Examples with MDCPrivilege org.apache.hadoop.hive.metastore.model.MDCPrivilege used on opensource projects

Example 1 with MDCPrivilege

use of org.apache.hadoop.hive.metastore.model.MDCPrivilege in project hive by apache.

the class ObjectStore method listPrincipalDCGrants.

@Override
public List<HiveObjectPrivilege> listPrincipalDCGrants(String principalName, PrincipalType principalType, String dcName) {
    List<MDCPrivilege> mDcs = listPrincipalMDCGrants(principalName, principalType, dcName);
    if (mDcs.isEmpty()) {
        return Collections.emptyList();
    }
    List<HiveObjectPrivilege> result = new ArrayList<>();
    for (int i = 0; i < mDcs.size(); i++) {
        MDCPrivilege sDC = mDcs.get(i);
        HiveObjectRef objectRef = new HiveObjectRef(HiveObjectType.DATACONNECTOR, null, dcName, null, null);
        HiveObjectPrivilege secObj = new HiveObjectPrivilege(objectRef, sDC.getPrincipalName(), principalType, new PrivilegeGrantInfo(sDC.getPrivilege(), sDC.getCreateTime(), sDC.getGrantor(), PrincipalType.valueOf(sDC.getGrantorType()), sDC.getGrantOption()), sDC.getAuthorizer());
        result.add(secObj);
    }
    return result;
}

Example 2 with MDCPrivilege

use of org.apache.hadoop.hive.metastore.model.MDCPrivilege in project hive by apache.

the class ObjectStore method listPrincipalMDCGrants.

private List<MDCPrivilege> listPrincipalMDCGrants(String principalName, PrincipalType principalType, String dcName, String authorizer) {
    boolean success = false;
    Query query = null;
    List<MDCPrivilege> mSecurityDCList = new ArrayList<>();
    dcName = normalizeIdentifier(dcName);
    try {
        LOG.debug("Executing listPrincipalDCGrants");
        openTransaction();
        List<MDCPrivilege> mPrivs;
        if (authorizer != null) {
            query = pm.newQuery(MDCPrivilege.class, "principalName == t1 && principalType == t2 && dataConnector.name == t3 && " + "authorizer == t4");
            query.declareParameters("java.lang.String t1, java.lang.String t2, java.lang.String t3, " + "java.lang.String t4");
            mPrivs = (List<MDCPrivilege>) query.executeWithArray(principalName, principalType.toString(), dcName, authorizer);
        } else {
            query = pm.newQuery(MDCPrivilege.class, "principalName == t1 && principalType == t2 && dataConnector.name == t3");
            query.declareParameters("java.lang.String t1, java.lang.String t2, java.lang.String t3");
            mPrivs = (List<MDCPrivilege>) query.executeWithArray(principalName, principalType.toString(), dcName);
        }
        pm.retrieveAll(mPrivs);
        success = commitTransaction();
        mSecurityDCList.addAll(mPrivs);
        LOG.debug("Done retrieving all objects for listPrincipalDCGrants");
    } finally {
        rollbackAndCleanup(success, query);
    }
    return mSecurityDCList;
}

Example 3 with MDCPrivilege

use of org.apache.hadoop.hive.metastore.model.MDCPrivilege in project hive by apache.

the class ObjectStore method revokePrivileges.

@Override
public boolean revokePrivileges(PrivilegeBag privileges, boolean grantOption) throws InvalidObjectException, MetaException, NoSuchObjectException {
    boolean committed = false;
    try {
        openTransaction();
        List<Object> persistentObjs = new ArrayList<>();
        List<HiveObjectPrivilege> privilegeList = privileges.getPrivileges();
        if (CollectionUtils.isNotEmpty(privilegeList)) {
            Iterator<HiveObjectPrivilege> privIter = privilegeList.iterator();
            while (privIter.hasNext()) {
                HiveObjectPrivilege privDef = privIter.next();
                HiveObjectRef hiveObject = privDef.getHiveObject();
                String privilegeStr = privDef.getGrantInfo().getPrivilege();
                if (privilegeStr == null || privilegeStr.trim().equals("")) {
                    continue;
                }
                String[] privs = privilegeStr.split(",");
                String userName = privDef.getPrincipalName();
                PrincipalType principalType = privDef.getPrincipalType();
                String catName = hiveObject.isSetCatName() ? hiveObject.getCatName() : getDefaultCatalog(conf);
                if (hiveObject.getObjectType() == HiveObjectType.GLOBAL) {
                    List<MGlobalPrivilege> mSecUser = this.listPrincipalMGlobalGrants(userName, principalType);
                    boolean found = false;
                    for (String privilege : privs) {
                        for (MGlobalPrivilege userGrant : mSecUser) {
                            String userGrantPrivs = userGrant.getPrivilege();
                            if (privilege.equals(userGrantPrivs)) {
                                found = true;
                                if (grantOption) {
                                    if (userGrant.getGrantOption()) {
                                        userGrant.setGrantOption(false);
                                    } else {
                                        throw new MetaException("User " + userName + " does not have grant option with privilege " + privilege);
                                    }
                                }
                                persistentObjs.add(userGrant);
                                break;
                            }
                        }
                        if (!found) {
                            throw new InvalidObjectException("No user grant found for privileges " + privilege);
                        }
                    }
                } else if (hiveObject.getObjectType() == HiveObjectType.DATABASE) {
                    MDatabase dbObj = getMDatabase(catName, hiveObject.getDbName());
                    String db = hiveObject.getDbName();
                    boolean found = false;
                    List<MDBPrivilege> dbGrants = this.listPrincipalMDBGrants(userName, principalType, catName, db);
                    for (String privilege : privs) {
                        for (MDBPrivilege dbGrant : dbGrants) {
                            String dbGrantPriv = dbGrant.getPrivilege();
                            if (privilege.equals(dbGrantPriv)) {
                                found = true;
                                if (grantOption) {
                                    if (dbGrant.getGrantOption()) {
                                        dbGrant.setGrantOption(false);
                                    } else {
                                        throw new MetaException("User " + userName + " does not have grant option with privilege " + privilege);
                                    }
                                }
                                persistentObjs.add(dbGrant);
                                break;
                            }
                        }
                        if (!found) {
                            throw new InvalidObjectException("No database grant found for privileges " + privilege + " on database " + db);
                        }
                    }
                } else if (hiveObject.getObjectType() == HiveObjectType.DATACONNECTOR) {
                    MDataConnector dCObj = getMDataConnector(hiveObject.getObjectName());
                    String dc = hiveObject.getObjectName();
                    boolean found = false;
                    List<MDCPrivilege> dcGrants = this.listPrincipalMDCGrants(userName, principalType, catName, dc);
                    for (String privilege : privs) {
                        for (MDCPrivilege dcGrant : dcGrants) {
                            String dcGrantPriv = dcGrant.getPrivilege();
                            if (privilege.equals(dcGrantPriv)) {
                                found = true;
                                if (grantOption) {
                                    if (dcGrant.getGrantOption()) {
                                        dcGrant.setGrantOption(false);
                                    } else {
                                        throw new MetaException("User " + userName + " does not have grant option with privilege " + privilege);
                                    }
                                }
                                persistentObjs.add(dcGrant);
                                break;
                            }
                        }
                        if (!found) {
                            throw new InvalidObjectException("No dataconnector grant found for privileges " + privilege + " on data connector " + dc);
                        }
                    }
                } else if (hiveObject.getObjectType() == HiveObjectType.TABLE) {
                    boolean found = false;
                    List<MTablePrivilege> tableGrants = this.listAllMTableGrants(userName, principalType, catName, hiveObject.getDbName(), hiveObject.getObjectName());
                    for (String privilege : privs) {
                        for (MTablePrivilege tabGrant : tableGrants) {
                            String tableGrantPriv = tabGrant.getPrivilege();
                            if (privilege.equalsIgnoreCase(tableGrantPriv)) {
                                found = true;
                                if (grantOption) {
                                    if (tabGrant.getGrantOption()) {
                                        tabGrant.setGrantOption(false);
                                    } else {
                                        throw new MetaException("User " + userName + " does not have grant option with privilege " + privilege);
                                    }
                                }
                                persistentObjs.add(tabGrant);
                                break;
                            }
                        }
                        if (!found) {
                            throw new InvalidObjectException("No grant (" + privilege + ") found " + " on table " + hiveObject.getObjectName() + ", database is " + hiveObject.getDbName());
                        }
                    }
                } else if (hiveObject.getObjectType() == HiveObjectType.PARTITION) {
                    boolean found = false;
                    Table tabObj = this.getTable(catName, hiveObject.getDbName(), hiveObject.getObjectName(), null);
                    String partName = null;
                    if (hiveObject.getPartValues() != null) {
                        partName = Warehouse.makePartName(tabObj.getPartitionKeys(), hiveObject.getPartValues());
                    }
                    List<MPartitionPrivilege> partitionGrants = this.listPrincipalMPartitionGrants(userName, principalType, catName, hiveObject.getDbName(), hiveObject.getObjectName(), partName);
                    for (String privilege : privs) {
                        for (MPartitionPrivilege partGrant : partitionGrants) {
                            String partPriv = partGrant.getPrivilege();
                            if (partPriv.equalsIgnoreCase(privilege)) {
                                found = true;
                                if (grantOption) {
                                    if (partGrant.getGrantOption()) {
                                        partGrant.setGrantOption(false);
                                    } else {
                                        throw new MetaException("User " + userName + " does not have grant option with privilege " + privilege);
                                    }
                                }
                                persistentObjs.add(partGrant);
                                break;
                            }
                        }
                        if (!found) {
                            throw new InvalidObjectException("No grant (" + privilege + ") found " + " on table " + tabObj.getTableName() + ", partition is " + partName + ", database is " + tabObj.getDbName());
                        }
                    }
                } else if (hiveObject.getObjectType() == HiveObjectType.COLUMN) {
                    Table tabObj = this.getTable(catName, hiveObject.getDbName(), hiveObject.getObjectName(), null);
                    String partName = null;
                    if (hiveObject.getPartValues() != null) {
                        partName = Warehouse.makePartName(tabObj.getPartitionKeys(), hiveObject.getPartValues());
                    }
                    if (partName != null) {
                        List<MPartitionColumnPrivilege> mSecCol = listPrincipalMPartitionColumnGrants(userName, principalType, catName, hiveObject.getDbName(), hiveObject.getObjectName(), partName, hiveObject.getColumnName());
                        boolean found = false;
                        for (String privilege : privs) {
                            for (MPartitionColumnPrivilege col : mSecCol) {
                                String colPriv = col.getPrivilege();
                                if (colPriv.equalsIgnoreCase(privilege)) {
                                    found = true;
                                    if (grantOption) {
                                        if (col.getGrantOption()) {
                                            col.setGrantOption(false);
                                        } else {
                                            throw new MetaException("User " + userName + " does not have grant option with privilege " + privilege);
                                        }
                                    }
                                    persistentObjs.add(col);
                                    break;
                                }
                            }
                            if (!found) {
                                throw new InvalidObjectException("No grant (" + privilege + ") found " + " on table " + tabObj.getTableName() + ", partition is " + partName + ", column name = " + hiveObject.getColumnName() + ", database is " + tabObj.getDbName());
                            }
                        }
                    } else {
                        List<MTableColumnPrivilege> mSecCol = listPrincipalMTableColumnGrants(userName, principalType, catName, hiveObject.getDbName(), hiveObject.getObjectName(), hiveObject.getColumnName());
                        boolean found = false;
                        for (String privilege : privs) {
                            for (MTableColumnPrivilege col : mSecCol) {
                                String colPriv = col.getPrivilege();
                                if (colPriv.equalsIgnoreCase(privilege)) {
                                    found = true;
                                    if (grantOption) {
                                        if (col.getGrantOption()) {
                                            col.setGrantOption(false);
                                        } else {
                                            throw new MetaException("User " + userName + " does not have grant option with privilege " + privilege);
                                        }
                                    }
                                    persistentObjs.add(col);
                                    break;
                                }
                            }
                            if (!found) {
                                throw new InvalidObjectException("No grant (" + privilege + ") found " + " on table " + tabObj.getTableName() + ", column name = " + hiveObject.getColumnName() + ", database is " + tabObj.getDbName());
                            }
                        }
                    }
                }
            }
        }
        if (CollectionUtils.isNotEmpty(persistentObjs)) {
            if (grantOption) {
            // If grant option specified, only update the privilege, don't remove it.
            // Grant option has already been removed from the privileges in the section above
            } else {
                pm.deletePersistentAll(persistentObjs);
            }
        }
        committed = commitTransaction();
    } finally {
        if (!committed) {
            rollbackTransaction();
        }
    }
    return committed;
}

Example 4 with MDCPrivilege

use of org.apache.hadoop.hive.metastore.model.MDCPrivilege in project hive by apache.

the class ObjectStore method listDataConnectorGrants.

private List<MDCPrivilege> listDataConnectorGrants(String dcName, String authorizer) throws Exception {
    LOG.debug("Executing listDataConnectorGrants");
    Preconditions.checkState(currentTransaction.isActive());
    dcName = normalizeIdentifier(dcName);
    final Query query;
    String[] args = null;
    final List<MDCPrivilege> mSecurityDCList;
    if (authorizer != null) {
        query = pm.newQuery(MDCPrivilege.class, "dataConnector.name == t1 && authorizer == t2");
        query.declareParameters("java.lang.String t1, java.lang.String t2");
        args = new String[] { dcName, authorizer };
    } else {
        query = pm.newQuery(MDCPrivilege.class, "dataConnector.name == t1");
        query.declareParameters("java.lang.String t1");
    }
    try (QueryWrapper wrapper = new QueryWrapper(query)) {
        if (args != null) {
            mSecurityDCList = (List<MDCPrivilege>) wrapper.executeWithArray(args);
        } else {
            mSecurityDCList = (List<MDCPrivilege>) wrapper.execute(dcName);
        }
        pm.retrieveAll(mSecurityDCList);
        LOG.debug("Done retrieving all objects for listDataConnectorGrants: {}", mSecurityDCList);
        return Collections.unmodifiableList(new ArrayList<>(mSecurityDCList));
    }
}

Example 5 with MDCPrivilege

use of org.apache.hadoop.hive.metastore.model.MDCPrivilege in project hive by apache.

the class ObjectStore method removeRole.

@Override
public boolean removeRole(String roleName) throws MetaException, NoSuchObjectException {
    boolean success = false;
    try {
        openTransaction();
        MRole mRol = getMRole(roleName);
        pm.retrieve(mRol);
        if (mRol != null) {
            // first remove all the membership, the membership that this role has
            // been granted
            List<MRoleMap> roleMap = listMRoleMembers(mRol.getRoleName());
            if (CollectionUtils.isNotEmpty(roleMap)) {
                pm.deletePersistentAll(roleMap);
            }
            List<MRoleMap> roleMember = listMSecurityPrincipalMembershipRole(mRol.getRoleName(), PrincipalType.ROLE);
            if (CollectionUtils.isNotEmpty(roleMember)) {
                pm.deletePersistentAll(roleMember);
            }
            // then remove all the grants
            List<MGlobalPrivilege> userGrants = listPrincipalMGlobalGrants(mRol.getRoleName(), PrincipalType.ROLE);
            if (CollectionUtils.isNotEmpty(userGrants)) {
                pm.deletePersistentAll(userGrants);
            }
            List<MDBPrivilege> dbGrants = listPrincipalAllDBGrant(mRol.getRoleName(), PrincipalType.ROLE);
            if (CollectionUtils.isNotEmpty(dbGrants)) {
                pm.deletePersistentAll(dbGrants);
            }
            List<MDCPrivilege> dcGrants = listPrincipalAllDCGrant(mRol.getRoleName(), PrincipalType.ROLE);
            if (CollectionUtils.isNotEmpty(dcGrants)) {
                pm.deletePersistentAll(dcGrants);
            }
            List<MTablePrivilege> tabPartGrants = listPrincipalAllTableGrants(mRol.getRoleName(), PrincipalType.ROLE);
            if (CollectionUtils.isNotEmpty(tabPartGrants)) {
                pm.deletePersistentAll(tabPartGrants);
            }
            List<MPartitionPrivilege> partGrants = listPrincipalAllPartitionGrants(mRol.getRoleName(), PrincipalType.ROLE);
            if (CollectionUtils.isNotEmpty(partGrants)) {
                pm.deletePersistentAll(partGrants);
            }
            List<MTableColumnPrivilege> tblColumnGrants = listPrincipalAllTableColumnGrants(mRol.getRoleName(), PrincipalType.ROLE);
            if (CollectionUtils.isNotEmpty(tblColumnGrants)) {
                pm.deletePersistentAll(tblColumnGrants);
            }
            List<MPartitionColumnPrivilege> partColumnGrants = listPrincipalAllPartitionColumnGrants(mRol.getRoleName(), PrincipalType.ROLE);
            if (CollectionUtils.isNotEmpty(partColumnGrants)) {
                pm.deletePersistentAll(partColumnGrants);
            }
            // finally remove the role
            pm.deletePersistent(mRol);
        }
        success = commitTransaction();
    } catch (Exception e) {
        throw new MetaException(e.getMessage());
    } finally {
        rollbackAndCleanup(success, null);
    }
    return success;
}