SentryPolicyStoreProcessor implements SentryPolicyService.Iface { @Override public TListSentryPrivilegesResponse list_sentry_privileges_by_user( TListSentryPrivilegesRequest request) throws TException { final Timer.Context timerContext = sentryMetrics.listPrivilegesByUserTimer.time(); TListSentryPrivilegesResponse response = new TListSentryPrivilegesResponse(); Set<TSentryPrivilege> privilegeSet = new HashSet<TSentryPrivilege>(); String subject = request.getRequestorUserName(); TSentryResponseStatus status = checkRequiredParameter(request.getPrincipalName(), "principalName parameter must not be null"); if (status != null) { response.setStatus(status); return response; } String userName = request.getPrincipalName().trim(); try { validateClientVersion(request.getProtocol_version()); Set<String> groups = getRequestorGroups(subject); Boolean admin = inAdminGroups(groups); if(!admin && !userName.equalsIgnoreCase(subject)) { throw new SentryAccessDeniedException("Access denied to " + subject); } if (request.isSetAuthorizableHierarchy()) { TSentryAuthorizable authorizableHierarchy = request.getAuthorizableHierarchy(); privilegeSet = sentryStore.getTSentryPrivileges(SentryPrincipalType.USER, Sets.newHashSet(userName), authorizableHierarchy); } else { privilegeSet = sentryStore.getAllTSentryPrivilegesByUserName(userName); } response.setPrivileges(privilegeSet); response.setStatus(Status.OK()); } catch (SentryNoSuchObjectException e) { response.setPrivileges(privilegeSet); String msg = "Privilege: " + request + " couldn't be retrieved."; LOGGER.error(msg, e); response.setStatus(Status.NoSuchObject(msg, e)); } catch (SentryAccessDeniedException e) { LOGGER.error(e.getMessage(), e); response.setStatus(Status.AccessDenied(e.getMessage(), e)); } catch (SentryGroupNotFoundException e) { LOGGER.error(e.getMessage(), e); response.setStatus(Status.AccessDenied(e.getMessage(), e)); } catch (SentryThriftAPIMismatchException e) { LOGGER.error(e.getMessage(), e); response.setStatus(Status.THRIFT_VERSION_MISMATCH(e.getMessage(), e)); } catch (Exception e) { String msg = "Unknown error for request: " + request + ", message: " + e.getMessage(); LOGGER.error(msg, e); response.setStatus(Status.RuntimeError(msg, e)); } finally { timerContext.stop(); } return response; } SentryPolicyStoreProcessor(String name,
        Configuration conf, SentryStoreInterface store); void stop(); void registerPlugin(SentryPolicyStorePlugin plugin); @VisibleForTesting Configuration getSentryStoreConf(); @Override TIsSentryAdminResponse is_sentry_admin(TIsSentryAdminRequest request); @Override TCreateSentryRoleResponse create_sentry_role(
    TCreateSentryRoleRequest request); @Override TAlterSentryRoleGrantPrivilegeResponse alter_sentry_role_grant_privilege(TAlterSentryRoleGrantPrivilegeRequest request); @Override TAlterSentryRoleRevokePrivilegeResponse alter_sentry_role_revoke_privilege(TAlterSentryRoleRevokePrivilegeRequest request); @Override TDropSentryRoleResponse drop_sentry_role(
    TDropSentryRoleRequest request); @Override TAlterSentryRoleAddGroupsResponse alter_sentry_role_add_groups(
    TAlterSentryRoleAddGroupsRequest request); @Override TAlterSentryRoleAddUsersResponse alter_sentry_role_add_users(
      TAlterSentryRoleAddUsersRequest request); @Override TAlterSentryRoleDeleteUsersResponse alter_sentry_role_delete_users(
      TAlterSentryRoleDeleteUsersRequest request); @Override TAlterSentryRoleDeleteGroupsResponse alter_sentry_role_delete_groups(
    TAlterSentryRoleDeleteGroupsRequest request); @Override TListSentryRolesResponse list_sentry_roles_by_group(
    TListSentryRolesRequest request); TListSentryRolesResponse list_sentry_roles_by_user(TListSentryRolesForUserRequest request); @Override TListSentryPrivilegesResponse list_sentry_privileges_by_role(
      TListSentryPrivilegesRequest request); @Override TListSentryPrivilegesResponse list_sentry_privileges_by_user(
    TListSentryPrivilegesRequest request); @Override TListSentryPrivilegesResponse list_sentry_privileges_by_user_and_itsgroups(
          TListSentryPrivilegesRequest request); @Override TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(
      TListSentryPrivilegesForProviderRequest request); static Set<String> getGroupsFromUserName(Configuration conf,
      String userName); @Override TDropPrivilegesResponse drop_sentry_privilege(
      TDropPrivilegesRequest request); @Override TRenamePrivilegesResponse rename_sentry_privilege(
      TRenamePrivilegesRequest request); @Override TListSentryPrivilegesByAuthResponse list_sentry_privileges_by_authorizable(
      TListSentryPrivilegesByAuthRequest request); @Override TListSentryPrivilegesByAuthUserResponse list_sentry_privileges_by_authorizable_and_user(
      TListSentryPrivilegesByAuthUserRequest request); @Override TSentryConfigValueResponse get_sentry_config_value(
          TSentryConfigValueRequest request); @Override @SuppressWarnings("PMD.AvoidBranchingStatementAsLastInLoop") TSentryExportMappingDataResponse export_sentry_mapping_data(
      TSentryExportMappingDataRequest request); @Override TSentryImportMappingDataResponse import_sentry_mapping_data(
      TSentryImportMappingDataRequest request); @Override TSentrySyncIDResponse sentry_sync_notifications(TSentrySyncIDRequest request); @Override TSentryHmsEventNotificationResponse sentry_notify_hms_event(TSentryHmsEventNotification request); @Override TSentryPrivilegesResponse list_roles_privileges(TSentryPrivilegesRequest request); @Override TSentryPrivilegesResponse list_users_privileges(TSentryPrivilegesRequest request);  }
@Test public void testListPrivilegesByUserName() throws Exception { MockGroupMappingService.addUserGroupMapping("admin", Sets.newHashSet("admin")); Configuration conf = new Configuration(); conf.set(ServerConfig.SENTRY_STORE_GROUP_MAPPING, "org.apache.sentry.api.service.thrift.MockGroupMappingService"); conf.set(ServerConfig.ADMIN_GROUPS, "admin"); SentryPolicyStoreProcessor policyStoreProcessor = new SentryPolicyStoreProcessor(ApiConstants.SentryPolicyServiceConstants.SENTRY_POLICY_SERVICE_NAME, conf, sentryStore); TListSentryPrivilegesResponse returnedResp; TListSentryPrivilegesResponse expectedResp; returnedResp = policyStoreProcessor.list_sentry_privileges_by_user(newPrivilegesRequest("admin", null, null)); expectedResp = new TListSentryPrivilegesResponse(); expectedResp.setStatus(Status.InvalidInput("principalName parameter must not be null", new SentryInvalidInputException("principalName parameter must not be null"))); Assert.assertEquals(expectedResp.getStatus().getValue(), returnedResp.getStatus().getValue()); Set<TSentryPrivilege> user1Privileges = Sets.newHashSet( newSentryPrivilege("database", "db1", "t1", "*"), newSentryPrivilege("database", "db1", "t2", "*")); Mockito.when(sentryStore.getAllTSentryPrivilegesByUserName("user1")).thenReturn(user1Privileges); returnedResp = policyStoreProcessor.list_sentry_privileges_by_user(newPrivilegesRequest("admin", "user1", null)); Assert.assertEquals(2, returnedResp.getPrivileges().size()); Assert.assertEquals(Status.OK(), returnedResp.getStatus()); assertTrue("User should have ALL privileges in db1.t1", returnedResp.getPrivileges().contains(newSentryPrivilege("database", "db1", "t1", "*"))); assertTrue("User should have ALL privileges in db1.t2", returnedResp.getPrivileges().contains(newSentryPrivilege("database", "db1", "t2", "*"))); returnedResp = policyStoreProcessor.list_sentry_privileges_by_user(newPrivilegesRequest("user1", "user1", null)); Assert.assertEquals(2, returnedResp.getPrivileges().size()); Assert.assertEquals(Status.OK(), returnedResp.getStatus()); assertTrue("User should have ALL privileges in db1.t1", returnedResp.getPrivileges().contains(newSentryPrivilege("database", "db1", "t1", "*"))); assertTrue("User should have ALL privileges in db1.t2", returnedResp.getPrivileges().contains(newSentryPrivilege("database", "db1", "t2", "*"))); returnedResp = policyStoreProcessor.list_sentry_privileges_by_user(newPrivilegesRequest("user2", "user1", null)); Assert.assertEquals(Status.ACCESS_DENIED.getCode(), returnedResp.getStatus().getValue()); assertNull(returnedResp.getPrivileges()); TSentryAuthorizable authorizable = new TSentryAuthorizable(); authorizable.setServer("server1"); authorizable.setDb("db1"); authorizable.setTable("t1"); user1Privileges = Sets.newHashSet( newSentryPrivilege("database", "db1", "t1", "*")); Mockito.when(sentryStore.getTSentryPrivileges(SentryPrincipalType.USER,Sets.newHashSet("user1"), authorizable)).thenReturn(user1Privileges); returnedResp = policyStoreProcessor.list_sentry_privileges_by_user(newPrivilegesRequest("user1", "user1", authorizable)); Assert.assertEquals(1, returnedResp.getPrivileges().size()); Assert.assertEquals(Status.OK(), returnedResp.getStatus()); assertTrue("User should have ALL privileges in db1.t1", returnedResp.getPrivileges().contains(newSentryPrivilege("database", "db1", "t1", "*"))); }