion>
- <groupId>org.testng</groupId>
- <artifactId>testng</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.apache.omid</groupId>
- <artifactId>omid-tso-server-hbase1.x</artifactId>
- <version>${omid.version}</version>
- <type>test-jar</type>
- <exclusions>
- <exclusion>
- <groupId>org.testng</groupId>
- <artifactId>testng</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
-
-
- <!-- Make sure we have all the antlr dependencies -->
- <dependency>
- <groupId>org.antlr</groupId>
- <artifactId>antlr-runtime</artifactId>
- <version>${antlr.version}</version>
- </dependency>
- <dependency>
- <groupId>jline</groupId>
- <artifactId>jline</artifactId>
- <version>2.11</version>
- </dependency>
- <dependency>
- <groupId>sqlline</groupId>
- <artifactId>sqlline</artifactId>
- <version>${sqlline.version}</version>
- </dependency>
- <dependency>
- <groupId>com.google.guava</groupId>
- <artifactId>guava</artifactId>
- <version>${guava.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.flume</groupId>
- <artifactId>flume-ng-core</artifactId>
- <version>${flume.version}</version>
- <exclusions>
- <exclusion>
- <groupId>org.xerial.snappy</groupId>
- <artifactId>snappy-java</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>com.github.stephenc.findbugs</groupId>
- <artifactId>findbugs-annotations</artifactId>
- <version>${findbugs-annotations.version}</version>
- </dependency>
- <dependency>
- <groupId>com.github.stephenc.jcip</groupId>
- <artifactId>jcip-annotations</artifactId>
- <version>${jcip-annotations.version}</version>
- </dependency>
- <dependency>
- <groupId>org.iq80.snappy</groupId>
- <artifactId>snappy</artifactId>
- <version>${snappy.version}</version>
- </dependency>
- <dependency>
- <groupId>org.codehaus.jackson</groupId>
- <artifactId>jackson-core-asl</artifactId>
- <version>${jackson.version}</version>
- <scope>compile</scope>
- </dependency>
- <dependency>
- <groupId>org.codehaus.jackson</groupId>
- <artifactId>jackson-mapper-asl</artifactId>
- <version>${jackson.version}</version>
- <scope>compile</scope>
- </dependency>
- <dependency>
- <groupId>com.google.code.findbugs</groupId>
- <artifactId>jsr305</artifactId>
- <version>2.0.1</version>
- </dependency>
- <dependency>
- <groupId>org.codehaus.jackson</groupId>
- <artifactId>jackson-jaxrs</artifactId>
- <version>${jackson.version}</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.codehaus.jackson</groupId>
- <artifactId>jackson-xc</artifactId>
- <version>${jackson.version}</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
- <version>${junit.version}</version>
- </dependency>
- <dependency>
- <groupId>org.mockito</groupId>
- <artifactId>mockito-all</artifactId>
- <version>${mockito-all.version}</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>com.google.protobuf</groupId>
- <artifactId>protobuf-java</artifactId>
- <version>${protobuf-java.version}</version>
- </dependency>
- <dependency>
- <groupId>log4j</groupId>
- <artifactId>log4j</artifactId>
- <version>${log4j.version}</version>
- </dependency>
- <dependency>
- <groupId>org.slf4j</groupId>
- <artifactId>slf4j-api</artifactId>
- <version>${slf4j.version}</version>
- </dependency>
- <dependency>
- <groupId>commons-cli</groupId>
- <artifactId>commons-cli</artifactId>
- <version>${commons-cli.version}</version>
- </dependency>
- <dependency>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- <version>${commons-logging.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.htrace</groupId>
- <artifactId>htrace-core</artifactId>
- <version>${htrace.version}</version>
- </dependency>
- <dependency>
- <groupId>commons-codec</groupId>
- <artifactId>commons-codec</artifactId>
- <version>${commons-codec.version}</version>
- </dependency>
- <dependency>
- <groupId>commons-collections</groupId>
- <artifactId>commons-collections</artifactId>
- <version>${collections.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.commons</groupId>
- <artifactId>commons-csv</artifactId>
- <version>${commons-csv.version}</version>
- </dependency>
- <dependency>
- <groupId>joda-time</groupId>
- <artifactId>joda-time</artifactId>
- <version>${jodatime.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.curator</groupId>
- <artifactId>curator-test</artifactId>
- <version>${curator.version}</version>
- </dependency>
- <dependency>
- <groupId>org.apache.curator</groupId>
- <artifactId>curator-client</artifactId>
- <version>${curator.version}</version>
- </dependency>
- <dependency>
- <groupId>com.clearspring.analytics</groupId>
- <artifactId>stream</artifactId>
- <version>${stream.version}</version>
- </dependency>
- <dependency>
- <groupId>com.salesforce.i18n</groupId>
- <artifactId>i18n-util</artifactId>
- <version>${i18n-util.version}</version>
- </dependency>
- <dependency>
- <groupId>javax.servlet</groupId>
- <artifactId>javax.servlet-api</artifactId>
- <version>${servlet.api.version}</version>
- </dependency>
- <dependency>
- <groupId>com.lmax</groupId>
- <artifactId>disruptor</artifactId>
- <version>${disruptor.version}</version>
- </dependency>
- </dependencies>
- </dependencyManagement>
-
- <profiles>
- <!-- disable doclint with 1.8+ JDKs-->
- <profile>
- <id>java8-doclint-disabled</id>
- <activation>
- <jdk>[1.8,)</jdk>
- </activation>
- <properties>
- <javadoc.opts>-Xdoclint:none</javadoc.opts>
- </properties>
- </profile>
- <!-- this profile should be activated for release builds -->
- <profile>
- <id>release</id>
- <build>
- <plugins>
- <plugin>
- <groupId>org.apache.rat</groupId>
- <artifactId>apache-rat-plugin</artifactId>
- <executions>
- <execution>
- <phase>package</phase>
- <goals>
- <goal>check</goal>
- </goals>
- </execution>
- </executions>
- </plugin>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-gpg-plugin</artifactId>
- <version>1.6</version>
- <executions>
- <execution>
- <id>sign-artifacts</id>
- <phase>verify</phase>
- <goals>
- <goal>sign</goal>
- </goals>
- </execution>
- </executions>
- </plugin>
- </plugins>
- </build>
- </profile>
- <profile>
- <id>spark16</id>
- <properties>
- <spark.version>1.6.1</spark.version>
- <scala.version>2.10.4</scala.version>
- <scala.binary.version>2.10</scala.binary.version>
- </properties>
- </profile>
- </profiles>
-
- <reporting>
- <plugins>
- <plugin>
- <groupId>org.apache.maven.plugins</groupId>
- <artifactId>maven-project-info-reports-plugin</artifactId>
- <version>3.0.0</version>
- </plugin>
- <plugin>
- <groupId>org.codehaus.mojo</groupId>
- <artifactId>findbugs-maven-plugin</artifactId>
- <version>3.0.5</version>
- </plugin>
- </plugins>
- </reporting>
-</project>
diff --git a/take2.patch b/take2.patch
deleted file mode 100644
index 0e24bbd..0000000
--- a/take2.patch
+++ /dev/null
@@ -1,207 +0,0 @@
-From 99222d84e2a87d0bb1179758158efc33075e4b90 Mon Sep 17 00:00:00 2001
-From: Thomas D'Silva <td...@apache.org>
-Date: Thu, 4 Apr 2019 16:34:24 -0700
-Subject: [PATCH] take 2
-
----
- .../org/apache/phoenix/end2end/BasePermissionsIT.java | 15 +++------------
- .../apache/phoenix/end2end/ChangePermissionsIT.java | 18 ------------------
- .../phoenix/end2end/SystemTablePermissionsIT.java | 4 ----
- .../apache/phoenix/end2end/TableDDLPermissionsIT.java | 5 -----
- 4 files changed, 3 insertions(+), 39 deletions(-)
-
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-index 81a68b455..791059067 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-@@ -60,12 +60,14 @@ import org.apache.phoenix.query.QueryServices;
- import org.apache.phoenix.util.PhoenixRuntime;
- import org.junit.After;
- import org.junit.BeforeClass;
-+import org.junit.experimental.categories.Category;
- import org.junit.runner.RunWith;
- import org.junit.runners.Parameterized;
-
- import com.google.common.base.Joiner;
- import com.google.common.base.Throwables;
-
-+@Category(NeedsOwnMiniClusterTest.class)
- @RunWith(Parameterized.class)
- public class BasePermissionsIT extends BaseTest {
-
-@@ -121,6 +123,7 @@ public class BasePermissionsIT extends BaseTest {
-
- public BasePermissionsIT(final boolean isNamespaceMapped) throws Exception {
- this.isNamespaceMapped = isNamespaceMapped;
-+ startNewMiniCluster();
- }
-
- @BeforeClass
-@@ -129,10 +132,6 @@ public class BasePermissionsIT extends BaseTest {
- }
-
- void startNewMiniCluster() throws Exception {
-- startNewMiniCluster(new Configuration());
-- }
--
-- void startNewMiniCluster(Configuration overrideConf) throws Exception{
- if (null != testUtil) {
- testUtil.shutdownMiniCluster();
- testUtil = null;
-@@ -144,9 +143,6 @@ public class BasePermissionsIT extends BaseTest {
- enablePhoenixHBaseAuthorization(config);
- configureNamespacesOnServer(config);
- config.setBoolean(LocalHBaseCluster.ASSIGN_RANDOM_PORTS, true);
-- if (overrideConf != null) {
-- config.addResource(overrideConf);
-- }
-
- testUtil.startMiniCluster(1);
- initializeUsers(testUtil.getConfiguration());
-@@ -167,11 +163,6 @@ public class BasePermissionsIT extends BaseTest {
- unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser", new String[0]);
- }
-
-- private void configureRandomHMasterPort(Configuration config) {
-- // Avoid multiple clusters trying to bind the master's info port (16010)
-- config.setInt(HConstants.MASTER_INFO_PORT, 0);
-- }
--
- void enablePhoenixHBaseAuthorization(Configuration config) {
- config.set("hbase.superuser", SUPERUSER + "," + "superUser2");
- config.set("hbase.security.authorization", Boolean.TRUE.toString());
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-index 65f44c04f..b699c7abd 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-@@ -30,7 +30,6 @@ import org.junit.experimental.categories.Category;
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- */
--@Category(NeedsOwnMiniClusterTest.class)
- public class ChangePermissionsIT extends BasePermissionsIT {
-
- private static final Log LOG = LogFactory.getLog(ChangePermissionsIT.class);
-@@ -80,9 +79,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testRXPermsReqdForPhoenixConn() throws Exception {
--
-- startNewMiniCluster();
--
- if(isNamespaceMapped) {
- // NS is enabled, CQSI tries creating SYSCAT, we get NamespaceNotFoundException exception for "SYSTEM" NS
- // We create custom ADE and throw it (and ignore NamespaceNotFoundException)
-@@ -112,9 +108,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testSuperUserCanChangePerms() throws Exception {
--
-- startNewMiniCluster();
--
- // Grant System Table access to all users, else they can't create a Phoenix connection
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-
-@@ -137,9 +130,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testReadPermsOnTableIndexAndView() throws Exception {
--
-- startNewMiniCluster();
--
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-
- // Create new schema and grant CREATE permissions to a user
-@@ -198,9 +188,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testGroupUserPerms() throws Exception {
--
-- startNewMiniCluster();
--
- if(isNamespaceMapped) {
- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
- }
-@@ -229,9 +216,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testMultiTenantTables() throws Exception {
--
-- startNewMiniCluster();
--
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-
- if(isNamespaceMapped) {
-@@ -276,8 +260,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testCreateViewOnTableWithRXPermsOnSchema() throws Exception {
--
-- startNewMiniCluster();
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-
- if(isNamespaceMapped) {
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-index 6da970b99..d89820f65 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-@@ -41,7 +41,6 @@ import org.junit.experimental.categories.Category;
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- * Uses HBase API directly to grant/revoke permissions
- */
--@Category(NeedsOwnMiniClusterTest.class)
- public class SystemTablePermissionsIT extends BasePermissionsIT {
-
- private static final String TABLE_NAME =
-@@ -53,9 +52,6 @@ public class SystemTablePermissionsIT extends BasePermissionsIT {
-
- @Test
- public void testSystemTablePermissions() throws Throwable {
--
-- startNewMiniCluster();
--
- verifyAllowed(createTable(TABLE_NAME), superUser1);
- verifyAllowed(readTable(TABLE_NAME), superUser1);
-
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-index 37073c393..45f828260 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-@@ -35,7 +35,6 @@ import org.junit.runners.Parameterized;
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- */
--@Category(NeedsOwnMiniClusterTest.class)
- @RunWith(Parameterized.class)
- public class TableDDLPermissionsIT extends BasePermissionsIT{
-
-@@ -44,7 +43,6 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
- }
-
- private void grantSystemTableAccess() throws Exception{
--
- try (Connection conn = getConnection()) {
- if (isNamespaceMapped) {
- grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.READ,
-@@ -88,10 +86,8 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
-
- @Test
- public void testSchemaPermissions() throws Throwable{
--
- if (!isNamespaceMapped) { return; }
- try {
-- startNewMiniCluster();
- grantSystemTableAccess();
- final String schemaName = "TEST_SCHEMA_PERMISSION";
- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-@@ -123,7 +119,6 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
-
- @Test
- public void testAutomaticGrantWithIndexAndView() throws Throwable {
-- startNewMiniCluster();
- final String schema = "TEST_INDEX_VIEW";
- final String tableName = "TABLE_DDL_PERMISSION_IT";
- final String phoenixTableName = schema + "." + tableName;
---
-2.15.1
-
diff --git a/test_failures.patch b/test_failures.patch
deleted file mode 100644
index ab3ed6d..0000000
--- a/test_failures.patch
+++ /dev/null
@@ -1,1085 +0,0 @@
-From d36f8c754522a299f00038c96b0fb02a8f8715a5 Mon Sep 17 00:00:00 2001
-From: Thomas D'Silva <td...@apache.org>
-Date: Wed, 3 Apr 2019 16:05:35 -0700
-Subject: [PATCH] Fixed perms test failures
-
----
- .../apache/phoenix/end2end/BasePermissionsIT.java | 203 +++++++++++++--------
- .../phoenix/end2end/ChangePermissionsIT.java | 155 ++++++++--------
- .../end2end/ChangePermissionsNSDisabledIT.java | 8 +
- .../end2end/ChangePermissionsNSEnabledIT.java | 9 +
- .../phoenix/end2end/SystemTablePermissionsIT.java | 131 -------------
- .../phoenix/end2end/TableDDLPermissionsIT.java | 201 ++++++++++----------
- .../end2end/TableDDLPermissionsNSDisabledIT.java | 8 +
- .../end2end/TableDDLPermissionsNSEnabledIT.java | 47 +++++
- .../phoenix/query/ConnectionQueryServicesImpl.java | 2 +-
- 9 files changed, 369 insertions(+), 395 deletions(-)
- create mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSDisabledIT.java
- create mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSEnabledIT.java
- delete mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
- create mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSDisabledIT.java
- create mode 100644 phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSEnabledIT.java
-
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-index 81a68b455..76f2606ca 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-@@ -16,37 +16,17 @@
- */
- package org.apache.phoenix.end2end;
-
--import static org.junit.Assert.assertEquals;
--import static org.junit.Assert.assertFalse;
--import static org.junit.Assert.assertNotNull;
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.io.IOException;
--import java.lang.reflect.UndeclaredThrowableException;
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.PreparedStatement;
--import java.sql.ResultSet;
--import java.sql.SQLException;
--import java.sql.Statement;
--import java.util.Arrays;
--import java.util.Collection;
--import java.util.Collections;
--import java.util.HashSet;
--import java.util.List;
--import java.util.Properties;
--import java.util.Set;
--
-+import com.google.common.base.Joiner;
-+import com.google.common.base.Throwables;
-+import com.google.common.collect.Maps;
- import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
- import org.apache.hadoop.conf.Configuration;
- import org.apache.hadoop.hbase.AuthUtil;
- import org.apache.hadoop.hbase.HBaseTestingUtility;
--import org.apache.hadoop.hbase.HConstants;
- import org.apache.hadoop.hbase.LocalHBaseCluster;
- import org.apache.hadoop.hbase.TableName;
-+import org.apache.hadoop.hbase.regionserver.wal.WALRecoveryRegionPostOpenIT;
- import org.apache.hadoop.hbase.security.AccessDeniedException;
- import org.apache.hadoop.hbase.security.User;
- import org.apache.hadoop.hbase.security.access.AccessControlClient;
-@@ -58,22 +38,41 @@ import org.apache.phoenix.query.BaseTest;
- import org.apache.phoenix.query.QueryConstants;
- import org.apache.phoenix.query.QueryServices;
- import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.After;
-+import org.apache.phoenix.util.ReadOnlyProps;
-+import org.junit.Before;
- import org.junit.BeforeClass;
--import org.junit.runner.RunWith;
--import org.junit.runners.Parameterized;
-+import org.junit.experimental.categories.Category;
-
--import com.google.common.base.Joiner;
--import com.google.common.base.Throwables;
-+import java.io.IOException;
-+import java.lang.reflect.UndeclaredThrowableException;
-+import java.security.PrivilegedExceptionAction;
-+import java.sql.Connection;
-+import java.sql.DriverManager;
-+import java.sql.PreparedStatement;
-+import java.sql.ResultSet;
-+import java.sql.SQLException;
-+import java.sql.Statement;
-+import java.util.Arrays;
-+import java.util.Collections;
-+import java.util.HashSet;
-+import java.util.List;
-+import java.util.Map;
-+import java.util.Properties;
-+import java.util.Set;
-
--@RunWith(Parameterized.class)
-+import static org.junit.Assert.assertEquals;
-+import static org.junit.Assert.assertFalse;
-+import static org.junit.Assert.assertNotNull;
-+import static org.junit.Assert.assertTrue;
-+import static org.junit.Assert.fail;
-+
-+@Category(NeedsOwnMiniClusterTest.class)
- public class BasePermissionsIT extends BaseTest {
-
- private static final Log LOG = LogFactory.getLog(BasePermissionsIT.class);
-
- static String SUPERUSER;
-
-- static HBaseTestingUtility testUtil;
- static final Set<String> PHOENIX_SYSTEM_TABLES =
- new HashSet<>(Arrays.asList("SYSTEM.CATALOG", "SYSTEM.SEQUENCE", "SYSTEM.STATS",
- "SYSTEM.FUNCTION", "SYSTEM.MUTEX"));
-@@ -121,26 +120,45 @@ public class BasePermissionsIT extends BaseTest {
-
- public BasePermissionsIT(final boolean isNamespaceMapped) throws Exception {
- this.isNamespaceMapped = isNamespaceMapped;
-+// initializeUsers(getUtility().getConfiguration());
-+// grantSystemTableAccess();
- }
-
- @BeforeClass
- public static void doSetup() throws Exception {
- SUPERUSER = System.getProperty("user.name");
-+
-+ Map<String, String> serverProps = Maps.newHashMapWithExpectedSize(10);
-+ serverProps.put("hbase.superuser", SUPERUSER + "," + "superUser2");
-+ serverProps.put("hbase.security.authorization", Boolean.TRUE.toString());
-+ serverProps.put("hbase.security.exec.permission.checks", Boolean.TRUE.toString());
-+ serverProps.put("hbase.coprocessor.master.classes", "org.apache.hadoop.hbase.security.access.AccessController");
-+ serverProps.put("hbase.coprocessor.region.classes", "org.apache.hadoop.hbase.security.access.AccessController");
-+ serverProps.put("hbase.coprocessor.regionserver.classes", "org.apache.hadoop.hbase.security.access.AccessController");
-+ serverProps.put(QueryServices.PHOENIX_ACLS_ENABLED,"true");
-+ serverProps.put("hbase.regionserver.wal.codec", "org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec");
-+ serverProps.put(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(true));
-+ serverProps.put(LocalHBaseCluster.ASSIGN_RANDOM_PORTS, "true");
-+
-+ Map<String, String> clientProps = Collections.singletonMap(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(true));
-+ NUM_SLAVES_BASE = 1;
-+ setUpTestDriver(new ReadOnlyProps(serverProps.entrySet().iterator()), new ReadOnlyProps(clientProps.entrySet().iterator()));
-+// startNewMiniCluster();
-+ }
-+
-+ @Before
-+ public void setup() {
-+ initializeUsers();
- }
-
-- void startNewMiniCluster() throws Exception {
-+ static void startNewMiniCluster() throws Exception {
- startNewMiniCluster(new Configuration());
- }
--
-- void startNewMiniCluster(Configuration overrideConf) throws Exception{
-- if (null != testUtil) {
-- testUtil.shutdownMiniCluster();
-- testUtil = null;
-- }
-
-- testUtil = new HBaseTestingUtility();
-+ static void startNewMiniCluster(Configuration overrideConf) throws Exception{
-+ utility = new HBaseTestingUtility();
-
-- Configuration config = testUtil.getConfiguration();
-+ Configuration config = utility.getConfiguration();
- enablePhoenixHBaseAuthorization(config);
- configureNamespacesOnServer(config);
- config.setBoolean(LocalHBaseCluster.ASSIGN_RANDOM_PORTS, true);
-@@ -148,31 +166,11 @@ public class BasePermissionsIT extends BaseTest {
- config.addResource(overrideConf);
- }
-
-- testUtil.startMiniCluster(1);
-- initializeUsers(testUtil.getConfiguration());
-- }
--
-- private void initializeUsers(Configuration configuration) {
--
-- superUser1 = User.createUserForTesting(configuration, SUPERUSER, new String[0]);
-- superUser2 = User.createUserForTesting(configuration, "superUser2", new String[0]);
--
-- regularUser1 = User.createUserForTesting(configuration, "regularUser1", new String[0]);
-- regularUser2 = User.createUserForTesting(configuration, "regularUser2", new String[0]);
-- regularUser3 = User.createUserForTesting(configuration, "regularUser3", new String[0]);
-- regularUser4 = User.createUserForTesting(configuration, "regularUser4", new String[0]);
--
-- groupUser = User.createUserForTesting(testUtil.getConfiguration(), "groupUser", new String[] {GROUP_SYSTEM_ACCESS});
--
-- unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser", new String[0]);
-+ utility.startMiniCluster(1);
-+// initializeUsers(testUtil.getConfiguration());
- }
-
-- private void configureRandomHMasterPort(Configuration config) {
-- // Avoid multiple clusters trying to bind the master's info port (16010)
-- config.setInt(HConstants.MASTER_INFO_PORT, 0);
-- }
--
-- void enablePhoenixHBaseAuthorization(Configuration config) {
-+ static void enablePhoenixHBaseAuthorization(Configuration config) {
- config.set("hbase.superuser", SUPERUSER + "," + "superUser2");
- config.set("hbase.security.authorization", Boolean.TRUE.toString());
- config.set("hbase.security.exec.permission.checks", Boolean.TRUE.toString());
-@@ -188,26 +186,71 @@ public class BasePermissionsIT extends BaseTest {
- config.set("hbase.regionserver.wal.codec", "org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec");
- }
-
-- void configureNamespacesOnServer(Configuration conf) {
-- conf.set(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-- }
--
-- @Parameterized.Parameters(name = "isNamespaceMapped={0}") // name is used by failsafe as file name in reports
-- public static Collection<Boolean> data() {
-- return Arrays.asList(false, true);
-+ static void configureNamespacesOnServer(Configuration conf) {
-+ conf.set(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(true));
- }
-
-- @After
-- public void cleanup() throws Exception {
-- if (testUtil != null) {
-- testUtil.shutdownMiniCluster();
-- testUtil = null;
-+ protected void initializeUsers() {
-+ Configuration configuration = getUtility().getConfiguration();
-+ superUser1 = User.createUserForTesting(configuration, SUPERUSER, new String[0]);
-+ superUser2 = User.createUserForTesting(configuration, "superUser2_" + generateUniqueName(), new String[0]);
-+
-+ regularUser1 = User.createUserForTesting(configuration, "regularUser1_" + generateUniqueName(), new String[0]);
-+ regularUser2 = User.createUserForTesting(configuration, "regularUser2_" + generateUniqueName(), new String[0]);
-+ regularUser3 = User.createUserForTesting(configuration, "regularUser3_" + generateUniqueName(), new String[0]);
-+ regularUser4 = User.createUserForTesting(configuration, "regularUser4_" + generateUniqueName(), new String[0]);
-+
-+ groupUser = User.createUserForTesting(getUtility().getConfiguration(), "groupUser_" + generateUniqueName(), new String[] {GROUP_SYSTEM_ACCESS});
-+
-+ unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser_" + generateUniqueName(), new String[0]);
-+ }
-+
-+ protected void grantSystemTableAccess() throws Exception{
-+ try (Connection conn = getConnection()) {
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Permission.Action.READ,
-+ Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-+ grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+
-+ } else {
-+ grantPermissions(regularUser1.getName(), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_SYSTEM_TABLES, Permission.Action.READ, Permission.Action.EXEC);
-+ // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-+ grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM.SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Permission.Action.WRITE,
-+ Permission.Action.READ, Permission.Action.EXEC);
-+ }
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
- }
- }
-
-- public static HBaseTestingUtility getUtility(){
-- return testUtil;
-- }
-+// @Parameterized.Parameters(name = "isNamespaceMapped={0}") // name is used by failsafe as file name in reports
-+// public static Collection<Boolean> data() {
-+// return Arrays.asList(false, true);
-+// }
-
- // Utility functions to grant permissions with HBase API
- void grantPermissions(String toUser, Set<String> tablesToGrant, Permission.Action... actions) throws Throwable {
-@@ -250,12 +293,12 @@ public class BasePermissionsIT extends BaseTest {
- }
-
- protected static String getUrl() {
-- return "jdbc:phoenix:localhost:" + testUtil.getZkCluster().getClientPort() + ":/hbase";
-+ return "jdbc:phoenix:localhost:" + getUtility().getZkCluster().getClientPort() + ":/hbase";
- }
-
- static Set<String> getHBaseTables() throws IOException {
- Set<String> tables = new HashSet<>();
-- for (TableName tn : testUtil.getHBaseAdmin().listTableNames()) {
-+ for (TableName tn : getUtility().getHBaseAdmin().listTableNames()) {
- tables.add(tn.getNameAsString());
- }
- return tables;
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-index 65f44c04f..2038c209f 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-@@ -23,31 +23,37 @@ import org.apache.hadoop.hbase.security.User;
- import org.apache.phoenix.jdbc.PhoenixDatabaseMetaData;
- import org.apache.phoenix.query.QueryConstants;
- import org.apache.phoenix.schema.TableNotFoundException;
--import org.apache.phoenix.util.SchemaUtil;
-+import org.junit.Before;
- import org.junit.Test;
--import org.junit.experimental.categories.Category;
-
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class ChangePermissionsIT extends BasePermissionsIT {
-+public abstract class ChangePermissionsIT extends BasePermissionsIT {
-
- private static final Log LOG = LogFactory.getLog(ChangePermissionsIT.class);
-
-- private static final String SCHEMA_NAME = "CHANGEPERMSSCHEMA";
-- private static final String TABLE_NAME =
-- ChangePermissionsIT.class.getSimpleName().toUpperCase();
-- private static final String FULL_TABLE_NAME = SCHEMA_NAME + "." + TABLE_NAME;
-- private static final String IDX1_TABLE_NAME = TABLE_NAME + "_IDX1";
-- private static final String IDX2_TABLE_NAME = TABLE_NAME + "_IDX2";
-- private static final String IDX3_TABLE_NAME = TABLE_NAME + "_IDX3";
-- private static final String LOCAL_IDX1_TABLE_NAME = TABLE_NAME + "_LIDX1";
-- private static final String VIEW1_TABLE_NAME = TABLE_NAME + "_V1";
-- private static final String VIEW2_TABLE_NAME = TABLE_NAME + "_V2";
-+ private final String schemaName;
-+ private final String tableName;
-+ private final String fullTableName;
-+ private final String idx1TableName;
-+ private final String idx2TableName;
-+ private final String idx3TableName;
-+ private final String localIdx1TableName;
-+ private final String view1TableName;
-+ private final String view2TableName;
-
- public ChangePermissionsIT(boolean isNamespaceMapped) throws Exception {
- super(isNamespaceMapped);
-+ this.schemaName = generateUniqueName();
-+ this.tableName = generateUniqueName();
-+ this.fullTableName = schemaName + "." + tableName;
-+ this.idx1TableName = tableName + "_IDX1";
-+ this.idx2TableName = tableName + "_IDX2";
-+ this.idx3TableName = tableName + "_IDX3";
-+ this.localIdx1TableName = tableName + "_LIDX1";
-+ this.view1TableName = tableName + "_V1";
-+ this.view2TableName = tableName + "_V2";
- }
-
- private void grantSystemTableAccess(User superUser, User... users) throws Exception {
-@@ -80,9 +86,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testRXPermsReqdForPhoenixConn() throws Exception {
--
-- startNewMiniCluster();
--
- if(isNamespaceMapped) {
- // NS is enabled, CQSI tries creating SYSCAT, we get NamespaceNotFoundException exception for "SYSTEM" NS
- // We create custom ADE and throw it (and ignore NamespaceNotFoundException)
-@@ -112,9 +115,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testSuperUserCanChangePerms() throws Exception {
--
-- startNewMiniCluster();
--
- // Grant System Table access to all users, else they can't create a Phoenix connection
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-
-@@ -137,59 +137,56 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testReadPermsOnTableIndexAndView() throws Exception {
--
-- startNewMiniCluster();
--
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-
- // Create new schema and grant CREATE permissions to a user
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
- } else {
- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
- }
-
- // Create new table. Create indexes, views and view indexes on top of it. Verify the contents by querying it
-- verifyAllowed(createTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createLocalIndex(LOCAL_IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX3_TABLE_NAME, VIEW1_TABLE_NAME), regularUser1);
-+ verifyAllowed(createTable(fullTableName), regularUser1);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, fullTableName), regularUser1);
-+ verifyAllowed(createLocalIndex(localIdx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx3TableName, view1TableName), regularUser1);
-
- // RegularUser2 doesn't have any permissions. It can get a PhoenixConnection
- // However it cannot query table, indexes or views without READ perms
- verifyAllowed(getConnectionAction(), regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(VIEW1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName, idx1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(view1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-
- // Grant READ permissions to RegularUser2 on the table
- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
- // Granting permissions directly to index tables should fail
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + IDX1_TABLE_NAME, false), AccessDeniedException.class, regularUser1);
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + idx1TableName, false), AccessDeniedException.class, regularUser1);
- // Granting permissions directly to views should fail. We expect TableNotFoundException since VIEWS are not physical tables
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + VIEW1_TABLE_NAME, false), TableNotFoundException.class, regularUser1);
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + view1TableName, false), TableNotFoundException.class, regularUser1);
-
- // Verify that all other access are successful now
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX2_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, LOCAL_IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(VIEW1_TABLE_NAME), regularUser2);
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME), regularUser2);
-+ verifyAllowed(readTable(fullTableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx1TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx2TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, localIdx1TableName), regularUser2);
-+ verifyAllowed(readTableWithoutVerification(schemaName + "." + idx1TableName), regularUser2);
-+ verifyAllowed(readTable(view1TableName), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName), regularUser2);
-
- // Revoke READ permissions to RegularUser2 on the table
- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(revokePermissions(regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(revokePermissions(regularUser2, fullTableName, false), regularUser1);
- // READ query should fail now
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-
- }
-
-@@ -198,30 +195,27 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testGroupUserPerms() throws Exception {
--
-- startNewMiniCluster();
--
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
- }
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
-
- // Grant SYSTEM table access to GROUP_SYSTEM_ACCESS and regularUser1
- verifyAllowed(grantPermissions("RX", GROUP_SYSTEM_ACCESS, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser1);
- grantSystemTableAccess(superUser1, regularUser1);
-
- // Grant Permissions to Groups (Should be automatically applicable to all users inside it)
-- verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), groupUser);
-+ verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyAllowed(readTable(fullTableName), groupUser);
-
- // GroupUser is an admin and can grant perms to other users
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, FULL_TABLE_NAME, false), groupUser);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, fullTableName, false), groupUser);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-
- // Revoke the perms and try accessing data again
-- verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, groupUser);
-+ verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, groupUser);
- }
-
- /**
-@@ -229,45 +223,42 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testMultiTenantTables() throws Exception {
--
-- startNewMiniCluster();
--
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
- } else {
- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
- }
-
- // Create MultiTenant Table (View Index Table should be automatically created)
- // At this point, the index table doesn't contain any data
-- verifyAllowed(createMultiTenantTable(FULL_TABLE_NAME), regularUser1);
-+ verifyAllowed(createMultiTenantTable(fullTableName), regularUser1);
-
- // RegularUser2 doesn't have access yet, RegularUser1 should have RWXCA on the table
-- verifyDenied(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readMultiTenantTableWithoutIndex(fullTableName), AccessDeniedException.class, regularUser2);
-
- // Grant perms to base table (Should propagate to View Index as well)
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
- // Try reading full table
-- verifyAllowed(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithoutIndex(fullTableName), regularUser2);
-
- // Create tenant specific views on the table using tenant specific Phoenix Connection
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createView(VIEW2_TABLE_NAME, FULL_TABLE_NAME, "o2"), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName, "o1"), regularUser1);
-+ verifyAllowed(createView(view2TableName, fullTableName, "o2"), regularUser1);
-
- // Create indexes on those views using tenant specific Phoenix Connection
- // It is not possible to create indexes on tenant specific views without tenant connection
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, VIEW1_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, VIEW2_TABLE_NAME, "o2"), regularUser1);
-+ verifyAllowed(createIndex(idx1TableName, view1TableName, "o1"), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, view2TableName, "o2"), regularUser1);
-
- // Read the tables as regularUser2, with and without the use of Index table
- // If perms are propagated correctly, then both of them should work
- // The test checks if the query plan uses the index table by searching for "_IDX_" string
- // _IDX_ is the prefix used with base table name to derieve the name of view index table
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME, "o1"), regularUser2);
-- verifyAllowed(readMultiTenantTableWithoutIndex(VIEW2_TABLE_NAME, "o2"), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName, "o1"), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithoutIndex(view2TableName, "o2"), regularUser2);
- }
-
- /**
-@@ -276,18 +267,16 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testCreateViewOnTableWithRXPermsOnSchema() throws Exception {
--
-- startNewMiniCluster();
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, schemaName, true), superUser1);
- } else {
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
- verifyAllowed(grantPermissions("RX", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
- }
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
- }
- }
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSDisabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSDisabledIT.java
-new file mode 100644
-index 000000000..a7004cd31
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSDisabledIT.java
-@@ -0,0 +1,8 @@
-+package org.apache.phoenix.end2end;
-+
-+public class ChangePermissionsNSDisabledIT extends ChangePermissionsIT {
-+
-+ public ChangePermissionsNSDisabledIT() throws Exception {
-+ super(false);
-+ }
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSEnabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSEnabledIT.java
-new file mode 100644
-index 000000000..4d062fafa
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsNSEnabledIT.java
-@@ -0,0 +1,9 @@
-+package org.apache.phoenix.end2end;
-+
-+public class ChangePermissionsNSEnabledIT extends ChangePermissionsIT {
-+
-+ public ChangePermissionsNSEnabledIT() throws Exception {
-+ super(true);
-+ }
-+
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-deleted file mode 100644
-index 6da970b99..000000000
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-+++ /dev/null
-@@ -1,131 +0,0 @@
--/*
-- * Licensed to the Apache Software Foundation (ASF) under one or more
-- * contributor license agreements. See the NOTICE file distributed with
-- * this work for additional information regarding copyright ownership.
-- * The ASF licenses this file to you under the Apache License, Version 2.0
-- * (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- *
-- * http://www.apache.org/licenses/LICENSE-2.0
-- *
-- * Unless required by applicable law or agreed to in writing, software
-- * distributed under the License is distributed on an "AS IS" BASIS,
-- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- * See the License for the specific language governing permissions and
-- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
--
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.Statement;
--import java.util.Collections;
--import java.util.Properties;
--import java.util.Set;
--
--import org.apache.hadoop.hbase.security.access.Permission.Action;
--import org.apache.phoenix.coprocessor.MetaDataProtocol;
--import org.apache.phoenix.jdbc.PhoenixConnection;
--import org.apache.phoenix.query.QueryServices;
--import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
--import org.apache.phoenix.schema.NewerTableAlreadyExistsException;
--import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.Test;
--import org.junit.experimental.categories.Category;
--
--/**
-- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
-- * Uses HBase API directly to grant/revoke permissions
-- */
--@Category(NeedsOwnMiniClusterTest.class)
--public class SystemTablePermissionsIT extends BasePermissionsIT {
--
-- private static final String TABLE_NAME =
-- SystemTablePermissionsIT.class.getSimpleName().toUpperCase();
--
-- public SystemTablePermissionsIT(boolean isNamespaceMapped) throws Exception {
-- super(isNamespaceMapped);
-- }
--
-- @Test
-- public void testSystemTablePermissions() throws Throwable {
--
-- startNewMiniCluster();
--
-- verifyAllowed(createTable(TABLE_NAME), superUser1);
-- verifyAllowed(readTable(TABLE_NAME), superUser1);
--
-- Set<String> tables = getHBaseTables();
-- if(isNamespaceMapped) {
-- assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-- tables.containsAll(PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES));
-- } else {
-- assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-- tables.containsAll(PHOENIX_SYSTEM_TABLES));
-- }
--
-- // Grant permission to the system tables for the unprivileged user
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- if(isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(),
-- PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.EXEC, Action.READ);
-- } else {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES,
-- Action.EXEC, Action.READ);
-- }
-- grantPermissions(regularUser1.getShortName(),
-- Collections.singleton(TABLE_NAME), Action.READ,Action.EXEC);
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception) e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
--
-- // Make sure that the unprivileged user can now read the table
-- verifyAllowed(readTable(TABLE_NAME), regularUser1);
-- //This verification is added to test PHOENIX-5178
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override public Void run() throws Exception {
-- try {
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(),"SYSTEM", Action.ADMIN);
-- }
-- return null;
-- } catch (Throwable e) {
-- throw new Exception(e);
-- }
--
-- }
-- });
-- if(isNamespaceMapped) {
-- verifyAllowed(new AccessTestAction() {
-- @Override public Object run() throws Exception {
-- Properties props = new Properties();
-- props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-- props.setProperty(PhoenixRuntime.CURRENT_SCN_ATTRIB, Long.toString(MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP));
-- //Impersonate meta connection
-- try (Connection metaConnection = DriverManager.getConnection(getUrl(), props);
-- Statement stmt = metaConnection.createStatement()) {
-- stmt.executeUpdate("CREATE SCHEMA IF NOT EXISTS SYSTEM");
-- }catch(NewerSchemaAlreadyExistsException e){
--
-- }
-- return null;
-- }
-- }, regularUser1);
-- }
-- }
--
--}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-index 37073c393..f2c4b649c 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-@@ -17,115 +17,41 @@
- package org.apache.phoenix.end2end;
-
-
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.util.Collections;
--
- import org.apache.hadoop.hbase.AuthUtil;
- import org.apache.hadoop.hbase.NamespaceDescriptor;
- import org.apache.hadoop.hbase.security.AccessDeniedException;
- import org.apache.hadoop.hbase.security.access.AccessControlClient;
- import org.apache.hadoop.hbase.security.access.Permission.Action;
-+import org.apache.phoenix.coprocessor.MetaDataProtocol;
-+import org.apache.phoenix.query.QueryServices;
-+import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
-+import org.apache.phoenix.util.PhoenixRuntime;
- import org.apache.phoenix.util.SchemaUtil;
- import org.junit.Test;
--import org.junit.experimental.categories.Category;
--import org.junit.runner.RunWith;
--import org.junit.runners.Parameterized;
-+
-+import java.security.PrivilegedExceptionAction;
-+import java.sql.Connection;
-+import java.sql.DriverManager;
-+import java.sql.Statement;
-+import java.util.Collections;
-+import java.util.Properties;
-+import java.util.Set;
-+
-+import static org.junit.Assert.assertTrue;
-
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- */
--@Category(NeedsOwnMiniClusterTest.class)
--@RunWith(Parameterized.class)
--public class TableDDLPermissionsIT extends BasePermissionsIT{
-+public abstract class TableDDLPermissionsIT extends BasePermissionsIT{
-
- public TableDDLPermissionsIT(boolean isNamespaceMapped) throws Exception {
- super(isNamespaceMapped);
- }
-
-- private void grantSystemTableAccess() throws Exception{
--
-- try (Connection conn = getConnection()) {
-- if (isNamespaceMapped) {
-- grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.READ,
-- Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-- Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES,
-- Action.READ, Action.EXEC);
-- // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-- grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM:MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
--
-- } else {
-- grantPermissions(regularUser1.getName(), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- grantPermissions(AuthUtil.toGroupEntry(GROUP_SYSTEM_ACCESS), PHOENIX_SYSTEM_TABLES, Action.READ, Action.EXEC);
-- // Local Index requires WRITE permission on SYSTEM.SEQUENCE TABLE.
-- grantPermissions(regularUser1.getName(), Collections.singleton("SYSTEM.SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getName(), Collections.singleton("SYSTEM:SEQUENCE"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(regularUser1.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- grantPermissions(unprivilegedUser.getShortName(), Collections.singleton("SYSTEM.MUTEX"), Action.WRITE,
-- Action.READ, Action.EXEC);
-- }
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- }
--
-- @Test
-- public void testSchemaPermissions() throws Throwable{
--
-- if (!isNamespaceMapped) { return; }
-- try {
-- startNewMiniCluster();
-- grantSystemTableAccess();
-- final String schemaName = "TEST_SCHEMA_PERMISSION";
-- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-- @Override
-- public Void run() throws Exception {
-- try {
-- AccessControlClient.grant(getUtility().getConnection(), regularUser1.getShortName(),
-- Action.ADMIN);
-- } catch (Throwable e) {
-- if (e instanceof Exception) {
-- throw (Exception)e;
-- } else {
-- throw new Exception(e);
-- }
-- }
-- return null;
-- }
-- });
-- verifyAllowed(createSchema(schemaName), regularUser1);
-- // Unprivileged user cannot drop a schema
-- verifyDenied(dropSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-- verifyDenied(createSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
--
-- verifyAllowed(dropSchema(schemaName), regularUser1);
-- } finally {
-- revokeAll();
-- }
-- }
--
- @Test
- public void testAutomaticGrantWithIndexAndView() throws Throwable {
-- startNewMiniCluster();
-- final String schema = "TEST_INDEX_VIEW";
-- final String tableName = "TABLE_DDL_PERMISSION_IT";
-+ final String schema = generateUniqueName();
-+ final String tableName = generateUniqueName();
- final String phoenixTableName = schema + "." + tableName;
- final String indexName1 = tableName + "_IDX1";
- final String indexName2 = tableName + "_IDX2";
-@@ -218,21 +144,96 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
- verifyAllowed(addProperties(phoenixTableName, "GUIDE_POSTS_WIDTH", "100"), regularUser1);
- verifyAllowed(dropView(viewName1), regularUser1);
- verifyAllowed(dropView(viewName2), regularUser1);
-- verifyAllowed(dropColumn(phoenixTableName, "val1"), regularUser1);
-- verifyAllowed(dropIndex(indexName1, phoenixTableName), regularUser1);
-- verifyAllowed(dropTable(phoenixTableName), regularUser1);
-+// verifyAllowed(dropColumn(phoenixTableName, "val1"), regularUser1);
-+// verifyAllowed(dropIndex(indexName1, phoenixTableName), regularUser1);
-+// verifyAllowed(dropTable(phoenixTableName), regularUser1);
-
- // check again with super users
-- verifyAllowed(createTable(phoenixTableName), superUser2);
-- verifyAllowed(createIndex(indexName1, phoenixTableName), superUser2);
-- verifyAllowed(createView(viewName1, phoenixTableName), superUser2);
-- verifyAllowed(readTable(phoenixTableName), superUser2);
-- verifyAllowed(dropView(viewName1), superUser2);
-- verifyAllowed(dropTable(phoenixTableName), superUser2);
-+// verifyAllowed(createTable(phoenixTableName), superUser2);
-+// verifyAllowed(createIndex(indexName1, phoenixTableName), superUser2);
-+// verifyAllowed(createView(viewName1, phoenixTableName), superUser2);
-+// verifyAllowed(readTable(phoenixTableName), superUser2);
-+// verifyAllowed(dropView(viewName1), superUser2);
-+// verifyAllowed(dropTable(phoenixTableName), superUser2);Peter Jan Sartorio
-
- } finally {
- revokeAll();
- }
- }
-
-+ @Test
-+ public void testSystemTablePermissions() throws Throwable {
-+ final String tableName = generateUniqueName();
-+ verifyAllowed(createTable(tableName), superUser1);
-+ verifyAllowed(readTable(tableName), superUser1);
-+
-+ Set<String> tables = getHBaseTables();
-+ if(isNamespaceMapped) {
-+ assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-+ tables.containsAll(PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES));
-+ } else {
-+ assertTrue("HBase tables do not include expected Phoenix tables: " + tables,
-+ tables.containsAll(PHOENIX_SYSTEM_TABLES));
-+ }
-+
-+ // Grant permission to the system tables for the unprivileged user
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ if(isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(),
-+ PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.EXEC, Action.READ);
-+ } else {
-+ grantPermissions(regularUser1.getShortName(), PHOENIX_SYSTEM_TABLES,
-+ Action.EXEC, Action.READ);
-+ }
-+ grantPermissions(regularUser1.getShortName(),
-+ Collections.singleton(tableName), Action.READ,Action.EXEC);
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception) e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+
-+ // Make sure that the unprivileged user can now read the table
-+ verifyAllowed(readTable(tableName), regularUser1);
-+ //This verification is added to test PHOENIX-5178
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override public Void run() throws Exception {
-+ try {
-+ if (isNamespaceMapped) {
-+ grantPermissions(regularUser1.getShortName(),"SYSTEM", Action.ADMIN);
-+ }
-+ return null;
-+ } catch (Throwable e) {
-+ throw new Exception(e);
-+ }
-+
-+ }
-+ });
-+ if(isNamespaceMapped) {
-+ verifyAllowed(new AccessTestAction() {
-+ @Override public Object run() throws Exception {
-+ Properties props = new Properties();
-+ props.setProperty(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
-+ props.setProperty(PhoenixRuntime.CURRENT_SCN_ATTRIB, Long.toString(MetaDataProtocol.MIN_SYSTEM_TABLE_TIMESTAMP));
-+ //Impersonate meta connection
-+ try (Connection metaConnection = DriverManager.getConnection(getUrl(), props);
-+ Statement stmt = metaConnection.createStatement()) {
-+ stmt.executeUpdate("CREATE SCHEMA IF NOT EXISTS SYSTEM");
-+ }catch(NewerSchemaAlreadyExistsException e){
-+
-+ }
-+ return null;
-+ }
-+ }, regularUser1);
-+ }
-+ }
-+
- }
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSDisabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSDisabledIT.java
-new file mode 100644
-index 000000000..271baea27
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSDisabledIT.java
-@@ -0,0 +1,8 @@
-+package org.apache.phoenix.end2end;
-+
-+public class TableDDLPermissionsNSDisabledIT extends TableDDLPermissionsIT {
-+
-+ public TableDDLPermissionsNSDisabledIT() throws Exception {
-+ super(false);
-+ }
-+}
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSEnabledIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSEnabledIT.java
-new file mode 100644
-index 000000000..c008537a4
---- /dev/null
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsNSEnabledIT.java
-@@ -0,0 +1,47 @@
-+package org.apache.phoenix.end2end;
-+
-+import org.apache.hadoop.hbase.security.AccessDeniedException;
-+import org.apache.hadoop.hbase.security.access.AccessControlClient;
-+import org.apache.hadoop.hbase.security.access.Permission;
-+import org.junit.Test;
-+
-+import java.security.PrivilegedExceptionAction;
-+
-+public class TableDDLPermissionsNSEnabledIT extends TableDDLPermissionsIT {
-+
-+ public TableDDLPermissionsNSEnabledIT() throws Exception {
-+ super(true);
-+ }
-+
-+ @Test
-+ public void testSchemaPermissions() throws Throwable{
-+ try {
-+ grantSystemTableAccess();
-+ final String schemaName = "TEST_SCHEMA_PERMISSION";
-+ superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-+ @Override
-+ public Void run() throws Exception {
-+ try {
-+ AccessControlClient.grant(getUtility().getConnection(), regularUser1.getShortName(),
-+ Permission.Action.ADMIN);
-+ } catch (Throwable e) {
-+ if (e instanceof Exception) {
-+ throw (Exception)e;
-+ } else {
-+ throw new Exception(e);
-+ }
-+ }
-+ return null;
-+ }
-+ });
-+ verifyAllowed(createSchema(schemaName), regularUser1);
-+ // Unprivileged user cannot drop a schema
-+ verifyDenied(dropSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-+ verifyDenied(createSchema(schemaName), AccessDeniedException.class, unprivilegedUser);
-+
-+ verifyAllowed(dropSchema(schemaName), regularUser1);
-+ } finally {
-+ revokeAll();
-+ }
-+ }
-+}
-diff --git a/phoenix-core/src/main/java/org/apache/phoenix/query/ConnectionQueryServicesImpl.java b/phoenix-core/src/main/java/org/apache/phoenix/query/ConnectionQueryServicesImpl.java
-index 1f5cd48e3..d227f666d 100644
---- a/phoenix-core/src/main/java/org/apache/phoenix/query/ConnectionQueryServicesImpl.java
-+++ b/phoenix-core/src/main/java/org/apache/phoenix/query/ConnectionQueryServicesImpl.java
-@@ -969,7 +969,7 @@ public class ConnectionQueryServicesImpl extends DelegateQueryServices implement
- }
- } else if (SchemaUtil.isTaskTable(tableName)) {
- if(!newDesc.hasCoprocessor(TaskRegionObserver.class.getName())) {
-- builder.addCoprocessor(TaskRegionObserver.class.getName(), null, priority, null);
-+ builder.addCoprocessor( TaskRegionObserver.class.getName(), null, priority, null);
- }
- }
-
---
-2.15.1
-
diff --git a/workin.patch b/workin.patch
deleted file mode 100644
index 8664b1f..0000000
--- a/workin.patch
+++ /dev/null
@@ -1,620 +0,0 @@
-From 71052b79f6bba6a34d29ed0ae5bd96bfc46de3f8 Mon Sep 17 00:00:00 2001
-From: Thomas D'Silva <td...@apache.org>
-Date: Thu, 4 Apr 2019 16:34:24 -0700
-Subject: [PATCH] take 2
-
----
- .../apache/phoenix/end2end/BasePermissionsIT.java | 118 ++++++--------
- .../phoenix/end2end/ChangePermissionsIT.java | 170 ++++++++++-----------
- .../phoenix/end2end/SystemTablePermissionsIT.java | 19 +--
- .../phoenix/end2end/TableDDLPermissionsIT.java | 5 -
- 4 files changed, 139 insertions(+), 173 deletions(-)
-
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-index 81a68b455..77e3ce756 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/BasePermissionsIT.java
-@@ -16,35 +16,13 @@
- */
- package org.apache.phoenix.end2end;
-
--import static org.junit.Assert.assertEquals;
--import static org.junit.Assert.assertFalse;
--import static org.junit.Assert.assertNotNull;
--import static org.junit.Assert.assertTrue;
--import static org.junit.Assert.fail;
--
--import java.io.IOException;
--import java.lang.reflect.UndeclaredThrowableException;
--import java.security.PrivilegedExceptionAction;
--import java.sql.Connection;
--import java.sql.DriverManager;
--import java.sql.PreparedStatement;
--import java.sql.ResultSet;
--import java.sql.SQLException;
--import java.sql.Statement;
--import java.util.Arrays;
--import java.util.Collection;
--import java.util.Collections;
--import java.util.HashSet;
--import java.util.List;
--import java.util.Properties;
--import java.util.Set;
--
-+import com.google.common.base.Joiner;
-+import com.google.common.base.Throwables;
- import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
- import org.apache.hadoop.conf.Configuration;
- import org.apache.hadoop.hbase.AuthUtil;
- import org.apache.hadoop.hbase.HBaseTestingUtility;
--import org.apache.hadoop.hbase.HConstants;
- import org.apache.hadoop.hbase.LocalHBaseCluster;
- import org.apache.hadoop.hbase.TableName;
- import org.apache.hadoop.hbase.security.AccessDeniedException;
-@@ -58,20 +36,42 @@ import org.apache.phoenix.query.BaseTest;
- import org.apache.phoenix.query.QueryConstants;
- import org.apache.phoenix.query.QueryServices;
- import org.apache.phoenix.util.PhoenixRuntime;
--import org.junit.After;
-+import org.junit.Before;
- import org.junit.BeforeClass;
-+import org.junit.experimental.categories.Category;
- import org.junit.runner.RunWith;
- import org.junit.runners.Parameterized;
-
--import com.google.common.base.Joiner;
--import com.google.common.base.Throwables;
-+import java.io.IOException;
-+import java.lang.reflect.UndeclaredThrowableException;
-+import java.security.PrivilegedExceptionAction;
-+import java.sql.Connection;
-+import java.sql.DriverManager;
-+import java.sql.PreparedStatement;
-+import java.sql.ResultSet;
-+import java.sql.SQLException;
-+import java.sql.Statement;
-+import java.util.Arrays;
-+import java.util.Collection;
-+import java.util.Collections;
-+import java.util.HashSet;
-+import java.util.List;
-+import java.util.Properties;
-+import java.util.Set;
-+
-+import static org.junit.Assert.assertEquals;
-+import static org.junit.Assert.assertFalse;
-+import static org.junit.Assert.assertNotNull;
-+import static org.junit.Assert.assertTrue;
-+import static org.junit.Assert.fail;
-
-+@Category(NeedsOwnMiniClusterTest.class)
- @RunWith(Parameterized.class)
- public class BasePermissionsIT extends BaseTest {
-
- private static final Log LOG = LogFactory.getLog(BasePermissionsIT.class);
-
-- static String SUPERUSER;
-+ static String SUPERUSER = System.getProperty("user.name");
-
- static HBaseTestingUtility testUtil;
- static final Set<String> PHOENIX_SYSTEM_TABLES =
-@@ -98,8 +98,8 @@ public class BasePermissionsIT extends BaseTest {
- // Instead use org.apache.hadoop.hbase.security.User class for testing purposes.
-
- // Super User has all the access
-- User superUser1 = null;
-- User superUser2 = null;
-+ static User superUser1 = null;
-+ static User superUser2 = null;
-
- // Regular users are granted and revoked permissions as needed
- User regularUser1 = null;
-@@ -125,14 +125,6 @@ public class BasePermissionsIT extends BaseTest {
-
- @BeforeClass
- public static void doSetup() throws Exception {
-- SUPERUSER = System.getProperty("user.name");
-- }
--
-- void startNewMiniCluster() throws Exception {
-- startNewMiniCluster(new Configuration());
-- }
--
-- void startNewMiniCluster(Configuration overrideConf) throws Exception{
- if (null != testUtil) {
- testUtil.shutdownMiniCluster();
- testUtil = null;
-@@ -142,37 +134,35 @@ public class BasePermissionsIT extends BaseTest {
-
- Configuration config = testUtil.getConfiguration();
- enablePhoenixHBaseAuthorization(config);
-- configureNamespacesOnServer(config);
-+ configureNamespacesOnServer(config, true);
- config.setBoolean(LocalHBaseCluster.ASSIGN_RANDOM_PORTS, true);
-- if (overrideConf != null) {
-- config.addResource(overrideConf);
-- }
-
- testUtil.startMiniCluster(1);
-- initializeUsers(testUtil.getConfiguration());
-+ superUser1 = User.createUserForTesting(config, SUPERUSER, new String[0]);
-+ superUser2 = User.createUserForTesting(config, "superUser2", new String[0]);
- }
-
-- private void initializeUsers(Configuration configuration) {
--
-- superUser1 = User.createUserForTesting(configuration, SUPERUSER, new String[0]);
-- superUser2 = User.createUserForTesting(configuration, "superUser2", new String[0]);
-+ @Before
-+ public void setUp() {
-+ Configuration configuration = testUtil.getConfiguration();
-
-- regularUser1 = User.createUserForTesting(configuration, "regularUser1", new String[0]);
-- regularUser2 = User.createUserForTesting(configuration, "regularUser2", new String[0]);
-- regularUser3 = User.createUserForTesting(configuration, "regularUser3", new String[0]);
-- regularUser4 = User.createUserForTesting(configuration, "regularUser4", new String[0]);
-+ regularUser1 = User.createUserForTesting(configuration, "regularUser1_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser2 = User.createUserForTesting(configuration, "regularUser2_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser3 = User.createUserForTesting(configuration, "regularUser3_"
-+ + generateUniqueName(), new String[0]);
-+ regularUser4 = User.createUserForTesting(configuration, "regularUser4_"
-+ + generateUniqueName(), new String[0]);
-
-- groupUser = User.createUserForTesting(testUtil.getConfiguration(), "groupUser", new String[] {GROUP_SYSTEM_ACCESS});
-+ groupUser = User.createUserForTesting(testUtil.getConfiguration(), "groupUser_"
-+ + generateUniqueName() , new String[] {GROUP_SYSTEM_ACCESS});
-
-- unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser", new String[0]);
-+ unprivilegedUser = User.createUserForTesting(configuration, "unprivilegedUser_"
-+ + generateUniqueName(), new String[0]);
- }
-
-- private void configureRandomHMasterPort(Configuration config) {
-- // Avoid multiple clusters trying to bind the master's info port (16010)
-- config.setInt(HConstants.MASTER_INFO_PORT, 0);
-- }
--
-- void enablePhoenixHBaseAuthorization(Configuration config) {
-+ private static void enablePhoenixHBaseAuthorization(Configuration config) {
- config.set("hbase.superuser", SUPERUSER + "," + "superUser2");
- config.set("hbase.security.authorization", Boolean.TRUE.toString());
- config.set("hbase.security.exec.permission.checks", Boolean.TRUE.toString());
-@@ -188,7 +178,7 @@ public class BasePermissionsIT extends BaseTest {
- config.set("hbase.regionserver.wal.codec", "org.apache.hadoop.hbase.regionserver.wal.IndexedWALEditCodec");
- }
-
-- void configureNamespacesOnServer(Configuration conf) {
-+ private static void configureNamespacesOnServer(Configuration conf, boolean isNamespaceMapped) {
- conf.set(QueryServices.IS_NAMESPACE_MAPPING_ENABLED, Boolean.toString(isNamespaceMapped));
- }
-
-@@ -197,14 +187,6 @@ public class BasePermissionsIT extends BaseTest {
- return Arrays.asList(false, true);
- }
-
-- @After
-- public void cleanup() throws Exception {
-- if (testUtil != null) {
-- testUtil.shutdownMiniCluster();
-- testUtil = null;
-- }
-- }
--
- public static HBaseTestingUtility getUtility(){
- return testUtil;
- }
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-index 65f44c04f..ae5ad39fb 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/ChangePermissionsIT.java
-@@ -13,8 +13,7 @@
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
-- */
--package org.apache.phoenix.end2end;
-+ */package org.apache.phoenix.end2end;
-
- import org.apache.commons.logging.Log;
- import org.apache.commons.logging.LogFactory;
-@@ -23,33 +22,47 @@ import org.apache.hadoop.hbase.security.User;
- import org.apache.phoenix.jdbc.PhoenixDatabaseMetaData;
- import org.apache.phoenix.query.QueryConstants;
- import org.apache.phoenix.schema.TableNotFoundException;
--import org.apache.phoenix.util.SchemaUtil;
-+import org.junit.After;
-+import org.junit.Before;
-+import org.junit.FixMethodOrder;
- import org.junit.Test;
--import org.junit.experimental.categories.Category;
-+import org.junit.runners.MethodSorters;
-
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- */
--@Category(NeedsOwnMiniClusterTest.class)
-+@FixMethodOrder(MethodSorters.NAME_ASCENDING)
- public class ChangePermissionsIT extends BasePermissionsIT {
-
- private static final Log LOG = LogFactory.getLog(ChangePermissionsIT.class);
-
-- private static final String SCHEMA_NAME = "CHANGEPERMSSCHEMA";
-- private static final String TABLE_NAME =
-- ChangePermissionsIT.class.getSimpleName().toUpperCase();
-- private static final String FULL_TABLE_NAME = SCHEMA_NAME + "." + TABLE_NAME;
-- private static final String IDX1_TABLE_NAME = TABLE_NAME + "_IDX1";
-- private static final String IDX2_TABLE_NAME = TABLE_NAME + "_IDX2";
-- private static final String IDX3_TABLE_NAME = TABLE_NAME + "_IDX3";
-- private static final String LOCAL_IDX1_TABLE_NAME = TABLE_NAME + "_LIDX1";
-- private static final String VIEW1_TABLE_NAME = TABLE_NAME + "_V1";
-- private static final String VIEW2_TABLE_NAME = TABLE_NAME + "_V2";
-+ private String schemaName;
-+ private String tableName;
-+ private String fullTableName;
-+ private String idx1TableName;
-+ private String idx2TableName;
-+ private String idx3TableName;
-+ private String localIdx1TableName;
-+ private String view1TableName;
-+ private String view2TableName;
-
- public ChangePermissionsIT(boolean isNamespaceMapped) throws Exception {
- super(isNamespaceMapped);
- }
-
-+ @Before
-+ public void setup() {
-+ schemaName = generateUniqueName();
-+ tableName = generateUniqueName();
-+ fullTableName = schemaName + "." + tableName;
-+ idx1TableName = tableName + "_IDX1";
-+ idx2TableName = tableName + "_IDX2";
-+ idx3TableName = tableName + "_IDX3";
-+ localIdx1TableName = tableName + "_LIDX1";
-+ view1TableName = tableName + "_V1";
-+ view2TableName = tableName + "_V2";
-+ }
-+
- private void grantSystemTableAccess(User superUser, User... users) throws Exception {
- for(User user : users) {
- if(isNamespaceMapped) {
-@@ -79,10 +92,8 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- * Tests grant revoke permissions per user 1. if NS enabled -> on namespace 2. If NS disabled -> on tables
- */
- @Test
-- public void testRXPermsReqdForPhoenixConn() throws Exception {
--
-- startNewMiniCluster();
--
-+ // this test needs to be run first
-+ public void aTestRXPermsReqdForPhoenixConn() throws Exception {
- if(isNamespaceMapped) {
- // NS is enabled, CQSI tries creating SYSCAT, we get NamespaceNotFoundException exception for "SYSTEM" NS
- // We create custom ADE and throw it (and ignore NamespaceNotFoundException)
-@@ -112,9 +123,6 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testSuperUserCanChangePerms() throws Exception {
--
-- startNewMiniCluster();
--
- // Grant System Table access to all users, else they can't create a Phoenix connection
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-
-@@ -137,60 +145,56 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testReadPermsOnTableIndexAndView() throws Exception {
--
-- startNewMiniCluster();
--
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, unprivilegedUser);
-
- // Create new schema and grant CREATE permissions to a user
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
- } else {
- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
- }
-
- // Create new table. Create indexes, views and view indexes on top of it. Verify the contents by querying it
-- verifyAllowed(createTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createLocalIndex(LOCAL_IDX1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-- verifyAllowed(createIndex(IDX3_TABLE_NAME, VIEW1_TABLE_NAME), regularUser1);
-+ verifyAllowed(createTable(fullTableName), regularUser1);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, fullTableName), regularUser1);
-+ verifyAllowed(createLocalIndex(localIdx1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
-+ verifyAllowed(createIndex(idx3TableName, view1TableName), regularUser1);
-
- // RegularUser2 doesn't have any permissions. It can get a PhoenixConnection
- // However it cannot query table, indexes or views without READ perms
- verifyAllowed(getConnectionAction(), regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTable(VIEW1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(fullTableName, idx1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTable(view1TableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
-
- // Grant READ permissions to RegularUser2 on the table
- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
- // Granting permissions directly to index tables should fail
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + IDX1_TABLE_NAME, false), AccessDeniedException.class, regularUser1);
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + idx1TableName, false), AccessDeniedException.class, regularUser1);
- // Granting permissions directly to views should fail. We expect TableNotFoundException since VIEWS are not physical tables
-- verifyDenied(grantPermissions("W", regularUser2, SCHEMA_NAME + "." + VIEW1_TABLE_NAME, false), TableNotFoundException.class, regularUser1);
-+ verifyDenied(grantPermissions("W", regularUser2, schemaName + "." + view1TableName, false), TableNotFoundException.class, regularUser1);
-
- // Verify that all other access are successful now
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, IDX2_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(FULL_TABLE_NAME, LOCAL_IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), regularUser2);
-- verifyAllowed(readTable(VIEW1_TABLE_NAME), regularUser2);
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME), regularUser2);
-+ verifyAllowed(readTable(fullTableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx1TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, idx2TableName), regularUser2);
-+ verifyAllowed(readTable(fullTableName, localIdx1TableName), regularUser2);
-+ verifyAllowed(readTableWithoutVerification(schemaName + "." + idx1TableName), regularUser2);
-+ verifyAllowed(readTable(view1TableName), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName), regularUser2);
-
- // Revoke READ permissions to RegularUser2 on the table
- // Permissions should propagate automatically to relevant physical tables such as global index and view index.
-- verifyAllowed(revokePermissions(regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(revokePermissions(regularUser2, fullTableName, false), regularUser1);
- // READ query should fail now
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-- verifyDenied(readTableWithoutVerification(SCHEMA_NAME + "." + IDX1_TABLE_NAME), AccessDeniedException.class, regularUser2);
--
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readTableWithoutVerification(schemaName + "." + idx1TableName), AccessDeniedException.class, regularUser2);
- }
-
- /**
-@@ -198,30 +202,27 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testGroupUserPerms() throws Exception {
--
-- startNewMiniCluster();
--
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
- }
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
-
- // Grant SYSTEM table access to GROUP_SYSTEM_ACCESS and regularUser1
- verifyAllowed(grantPermissions("RX", GROUP_SYSTEM_ACCESS, PHOENIX_SYSTEM_TABLES_IDENTIFIERS, false), superUser1);
- grantSystemTableAccess(superUser1, regularUser1);
-
- // Grant Permissions to Groups (Should be automatically applicable to all users inside it)
-- verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyAllowed(readTable(FULL_TABLE_NAME), groupUser);
-+ verifyAllowed(grantPermissions("ARX", GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyAllowed(readTable(fullTableName), groupUser);
-
- // GroupUser is an admin and can grant perms to other users
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, regularUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, FULL_TABLE_NAME, false), groupUser);
-- verifyAllowed(readTable(FULL_TABLE_NAME), regularUser1);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, fullTableName, false), groupUser);
-+ verifyAllowed(readTable(fullTableName), regularUser1);
-
- // Revoke the perms and try accessing data again
-- verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, FULL_TABLE_NAME, false), superUser1);
-- verifyDenied(readTable(FULL_TABLE_NAME), AccessDeniedException.class, groupUser);
-+ verifyAllowed(revokePermissions(GROUP_SYSTEM_ACCESS, fullTableName, false), superUser1);
-+ verifyDenied(readTable(fullTableName), AccessDeniedException.class, groupUser);
- }
-
- /**
-@@ -229,45 +230,42 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testMultiTenantTables() throws Exception {
--
-- startNewMiniCluster();
--
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(grantPermissions("C", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(grantPermissions("C", regularUser1, schemaName, true), superUser1);
- } else {
- verifyAllowed(grantPermissions("C", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
- }
-
- // Create MultiTenant Table (View Index Table should be automatically created)
- // At this point, the index table doesn't contain any data
-- verifyAllowed(createMultiTenantTable(FULL_TABLE_NAME), regularUser1);
-+ verifyAllowed(createMultiTenantTable(fullTableName), regularUser1);
-
- // RegularUser2 doesn't have access yet, RegularUser1 should have RWXCA on the table
-- verifyDenied(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), AccessDeniedException.class, regularUser2);
-+ verifyDenied(readMultiTenantTableWithoutIndex(fullTableName), AccessDeniedException.class, regularUser2);
-
- // Grant perms to base table (Should propagate to View Index as well)
-- verifyAllowed(grantPermissions("RX", regularUser2, FULL_TABLE_NAME, false), regularUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser2, fullTableName, false), regularUser1);
- // Try reading full table
-- verifyAllowed(readMultiTenantTableWithoutIndex(FULL_TABLE_NAME), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithoutIndex(fullTableName), regularUser2);
-
- // Create tenant specific views on the table using tenant specific Phoenix Connection
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createView(VIEW2_TABLE_NAME, FULL_TABLE_NAME, "o2"), regularUser1);
-+ verifyAllowed(createView(view1TableName, fullTableName, "o1"), regularUser1);
-+ verifyAllowed(createView(view2TableName, fullTableName, "o2"), regularUser1);
-
- // Create indexes on those views using tenant specific Phoenix Connection
- // It is not possible to create indexes on tenant specific views without tenant connection
-- verifyAllowed(createIndex(IDX1_TABLE_NAME, VIEW1_TABLE_NAME, "o1"), regularUser1);
-- verifyAllowed(createIndex(IDX2_TABLE_NAME, VIEW2_TABLE_NAME, "o2"), regularUser1);
-+ verifyAllowed(createIndex(idx1TableName, view1TableName, "o1"), regularUser1);
-+ verifyAllowed(createIndex(idx2TableName, view2TableName, "o2"), regularUser1);
-
- // Read the tables as regularUser2, with and without the use of Index table
- // If perms are propagated correctly, then both of them should work
- // The test checks if the query plan uses the index table by searching for "_IDX_" string
- // _IDX_ is the prefix used with base table name to derieve the name of view index table
-- verifyAllowed(readMultiTenantTableWithIndex(VIEW1_TABLE_NAME, "o1"), regularUser2);
-- verifyAllowed(readMultiTenantTableWithoutIndex(VIEW2_TABLE_NAME, "o2"), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithIndex(view1TableName, "o1"), regularUser2);
-+ verifyAllowed(readMultiTenantTableWithoutIndex(view2TableName, "o2"), regularUser2);
- }
-
- /**
-@@ -276,18 +274,16 @@ public class ChangePermissionsIT extends BasePermissionsIT {
- */
- @Test
- public void testCreateViewOnTableWithRXPermsOnSchema() throws Exception {
--
-- startNewMiniCluster();
- grantSystemTableAccess(superUser1, regularUser1, regularUser2, regularUser3);
-
- if(isNamespaceMapped) {
-- verifyAllowed(createSchema(SCHEMA_NAME), superUser1);
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-- verifyAllowed(grantPermissions("RX", regularUser1, SCHEMA_NAME, true), superUser1);
-+ verifyAllowed(createSchema(schemaName), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
-+ verifyAllowed(grantPermissions("RX", regularUser1, schemaName, true), superUser1);
- } else {
-- verifyAllowed(createTable(FULL_TABLE_NAME), superUser1);
-+ verifyAllowed(createTable(fullTableName), superUser1);
- verifyAllowed(grantPermissions("RX", regularUser1, surroundWithDoubleQuotes(QueryConstants.HBASE_DEFAULT_SCHEMA_NAME), true), superUser1);
-- }
-- verifyAllowed(createView(VIEW1_TABLE_NAME, FULL_TABLE_NAME), regularUser1);
-+ }
-+ verifyAllowed(createView(view1TableName, fullTableName), regularUser1);
- }
- }
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-index 6da970b99..fb2dfc943 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/SystemTablePermissionsIT.java
-@@ -29,35 +29,28 @@ import java.util.Set;
-
- import org.apache.hadoop.hbase.security.access.Permission.Action;
- import org.apache.phoenix.coprocessor.MetaDataProtocol;
--import org.apache.phoenix.jdbc.PhoenixConnection;
- import org.apache.phoenix.query.QueryServices;
- import org.apache.phoenix.schema.NewerSchemaAlreadyExistsException;
--import org.apache.phoenix.schema.NewerTableAlreadyExistsException;
- import org.apache.phoenix.util.PhoenixRuntime;
- import org.junit.Test;
--import org.junit.experimental.categories.Category;
-
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- * Uses HBase API directly to grant/revoke permissions
- */
--@Category(NeedsOwnMiniClusterTest.class)
- public class SystemTablePermissionsIT extends BasePermissionsIT {
-
-- private static final String TABLE_NAME =
-- SystemTablePermissionsIT.class.getSimpleName().toUpperCase();
-+ private String tableName;
-
- public SystemTablePermissionsIT(boolean isNamespaceMapped) throws Exception {
- super(isNamespaceMapped);
-+ tableName = generateUniqueName();
- }
-
- @Test
- public void testSystemTablePermissions() throws Throwable {
--
-- startNewMiniCluster();
--
-- verifyAllowed(createTable(TABLE_NAME), superUser1);
-- verifyAllowed(readTable(TABLE_NAME), superUser1);
-+ verifyAllowed(createTable(tableName), superUser1);
-+ verifyAllowed(readTable(tableName), superUser1);
-
- Set<String> tables = getHBaseTables();
- if(isNamespaceMapped) {
-@@ -81,7 +74,7 @@ public class SystemTablePermissionsIT extends BasePermissionsIT {
- Action.EXEC, Action.READ);
- }
- grantPermissions(regularUser1.getShortName(),
-- Collections.singleton(TABLE_NAME), Action.READ,Action.EXEC);
-+ Collections.singleton(tableName), Action.READ,Action.EXEC);
- } catch (Throwable e) {
- if (e instanceof Exception) {
- throw (Exception) e;
-@@ -94,7 +87,7 @@ public class SystemTablePermissionsIT extends BasePermissionsIT {
- });
-
- // Make sure that the unprivileged user can now read the table
-- verifyAllowed(readTable(TABLE_NAME), regularUser1);
-+ verifyAllowed(readTable(tableName), regularUser1);
- //This verification is added to test PHOENIX-5178
- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
- @Override public Void run() throws Exception {
-diff --git a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-index 37073c393..45f828260 100644
---- a/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-+++ b/phoenix-core/src/it/java/org/apache/phoenix/end2end/TableDDLPermissionsIT.java
-@@ -35,7 +35,6 @@ import org.junit.runners.Parameterized;
- /**
- * Test that verifies a user can read Phoenix tables with a minimal set of permissions.
- */
--@Category(NeedsOwnMiniClusterTest.class)
- @RunWith(Parameterized.class)
- public class TableDDLPermissionsIT extends BasePermissionsIT{
-
-@@ -44,7 +43,6 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
- }
-
- private void grantSystemTableAccess() throws Exception{
--
- try (Connection conn = getConnection()) {
- if (isNamespaceMapped) {
- grantPermissions(regularUser1.getShortName(), PHOENIX_NAMESPACE_MAPPED_SYSTEM_TABLES, Action.READ,
-@@ -88,10 +86,8 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
-
- @Test
- public void testSchemaPermissions() throws Throwable{
--
- if (!isNamespaceMapped) { return; }
- try {
-- startNewMiniCluster();
- grantSystemTableAccess();
- final String schemaName = "TEST_SCHEMA_PERMISSION";
- superUser1.runAs(new PrivilegedExceptionAction<Void>() {
-@@ -123,7 +119,6 @@ public class TableDDLPermissionsIT extends BasePermissionsIT{
-
- @Test
- public void testAutomaticGrantWithIndexAndView() throws Throwable {
-- startNewMiniCluster();
- final String schema = "TEST_INDEX_VIEW";
- final String tableName = "TABLE_DDL_PERMISSION_IT";
- final String phoenixTableName = schema + "." + tableName;
---
-2.15.1
-