Modified VisibilityFilter to handle multiple Authorizations objects#6402
Modified VisibilityFilter to handle multiple Authorizations objects#6402dlmarion wants to merge 5 commits into
Conversation
Accumulo Access provides an AccessEvaluator that accepts a Collection of Sets of Strings (effectively Collection<Authorizations>). The existing user VisibilityFilter only accepts a single Authorizations object. This new visibility filter accepts a set of Authorizations in a single filter.
dlmarion
changed the title
| io.addNamedOption(AUTHS, | ||
| "the serialized set of authorizations to filter against (default: empty" | ||
| + " string, accepts only entries visible by all)"); |
There was a problem hiding this comment.
Can't remove this option. The configuration parameter is the main API for this class. Removing or renaming it breaks it.
There was a problem hiding this comment.
Ok, I can add it back. I didn't consider the case where someone has this configured on a table prior to a 4.0 upgrade.
| io.addNamedOption(NUM_AUTHS, | ||
| "The number of serialized authorizations to filter against (default 0)"); | ||
| io.addUnnamedOption(AUTH_PREFIX | ||
| + "N, where the value is a serialized set of authorizations. N must be between zero and NUM_AUTHS."); |
There was a problem hiding this comment.
I'm not sure these descriptions really communicate how these are used. Is the idea that you specify some config like:
numAuths = 3
auth_0 = a,b,c
auth_1 = c,b,d
auth_2 = a,c,z
And then it does something like:
if (entry.evaluateUsing(auth_0) && entry..evaluateUsing(auth_1) && entry..evaluateUsing(auth_2)) {
return entry;
}
Is the idea to replace multiple executions of the iterator with a single one?
Instead, I think it might make sense to have a config that preserves the existing behavior, and extends the existing config:
auths = a,b,c;c,b,d;a,c,z
This is simpler, and backwards compatible. The description can be extended to say: "if multiple serialized sets are configured, separated by semi-colons, then entries are accepted only if they would be accepted by each of the sets independently"
There was a problem hiding this comment.
I'm not sure these descriptions really communicate how these are used. Is the idea that you specify some config like:
numAuths = 3 auth_0 = a,b,c auth_1 = c,b,d auth_2 = a,c,z
Yes
And then it does something like:
if (entry.evaluateUsing(auth_0) && entry..evaluateUsing(auth_1) && entry..evaluateUsing(auth_2)) { return entry; }Is the idea to replace multiple executions of the iterator with a single one?
Yes
Instead, I think it might make sense to have a config that preserves the existing behavior, and extends the existing config:
auths = a,b,c;c,b,d;a,c,zThis is simpler, and backwards compatible. The description can be extended to say: "if multiple serialized sets are configured, separated by semi-colons, then entries are accepted only if they would be accepted by each of the sets independently"
I don't think we should do this. The semi-colon can be used in a quoted authorization.
There was a problem hiding this comment.
I changed the options and serialization in 5c6165b, take a look when you can.
2 participants
Accumulo Access provides an AccessEvaluator
that accepts a Collection of Sets of Strings (effectively
Collection<Authorizations>). Modified the existing userVisibilityFilter to accept a set of Authorizations and
use the new AccessEvaluator.