PrivilegeOperatePersistence { Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { if (roles == null || roles.isEmpty()) { return Collections.emptySet(); } Query query = pm.newQuery(MSentryGMPrivilege.class); QueryParamBuilder paramBuilder = QueryParamBuilder.addRolesFilter(query, null, SentryStore.rolesToRoleNames(roles)); query.setFilter(paramBuilder.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>)query.executeWithMap(paramBuilder.getArguments()); if (mPrivileges.isEmpty()) { return Collections.emptySet(); } Set<PrivilegeObject> privileges = new HashSet<>(mPrivileges.size()); for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } PrivilegeOperatePersistence(Configuration conf); void grantPrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void dropPrivilege(PrivilegeObject privilege,PersistenceManager pm); void renamePrivilege(String component, String service,
      List<? extends Authorizable> oldAuthorizables, List<? extends Authorizable> newAuthorizables,
      String grantorPrincipal, PersistenceManager pm);  }
@Test public void testGrantPrivilegeTwice() throws Exception { String roleName = "r1"; String grantor = ADMIN_USER; sentryStore.createRole(SEARCH, roleName, grantor); PrivilegeObject queryPrivilegeWithOption = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(true) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilegeWithOption, grantor); assertEquals(1,sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName)).size()); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilegeWithOption, grantor); assertEquals(1,sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName)).size()); PrivilegeObject queryPrivilegeWithNoOption = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(false) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilegeWithNoOption, grantor); assertEquals(2,sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName)).size()); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilegeWithNoOption, grantor); assertEquals(2,sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName)).size()); PrivilegeObject queryPrivilegeWithNullGrant = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(null) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilegeWithNullGrant, grantor); assertEquals(3,sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName)).size()); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilegeWithNullGrant, grantor); assertEquals(3,sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName)).size()); }
@Test public void testGrantPrivilegeWithAllPrivilegeExist() throws Exception { String roleName = "r1"; String grantor = ADMIN_USER; PrivilegeObject allPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.ALL) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .build(); sentryStore.createRole(SEARCH, roleName, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, allPrivilege, grantor); assertEquals(Sets.newHashSet(allPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); PrivilegeObject queryPrivilege = new Builder(allPrivilege) .setAction(SolrConstants.QUERY) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilege, grantor); assertEquals(Sets.newHashSet(allPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); }
@Test public void testGrantALLPrivilegeWithOtherPrivilegesExist() throws Exception { String roleName1 = "r1"; String roleName2 = "r2"; String grantor = ADMIN_USER; PrivilegeObject queryPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .build(); PrivilegeObject updatePrivilege = new Builder(queryPrivilege) .setAction(SolrConstants.UPDATE) .build(); sentryStore.createRole(SEARCH, roleName1, grantor); sentryStore.createRole(SEARCH, roleName2, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, updatePrivilege,grantor); assertEquals(Sets.newHashSet(queryPrivilege, updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName1))); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, queryPrivilege, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, updatePrivilege,grantor); assertEquals(Sets.newHashSet(queryPrivilege, updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); PrivilegeObject allPrivilege = new Builder(queryPrivilege) .setAction(SolrConstants.ALL) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, allPrivilege, grantor); assertEquals(Sets.newHashSet(allPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName1))); assertEquals(Sets.newHashSet(queryPrivilege, updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); }
@Test public void testGrantRevokeCheckWithGrantOption() throws Exception { addGroupsToUser(GRANT_OPTION_USER, GRANT_OPTION_GROUP); addGroupsToUser(NO_GRANT_OPTION_USER, NO_GRANT_OPTION_GROUP); writePolicyFile(); String roleName1 = "r1"; String roleName2 = "r2"; String grantor = "g1"; sentryStore.createRole(SEARCH, roleName1, grantor); sentryStore.createRole(SEARCH, roleName2, grantor); PrivilegeObject queryPrivilege1 = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(true) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege1, ADMIN_USER); assertEquals(Sets.newHashSet(queryPrivilege1), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName1))); PrivilegeObject queryPrivilege2 = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(false).build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, queryPrivilege2, ADMIN_USER); assertEquals(Sets.newHashSet(queryPrivilege2), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); sentryStore.alterRoleAddGroups(SEARCH, roleName1, Sets.newHashSet(GRANT_OPTION_GROUP), grantor); sentryStore.alterRoleAddGroups(SEARCH, roleName2, Sets.newHashSet(NO_GRANT_OPTION_GROUP), grantor); String roleName3 = "r3"; sentryStore.createRole(SEARCH, roleName3, grantor); try{ sentryStore.alterRoleGrantPrivilege(SEARCH, roleName3, queryPrivilege1, GRANT_OPTION_USER); } catch (SentryGrantDeniedException e) { fail("SentryGrantDeniedException shouldn't have been thrown"); } try{ sentryStore.alterRoleRevokePrivilege(SEARCH, roleName3, queryPrivilege1, GRANT_OPTION_USER); } catch (SentryGrantDeniedException e) { fail("SentryGrantDeniedException shouldn't have been thrown"); } try { sentryStore.alterRoleGrantPrivilege(SEARCH, roleName3, queryPrivilege2, NO_GRANT_OPTION_USER); fail("SentryGrantDeniedException should have been thrown"); } catch (SentryGrantDeniedException e) { } try { sentryStore.alterRoleGrantPrivilege(SEARCH, roleName3, queryPrivilege2, NO_GRANT_OPTION_USER); fail("SentryGrantDeniedException should have been thrown"); } catch (SentryGrantDeniedException e) { } }
@Test public void testGrantWithGrantOption() throws Exception { addGroupsToUser(GRANT_OPTION_USER, GRANT_OPTION_GROUP); addGroupsToUser(NO_GRANT_OPTION_USER, NO_GRANT_OPTION_GROUP); writePolicyFile(); String roleName1 = "r1"; String grantor = "g1"; sentryStore.createRole(SEARCH, roleName1, grantor); PrivilegeObject queryPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(true) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege,ADMIN_USER); sentryStore.alterRoleAddGroups(SEARCH, roleName1, Sets.newHashSet(GRANT_OPTION_GROUP), grantor); String roleName2 = "r2"; sentryStore.createRole(SEARCH, roleName2, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, queryPrivilege, GRANT_OPTION_USER); assertEquals(Sets.newHashSet(queryPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); }
@Test public void testRevokeAllPrivilege() throws Exception { String roleName = "r1"; String grantor = ADMIN_USER; PrivilegeObject queryPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME),new Field(FIELD_NAME))) .build(); PrivilegeObject updatePrivilege = new Builder(queryPrivilege) .setAction(SolrConstants.UPDATE) .build(); sentryStore.createRole(SEARCH, roleName, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilege, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, updatePrivilege, grantor); assertEquals(Sets.newHashSet(queryPrivilege,updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); PrivilegeObject allPrivilege = new Builder(queryPrivilege) .setAction(SolrConstants.ALL) .build(); sentryStore.alterRoleRevokePrivilege(SEARCH, roleName, allPrivilege, grantor); assertEquals(Sets.newHashSet(), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); }
@Test public void testRevokePrivilegeWithAllPrivilegeExist() throws Exception { String roleName = "r1"; String grantor = ADMIN_USER; PrivilegeObject allPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.ALL) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME), new Field(FIELD_NAME))) .build(); sentryStore.createRole(SEARCH, roleName, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, allPrivilege, grantor); assertEquals(Sets.newHashSet(allPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); PrivilegeObject updatePrivilege = new Builder(allPrivilege) .setAction(SolrConstants.UPDATE) .build(); PrivilegeObject queryPrivilege = new Builder(allPrivilege) .setAction(SolrConstants.QUERY) .build(); sentryStore.alterRoleRevokePrivilege(SEARCH, roleName, updatePrivilege, grantor); assertEquals(Sets.newHashSet(queryPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); }
@Test public void testRevokePrivilegeWithAllPrivilegesGranted() throws Exception { String roleName = "r1"; String grantor = ADMIN_USER; PrivilegeObject allPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.ALL) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME), new Field(FIELD_NAME))) .build(); PrivilegeObject updatePrivilege = new Builder(allPrivilege) .setAction(SolrConstants.UPDATE) .build(); PrivilegeObject queryPrivilege = new Builder(allPrivilege) .setAction(SolrConstants.QUERY) .build(); sentryStore.createRole(SEARCH, roleName, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilege, grantor); assertEquals(Sets.newHashSet(queryPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, updatePrivilege, grantor); assertEquals(Sets.newHashSet(queryPrivilege, updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, allPrivilege, grantor); assertEquals(Sets.newHashSet(allPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); sentryStore.alterRoleRevokePrivilege(SEARCH, roleName, updatePrivilege, grantor); assertEquals(Sets.newHashSet(queryPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); }
@Test public void testRevokeParentPrivilegeWithChildsExist() throws Exception { String roleName = "r1"; String grantor = ADMIN_USER; PrivilegeObject updatePrivilege1 = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.UPDATE) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME), new Field(FIELD_NAME))) .build(); PrivilegeObject queryPrivilege1 = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME),new Field(FIELD_NAME))) .build(); PrivilegeObject queryPrivilege2 = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(NOT_COLLECTION_NAME))) .build(); sentryStore.createRole(SEARCH, roleName, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, updatePrivilege1, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilege1, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilege2, grantor); PrivilegeObject allPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.ALL) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .build(); sentryStore.alterRoleRevokePrivilege(SEARCH, roleName, allPrivilege, grantor); assertEquals(Sets.newHashSet(queryPrivilege2), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); }
@Test public void testRevokeWithGrantOption() throws Exception { addGroupsToUser(GRANT_OPTION_USER, GRANT_OPTION_GROUP); addGroupsToUser(NO_GRANT_OPTION_USER, NO_GRANT_OPTION_GROUP); writePolicyFile(); String roleName1 = "r1"; String grantor = "g1"; sentryStore.createRole(SEARCH, roleName1, grantor); PrivilegeObject queryPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(true) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege, ADMIN_USER); assertEquals(Sets.newHashSet(queryPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName1))); sentryStore.alterRoleAddGroups(SEARCH, roleName1, Sets.newHashSet(GRANT_OPTION_GROUP), grantor); String roleName2 = "r2"; sentryStore.createRole(SEARCH, roleName2, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, queryPrivilege, GRANT_OPTION_USER); assertEquals(Sets.newHashSet(queryPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); sentryStore.alterRoleRevokePrivilege(SEARCH, roleName2, queryPrivilege, GRANT_OPTION_USER); assertEquals(Sets.newHashSet(), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); }
@Test public void testGetPrivilegesByRoleName() throws Exception { String roleName1 = "r1"; String roleName2 = "r2"; String grantor = "g1"; PrivilegeObject queryPrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .build(); sentryStore.createRole(SEARCH, roleName1, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege, ADMIN_USER); PrivilegeObject updatePrivilege = new Builder() .setComponent(SEARCH) .setAction(SolrConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .build(); sentryStore.createRole(SEARCH, roleName2, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, updatePrivilege, ADMIN_USER); assertEquals(Sets.newHashSet(queryPrivilege,updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName1,roleName2))); }