Skip to content

Commit e212409

Browse files
committed
docs: Document reduced API call
1 parent 3838c06 commit e212409

File tree

1 file changed

+39
-2
lines changed

1 file changed

+39
-2
lines changed

README.md

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,47 @@ The Stackable HDFS already takes care of this, you don't need to do anything in
3131

3232
### API
3333

34-
For every action a request similar to the following is sent to OPA:
34+
By default for every HDFS action a request similar to the following is sent to OPA:
35+
36+
37+
```json
38+
{
39+
"input": {
40+
"fsOwner": "nn",
41+
"supergroup": "supergroup",
42+
"callerUgi": {
43+
"realUser": null,
44+
"userName": "alice/[email protected]",
45+
"shortUserName": "alice",
46+
"primaryGroup": "developers",
47+
"groups": [
48+
"developers"
49+
],
50+
"authenticationMethod": "KERBEROS",
51+
"realAuthenticationMethod": "KERBEROS"
52+
},
53+
"snapshotId": 2147483646,
54+
"path": "/developers-ro/hosts._COPYING_",
55+
"ancestorIndex": 1,
56+
"doCheckOwner": false,
57+
"ignoreEmptyDir": false,
58+
"operationName": "getfileinfo",
59+
"callerContext": {
60+
"context": "CLI",
61+
"signature": null
62+
}
63+
}
64+
}
65+
```
66+
67+
The contained details should be sufficient for most use-cases.
68+
However, if you need access to all the provided information from the `INodeAttributeProvider.AccessControlEnforcer` interface, you can instruct hdfs-utils to send all fields by setting `hadoop.security.authorization.opa.extended-requests` to `true`.
69+
However, please note that this results in very big JSON objects being send from HDFS to OPA, so please keep an eye on performance degradations.
70+
71+
The following example provides an extend request sending all available fields:
3572

3673
<details>
37-
<summary>Example request</summary>
74+
<summary>Example extended request</summary>
3875

3976
```json
4077
{

0 commit comments

Comments
 (0)