@Test public void testGrantALLPrivilegeWithOtherPrivilegesExist() throws Exception { String roleName1 = "r1"; String roleName2 = "r2"; String grantor = ADMIN_USER; PrivilegeObject queryPrivilege = new Builder() .setComponent(SEARCH) .setAction(SearchConstants.QUERY) .setService(SERVICE) .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME))) .build(); PrivilegeObject updatePrivilege = new Builder(queryPrivilege) .setAction(SearchConstants.UPDATE) .build(); sentryStore.createRole(SEARCH, roleName1, grantor); sentryStore.createRole(SEARCH, roleName2, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, updatePrivilege,grantor); assertEquals(Sets.newHashSet(queryPrivilege, updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName1))); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, queryPrivilege, grantor); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, updatePrivilege,grantor); assertEquals(Sets.newHashSet(queryPrivilege, updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); PrivilegeObject allPrivilege = new Builder(queryPrivilege) .setAction(SearchConstants.ALL) .build(); sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, allPrivilege, grantor); assertEquals(Sets.newHashSet(allPrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName1))); assertEquals(Sets.newHashSet(queryPrivilege, updatePrivilege), sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2))); }
@SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; }
PrivilegeOperatePersistence { @SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } }
PrivilegeOperatePersistence { @SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } PrivilegeOperatePersistence(Configuration conf); }
PrivilegeOperatePersistence { @SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } PrivilegeOperatePersistence(Configuration conf); boolean checkPrivilegeOption(Set<MSentryRole> roles, PrivilegeObject privilege, PersistenceManager pm); void grantPrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void dropPrivilege(PrivilegeObject privilege,PersistenceManager pm); @SuppressWarnings("unchecked") Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm); Set<PrivilegeObject> getPrivilegesByProvider(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); Set<MSentryGMPrivilege> getPrivilegesByAuthorizable(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); void renamePrivilege(String component, String service,
      List<? extends Authorizable> oldAuthorizables, List<? extends Authorizable> newAuthorizables,
      String grantorPrincipal, PersistenceManager pm); }
PrivilegeOperatePersistence { @SuppressWarnings("unchecked") public Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm) { Set<PrivilegeObject> privileges = Sets.newHashSet(); if (roles == null || roles.size() == 0) { return privileges; } Query query = pm.newQuery(MSentryGMPrivilege.class); StringBuilder filters = new StringBuilder(); query.declareVariables("org.apache.sentry.provider.db.service.model.MSentryRole role"); List<String> rolesFiler = new LinkedList<String>(); for (MSentryRole role : roles) { rolesFiler.add("role.roleName == \"" + role.getRoleName() + "\" "); } filters.append("roles.contains(role) " + "&& (" + Joiner.on(" || ").join(rolesFiler) + ")"); query.setFilter(filters.toString()); List<MSentryGMPrivilege> mPrivileges = (List<MSentryGMPrivilege>) query.execute(); if (mPrivileges == null || mPrivileges.isEmpty()) { return privileges; } for (MSentryGMPrivilege mPrivilege : mPrivileges) { privileges.add(new Builder() .setComponent(mPrivilege.getComponentName()) .setService(mPrivilege.getServiceName()) .setAction(mPrivilege.getAction()) .setAuthorizables(mPrivilege.getAuthorizables()) .withGrantOption(mPrivilege.getGrantOption()) .build()); } return privileges; } PrivilegeOperatePersistence(Configuration conf); boolean checkPrivilegeOption(Set<MSentryRole> roles, PrivilegeObject privilege, PersistenceManager pm); void grantPrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void revokePrivilege(PrivilegeObject privilege,MSentryRole role, PersistenceManager pm); void dropPrivilege(PrivilegeObject privilege,PersistenceManager pm); @SuppressWarnings("unchecked") Set<PrivilegeObject> getPrivilegesByRole(Set<MSentryRole> roles, PersistenceManager pm); Set<PrivilegeObject> getPrivilegesByProvider(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); Set<MSentryGMPrivilege> getPrivilegesByAuthorizable(String component,
      String service, Set<MSentryRole> roles,
      List<? extends Authorizable> authorizables, PersistenceManager pm); void renamePrivilege(String component, String service,
      List<? extends Authorizable> oldAuthorizables, List<? extends Authorizable> newAuthorizables,
      String grantorPrincipal, PersistenceManager pm);  }