@Test public void testCatalogOperations() { assertEquals(accessControlManager.filterCatalogs(context(alice), allCatalogs), allCatalogs); Set<String> bobCatalogs = ImmutableSet.of("open-to-all", "all-allowed"); assertEquals(accessControlManager.filterCatalogs(context(bob), allCatalogs), bobCatalogs); }
@Override public Set<String> filterCatalogs(SystemSecurityContext context, Set<String> catalogs) { LOG.debug("==> RangerSystemAccessControl.filterCatalogs("+ catalogs + ")"); Set<String> filteredCatalogs = new HashSet<>(catalogs.size()); for (String catalog: catalogs) { if (hasPermission(createResource(catalog), context, PrestoAccessType.SELECT)) { filteredCatalogs.add(catalog); } } return filteredCatalogs; }
RangerSystemAccessControl implements SystemAccessControl { @Override public Set<String> filterCatalogs(SystemSecurityContext context, Set<String> catalogs) { LOG.debug("==> RangerSystemAccessControl.filterCatalogs("+ catalogs + ")"); Set<String> filteredCatalogs = new HashSet<>(catalogs.size()); for (String catalog: catalogs) { if (hasPermission(createResource(catalog), context, PrestoAccessType.SELECT)) { filteredCatalogs.add(catalog); } } return filteredCatalogs; } }
RangerSystemAccessControl implements SystemAccessControl { @Override public Set<String> filterCatalogs(SystemSecurityContext context, Set<String> catalogs) { LOG.debug("==> RangerSystemAccessControl.filterCatalogs("+ catalogs + ")"); Set<String> filteredCatalogs = new HashSet<>(catalogs.size()); for (String catalog: catalogs) { if (hasPermission(createResource(catalog), context, PrestoAccessType.SELECT)) { filteredCatalogs.add(catalog); } } return filteredCatalogs; } RangerSystemAccessControl(Map<String, String> config); }
RangerSystemAccessControl implements SystemAccessControl { @Override public Set<String> filterCatalogs(SystemSecurityContext context, Set<String> catalogs) { LOG.debug("==> RangerSystemAccessControl.filterCatalogs("+ catalogs + ")"); Set<String> filteredCatalogs = new HashSet<>(catalogs.size()); for (String catalog: catalogs) { if (hasPermission(createResource(catalog), context, PrestoAccessType.SELECT)) { filteredCatalogs.add(catalog); } } return filteredCatalogs; } RangerSystemAccessControl(Map<String, String> config); @Override Optional<ViewExpression> getRowFilter(SystemSecurityContext context, CatalogSchemaTableName tableName); @Override Optional<ViewExpression> getColumnMask(SystemSecurityContext context, CatalogSchemaTableName tableName, String columnName, Type type); @Override Set<String> filterCatalogs(SystemSecurityContext context, Set<String> catalogs); @Override Set<String> filterSchemas(SystemSecurityContext context, String catalogName, Set<String> schemaNames); @Override Set<SchemaTableName> filterTables(SystemSecurityContext context, String catalogName, Set<SchemaTableName> tableNames); @Override void checkCanSetSystemSessionProperty(SystemSecurityContext context, String propertyName); @Override void checkCanImpersonateUser(SystemSecurityContext context, String userName); @Override void checkCanSetUser(Optional<Principal> principal, String userName); @Override void checkCanSetCatalogSessionProperty(SystemSecurityContext context, String catalogName, String propertyName); @Override void checkCanShowRoles(SystemSecurityContext context, String catalogName); @Override void checkCanAccessCatalog(SystemSecurityContext context, String catalogName); @Override void checkCanShowSchemas(SystemSecurityContext context, String catalogName); @Override void checkCanSetSchemaAuthorization(SystemSecurityContext context, CatalogSchemaName schema, PrestoPrincipal principal); @Override void checkCanShowCreateSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanCreateSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanDropSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanRenameSchema(SystemSecurityContext context, CatalogSchemaName schema, String newSchemaName); @Override void checkCanShowTables(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanShowCreateTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanCreateTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDropTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanRenameTable(SystemSecurityContext context, CatalogSchemaTableName table, CatalogSchemaTableName newTable); @Override void checkCanInsertIntoTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDeleteFromTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanGrantTablePrivilege(SystemSecurityContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal grantee, boolean withGrantOption); @Override void checkCanRevokeTablePrivilege(SystemSecurityContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal revokee, boolean grantOptionFor); @Override void checkCanSetTableComment(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanCreateView(SystemSecurityContext context, CatalogSchemaTableName view); @Override void checkCanDropView(SystemSecurityContext context, CatalogSchemaTableName view); @Override void checkCanCreateViewWithSelectFromColumns(SystemSecurityContext context, CatalogSchemaTableName table, Set<String> columns); @Override void checkCanRenameView(SystemSecurityContext context, CatalogSchemaTableName view, CatalogSchemaTableName newView); @Override void checkCanAddColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDropColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanRenameColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanShowColumns(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanSelectFromColumns(SystemSecurityContext context, CatalogSchemaTableName table, Set<String> columns); @Override List<ColumnMetadata> filterColumns(SystemSecurityContext context, CatalogSchemaTableName table, List<ColumnMetadata> columns); @Override void checkCanExecuteQuery(SystemSecurityContext context); @Override void checkCanViewQueryOwnedBy(SystemSecurityContext context, String queryOwner); @Override Set<String> filterViewQueryOwnedBy(SystemSecurityContext context, Set<String> queryOwners); @Override void checkCanKillQueryOwnedBy(SystemSecurityContext context, String queryOwner); @Override void checkCanGrantExecuteFunctionPrivilege(SystemSecurityContext context, String function, PrestoPrincipal grantee, boolean grantOption); @Override void checkCanExecuteFunction(SystemSecurityContext context, String function); @Override void checkCanExecuteProcedure(SystemSecurityContext context, CatalogSchemaRoutineName procedure); }
RangerSystemAccessControl implements SystemAccessControl { @Override public Set<String> filterCatalogs(SystemSecurityContext context, Set<String> catalogs) { LOG.debug("==> RangerSystemAccessControl.filterCatalogs("+ catalogs + ")"); Set<String> filteredCatalogs = new HashSet<>(catalogs.size()); for (String catalog: catalogs) { if (hasPermission(createResource(catalog), context, PrestoAccessType.SELECT)) { filteredCatalogs.add(catalog); } } return filteredCatalogs; } RangerSystemAccessControl(Map<String, String> config); @Override Optional<ViewExpression> getRowFilter(SystemSecurityContext context, CatalogSchemaTableName tableName); @Override Optional<ViewExpression> getColumnMask(SystemSecurityContext context, CatalogSchemaTableName tableName, String columnName, Type type); @Override Set<String> filterCatalogs(SystemSecurityContext context, Set<String> catalogs); @Override Set<String> filterSchemas(SystemSecurityContext context, String catalogName, Set<String> schemaNames); @Override Set<SchemaTableName> filterTables(SystemSecurityContext context, String catalogName, Set<SchemaTableName> tableNames); @Override void checkCanSetSystemSessionProperty(SystemSecurityContext context, String propertyName); @Override void checkCanImpersonateUser(SystemSecurityContext context, String userName); @Override void checkCanSetUser(Optional<Principal> principal, String userName); @Override void checkCanSetCatalogSessionProperty(SystemSecurityContext context, String catalogName, String propertyName); @Override void checkCanShowRoles(SystemSecurityContext context, String catalogName); @Override void checkCanAccessCatalog(SystemSecurityContext context, String catalogName); @Override void checkCanShowSchemas(SystemSecurityContext context, String catalogName); @Override void checkCanSetSchemaAuthorization(SystemSecurityContext context, CatalogSchemaName schema, PrestoPrincipal principal); @Override void checkCanShowCreateSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanCreateSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanDropSchema(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanRenameSchema(SystemSecurityContext context, CatalogSchemaName schema, String newSchemaName); @Override void checkCanShowTables(SystemSecurityContext context, CatalogSchemaName schema); @Override void checkCanShowCreateTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanCreateTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDropTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanRenameTable(SystemSecurityContext context, CatalogSchemaTableName table, CatalogSchemaTableName newTable); @Override void checkCanInsertIntoTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDeleteFromTable(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanGrantTablePrivilege(SystemSecurityContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal grantee, boolean withGrantOption); @Override void checkCanRevokeTablePrivilege(SystemSecurityContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal revokee, boolean grantOptionFor); @Override void checkCanSetTableComment(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanCreateView(SystemSecurityContext context, CatalogSchemaTableName view); @Override void checkCanDropView(SystemSecurityContext context, CatalogSchemaTableName view); @Override void checkCanCreateViewWithSelectFromColumns(SystemSecurityContext context, CatalogSchemaTableName table, Set<String> columns); @Override void checkCanRenameView(SystemSecurityContext context, CatalogSchemaTableName view, CatalogSchemaTableName newView); @Override void checkCanAddColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanDropColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanRenameColumn(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanShowColumns(SystemSecurityContext context, CatalogSchemaTableName table); @Override void checkCanSelectFromColumns(SystemSecurityContext context, CatalogSchemaTableName table, Set<String> columns); @Override List<ColumnMetadata> filterColumns(SystemSecurityContext context, CatalogSchemaTableName table, List<ColumnMetadata> columns); @Override void checkCanExecuteQuery(SystemSecurityContext context); @Override void checkCanViewQueryOwnedBy(SystemSecurityContext context, String queryOwner); @Override Set<String> filterViewQueryOwnedBy(SystemSecurityContext context, Set<String> queryOwners); @Override void checkCanKillQueryOwnedBy(SystemSecurityContext context, String queryOwner); @Override void checkCanGrantExecuteFunctionPrivilege(SystemSecurityContext context, String function, PrestoPrincipal grantee, boolean grantOption); @Override void checkCanExecuteFunction(SystemSecurityContext context, String function); @Override void checkCanExecuteProcedure(SystemSecurityContext context, CatalogSchemaRoutineName procedure); final static String RANGER_CONFIG_KEYTAB; final static String RANGER_CONFIG_PRINCIPAL; final static String RANGER_CONFIG_USE_UGI; final static String RANGER_CONFIG_HADOOP_CONFIG; final static String RANGER_PRESTO_DEFAULT_HADOOP_CONF; final static String RANGER_PRESTO_SERVICETYPE; final static String RANGER_PRESTO_APPID; }