SentryPolicyStoreProcessor implements SentryPolicyService.Iface { @Override public TAlterSentryRoleGrantPrivilegeResponse alter_sentry_role_grant_privilege (TAlterSentryRoleGrantPrivilegeRequest request) throws TException { final Timer.Context timerContext = sentryMetrics.grantTimer.time(); TAlterSentryRoleGrantPrivilegeResponse response = new TAlterSentryRoleGrantPrivilegeResponse(); try { validateClientVersion(request.getProtocol_version()); if ( !(request.isSetPrivileges()^request.isSetPrivilege()) ) { throw new SentryUserException("SENTRY API version is not right!"); } if (request.isSetPrivilege()) { request.setPrivileges(Sets.newHashSet(request.getPrivilege())); } SentryServiceUtil.checkDbExplicitGrantsPermitted(conf, request.getPrivileges()); checkGrantOptionPrivileges(request.getRequestorUserName(), request.getPrivileges()); Preconditions.checkState(sentryPlugins.size() <= 1); Map<TSentryPrivilege, Update> privilegesUpdateMap = new HashMap<>(); for (SentryPolicyStorePlugin plugin : sentryPlugins) { plugin.onAlterSentryRoleGrantPrivilege(request.getRoleName(), request.getPrivileges(), privilegesUpdateMap); } if (!privilegesUpdateMap.isEmpty()) { sentryStore.alterSentryRoleGrantPrivileges(request.getRoleName(), request.getPrivileges(), privilegesUpdateMap); } else { sentryStore.alterSentryRoleGrantPrivileges(request.getRoleName(), request.getPrivileges()); } GrantPrivilegeRequestValidator.validate(request); response.setStatus(Status.OK()); response.setPrivileges(request.getPrivileges()); if (response.isSetPrivileges() && response.getPrivileges().size() == 1) { response.setPrivilege(response.getPrivileges().iterator().next()); } notificationHandlerInvoker.alter_sentry_role_grant_privilege(request, response); } catch (SentryNoSuchObjectException e) { String msg = "Role: " + request.getRoleName() + " doesn't exist"; LOGGER.error(msg, e); response.setStatus(Status.NoSuchObject(msg, e)); } catch (SentryInvalidInputException e) { LOGGER.error(e.getMessage(), e); response.setStatus(Status.InvalidInput(e.getMessage(), e)); } catch (SentryAccessDeniedException e) { LOGGER.error(e.getMessage(), e); response.setStatus(Status.AccessDenied(e.getMessage(), e)); } catch (SentryGroupNotFoundException e) { LOGGER.error(e.getMessage(), e); response.setStatus(Status.AccessDenied(e.getMessage(), e)); } catch (SentryThriftAPIMismatchException e) { LOGGER.error(e.getMessage(), e); response.setStatus(Status.THRIFT_VERSION_MISMATCH(e.getMessage(), e)); } catch (Exception e) { String msg = "Unknown error for request: " + request + ", message: " + e.getMessage(); LOGGER.error(msg, e); response.setStatus(Status.RuntimeError(msg, e)); } finally { timerContext.stop(); } audit.onGrantRolePrivilege(request, response); return response; } SentryPolicyStoreProcessor(String name,
        Configuration conf, SentryStoreInterface store); void stop(); void registerPlugin(SentryPolicyStorePlugin plugin); @VisibleForTesting Configuration getSentryStoreConf(); @Override TIsSentryAdminResponse is_sentry_admin(TIsSentryAdminRequest request); @Override TCreateSentryRoleResponse create_sentry_role(
    TCreateSentryRoleRequest request); @Override TAlterSentryRoleGrantPrivilegeResponse alter_sentry_role_grant_privilege(TAlterSentryRoleGrantPrivilegeRequest request); @Override TAlterSentryRoleRevokePrivilegeResponse alter_sentry_role_revoke_privilege(TAlterSentryRoleRevokePrivilegeRequest request); @Override TDropSentryRoleResponse drop_sentry_role(
    TDropSentryRoleRequest request); @Override TAlterSentryRoleAddGroupsResponse alter_sentry_role_add_groups(
    TAlterSentryRoleAddGroupsRequest request); @Override TAlterSentryRoleAddUsersResponse alter_sentry_role_add_users(
      TAlterSentryRoleAddUsersRequest request); @Override TAlterSentryRoleDeleteUsersResponse alter_sentry_role_delete_users(
      TAlterSentryRoleDeleteUsersRequest request); @Override TAlterSentryRoleDeleteGroupsResponse alter_sentry_role_delete_groups(
    TAlterSentryRoleDeleteGroupsRequest request); @Override TListSentryRolesResponse list_sentry_roles_by_group(
    TListSentryRolesRequest request); TListSentryRolesResponse list_sentry_roles_by_user(TListSentryRolesForUserRequest request); @Override TListSentryPrivilegesResponse list_sentry_privileges_by_role(
      TListSentryPrivilegesRequest request); @Override TListSentryPrivilegesResponse list_sentry_privileges_by_user(
    TListSentryPrivilegesRequest request); @Override TListSentryPrivilegesResponse list_sentry_privileges_by_user_and_itsgroups(
          TListSentryPrivilegesRequest request); @Override TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(
      TListSentryPrivilegesForProviderRequest request); static Set<String> getGroupsFromUserName(Configuration conf,
      String userName); @Override TDropPrivilegesResponse drop_sentry_privilege(
      TDropPrivilegesRequest request); @Override TRenamePrivilegesResponse rename_sentry_privilege(
      TRenamePrivilegesRequest request); @Override TListSentryPrivilegesByAuthResponse list_sentry_privileges_by_authorizable(
      TListSentryPrivilegesByAuthRequest request); @Override TListSentryPrivilegesByAuthUserResponse list_sentry_privileges_by_authorizable_and_user(
      TListSentryPrivilegesByAuthUserRequest request); @Override TSentryConfigValueResponse get_sentry_config_value(
          TSentryConfigValueRequest request); @Override @SuppressWarnings("PMD.AvoidBranchingStatementAsLastInLoop") TSentryExportMappingDataResponse export_sentry_mapping_data(
      TSentryExportMappingDataRequest request); @Override TSentryImportMappingDataResponse import_sentry_mapping_data(
      TSentryImportMappingDataRequest request); @Override TSentrySyncIDResponse sentry_sync_notifications(TSentrySyncIDRequest request); @Override TSentryHmsEventNotificationResponse sentry_notify_hms_event(TSentryHmsEventNotification request); @Override TSentryPrivilegesResponse list_roles_privileges(TSentryPrivilegesRequest request); @Override TSentryPrivilegesResponse list_users_privileges(TSentryPrivilegesRequest request);  }
@Test public void testGrantNotPermittedPrivilegesThrowsException() throws TException { MockGroupMappingService.addUserGroupMapping("admin", Sets.newHashSet("admin")); Configuration conf = new Configuration(); conf.set(ServerConfig.SENTRY_STORE_GROUP_MAPPING, MockGroupMappingService.class.getName()); conf.set(ServerConfig.ADMIN_GROUPS, "admin"); conf.set(ServerConfig.SENTRY_DB_EXPLICIT_GRANTS_PERMITTED, "ALL,SELECT,INSERT,CREATE"); SentryPolicyStoreProcessor policyStoreProcessor = null; try { policyStoreProcessor = new SentryPolicyStoreProcessor(ApiConstants.SentryPolicyServiceConstants.SENTRY_POLICY_SERVICE_NAME, conf, sentryStore); } catch (Exception e) { Assert.fail("SentryPolicyStoreProcessor constructor should not throw an exception."); } TAlterSentryRoleGrantPrivilegeResponse response = null; TAlterSentryRoleGrantPrivilegeRequest request = new TAlterSentryRoleGrantPrivilegeRequest(ThriftConstants.TSENTRY_SERVICE_VERSION_CURRENT, "admin", "role1"); request.setPrivileges(Sets.newHashSet(newSentryPrivilege("SERVER", "", "", "ALTER"))); response = policyStoreProcessor.alter_sentry_role_grant_privilege(request); Assert.assertEquals("Grant ALTER should not be permitted.", Status.ACCESS_DENIED.getCode(), response.getStatus().getValue()); request.setPrivileges(Sets.newHashSet(newSentryPrivilege("SERVER", "", "", "SELECT"))); response = policyStoreProcessor.alter_sentry_role_grant_privilege(request); Assert.assertEquals("Grant SELECT should be permitted.", Status.OK.getCode(), response.getStatus().getValue()); request.setPrivileges(Sets.newHashSet( newSentryPrivilege("SERVER", "", "", "ALTER"), newSentryPrivilege("SERVER", "", "", "SELECT") )); response = policyStoreProcessor.alter_sentry_role_grant_privilege(request); Assert.assertEquals("Grant ALTER should not be permitted.", Status.ACCESS_DENIED.getCode(), response.getStatus().getValue()); assertTrue("ALTER privileges should not be permitted", response.getStatus().getMessage().contains("ALTER")); Assert.assertFalse("SELECT privileges should be permitted", response.getStatus().getMessage().contains("SELECT")); }