/*
if column family level checks fail, check for a qualifier level permission
in one of the families. If it is present, then continue with the AccessControlFilter.
*/
RegionCoprocessorEnvironment e = c.getEnvironment();
User user = getActiveUser();
AuthResult authResult = permissionGranted("scannerOpen", user, TablePermission.Action.READ, e,
scan.getFamilyMap());
if (!authResult.isAllowed()) {
if (hasFamilyQualifierPermission(user, TablePermission.Action.READ, e,
scan.getFamilyMap())) {
byte[] table = getTableName(e);
AccessControlFilter filter = new AccessControlFilter(authManager,
user, table);
// wrap any existing filter
if (scan.hasFilter()) {
FilterList wrapper = new FilterList(FilterList.Operator.MUST_PASS_ALL,
Lists.newArrayList(filter, scan.getFilter()));
scan.setFilter(wrapper);
} else {
scan.setFilter(filter);
}
logResult(AuthResult.allow("scannerOpen", "Access allowed with filter", user,
TablePermission.Action.READ, authResult.table));
} else {
// no table/family level perms and no qualifier level perms, reject
logResult(authResult);
throw new AccessDeniedException("Insufficient permissions for user '"+
(user != null ? user.getShortName() : "null")+"' "+
"for scanner open on table " + Bytes.toString(getTableName(e)));
}
} else {
// log success
logResult(authResult);