My HBase cluster uses basic/simple authentication (no Kerberos). All my test cases below are done on one node. On that node, a user "testuser" has it primary group as "developer". By hbase superuser hbase(main):005:0> grant '@developer','RWXCA','@test' Took 0.1722 seconds By testuser hbase(main):007:0> list test:table1 1 row(s) Took 0.0500 seconds hbase(main):014:0> scan 'test:table1' ROW COLUMN+CELL ERROR: org.apache.hadoop.hbase.security.AccessDeniedException: Insufficient permissions for user 'testuser' (table=test:table1, action=READ) Why does testuser, who has the full permission on the "test" namespace, get the permission error? In addition, I feel that, when I run the grant command grant '@developer','RWXCA','@test' The permission is somehow granted at the namespace level, but not on every table inside the namespace "test". To prove that, as the "testuser", I can create a new table 'test:table2', add data to that new table, and run a scan on that new table successfully. But still I cannot run the scan on another table in the "test" namespace. I understand this is a strange case. I wonder anyone else experienced the same problem. Right now my workround is to grant the permission to "testuser" directly. This way testuser can scan the table without permission error.
... View more
