@Test public void testGrantRevokeCheckWithGrantOption() throws Exception { addGroupsToUser(GRANT_OPTION_USER, GRANT_OPTION_GROUP); addGroupsToUser(NO_GRANT_OPTION_USER, NO_GRANT_OPTION_GROUP); writePolicyFile(); String roleName1 = "r1"; String roleName2 = "r2"; String grantor = "g1"; sentryStore.createRole(SEARCH, roleName1, grantor); sentryStore.createRole(SEARCH, roleName2, grantor); PrivilegeObject queryPrivilege1 = new Builder() .setComponent(SEARCH) .setAction(SearchConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(true) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege1, ADMIN_USER); assertEquals(Sets.newHashSet(queryPrivilege1), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName1))); PrivilegeObject queryPrivilege2 = new Builder() .setComponent(SEARCH) .setAction(SearchConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .withGrantOption(false).build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, queryPrivilege2, ADMIN_USER); assertEquals(Sets.newHashSet(queryPrivilege2), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); sentryStore.alterRoleAddGroups(SEARCH, roleName1, Sets.newHashSet(GRANT_OPTION_GROUP), grantor); sentryStore.alterRoleAddGroups(SEARCH, roleName2, Sets.newHashSet(NO_GRANT_OPTION_GROUP), grantor); String roleName3 = "r3"; sentryStore.createRole(SEARCH, roleName3, grantor); try{ sentryStore.alterRoleGrantPrivilege(SEARCH, roleName3, queryPrivilege1, GRANT_OPTION_USER); } catch (SentryGrantDeniedException e) { fail("SentryGrantDeniedException shouldn't have been thrown"); } try{ sentryStore.alterRoleRevokePrivilege(SEARCH, roleName3, queryPrivilege1, GRANT_OPTION_USER); } catch (SentryGrantDeniedException e) { fail("SentryGrantDeniedException shouldn't have been thrown"); } try { sentryStore.alterRoleGrantPrivilege(SEARCH, roleName3, queryPrivilege2, NO_GRANT_OPTION_USER); fail("SentryGrantDeniedException should have been thrown"); } catch (SentryGrantDeniedException e) { } try { sentryStore.alterRoleGrantPrivilege(SEARCH, roleName3, queryPrivilege2, NO_GRANT_OPTION_USER); fail("SentryGrantDeniedException should have been thrown"); } catch (SentryGrantDeniedException e) { } }
@SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; }
PrivilegeOperatePersistence { @SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } }
PrivilegeOperatePersistence { @SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } PrivilegeOperatePersistence(Configuration conf); }
PrivilegeOperatePersistence { @SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } PrivilegeOperatePersistence(Configuration conf); boolean checkPrivilegeOption(Set<MSentryRole> roles, PrivilegeObject privilege, PersistenceManager pm); void grantPrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void dropPrivilege(PrivilegeObject privilege,PersistenceManager pm); @SuppressWarnings("unchecked") Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm); Set<PrivilegeObject> getPrivilegesByProvider(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); Set<MSentryGMPrivilege> getPrivilegesByAuthorizable(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); void renamePrivilege(String component, String service,
      List<? extends Authorizable> oldAuthorizables, List<? extends Authorizable> newAuthorizables,
      String grantorPrincipal, PersistenceManager pm); }
PrivilegeOperatePersistence { @SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } PrivilegeOperatePersistence(Configuration conf); boolean checkPrivilegeOption(Set<MSentryRole> roles, PrivilegeObject privilege, PersistenceManager pm); void grantPrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void dropPrivilege(PrivilegeObject privilege,PersistenceManager pm); @SuppressWarnings("unchecked") Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm); Set<PrivilegeObject> getPrivilegesByProvider(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); Set<MSentryGMPrivilege> getPrivilegesByAuthorizable(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); void renamePrivilege(String component, String service,
      List<? extends Authorizable> oldAuthorizables, List<? extends Authorizable> newAuthorizables,
      String grantorPrincipal, PersistenceManager pm);  }