org.apache.hadoop.hbase.security.visibility

类 DefaultVisibilityLabelServiceImpl

java.lang.Object

org.apache.hadoop.hbase.security.visibility.DefaultVisibilityLabelServiceImpl

所有已实现的接口:

org.apache.hadoop.conf.Configurable, VisibilityLabelService

@InterfaceAudience.Private
public class DefaultVisibilityLabelServiceImpl
extends Object
implements VisibilityLabelService

构造器概要

构造器

构造器和说明
DefaultVisibilityLabelServiceImpl()

方法概要

限定符和类型	方法和说明
OperationStatus[]	addLabels(List<byte[]> labels) Adds the set of labels into the system.
protected void	addSystemLabel(Region region, Map<String,Integer> labels, Map<String,List<Integer>> userAuths)
OperationStatus[]	clearAuths(byte[] user, List<byte[]> authLabels) Removes given labels from user's globally authorized list of labels.
List<Tag>	createVisibilityExpTags(String visExpression, boolean withSerializationFormat, boolean checkAuths) Creates tags corresponding to given visibility expression.
byte[]	encodeVisibilityForReplication(List<Tag> tags, Byte serializationFormat) Provides a way to modify the visibility tags of type TagType .VISIBILITY_TAG_TYPE, that are part of the cell created from the WALEdits that are prepared for replication while calling ReplicationEndpoint .replicate().
protected Pair<Map<String,Integer>,Map<String,List<Integer>>>	extractLabelsAndAuths(List<List<Cell>> labelDetails)
org.apache.hadoop.conf.Configuration	getConf()
protected List<List<Cell>>	getExistingLabelsWithAuths()
List<String>	getGroupAuths(String[] groups, boolean systemCall) Retrieve the visibility labels for the groups.
List<String>	getUserAuths(byte[] user, boolean systemCall) Retrieve the visibility labels for the user.
VisibilityExpEvaluator	getVisibilityExpEvaluator(Authorizations authorizations) Creates VisibilityExpEvaluator corresponding to given Authorizations.
boolean	havingSystemAuth(User user) System checks for user auth during admin operations.
void	init(RegionCoprocessorEnvironment e) System calls this after opening of regions.
protected boolean	isReadFromSystemAuthUser()
List<String>	listLabels(String regex) Retrieve the list of visibility labels defined in the system.
boolean	matchVisibility(List<Tag> putVisTags, Byte putTagsFormat, List<Tag> deleteVisTags, Byte deleteTagsFormat) System uses this for deciding whether a Cell can be deleted by matching visibility expression in Delete mutation and the cell in consideration.
OperationStatus[]	setAuths(byte[] user, List<byte[]> authLabels) Sets given labels globally authorized for the user.
void	setConf(org.apache.hadoop.conf.Configuration conf)
protected void	updateZk(boolean labelAddition)

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

构造器详细资料

DefaultVisibilityLabelServiceImpl

public DefaultVisibilityLabelServiceImpl()

方法详细资料

setConf

public void setConf(org.apache.hadoop.conf.Configuration conf)

指定者:

setConf 在接口中 org.apache.hadoop.conf.Configurable

getConf

public org.apache.hadoop.conf.Configuration getConf()

指定者:

getConf 在接口中 org.apache.hadoop.conf.Configurable

init

public void init(RegionCoprocessorEnvironment e)
          throws IOException

从接口复制的说明: VisibilityLabelService

System calls this after opening of regions. Gives a chance for the VisibilityLabelService to so any initialization logic.

指定者:

init 在接口中 VisibilityLabelService

参数:

e - the region coprocessor env

抛出:

IOException

getExistingLabelsWithAuths

protected List<List<Cell>> getExistingLabelsWithAuths()
                                               throws IOException

抛出:

IOException

extractLabelsAndAuths

protected Pair<Map<String,Integer>,Map<String,List<Integer>>> extractLabelsAndAuths(List<List<Cell>> labelDetails)

addSystemLabel

protected void addSystemLabel(Region region,
                              Map<String,Integer> labels,
                              Map<String,List<Integer>> userAuths)
                       throws IOException

抛出:

IOException

addLabels

public OperationStatus[] addLabels(List<byte[]> labels)
                            throws IOException

从接口复制的说明: VisibilityLabelService

Adds the set of labels into the system.

指定者:

addLabels 在接口中 VisibilityLabelService

参数:

labels - Labels to add to the system.

返回:

OperationStatus for each of the label addition

抛出:

IOException

setAuths

public OperationStatus[] setAuths(byte[] user,
                                  List<byte[]> authLabels)
                           throws IOException

从接口复制的说明: VisibilityLabelService

Sets given labels globally authorized for the user.

指定者:

setAuths 在接口中 VisibilityLabelService

参数:

user - The authorizing user

authLabels - Labels which are getting authorized for the user

返回:

OperationStatus for each of the label auth addition

抛出:

IOException

clearAuths

public OperationStatus[] clearAuths(byte[] user,
                                    List<byte[]> authLabels)
                             throws IOException

从接口复制的说明: VisibilityLabelService

Removes given labels from user's globally authorized list of labels.

指定者:

clearAuths 在接口中 VisibilityLabelService

参数:

user - The user whose authorization to be removed

authLabels - Labels which are getting removed from authorization set

返回:

OperationStatus for each of the label auth removal

抛出:

IOException

getUserAuths

public List<String> getUserAuths(byte[] user,
                                 boolean systemCall)
                          throws IOException

从接口复制的说明: VisibilityLabelService

Retrieve the visibility labels for the user.

指定者:

getUserAuths 在接口中 VisibilityLabelService

参数:

user - Name of the user whose authorization to be retrieved

systemCall - Whether a system or user originated call.

返回:

Visibility labels authorized for the given user.

抛出:

IOException

getGroupAuths

public List<String> getGroupAuths(String[] groups,
                                  boolean systemCall)
                           throws IOException

从接口复制的说明: VisibilityLabelService

Retrieve the visibility labels for the groups.

指定者:

getGroupAuths 在接口中 VisibilityLabelService

参数:

groups - Name of the groups whose authorization to be retrieved

systemCall - Whether a system or user originated call.

返回:

Visibility labels authorized for the given group.

抛出:

IOException

listLabels

public List<String> listLabels(String regex)
                        throws IOException

从接口复制的说明: VisibilityLabelService

Retrieve the list of visibility labels defined in the system.

指定者:

listLabels 在接口中 VisibilityLabelService

参数:

regex - The regular expression to filter which labels are returned.

返回:

List of visibility labels

抛出:

IOException

createVisibilityExpTags

public List<Tag> createVisibilityExpTags(String visExpression,
                                         boolean withSerializationFormat,
                                         boolean checkAuths)
                                  throws IOException

从接口复制的说明: VisibilityLabelService

Creates tags corresponding to given visibility expression.
Note: This will be concurrently called from multiple threads and implementation should take care of thread safety.

指定者:

createVisibilityExpTags 在接口中 VisibilityLabelService

参数:

visExpression - The Expression for which corresponding Tags to be created.

withSerializationFormat - specifies whether a tag, denoting the serialization version of the tags, to be added in the list. When this is true make sure to add the serialization format Tag also. The format tag value should be byte type.

checkAuths - denotes whether to check individual labels in visExpression against user's global auth label.

返回:

The list of tags corresponds to the visibility expression. These tags will be stored along with the Cells.

抛出:

IOException

updateZk

protected void updateZk(boolean labelAddition)
                 throws IOException

抛出:

IOException

getVisibilityExpEvaluator

public VisibilityExpEvaluator getVisibilityExpEvaluator(Authorizations authorizations)
                                                 throws IOException

从接口复制的说明: VisibilityLabelService

Creates VisibilityExpEvaluator corresponding to given Authorizations.
Note: This will be concurrently called from multiple threads and implementation should take care of thread safety.

指定者:

getVisibilityExpEvaluator 在接口中 VisibilityLabelService

参数:

authorizations - Authorizations for the read request

返回:

The VisibilityExpEvaluator corresponding to the given set of authorization labels.

抛出:

IOException

isReadFromSystemAuthUser

protected boolean isReadFromSystemAuthUser()
                                    throws IOException

抛出:

IOException

havingSystemAuth

public boolean havingSystemAuth(User user)
                         throws IOException

从接口复制的说明: VisibilityLabelService

System checks for user auth during admin operations. (ie. Label add, set/clear auth). The operation is allowed only for users having system auth. Also during read, if the requesting user has system auth, he can view all the data irrespective of its labels.

指定者:

havingSystemAuth 在接口中 VisibilityLabelService

参数:

user - User for whom system auth check to be done.

返回:

true if the given user is having system/super auth

抛出:

IOException

matchVisibility

public boolean matchVisibility(List<Tag> putVisTags,
                               Byte putTagsFormat,
                               List<Tag> deleteVisTags,
                               Byte deleteTagsFormat)
                        throws IOException

从接口复制的说明: VisibilityLabelService

System uses this for deciding whether a Cell can be deleted by matching visibility expression in Delete mutation and the cell in consideration. Also system passes the serialization format of visibility tags in Put and Delete.
Note: This will be concurrently called from multiple threads and implementation should take care of thread safety.

指定者:

matchVisibility 在接口中 VisibilityLabelService

参数:

putVisTags - The visibility tags present in the Put mutation

putTagsFormat - The serialization format for the Put visibility tags. A null value for this format means the tags are written with unsorted label ordinals

deleteVisTags - - The visibility tags in the delete mutation (the specified Cell Visibility)

deleteTagsFormat - The serialization format for the Delete visibility tags. A null value for this format means the tags are written with unsorted label ordinals

返回:

true if matching tags are found

抛出:

IOException

另请参阅:

VisibilityConstants.SORTED_ORDINAL_SERIALIZATION_FORMAT

encodeVisibilityForReplication

public byte[] encodeVisibilityForReplication(List<Tag> tags,
                                             Byte serializationFormat)
                                      throws IOException

从接口复制的说明: VisibilityLabelService

Provides a way to modify the visibility tags of type TagType .VISIBILITY_TAG_TYPE, that are part of the cell created from the WALEdits that are prepared for replication while calling ReplicationEndpoint .replicate(). VisibilityReplicationEndpoint calls this API to provide an opportunity to modify the visibility tags before replicating.

指定者:

encodeVisibilityForReplication 在接口中 VisibilityLabelService

参数:

tags - the visibility tags associated with the cell

serializationFormat - the serialization format associated with the tag

返回:

the modified visibility expression in the form of byte[]

抛出:

IOException