@Test public void testCheckPermissions() throws Exception { AccessTestAction globalAdmin = new AccessTestAction() { @Override public Void run() throws Exception { checkGlobalPerms(Permission.Action.ADMIN); return null; } }; verifyGlobal(globalAdmin); AccessTestAction globalReadWrite = new AccessTestAction() { @Override public Void run() throws Exception { checkGlobalPerms(Permission.Action.READ, Permission.Action.WRITE); return null; } }; verifyGlobal(globalReadWrite); final byte[] TEST_Q1 = Bytes.toBytes("q1"); final byte[] TEST_Q2 = Bytes.toBytes("q2"); User userTable = User.createUserForTesting(conf, "user_check_perms_table", new String[0]); User userColumn = User.createUserForTesting(conf, "user_check_perms_family", new String[0]); User userQualifier = User.createUserForTesting(conf, "user_check_perms_q", new String[0]); grantOnTable(TEST_UTIL, userTable.getShortName(), TEST_TABLE.getTableName(), null, null, Permission.Action.READ); grantOnTable(TEST_UTIL, userColumn.getShortName(), TEST_TABLE.getTableName(), TEST_FAMILY, null, Permission.Action.READ); grantOnTable(TEST_UTIL, userQualifier.getShortName(), TEST_TABLE.getTableName(), TEST_FAMILY, TEST_Q1, Permission.Action.READ); AccessTestAction tableRead = new AccessTestAction() { @Override public Void run() throws Exception { checkTablePerms(TEST_TABLE.getTableName(), null, null, Permission.Action.READ); return null; } }; AccessTestAction columnRead = new AccessTestAction() { @Override public Void run() throws Exception { checkTablePerms(TEST_TABLE.getTableName(), TEST_FAMILY, null, Permission.Action.READ); return null; } }; AccessTestAction qualifierRead = new AccessTestAction() { @Override public Void run() throws Exception { checkTablePerms(TEST_TABLE.getTableName(), TEST_FAMILY, TEST_Q1, Permission.Action.READ); return null; } }; AccessTestAction multiQualifierRead = new AccessTestAction() { @Override public Void run() throws Exception { checkTablePerms(TEST_TABLE.getTableName(), new Permission[] { new TablePermission(TEST_TABLE.getTableName(), TEST_FAMILY, TEST_Q1, Permission.Action.READ), new TablePermission(TEST_TABLE.getTableName(), TEST_FAMILY, TEST_Q2, Permission.Action.READ), }); return null; } }; AccessTestAction globalAndTableRead = new AccessTestAction() { @Override public Void run() throws Exception { checkTablePerms(TEST_TABLE.getTableName(), new Permission[] { new Permission(Permission.Action.READ), new TablePermission(TEST_TABLE.getTableName(), null, (byte[]) null, Permission.Action.READ), }); return null; } }; AccessTestAction noCheck = new AccessTestAction() { @Override public Void run() throws Exception { checkTablePerms(TEST_TABLE.getTableName(), new Permission[0]); return null; } }; verifyAllowed(tableRead, SUPERUSER, userTable); verifyDenied(tableRead, userColumn, userQualifier); verifyAllowed(columnRead, SUPERUSER, userTable, userColumn); verifyDenied(columnRead, userQualifier); verifyAllowed(qualifierRead, SUPERUSER, userTable, userColumn, userQualifier); verifyAllowed(multiQualifierRead, SUPERUSER, userTable, userColumn); verifyDenied(multiQualifierRead, userQualifier); verifyAllowed(globalAndTableRead, SUPERUSER); verifyDenied(globalAndTableRead, userTable, userColumn, userQualifier); verifyAllowed(noCheck, SUPERUSER, userTable, userColumn, userQualifier); AccessTestAction familyReadWrite = new AccessTestAction() { @Override public Void run() throws Exception { checkTablePerms(TEST_TABLE.getTableName(), TEST_FAMILY, null, Permission.Action.READ, Permission.Action.WRITE); return null; } }; verifyAllowed(familyReadWrite, SUPERUSER, USER_OWNER, USER_CREATE, USER_RW); verifyDenied(familyReadWrite, USER_NONE, USER_RO); CheckPermissionsRequest checkRequest = CheckPermissionsRequest.newBuilder() .addPermission(AccessControlProtos.Permission.newBuilder() .setType(AccessControlProtos.Permission.Type.Table) .setTablePermission( AccessControlProtos.TablePermission.newBuilder() .setTableName(ProtobufUtil.toProtoTableName(TEST_TABLE.getTableName())) .addAction(AccessControlProtos.Permission.Action.CREATE)) ).build(); HTable acl = new HTable(conf, AccessControlLists.ACL_TABLE_NAME); try { BlockingRpcChannel channel = acl.coprocessorService(new byte[0]); AccessControlService.BlockingInterface protocol = AccessControlService.newBlockingStub(channel); try { protocol.checkPermissions(null, checkRequest); fail("this should have thrown CoprocessorException"); } catch (ServiceException ex) { } } finally { acl.close(); } }
@Override public void checkPermissions(RpcController controller, AccessControlProtos.CheckPermissionsRequest request, RpcCallback<AccessControlProtos.CheckPermissionsResponse> done) { Permission[] permissions = new Permission[request.getPermissionCount()]; for (int i=0; i < request.getPermissionCount(); i++) { permissions[i] = ProtobufUtil.toPermission(request.getPermission(i)); } AccessControlProtos.CheckPermissionsResponse response = null; try { TableName tableName = regionEnv.getRegion().getTableDesc().getTableName(); for (Permission permission : permissions) { if (permission instanceof TablePermission) { TablePermission tperm = (TablePermission) permission; for (Action action : permission.getActions()) { if (!tperm.getTableName().equals(tableName)) { throw new CoprocessorException(AccessController.class, String.format("This method " + "can only execute at the table specified in TablePermission. " + "Table of the region:%s , requested table:%s", tableName, tperm.getTableName())); } Map<byte[], Set<byte[]>> familyMap = new TreeMap<byte[], Set<byte[]>>(Bytes.BYTES_COMPARATOR); if (tperm.getFamily() != null) { if (tperm.getQualifier() != null) { Set<byte[]> qualifiers = Sets.newTreeSet(Bytes.BYTES_COMPARATOR); qualifiers.add(tperm.getQualifier()); familyMap.put(tperm.getFamily(), qualifiers); } else { familyMap.put(tperm.getFamily(), null); } } requirePermission("checkPermissions", action, regionEnv, familyMap); } } else { for (Action action : permission.getActions()) { requirePermission("checkPermissions", action); } } } response = AccessControlProtos.CheckPermissionsResponse.getDefaultInstance(); } catch (IOException ioe) { ResponseConverter.setControllerException(controller, ioe); } done.run(response); }
AccessController extends BaseRegionObserver implements MasterObserver, RegionServerObserver,
      AccessControlService.Interface, CoprocessorService, EndpointObserver { @Override public void checkPermissions(RpcController controller, AccessControlProtos.CheckPermissionsRequest request, RpcCallback<AccessControlProtos.CheckPermissionsResponse> done) { Permission[] permissions = new Permission[request.getPermissionCount()]; for (int i=0; i < request.getPermissionCount(); i++) { permissions[i] = ProtobufUtil.toPermission(request.getPermission(i)); } AccessControlProtos.CheckPermissionsResponse response = null; try { TableName tableName = regionEnv.getRegion().getTableDesc().getTableName(); for (Permission permission : permissions) { if (permission instanceof TablePermission) { TablePermission tperm = (TablePermission) permission; for (Action action : permission.getActions()) { if (!tperm.getTableName().equals(tableName)) { throw new CoprocessorException(AccessController.class, String.format("This method " + "can only execute at the table specified in TablePermission. " + "Table of the region:%s , requested table:%s", tableName, tperm.getTableName())); } Map<byte[], Set<byte[]>> familyMap = new TreeMap<byte[], Set<byte[]>>(Bytes.BYTES_COMPARATOR); if (tperm.getFamily() != null) { if (tperm.getQualifier() != null) { Set<byte[]> qualifiers = Sets.newTreeSet(Bytes.BYTES_COMPARATOR); qualifiers.add(tperm.getQualifier()); familyMap.put(tperm.getFamily(), qualifiers); } else { familyMap.put(tperm.getFamily(), null); } } requirePermission("checkPermissions", action, regionEnv, familyMap); } } else { for (Action action : permission.getActions()) { requirePermission("checkPermissions", action); } } } response = AccessControlProtos.CheckPermissionsResponse.getDefaultInstance(); } catch (IOException ioe) { ResponseConverter.setControllerException(controller, ioe); } done.run(response); } }
AccessController extends BaseRegionObserver implements MasterObserver, RegionServerObserver,
      AccessControlService.Interface, CoprocessorService, EndpointObserver { @Override public void checkPermissions(RpcController controller, AccessControlProtos.CheckPermissionsRequest request, RpcCallback<AccessControlProtos.CheckPermissionsResponse> done) { Permission[] permissions = new Permission[request.getPermissionCount()]; for (int i=0; i < request.getPermissionCount(); i++) { permissions[i] = ProtobufUtil.toPermission(request.getPermission(i)); } AccessControlProtos.CheckPermissionsResponse response = null; try { TableName tableName = regionEnv.getRegion().getTableDesc().getTableName(); for (Permission permission : permissions) { if (permission instanceof TablePermission) { TablePermission tperm = (TablePermission) permission; for (Action action : permission.getActions()) { if (!tperm.getTableName().equals(tableName)) { throw new CoprocessorException(AccessController.class, String.format("This method " + "can only execute at the table specified in TablePermission. " + "Table of the region:%s , requested table:%s", tableName, tperm.getTableName())); } Map<byte[], Set<byte[]>> familyMap = new TreeMap<byte[], Set<byte[]>>(Bytes.BYTES_COMPARATOR); if (tperm.getFamily() != null) { if (tperm.getQualifier() != null) { Set<byte[]> qualifiers = Sets.newTreeSet(Bytes.BYTES_COMPARATOR); qualifiers.add(tperm.getQualifier()); familyMap.put(tperm.getFamily(), qualifiers); } else { familyMap.put(tperm.getFamily(), null); } } requirePermission("checkPermissions", action, regionEnv, familyMap); } } else { for (Action action : permission.getActions()) { requirePermission("checkPermissions", action); } } } response = AccessControlProtos.CheckPermissionsResponse.getDefaultInstance(); } catch (IOException ioe) { ResponseConverter.setControllerException(controller, ioe); } done.run(response); }  }
AccessController extends BaseRegionObserver implements MasterObserver, RegionServerObserver,
      AccessControlService.Interface, CoprocessorService, EndpointObserver { @Override public void checkPermissions(RpcController controller, AccessControlProtos.CheckPermissionsRequest request, RpcCallback<AccessControlProtos.CheckPermissionsResponse> done) { Permission[] permissions = new Permission[request.getPermissionCount()]; for (int i=0; i < request.getPermissionCount(); i++) { permissions[i] = ProtobufUtil.toPermission(request.getPermission(i)); } AccessControlProtos.CheckPermissionsResponse response = null; try { TableName tableName = regionEnv.getRegion().getTableDesc().getTableName(); for (Permission permission : permissions) { if (permission instanceof TablePermission) { TablePermission tperm = (TablePermission) permission; for (Action action : permission.getActions()) { if (!tperm.getTableName().equals(tableName)) { throw new CoprocessorException(AccessController.class, String.format("This method " + "can only execute at the table specified in TablePermission. " + "Table of the region:%s , requested table:%s", tableName, tperm.getTableName())); } Map<byte[], Set<byte[]>> familyMap = new TreeMap<byte[], Set<byte[]>>(Bytes.BYTES_COMPARATOR); if (tperm.getFamily() != null) { if (tperm.getQualifier() != null) { Set<byte[]> qualifiers = Sets.newTreeSet(Bytes.BYTES_COMPARATOR); qualifiers.add(tperm.getQualifier()); familyMap.put(tperm.getFamily(), qualifiers); } else { familyMap.put(tperm.getFamily(), null); } } requirePermission("checkPermissions", action, regionEnv, familyMap); } } else { for (Action action : permission.getActions()) { requirePermission("checkPermissions", action); } } } response = AccessControlProtos.CheckPermissionsResponse.getDefaultInstance(); } catch (IOException ioe) { ResponseConverter.setControllerException(controller, ioe); } done.run(response); }  HRegion getRegion(); TableAuthManager getAuthManager(); void start(CoprocessorEnvironment env); void stop(CoprocessorEnvironment env); @Override void preCreateTable(ObserverContext<MasterCoprocessorEnvironment> c,
      HTableDescriptor desc, HRegionInfo[] regions); @Override void preCreateTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      HTableDescriptor desc, HRegionInfo[] regions); @Override void postCreateTable(ObserverContext<MasterCoprocessorEnvironment> c,
      HTableDescriptor desc, HRegionInfo[] regions); @Override void postCreateTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      HTableDescriptor desc, HRegionInfo[] regions); @Override void preDeleteTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName); @Override void preDeleteTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postDeleteTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postDeleteTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preTruncateTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName); @Override void postTruncateTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preTruncateTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postTruncateTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preModifyTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName,
      HTableDescriptor htd); @Override void preModifyTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HTableDescriptor htd); @Override void postModifyTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HTableDescriptor htd); @Override void postModifyTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HTableDescriptor htd); @Override void preAddColumn(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName,
      HColumnDescriptor column); @Override void preAddColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor column); @Override void postAddColumn(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor column); @Override void postAddColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor column); @Override void preModifyColumn(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName,
      HColumnDescriptor descriptor); @Override void preModifyColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor descriptor); @Override void postModifyColumn(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor descriptor); @Override void postModifyColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor descriptor); @Override void preDeleteColumn(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName,
      byte[] col); @Override void preDeleteColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, byte[] col); @Override void postDeleteColumn(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, byte[] col); @Override void postDeleteColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, byte[] col); @Override void preEnableTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName); @Override void preEnableTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postEnableTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postEnableTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preDisableTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName); @Override void preDisableTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postDisableTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postDisableTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preMove(ObserverContext<MasterCoprocessorEnvironment> c, HRegionInfo region,
      ServerName srcServer, ServerName destServer); @Override void postMove(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo region, ServerName srcServer, ServerName destServer); @Override void preAssign(ObserverContext<MasterCoprocessorEnvironment> c, HRegionInfo regionInfo); @Override void postAssign(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo regionInfo); @Override void preUnassign(ObserverContext<MasterCoprocessorEnvironment> c, HRegionInfo regionInfo,
      boolean force); @Override void postUnassign(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo regionInfo, boolean force); @Override void preRegionOffline(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo regionInfo); @Override void postRegionOffline(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo regionInfo); @Override void preBalance(ObserverContext<MasterCoprocessorEnvironment> c); @Override void postBalance(ObserverContext<MasterCoprocessorEnvironment> c, List<RegionPlan> plans); @Override boolean preBalanceSwitch(ObserverContext<MasterCoprocessorEnvironment> c,
      boolean newValue); @Override void postBalanceSwitch(ObserverContext<MasterCoprocessorEnvironment> c,
      boolean oldValue, boolean newValue); @Override void preShutdown(ObserverContext<MasterCoprocessorEnvironment> c); @Override void preStopMaster(ObserverContext<MasterCoprocessorEnvironment> c); @Override void postStartMaster(ObserverContext<MasterCoprocessorEnvironment> ctx); @Override void preMasterInitialization(
      ObserverContext<MasterCoprocessorEnvironment> ctx); @Override void preSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void postSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void preCloneSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void postCloneSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void preRestoreSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void postRestoreSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void preDeleteSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot); @Override void postDeleteSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot); @Override void preCreateNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
      NamespaceDescriptor ns); @Override void postCreateNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
      NamespaceDescriptor ns); @Override void preDeleteNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx, String namespace); @Override void postDeleteNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
                                  String namespace); @Override void preModifyNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
      NamespaceDescriptor ns); @Override void postModifyNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
                                  NamespaceDescriptor ns); @Override void preTableFlush(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final TableName tableName); @Override void postTableFlush(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final TableName tableName); @Override void preOpen(ObserverContext<RegionCoprocessorEnvironment> e); @Override void postOpen(ObserverContext<RegionCoprocessorEnvironment> c); @Override void postLogReplay(ObserverContext<RegionCoprocessorEnvironment> c); @Override void preFlush(ObserverContext<RegionCoprocessorEnvironment> e); @Override void preSplit(ObserverContext<RegionCoprocessorEnvironment> e); @Override void preSplit(ObserverContext<RegionCoprocessorEnvironment> e,
      byte[] splitRow); @Override InternalScanner preCompact(ObserverContext<RegionCoprocessorEnvironment> e,
      final Store store, final InternalScanner scanner, final ScanType scanType); @Override void preCompactSelection(final ObserverContext<RegionCoprocessorEnvironment> e,
      final Store store, final List<StoreFile> candidates); @Override void preGetClosestRowBefore(final ObserverContext<RegionCoprocessorEnvironment> c,
      final byte [] row, final byte [] family, final Result result); @Override void preGetOp(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Get get, final List<Cell> result); @Override boolean preExists(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Get get, final boolean exists); @Override void prePut(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Put put, final WALEdit edit, final Durability durability); @Override void postPut(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Put put, final WALEdit edit, final Durability durability); @Override void preDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Delete delete, final WALEdit edit, final Durability durability); @Override void postDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Delete delete, final WALEdit edit, final Durability durability); @Override boolean preCheckAndPut(final ObserverContext<RegionCoprocessorEnvironment> c,
      final byte [] row, final byte [] family, final byte [] qualifier,
      final CompareFilter.CompareOp compareOp,
      final ByteArrayComparable comparator, final Put put,
      final boolean result); @Override boolean preCheckAndDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
      final byte [] row, final byte [] family, final byte [] qualifier,
      final CompareFilter.CompareOp compareOp,
      final ByteArrayComparable comparator, final Delete delete,
      final boolean result); @Override long preIncrementColumnValue(final ObserverContext<RegionCoprocessorEnvironment> c,
      final byte [] row, final byte [] family, final byte [] qualifier,
      final long amount, final boolean writeToWAL); @Override Result preAppend(ObserverContext<RegionCoprocessorEnvironment> c, Append append); @Override Result preIncrement(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Increment increment); @Override Cell postMutationBeforeWAL(ObserverContext<RegionCoprocessorEnvironment> ctx,
      MutationType opType, Mutation mutation, Cell oldCell, Cell newCell); @Override RegionScanner preScannerOpen(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Scan scan, final RegionScanner s); @Override RegionScanner postScannerOpen(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Scan scan, final RegionScanner s); @Override boolean preScannerNext(final ObserverContext<RegionCoprocessorEnvironment> c,
      final InternalScanner s, final List<Result> result,
      final int limit, final boolean hasNext); @Override void preScannerClose(final ObserverContext<RegionCoprocessorEnvironment> c,
      final InternalScanner s); @Override void postScannerClose(final ObserverContext<RegionCoprocessorEnvironment> c,
      final InternalScanner s); @Override void preBulkLoadHFile(ObserverContext<RegionCoprocessorEnvironment> ctx,
      List<Pair<byte[], String>> familyPaths); void prePrepareBulkLoad(RegionCoprocessorEnvironment e); void preCleanupBulkLoad(RegionCoprocessorEnvironment e); @Override Message preEndpointInvocation(ObserverContext<RegionCoprocessorEnvironment> ctx,
      Service service, String methodName, Message request); @Override void postEndpointInvocation(ObserverContext<RegionCoprocessorEnvironment> ctx,
      Service service, String methodName, Message request, Message.Builder responseBuilder); @Override void grant(RpcController controller,
                    AccessControlProtos.GrantRequest request,
                    RpcCallback<AccessControlProtos.GrantResponse> done); @Override void revoke(RpcController controller,
                     AccessControlProtos.RevokeRequest request,
                     RpcCallback<AccessControlProtos.RevokeResponse> done); @Override void getUserPermissions(RpcController controller,
                                 AccessControlProtos.GetUserPermissionsRequest request,
                                 RpcCallback<AccessControlProtos.GetUserPermissionsResponse> done); @Override void checkPermissions(RpcController controller,
                               AccessControlProtos.CheckPermissionsRequest request,
                               RpcCallback<AccessControlProtos.CheckPermissionsResponse> done); @Override Service getService(); @Override void preClose(ObserverContext<RegionCoprocessorEnvironment> e, boolean abortRequested); @Override void preStopRegionServer(
      ObserverContext<RegionServerCoprocessorEnvironment> env); @Override void preGetTableDescriptors(ObserverContext<MasterCoprocessorEnvironment> ctx,
      List<TableName> tableNamesList,
      List<HTableDescriptor> descriptors); @Override void postGetTableDescriptors(ObserverContext<MasterCoprocessorEnvironment> ctx,
      List<HTableDescriptor> descriptors); @Override void preMerge(ObserverContext<RegionServerCoprocessorEnvironment> ctx, HRegion regionA,
      HRegion regionB); @Override void postMerge(ObserverContext<RegionServerCoprocessorEnvironment> c, HRegion regionA,
      HRegion regionB, HRegion mergedRegion); @Override void preMergeCommit(ObserverContext<RegionServerCoprocessorEnvironment> ctx,
      HRegion regionA, HRegion regionB, List<Mutation> metaEntries); @Override void postMergeCommit(ObserverContext<RegionServerCoprocessorEnvironment> ctx,
      HRegion regionA, HRegion regionB, HRegion mergedRegion); @Override void preRollBackMerge(ObserverContext<RegionServerCoprocessorEnvironment> ctx,
      HRegion regionA, HRegion regionB); @Override void postRollBackMerge(ObserverContext<RegionServerCoprocessorEnvironment> ctx,
      HRegion regionA, HRegion regionB); }
AccessController extends BaseRegionObserver implements MasterObserver, RegionServerObserver,
      AccessControlService.Interface, CoprocessorService, EndpointObserver { @Override public void checkPermissions(RpcController controller, AccessControlProtos.CheckPermissionsRequest request, RpcCallback<AccessControlProtos.CheckPermissionsResponse> done) { Permission[] permissions = new Permission[request.getPermissionCount()]; for (int i=0; i < request.getPermissionCount(); i++) { permissions[i] = ProtobufUtil.toPermission(request.getPermission(i)); } AccessControlProtos.CheckPermissionsResponse response = null; try { TableName tableName = regionEnv.getRegion().getTableDesc().getTableName(); for (Permission permission : permissions) { if (permission instanceof TablePermission) { TablePermission tperm = (TablePermission) permission; for (Action action : permission.getActions()) { if (!tperm.getTableName().equals(tableName)) { throw new CoprocessorException(AccessController.class, String.format("This method " + "can only execute at the table specified in TablePermission. " + "Table of the region:%s , requested table:%s", tableName, tperm.getTableName())); } Map<byte[], Set<byte[]>> familyMap = new TreeMap<byte[], Set<byte[]>>(Bytes.BYTES_COMPARATOR); if (tperm.getFamily() != null) { if (tperm.getQualifier() != null) { Set<byte[]> qualifiers = Sets.newTreeSet(Bytes.BYTES_COMPARATOR); qualifiers.add(tperm.getQualifier()); familyMap.put(tperm.getFamily(), qualifiers); } else { familyMap.put(tperm.getFamily(), null); } } requirePermission("checkPermissions", action, regionEnv, familyMap); } } else { for (Action action : permission.getActions()) { requirePermission("checkPermissions", action); } } } response = AccessControlProtos.CheckPermissionsResponse.getDefaultInstance(); } catch (IOException ioe) { ResponseConverter.setControllerException(controller, ioe); } done.run(response); }  HRegion getRegion(); TableAuthManager getAuthManager(); void start(CoprocessorEnvironment env); void stop(CoprocessorEnvironment env); @Override void preCreateTable(ObserverContext<MasterCoprocessorEnvironment> c,
      HTableDescriptor desc, HRegionInfo[] regions); @Override void preCreateTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      HTableDescriptor desc, HRegionInfo[] regions); @Override void postCreateTable(ObserverContext<MasterCoprocessorEnvironment> c,
      HTableDescriptor desc, HRegionInfo[] regions); @Override void postCreateTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      HTableDescriptor desc, HRegionInfo[] regions); @Override void preDeleteTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName); @Override void preDeleteTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postDeleteTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postDeleteTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preTruncateTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName); @Override void postTruncateTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preTruncateTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postTruncateTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preModifyTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName,
      HTableDescriptor htd); @Override void preModifyTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HTableDescriptor htd); @Override void postModifyTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HTableDescriptor htd); @Override void postModifyTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HTableDescriptor htd); @Override void preAddColumn(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName,
      HColumnDescriptor column); @Override void preAddColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor column); @Override void postAddColumn(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor column); @Override void postAddColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor column); @Override void preModifyColumn(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName,
      HColumnDescriptor descriptor); @Override void preModifyColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor descriptor); @Override void postModifyColumn(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor descriptor); @Override void postModifyColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, HColumnDescriptor descriptor); @Override void preDeleteColumn(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName,
      byte[] col); @Override void preDeleteColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, byte[] col); @Override void postDeleteColumn(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, byte[] col); @Override void postDeleteColumnHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName, byte[] col); @Override void preEnableTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName); @Override void preEnableTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postEnableTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postEnableTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preDisableTable(ObserverContext<MasterCoprocessorEnvironment> c, TableName tableName); @Override void preDisableTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postDisableTable(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void postDisableTableHandler(ObserverContext<MasterCoprocessorEnvironment> c,
      TableName tableName); @Override void preMove(ObserverContext<MasterCoprocessorEnvironment> c, HRegionInfo region,
      ServerName srcServer, ServerName destServer); @Override void postMove(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo region, ServerName srcServer, ServerName destServer); @Override void preAssign(ObserverContext<MasterCoprocessorEnvironment> c, HRegionInfo regionInfo); @Override void postAssign(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo regionInfo); @Override void preUnassign(ObserverContext<MasterCoprocessorEnvironment> c, HRegionInfo regionInfo,
      boolean force); @Override void postUnassign(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo regionInfo, boolean force); @Override void preRegionOffline(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo regionInfo); @Override void postRegionOffline(ObserverContext<MasterCoprocessorEnvironment> c,
      HRegionInfo regionInfo); @Override void preBalance(ObserverContext<MasterCoprocessorEnvironment> c); @Override void postBalance(ObserverContext<MasterCoprocessorEnvironment> c, List<RegionPlan> plans); @Override boolean preBalanceSwitch(ObserverContext<MasterCoprocessorEnvironment> c,
      boolean newValue); @Override void postBalanceSwitch(ObserverContext<MasterCoprocessorEnvironment> c,
      boolean oldValue, boolean newValue); @Override void preShutdown(ObserverContext<MasterCoprocessorEnvironment> c); @Override void preStopMaster(ObserverContext<MasterCoprocessorEnvironment> c); @Override void postStartMaster(ObserverContext<MasterCoprocessorEnvironment> ctx); @Override void preMasterInitialization(
      ObserverContext<MasterCoprocessorEnvironment> ctx); @Override void preSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void postSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void preCloneSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void postCloneSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void preRestoreSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void postRestoreSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot, final HTableDescriptor hTableDescriptor); @Override void preDeleteSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot); @Override void postDeleteSnapshot(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final SnapshotDescription snapshot); @Override void preCreateNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
      NamespaceDescriptor ns); @Override void postCreateNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
      NamespaceDescriptor ns); @Override void preDeleteNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx, String namespace); @Override void postDeleteNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
                                  String namespace); @Override void preModifyNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
      NamespaceDescriptor ns); @Override void postModifyNamespace(ObserverContext<MasterCoprocessorEnvironment> ctx,
                                  NamespaceDescriptor ns); @Override void preTableFlush(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final TableName tableName); @Override void postTableFlush(final ObserverContext<MasterCoprocessorEnvironment> ctx,
      final TableName tableName); @Override void preOpen(ObserverContext<RegionCoprocessorEnvironment> e); @Override void postOpen(ObserverContext<RegionCoprocessorEnvironment> c); @Override void postLogReplay(ObserverContext<RegionCoprocessorEnvironment> c); @Override void preFlush(ObserverContext<RegionCoprocessorEnvironment> e); @Override void preSplit(ObserverContext<RegionCoprocessorEnvironment> e); @Override void preSplit(ObserverContext<RegionCoprocessorEnvironment> e,
      byte[] splitRow); @Override InternalScanner preCompact(ObserverContext<RegionCoprocessorEnvironment> e,
      final Store store, final InternalScanner scanner, final ScanType scanType); @Override void preCompactSelection(final ObserverContext<RegionCoprocessorEnvironment> e,
      final Store store, final List<StoreFile> candidates); @Override void preGetClosestRowBefore(final ObserverContext<RegionCoprocessorEnvironment> c,
      final byte [] row, final byte [] family, final Result result); @Override void preGetOp(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Get get, final List<Cell> result); @Override boolean preExists(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Get get, final boolean exists); @Override void prePut(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Put put, final WALEdit edit, final Durability durability); @Override void postPut(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Put put, final WALEdit edit, final Durability durability); @Override void preDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Delete delete, final WALEdit edit, final Durability durability); @Override void postDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Delete delete, final WALEdit edit, final Durability durability); @Override boolean preCheckAndPut(final ObserverContext<RegionCoprocessorEnvironment> c,
      final byte [] row, final byte [] family, final byte [] qualifier,
      final CompareFilter.CompareOp compareOp,
      final ByteArrayComparable comparator, final Put put,
      final boolean result); @Override boolean preCheckAndDelete(final ObserverContext<RegionCoprocessorEnvironment> c,
      final byte [] row, final byte [] family, final byte [] qualifier,
      final CompareFilter.CompareOp compareOp,
      final ByteArrayComparable comparator, final Delete delete,
      final boolean result); @Override long preIncrementColumnValue(final ObserverContext<RegionCoprocessorEnvironment> c,
      final byte [] row, final byte [] family, final byte [] qualifier,
      final long amount, final boolean writeToWAL); @Override Result preAppend(ObserverContext<RegionCoprocessorEnvironment> c, Append append); @Override Result preIncrement(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Increment increment); @Override Cell postMutationBeforeWAL(ObserverContext<RegionCoprocessorEnvironment> ctx,
      MutationType opType, Mutation mutation, Cell oldCell, Cell newCell); @Override RegionScanner preScannerOpen(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Scan scan, final RegionScanner s); @Override RegionScanner postScannerOpen(final ObserverContext<RegionCoprocessorEnvironment> c,
      final Scan scan, final RegionScanner s); @Override boolean preScannerNext(final ObserverContext<RegionCoprocessorEnvironment> c,
      final InternalScanner s, final List<Result> result,
      final int limit, final boolean hasNext); @Override void preScannerClose(final ObserverContext<RegionCoprocessorEnvironment> c,
      final InternalScanner s); @Override void postScannerClose(final ObserverContext<RegionCoprocessorEnvironment> c,
      final InternalScanner s); @Override void preBulkLoadHFile(ObserverContext<RegionCoprocessorEnvironment> ctx,
      List<Pair<byte[], String>> familyPaths); void prePrepareBulkLoad(RegionCoprocessorEnvironment e); void preCleanupBulkLoad(RegionCoprocessorEnvironment e); @Override Message preEndpointInvocation(ObserverContext<RegionCoprocessorEnvironment> ctx,
      Service service, String methodName, Message request); @Override void postEndpointInvocation(ObserverContext<RegionCoprocessorEnvironment> ctx,
      Service service, String methodName, Message request, Message.Builder responseBuilder); @Override void grant(RpcController controller,
                    AccessControlProtos.GrantRequest request,
                    RpcCallback<AccessControlProtos.GrantResponse> done); @Override void revoke(RpcController controller,
                     AccessControlProtos.RevokeRequest request,
                     RpcCallback<AccessControlProtos.RevokeResponse> done); @Override void getUserPermissions(RpcController controller,
                                 AccessControlProtos.GetUserPermissionsRequest request,
                                 RpcCallback<AccessControlProtos.GetUserPermissionsResponse> done); @Override void checkPermissions(RpcController controller,
                               AccessControlProtos.CheckPermissionsRequest request,
                               RpcCallback<AccessControlProtos.CheckPermissionsResponse> done); @Override Service getService(); @Override void preClose(ObserverContext<RegionCoprocessorEnvironment> e, boolean abortRequested); @Override void preStopRegionServer(
      ObserverContext<RegionServerCoprocessorEnvironment> env); @Override void preGetTableDescriptors(ObserverContext<MasterCoprocessorEnvironment> ctx,
      List<TableName> tableNamesList,
      List<HTableDescriptor> descriptors); @Override void postGetTableDescriptors(ObserverContext<MasterCoprocessorEnvironment> ctx,
      List<HTableDescriptor> descriptors); @Override void preMerge(ObserverContext<RegionServerCoprocessorEnvironment> ctx, HRegion regionA,
      HRegion regionB); @Override void postMerge(ObserverContext<RegionServerCoprocessorEnvironment> c, HRegion regionA,
      HRegion regionB, HRegion mergedRegion); @Override void preMergeCommit(ObserverContext<RegionServerCoprocessorEnvironment> ctx,
      HRegion regionA, HRegion regionB, List<Mutation> metaEntries); @Override void postMergeCommit(ObserverContext<RegionServerCoprocessorEnvironment> ctx,
      HRegion regionA, HRegion regionB, HRegion mergedRegion); @Override void preRollBackMerge(ObserverContext<RegionServerCoprocessorEnvironment> ctx,
      HRegion regionA, HRegion regionB); @Override void postRollBackMerge(ObserverContext<RegionServerCoprocessorEnvironment> ctx,
      HRegion regionA, HRegion regionB); static final Log LOG; }