@Test public void testRevokePrivilege() throws Exception { String roleName = "r1"; String grantor = ADMIN_USER; PrivilegeObject queryPrivilege = new Builder() .setComponent(SEARCH) .setAction(SearchConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME), new Field(FIELD_NAME))) .build(); PrivilegeObject updatePrivilege = new Builder(queryPrivilege) .setAction(SearchConstants.UPDATE) .build(); sentryStore.createRole(SEARCH, roleName, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, queryPrivilege, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName, updatePrivilege, grantor); assertEquals(Sets.newHashSet(queryPrivilege,updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); sentryStore.alterRoleRevokePrivilege(SEARCH, roleName, queryPrivilege, grantor); assertEquals(Sets.newHashSet(updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName))); }
public void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm) throws SentryUserException { MSentryGMPrivilege mPrivilege = getPrivilege(convertToPrivilege(privilege), pm); if (mPrivilege == null) { mPrivilege = convertToPrivilege(privilege); } else { mPrivilege = (MSentryGMPrivilege) pm.detachCopy(mPrivilege); } Set<MSentryGMPrivilege> privilegeGraph = Sets.newHashSet(); privilegeGraph.addAll(populateIncludePrivileges(Sets.newHashSet(role), mPrivilege, pm)); for (MSentryGMPrivilege persistedPriv : privilegeGraph) { revokeRolePartial(mPrivilege, persistedPriv, role, pm); } pm.makePersistent(role); }
PrivilegeOperatePersistence { public void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm) throws SentryUserException { MSentryGMPrivilege mPrivilege = getPrivilege(convertToPrivilege(privilege), pm); if (mPrivilege == null) { mPrivilege = convertToPrivilege(privilege); } else { mPrivilege = (MSentryGMPrivilege) pm.detachCopy(mPrivilege); } Set<MSentryGMPrivilege> privilegeGraph = Sets.newHashSet(); privilegeGraph.addAll(populateIncludePrivileges(Sets.newHashSet(role), mPrivilege, pm)); for (MSentryGMPrivilege persistedPriv : privilegeGraph) { revokeRolePartial(mPrivilege, persistedPriv, role, pm); } pm.makePersistent(role); } }
PrivilegeOperatePersistence { public void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm) throws SentryUserException { MSentryGMPrivilege mPrivilege = getPrivilege(convertToPrivilege(privilege), pm); if (mPrivilege == null) { mPrivilege = convertToPrivilege(privilege); } else { mPrivilege = (MSentryGMPrivilege) pm.detachCopy(mPrivilege); } Set<MSentryGMPrivilege> privilegeGraph = Sets.newHashSet(); privilegeGraph.addAll(populateIncludePrivileges(Sets.newHashSet(role), mPrivilege, pm)); for (MSentryGMPrivilege persistedPriv : privilegeGraph) { revokeRolePartial(mPrivilege, persistedPriv, role, pm); } pm.makePersistent(role); } PrivilegeOperatePersistence(Configuration conf); }
PrivilegeOperatePersistence { public void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm) throws SentryUserException { MSentryGMPrivilege mPrivilege = getPrivilege(convertToPrivilege(privilege), pm); if (mPrivilege == null) { mPrivilege = convertToPrivilege(privilege); } else { mPrivilege = (MSentryGMPrivilege) pm.detachCopy(mPrivilege); } Set<MSentryGMPrivilege> privilegeGraph = Sets.newHashSet(); privilegeGraph.addAll(populateIncludePrivileges(Sets.newHashSet(role), mPrivilege, pm)); for (MSentryGMPrivilege persistedPriv : privilegeGraph) { revokeRolePartial(mPrivilege, persistedPriv, role, pm); } pm.makePersistent(role); } PrivilegeOperatePersistence(Configuration conf); boolean checkPrivilegeOption(Set<MSentryRole> roles, PrivilegeObject privilege, PersistenceManager pm); void grantPrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void dropPrivilege(PrivilegeObject privilege,PersistenceManager pm); @SuppressWarnings("unchecked") Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm); Set<PrivilegeObject> getPrivilegesByProvider(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); Set<MSentryGMPrivilege> getPrivilegesByAuthorizable(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); void renamePrivilege(String component, String service,
      List<? extends Authorizable> oldAuthorizables, List<? extends Authorizable> newAuthorizables,
      String grantorPrincipal, PersistenceManager pm); }
PrivilegeOperatePersistence { public void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm) throws SentryUserException { MSentryGMPrivilege mPrivilege = getPrivilege(convertToPrivilege(privilege), pm); if (mPrivilege == null) { mPrivilege = convertToPrivilege(privilege); } else { mPrivilege = (MSentryGMPrivilege) pm.detachCopy(mPrivilege); } Set<MSentryGMPrivilege> privilegeGraph = Sets.newHashSet(); privilegeGraph.addAll(populateIncludePrivileges(Sets.newHashSet(role), mPrivilege, pm)); for (MSentryGMPrivilege persistedPriv : privilegeGraph) { revokeRolePartial(mPrivilege, persistedPriv, role, pm); } pm.makePersistent(role); } PrivilegeOperatePersistence(Configuration conf); boolean checkPrivilegeOption(Set<MSentryRole> roles, PrivilegeObject privilege, PersistenceManager pm); void grantPrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void dropPrivilege(PrivilegeObject privilege,PersistenceManager pm); @SuppressWarnings("unchecked") Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm); Set<PrivilegeObject> getPrivilegesByProvider(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); Set<MSentryGMPrivilege> getPrivilegesByAuthorizable(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); void renamePrivilege(String component, String service,
      List<? extends Authorizable> oldAuthorizables, List<? extends Authorizable> newAuthorizables,
      String grantorPrincipal, PersistenceManager pm);  }