Examples with RoleGrant io.prestosql.spi.security.RoleGrant used on opensource projects

Example 6 with RoleGrant

use of io.prestosql.spi.security.RoleGrant in project boostkit-bigdata by kunpengcompute.

the class FileHiveMetastore method revokeRoles.

@Override
public synchronized void revokeRoles(Set<String> roles, Set<HivePrincipal> grantees, boolean adminOptionFor, HivePrincipal grantor) {
    Set<RoleGrant> existingGrants = listRoleGrantsSanitized();
    Set<RoleGrant> modifiedGrants = new HashSet<>(existingGrants);
    for (HivePrincipal grantee : grantees) {
        for (String role : roles) {
            RoleGrant grantWithAdminOption = new RoleGrant(grantee.toPrestoPrincipal(), role, true);
            RoleGrant grantWithoutAdminOption = new RoleGrant(grantee.toPrestoPrincipal(), role, false);
            if (modifiedGrants.contains(grantWithAdminOption) || modifiedGrants.contains(grantWithoutAdminOption)) {
                if (adminOptionFor) {
                    modifiedGrants.remove(grantWithAdminOption);
                    modifiedGrants.add(grantWithoutAdminOption);
                } else {
                    modifiedGrants.remove(grantWithAdminOption);
                    modifiedGrants.remove(grantWithoutAdminOption);
                }
            }
        }
    }
    modifiedGrants = removeDuplicatedEntries(modifiedGrants);
    if (!existingGrants.equals(modifiedGrants)) {
        writeRoleGrantsFile(modifiedGrants);
    }
}

Example 7 with RoleGrant

use of io.prestosql.spi.security.RoleGrant in project boostkit-bigdata by kunpengcompute.

the class FileHiveMetastore method removeNonExistingRoles.

private static Set<RoleGrant> removeNonExistingRoles(Set<RoleGrant> grants, Set<String> existingRoles) {
    ImmutableSet.Builder<RoleGrant> result = ImmutableSet.builder();
    for (RoleGrant grant : grants) {
        if (!existingRoles.contains(grant.getRoleName())) {
            continue;
        }
        HivePrincipal grantee = HivePrincipal.from(grant.getGrantee());
        if (grantee.getType() == ROLE && !existingRoles.contains(grantee.getName())) {
            continue;
        }
        result.add(grant);
    }
    return result.build();
}

Example 8 with RoleGrant

use of io.prestosql.spi.security.RoleGrant in project boostkit-bigdata by kunpengcompute.

the class FileHiveMetastore method grantRoles.

@Override
public synchronized void grantRoles(Set<String> roles, Set<HivePrincipal> grantees, boolean withAdminOption, HivePrincipal grantor) {
    Set<String> existingRoles = listRoles();
    Set<RoleGrant> existingGrants = listRoleGrantsSanitized();
    Set<RoleGrant> modifiedGrants = new HashSet<>(existingGrants);
    for (HivePrincipal grantee : grantees) {
        for (String role : roles) {
            checkArgument(existingRoles.contains(role), "Role does not exist: %s", role);
            if (grantee.getType() == ROLE) {
                checkArgument(existingRoles.contains(grantee.getName()), "Role does not exist: %s", grantee.getName());
            }
            RoleGrant grantWithAdminOption = new RoleGrant(grantee.toPrestoPrincipal(), role, true);
            RoleGrant grantWithoutAdminOption = new RoleGrant(grantee.toPrestoPrincipal(), role, false);
            if (withAdminOption) {
                modifiedGrants.remove(grantWithoutAdminOption);
                modifiedGrants.add(grantWithAdminOption);
            } else {
                modifiedGrants.remove(grantWithAdminOption);
                modifiedGrants.add(grantWithoutAdminOption);
            }
        }
    }
    modifiedGrants = removeDuplicatedEntries(modifiedGrants);
    if (!existingGrants.equals(modifiedGrants)) {
        writeRoleGrantsFile(modifiedGrants);
    }
}

Example 9 with RoleGrant

use of io.prestosql.spi.security.RoleGrant in project boostkit-bigdata by kunpengcompute.

the class FileHiveMetastore method removeDuplicatedEntries.

private Set<RoleGrant> removeDuplicatedEntries(Set<RoleGrant> grants) {
    Map<RoleGranteeTuple, RoleGrant> map = new HashMap<>();
    for (RoleGrant grant : grants) {
        RoleGranteeTuple tuple = new RoleGranteeTuple(grant.getRoleName(), HivePrincipal.from(grant.getGrantee()));
        map.merge(tuple, grant, (first, second) -> first.isGrantable() ? first : second);
    }
    return ImmutableSet.copyOf(map.values());
}

Example 10 with RoleGrant

use of io.prestosql.spi.security.RoleGrant in project boostkit-bigdata by kunpengcompute.

the class ThriftMetastoreUtil method listEnabledRoles.

public static Stream<String> listEnabledRoles(ConnectorIdentity identity, Function<HivePrincipal, Set<RoleGrant>> listRoleGrants) {
    Optional<SelectedRole> role = identity.getRole();
    if (role.isPresent() && role.get().getType() == SelectedRole.Type.NONE) {
        return Stream.of(PUBLIC_ROLE_NAME);
    }
    HivePrincipal principal;
    if (!role.isPresent() || role.get().getType() == SelectedRole.Type.ALL) {
        principal = new HivePrincipal(USER, identity.getUser());
    } else {
        principal = new HivePrincipal(ROLE, role.get().getRole().get());
    }
    Stream<String> roles = Stream.of(PUBLIC_ROLE_NAME);
    if (principal.getType() == ROLE) {
        roles = Stream.concat(roles, Stream.of(principal.getName()));
    }
    return Stream.concat(roles, listApplicableRoles(principal, listRoleGrants).map(RoleGrant::getRoleName).filter(Predicate.isEqual(ADMIN_ROLE_NAME).negate()));
}