Examples with PrestoPrincipal com.facebook.presto.spi.security.PrestoPrincipal used on opensource projects

Example 1 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class HiveMetadata method grantTablePrivileges.

@Override
public void grantTablePrivileges(ConnectorSession session, SchemaTableName schemaTableName, Set<Privilege> privileges, PrestoPrincipal grantee, boolean grantOption) {
    String schemaName = schemaTableName.getSchemaName();
    String tableName = schemaTableName.getTableName();
    Set<HivePrivilegeInfo> hivePrivilegeInfos = privileges.stream().map(privilege -> new HivePrivilegeInfo(toHivePrivilege(privilege), grantOption, new PrestoPrincipal(USER, session.getUser()), new PrestoPrincipal(USER, session.getUser()))).collect(toSet());
    MetastoreContext metastoreContext = getMetastoreContext(session);
    metastore.grantTablePrivileges(metastoreContext, schemaName, tableName, grantee, hivePrivilegeInfos);
}

Example 2 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class HiveMetadata method revokeRoles.

@Override
public void revokeRoles(ConnectorSession session, Set<String> roles, Set<PrestoPrincipal> grantees, boolean adminOptionFor, Optional<PrestoPrincipal> grantor) {
    MetastoreContext metastoreContext = getMetastoreContext(session);
    metastore.revokeRoles(metastoreContext, roles, grantees, adminOptionFor, grantor.orElse(new PrestoPrincipal(USER, session.getUser())));
}

Example 3 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class ThriftHiveMetastore method revokeTablePrivileges.

@Override
public void revokeTablePrivileges(MetastoreContext metastoreContext, String databaseName, String tableName, PrestoPrincipal grantee, Set<HivePrivilegeInfo> privileges) {
    Set<PrivilegeGrantInfo> requestedPrivileges = privileges.stream().map(ThriftMetastoreUtil::toMetastoreApiPrivilegeGrantInfo).collect(Collectors.toSet());
    checkArgument(!containsAllPrivilege(requestedPrivileges), "\"ALL\" not supported in PrivilegeGrantInfo.privilege");
    try {
        retry().stopOnIllegalExceptions().run("revokeTablePrivileges", stats.getRevokeTablePrivileges().wrap(() -> getMetastoreClientThenCall(metastoreContext, client -> {
            Set<HivePrivilege> existingHivePrivileges = listTablePrivileges(metastoreContext, databaseName, tableName, grantee).stream().map(HivePrivilegeInfo::getHivePrivilege).collect(toSet());
            Set<PrivilegeGrantInfo> privilegesToRevoke = requestedPrivileges.stream().filter(privilegeGrantInfo -> existingHivePrivileges.contains(getOnlyElement(parsePrivilege(privilegeGrantInfo, Optional.empty())).getHivePrivilege())).collect(toSet());
            if (privilegesToRevoke.isEmpty()) {
                return null;
            }
            return client.revokePrivileges(buildPrivilegeBag(databaseName, tableName, grantee, privilegesToRevoke));
        })));
    } catch (TException e) {
        throw new PrestoException(HIVE_METASTORE_ERROR, e);
    } catch (Exception e) {
        throw propagate(e);
    }
}

Example 4 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class FileHiveMetastore method createTable.

@Override
public synchronized void createTable(MetastoreContext metastoreContext, Table table, PrincipalPrivileges principalPrivileges) {
    checkArgument(!table.getTableType().equals(TEMPORARY_TABLE), "temporary tables must never be committed to the metastore");
    verifyTableNotExists(metastoreContext, table.getDatabaseName(), table.getTableName());
    Path tableMetadataDirectory = getTableMetadataDirectory(table);
    // validate table location
    if (table.getTableType().equals(VIRTUAL_VIEW)) {
        checkArgument(table.getStorage().getLocation().isEmpty(), "Storage location for view must be empty");
    } else if (table.getTableType().equals(MANAGED_TABLE) || table.getTableType().equals(MATERIALIZED_VIEW)) {
        if (!tableMetadataDirectory.equals(new Path(table.getStorage().getLocation()))) {
            throw new PrestoException(HIVE_METASTORE_ERROR, "Table directory must be " + tableMetadataDirectory);
        }
    } else if (table.getTableType().equals(EXTERNAL_TABLE)) {
        try {
            Path externalLocation = new Path(table.getStorage().getLocation());
            FileSystem externalFileSystem = hdfsEnvironment.getFileSystem(hdfsContext, externalLocation);
            if (!externalFileSystem.isDirectory(externalLocation)) {
                throw new PrestoException(HIVE_METASTORE_ERROR, "External table location does not exist");
            }
            if (isChildDirectory(catalogDirectory, externalLocation) && !isIcebergTable(table.getParameters())) {
                throw new PrestoException(HIVE_METASTORE_ERROR, "External table location can not be inside the system metadata directory");
            }
        } catch (IOException e) {
            throw new PrestoException(HIVE_METASTORE_ERROR, "Could not validate external location", e);
        }
    } else {
        throw new PrestoException(NOT_SUPPORTED, "Table type not supported: " + table.getTableType());
    }
    if (!table.getTableType().equals(VIRTUAL_VIEW)) {
        File location = new File(new Path(table.getStorage().getLocation()).toUri());
        checkArgument(location.isDirectory(), "Table location is not a directory: %s", location);
        checkArgument(location.exists(), "Table directory does not exist: %s", location);
    }
    writeSchemaFile("table", tableMetadataDirectory, tableCodec, new TableMetadata(table), false);
    for (Entry<String, Collection<HivePrivilegeInfo>> entry : principalPrivileges.getUserPrivileges().asMap().entrySet()) {
        setTablePrivileges(metastoreContext, new PrestoPrincipal(USER, entry.getKey()), table.getDatabaseName(), table.getTableName(), entry.getValue());
    }
    for (Entry<String, Collection<HivePrivilegeInfo>> entry : principalPrivileges.getRolePrivileges().asMap().entrySet()) {
        setTablePrivileges(metastoreContext, new PrestoPrincipal(ROLE, entry.getKey()), table.getDatabaseName(), table.getTableName(), entry.getValue());
    }
}

Example 5 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class FileHiveMetastore method revokeRoles.

@Override
public synchronized void revokeRoles(MetastoreContext metastoreContext, Set<String> roles, Set<PrestoPrincipal> grantees, boolean adminOptionFor, PrestoPrincipal grantor) {
    Set<RoleGrant> existingGrants = listRoleGrantsSanitized(metastoreContext);
    Set<RoleGrant> modifiedGrants = new HashSet<>(existingGrants);
    for (PrestoPrincipal grantee : grantees) {
        for (String role : roles) {
            RoleGrant grantWithAdminOption = new RoleGrant(grantee, role, true);
            RoleGrant grantWithoutAdminOption = new RoleGrant(grantee, role, false);
            if (modifiedGrants.contains(grantWithAdminOption) || modifiedGrants.contains(grantWithoutAdminOption)) {
                if (adminOptionFor) {
                    modifiedGrants.remove(grantWithAdminOption);
                    modifiedGrants.add(grantWithoutAdminOption);
                } else {
                    modifiedGrants.remove(grantWithAdminOption);
                    modifiedGrants.remove(grantWithoutAdminOption);
                }
            }
        }
    }
    modifiedGrants = removeDuplicatedEntries(modifiedGrants);
    if (!existingGrants.equals(modifiedGrants)) {
        writeRoleGrantsFile(modifiedGrants);
    }
}