RangerSystemAccessControl implements SystemAccessControl { @Override public void checkCanImpersonateUser(SystemSecurityContext context, String userName) { if (!hasPermission(createUserResource(userName), context, PrestoAccessType.IMPERSONATE)) { LOG.debug("RangerSystemAccessControl.checkCanImpersonateUser(" + userName + ") denied"); AccessDeniedException.denyImpersonateUser(context.getIdentity().getUser(), userName); } } RangerSystemAccessControl(Map<String, String> config); @Override Optional<ViewExpression> getRowFilter(SystemSecurityContext context, CatalogSchemaTableName tableName); @Override Optional<ViewExpression> getColumnMask(SystemSecurityContext context, CatalogSchemaTableName tableName, String columnName, Type type); @Override Set<String> filterCatalogs(SystemSecurityContext context, Set<String> catalogs); @Override Set<String> filterSchemas(SystemSecurityContext context, String catalogName, Set<String> schemaNames); @Override Set<SchemaTableName> filterTables(SystemSecurityContext context, String catalogName, Set<SchemaTableName> tableNames); @Override void checkCanSetSystemSessionProperty(SystemSecurityContext context, String propertyName); @Override void checkCanImpersonateUser(SystemSecurityContext context, String userName); @Override void checkCanSetUser(Optional<Principal> principal, String userName); @Override void checkCanSetCatalogSessionProperty(SystemSecurityContext context, String catalogName, String propertyName); @Override void checkCanShowRoles(SystemSecurityContext context, String catalogName); @Override void checkCanAccessCatalog(SystemSecurityContext context, String catalogName); @Override void checkCanShowSchemas(SystemSecurityContext context, String catalogName); @Override void checkCanSetSchemaAuthorization(SystemSecurityContext context, CatalogSchemaName schema, PrestoPrincipal principal); @Override void checkCanShowCreateSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanCreateSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanDropSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanRenameSchema(SystemSecurityContext context, CatalogSchemaName schema, String newSchemaName); @Override void checkCanShowTables(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanShowCreateTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanCreateTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDropTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanRenameTable(SystemSecurityContext context, CatalogSchemaTableName table, CatalogSchemaTableName newTable); @Override void checkCanInsertIntoTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDeleteFromTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanGrantTablePrivilege(SystemSecurityContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal grantee, boolean withGrantOption); @Override void checkCanRevokeTablePrivilege(SystemSecurityContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal revokee, boolean grantOptionFor); @Override void checkCanSetTableComment(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanCreateView(SystemSecurityContext context, CatalogSchemaTableName view); @Override void checkCanDropView(SystemSecurityContext context, CatalogSchemaTableName view); @Override void checkCanCreateViewWithSelectFromColumns(SystemSecurityContext context, CatalogSchemaTableName table, Set<String> columns); @Override void checkCanRenameView(SystemSecurityContext context, CatalogSchemaTableName view, CatalogSchemaTableName newView); @Override void checkCanAddColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDropColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanRenameColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanShowColumns(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanSelectFromColumns(SystemSecurityContext context, CatalogSchemaTableName table, Set<String> columns); @Override List<ColumnMetadata> filterColumns(SystemSecurityContext context, CatalogSchemaTableName table, List<ColumnMetadata> columns); @Override void checkCanExecuteQuery(SystemSecurityContext context); @Override void checkCanViewQueryOwnedBy(SystemSecurityContext context, String queryOwner); @Override Set<String> filterViewQueryOwnedBy(SystemSecurityContext context, Set<String> queryOwners); @Override void checkCanKillQueryOwnedBy(SystemSecurityContext context, String queryOwner); @Override void checkCanGrantExecuteFunctionPrivilege(SystemSecurityContext context, String function, PrestoPrincipal grantee, boolean grantOption); @Override void checkCanExecuteFunction(SystemSecurityContext context, String function); @Override void checkCanExecuteProcedure(SystemSecurityContext context, CatalogSchemaRoutineName procedure); final static String RANGER_CONFIG_KEYTAB; final static String RANGER_CONFIG_PRINCIPAL; final static String RANGER_CONFIG_USE_UGI; final static String RANGER_CONFIG_HADOOP_CONFIG; final static String RANGER_PRESTO_DEFAULT_HADOOP_CONF; final static String RANGER_PRESTO_SERVICETYPE; final static String RANGER_PRESTO_APPID; }
@Test @SuppressWarnings("PMD") public void testCanSetUserOperations() { try { accessControlManager.checkCanImpersonateUser(context(alice), bob.getUser()); throw new AssertionError("expected AccessDeniedExeption"); } catch (AccessDeniedException expected) { } accessControlManager.checkCanImpersonateUser(context(admin), bob.getUser()); try { accessControlManager.checkCanImpersonateUser(context(kerberosInvalidAlice), bob.getUser()); throw new AssertionError("expected AccessDeniedExeption"); } catch (AccessDeniedException expected) { } }