Examples with PrestoPrincipal com.facebook.presto.spi.security.PrestoPrincipal used on opensource projects

Example 16 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class ThriftMetastoreUtil method parsePrivilege.

public static Set<HivePrivilegeInfo> parsePrivilege(PrivilegeGrantInfo userGrant, Optional<PrestoPrincipal> grantee) {
    boolean withGrantOption = userGrant.isGrantOption();
    String name = userGrant.getPrivilege().toUpperCase(ENGLISH);
    PrestoPrincipal grantor = new PrestoPrincipal(fromMetastoreApiPrincipalType(userGrant.getGrantorType()), userGrant.getGrantor());
    switch(name) {
        case "ALL":
            return Arrays.stream(HivePrivilegeInfo.HivePrivilege.values()).map(hivePrivilege -> new HivePrivilegeInfo(hivePrivilege, withGrantOption, grantor, grantee.orElse(grantor))).collect(toImmutableSet());
        case "SELECT":
            return ImmutableSet.of(new HivePrivilegeInfo(SELECT, withGrantOption, grantor, grantee.orElse(grantor)));
        case "INSERT":
            return ImmutableSet.of(new HivePrivilegeInfo(INSERT, withGrantOption, grantor, grantee.orElse(grantor)));
        case "UPDATE":
            return ImmutableSet.of(new HivePrivilegeInfo(UPDATE, withGrantOption, grantor, grantee.orElse(grantor)));
        case "DELETE":
            return ImmutableSet.of(new HivePrivilegeInfo(DELETE, withGrantOption, grantor, grantee.orElse(grantor)));
        case "OWNERSHIP":
            return ImmutableSet.of(new HivePrivilegeInfo(OWNERSHIP, withGrantOption, grantor, grantee.orElse(grantor)));
        default:
            throw new IllegalArgumentException("Unsupported privilege name: " + name);
    }
}

Example 17 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class ThriftHiveMetastore method listTablePrivileges.

@Override
public Set<HivePrivilegeInfo> listTablePrivileges(MetastoreContext metastoreContext, String databaseName, String tableName, PrestoPrincipal principal) {
    try {
        return retry().stopOnIllegalExceptions().run("getListPrivileges", stats.getListPrivileges().wrap(() -> getMetastoreClientThenCall(metastoreContext, client -> {
            Table table = client.getTable(databaseName, tableName);
            ImmutableSet.Builder<HivePrivilegeInfo> privileges = ImmutableSet.builder();
            List<HiveObjectPrivilege> hiveObjectPrivilegeList;
            // principal can be null when we want to list all privileges for admins
            if (principal == null) {
                hiveObjectPrivilegeList = client.listPrivileges(null, null, new HiveObjectRef(TABLE, databaseName, tableName, null, null));
            } else {
                if (principal.getType() == USER && table.getOwner().equals(principal.getName())) {
                    privileges.add(new HivePrivilegeInfo(OWNERSHIP, true, principal, principal));
                }
                hiveObjectPrivilegeList = client.listPrivileges(principal.getName(), fromPrestoPrincipalType(principal.getType()), new HiveObjectRef(TABLE, databaseName, tableName, null, null));
            }
            for (HiveObjectPrivilege hiveObjectPrivilege : hiveObjectPrivilegeList) {
                PrestoPrincipal grantee = new PrestoPrincipal(fromMetastoreApiPrincipalType(hiveObjectPrivilege.getPrincipalType()), hiveObjectPrivilege.getPrincipalName());
                privileges.addAll(parsePrivilege(hiveObjectPrivilege.getGrantInfo(), Optional.of(grantee)));
            }
            return privileges.build();
        })));
    } catch (TException e) {
        throw new PrestoException(HIVE_METASTORE_ERROR, e);
    } catch (Exception e) {
        throw propagate(e);
    }
}

Example 18 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class ThriftMetastoreUtil method listEnabledRoles.

public static Stream<String> listEnabledRoles(ConnectorIdentity identity, Function<PrestoPrincipal, Set<RoleGrant>> listRoleGrants) {
    Optional<SelectedRole> role = identity.getRole();
    if (role.isPresent() && role.get().getType() == SelectedRole.Type.NONE) {
        return Stream.of(PUBLIC_ROLE_NAME);
    }
    PrestoPrincipal principal;
    if (!role.isPresent() || role.get().getType() == SelectedRole.Type.ALL) {
        principal = new PrestoPrincipal(USER, identity.getUser());
    } else {
        principal = new PrestoPrincipal(ROLE, role.get().getRole().get());
    }
    Stream<String> roles = Stream.of(PUBLIC_ROLE_NAME);
    if (principal.getType() == ROLE) {
        roles = Stream.concat(roles, Stream.of(principal.getName()));
    }
    return Stream.concat(roles, listApplicableRoles(principal, listRoleGrants).map(RoleGrant::getRoleName).filter(Predicate.isEqual(ADMIN_ROLE_NAME).negate()));
}

Example 19 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class FileHiveMetastore method removeNonExistingRoles.

private static Set<RoleGrant> removeNonExistingRoles(Set<RoleGrant> grants, Set<String> existingRoles) {
    ImmutableSet.Builder<RoleGrant> result = ImmutableSet.builder();
    for (RoleGrant grant : grants) {
        if (!existingRoles.contains(grant.getRoleName())) {
            continue;
        }
        PrestoPrincipal grantee = grant.getGrantee();
        if (grantee.getType() == ROLE && !existingRoles.contains(grantee.getName())) {
            continue;
        }
        result.add(grant);
    }
    return result.build();
}

Example 20 with PrestoPrincipal

use of com.facebook.presto.spi.security.PrestoPrincipal in project presto by prestodb.

the class SemiTransactionalHiveMetastore method listTablePrivileges.

public synchronized Set<HivePrivilegeInfo> listTablePrivileges(MetastoreContext metastoreContext, String databaseName, String tableName, PrestoPrincipal principal) {
    checkReadable();
    SchemaTableName schemaTableName = new SchemaTableName(databaseName, tableName);
    Action<TableAndMore> tableAction = tableActions.get(schemaTableName);
    if (tableAction == null) {
        return delegate.listTablePrivileges(metastoreContext, databaseName, tableName, principal);
    }
    switch(tableAction.getType()) {
        case ADD:
        case ALTER:
            {
                if (principal.getType() == PrincipalType.ROLE) {
                    return ImmutableSet.of();
                }
                if (!principal.getName().equals(tableAction.getData().getTable().getOwner())) {
                    return ImmutableSet.of();
                }
                Collection<HivePrivilegeInfo> privileges = tableAction.getData().getPrincipalPrivileges().getUserPrivileges().get(principal.getName());
                return ImmutableSet.<HivePrivilegeInfo>builder().addAll(privileges).add(new HivePrivilegeInfo(OWNERSHIP, true, new PrestoPrincipal(USER, principal.getName()), new PrestoPrincipal(USER, principal.getName()))).build();
            }
        case INSERT_EXISTING:
            return delegate.listTablePrivileges(metastoreContext, databaseName, tableName, principal);
        case DROP:
            throw new TableNotFoundException(schemaTableName);
        default:
            throw new IllegalStateException("Unknown action type");
    }
}