final Get get, final List<KeyValue> result) throws IOException {
/*
if column family level checks fail, check for a qualifier level permission
in one of the families. If it is present, then continue with the AccessControlFilter.
*/
RegionCoprocessorEnvironment e = c.getEnvironment();
User requestUser = getActiveUser();
AuthResult authResult = permissionGranted("get", requestUser,
TablePermission.Action.READ, e, get.getFamilyMap());
if (!authResult.isAllowed()) {
if (hasFamilyQualifierPermission(requestUser,
TablePermission.Action.READ, e, get.getFamilyMap())) {
byte[] table = getTableName(e);
AccessControlFilter filter = new AccessControlFilter(authManager,
requestUser, table);
// wrap any existing filter
if (get.getFilter() != null) {
FilterList wrapper = new FilterList(FilterList.Operator.MUST_PASS_ALL,
Lists.newArrayList(filter, get.getFilter()));
get.setFilter(wrapper);
} else {
get.setFilter(filter);
}
logResult(AuthResult.allow("get", "Access allowed with filter", requestUser,
TablePermission.Action.READ, authResult.table));
} else {
logResult(authResult);
throw new AccessDeniedException("Insufficient permissions (table=" +
e.getRegion().getTableDesc().getNameAsString() + ", action=READ)");
}
} else {
// log auth success
logResult(authResult);
}