Examples with HiveAccessControlException org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException used on opensource projects

Example 1 with HiveAccessControlException

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException in project hive by apache.

the class SQLStdHiveAccessController method grantRole.

@Override
public void grantRole(List<HivePrincipal> hivePrincipals, List<String> roleNames, boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthzPluginException, HiveAccessControlException {
    if (!(isUserAdmin() || doesUserHasAdminOption(roleNames))) {
        throw new HiveAccessControlException("Current user : " + currentUserName + " is not" + " allowed to grant role. " + ADMIN_ONLY_MSG + " Otherwise, " + HAS_ADMIN_PRIV_MSG);
    }
    for (HivePrincipal hivePrincipal : hivePrincipals) {
        for (String roleName : roleNames) {
            try {
                IMetaStoreClient mClient = metastoreClientFactory.getHiveMetastoreClient();
                mClient.grant_role(roleName, hivePrincipal.getName(), AuthorizationUtils.getThriftPrincipalType(hivePrincipal.getType()), grantorPrinc.getName(), AuthorizationUtils.getThriftPrincipalType(grantorPrinc.getType()), grantOption);
            } catch (MetaException e) {
                throw SQLAuthorizationUtils.getPluginException("Error granting role", e);
            } catch (Exception e) {
                String msg = "Error granting roles for " + hivePrincipal.getName() + " to role " + roleName;
                throw SQLAuthorizationUtils.getPluginException(msg, e);
            }
        }
    }
}

Example 2 with HiveAccessControlException

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException in project hive by apache.

the class SQLStdHiveAccessController method revokePrivileges.

@Override
public void revokePrivileges(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException, HiveAccessControlException {
    hivePrivileges = expandAndValidatePrivileges(hivePrivileges);
    IMetaStoreClient metastoreClient = metastoreClientFactory.getHiveMetastoreClient();
    // authorize the revoke, and get the set of privileges to be revoked
    List<HiveObjectPrivilege> revokePrivs = RevokePrivAuthUtils.authorizeAndGetRevokePrivileges(hivePrincipals, hivePrivileges, hivePrivObject, grantOption, metastoreClient, authenticator.getUserName());
    try {
        // unfortunately, the metastore api revokes all privileges that match on
        // principal, privilege object type it does not filter on the grator
        // username.
        // So this will revoke privileges that are granted by other users.This is
        // not SQL compliant behavior. Need to change/add a metastore api
        // that has desired behavior.
        metastoreClient.revoke_privileges(new PrivilegeBag(revokePrivs), grantOption);
    } catch (Exception e) {
        throw SQLAuthorizationUtils.getPluginException("Error revoking privileges", e);
    }
}

Example 3 with HiveAccessControlException

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException in project hive by apache.

the class SQLStdHiveAccessController method setCurrentRole.

@Override
public void setCurrentRole(String roleName) throws HiveAccessControlException, HiveAuthzPluginException {
    initUserRoles();
    if (NONE.equalsIgnoreCase(roleName)) {
        // for set role NONE, clear all roles for current session.
        currentRoles.clear();
        return;
    }
    if (ALL.equalsIgnoreCase(roleName)) {
        // for set role ALL, reset roles to default roles.
        currentRoles.clear();
        currentRoles.addAll(getRolesFromMS());
        return;
    }
    for (HiveRoleGrant role : getRolesFromMS()) {
        // set to one of the roles user belongs to.
        if (role.getRoleName().equalsIgnoreCase(roleName)) {
            currentRoles.clear();
            currentRoles.add(role);
            return;
        }
    }
    // set to ADMIN role, if user belongs there.
    if (HiveMetaStore.ADMIN.equalsIgnoreCase(roleName) && null != this.adminRole) {
        currentRoles.clear();
        currentRoles.add(adminRole);
        return;
    }
    LOG.info("Current user : " + currentUserName + ", Current Roles : " + currentRoles);
    // If we are here it means, user is requesting a role he doesn't belong to.
    throw new HiveAccessControlException(currentUserName + " doesn't belong to role " + roleName);
}

Example 4 with HiveAccessControlException

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException in project hive by apache.

the class SQLStdHiveAccessController method createRole.

@Override
public void createRole(String roleName, HivePrincipal adminGrantor) throws HiveAuthzPluginException, HiveAccessControlException {
    // only user belonging to admin role can create new roles.
    if (!isUserAdmin()) {
        throw new HiveAccessControlException("Current user : " + currentUserName + " is not" + " allowed to add roles. " + ADMIN_ONLY_MSG);
    }
    if (RESERVED_ROLE_NAMES.contains(roleName.trim().toUpperCase())) {
        throw new HiveAuthzPluginException("Role name cannot be one of the reserved roles: " + RESERVED_ROLE_NAMES);
    }
    try {
        String grantorName = adminGrantor == null ? null : adminGrantor.getName();
        metastoreClientFactory.getHiveMetastoreClient().create_role(new Role(roleName, 0, grantorName));
    } catch (TException e) {
        throw SQLAuthorizationUtils.getPluginException("Error create role", e);
    }
}

Example 5 with HiveAccessControlException

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException in project hive by apache.

the class SQLStdHiveAccessController method revokeRole.

@Override
public void revokeRole(List<HivePrincipal> hivePrincipals, List<String> roleNames, boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthzPluginException, HiveAccessControlException {
    if (!(isUserAdmin() || doesUserHasAdminOption(roleNames))) {
        throw new HiveAccessControlException("Current user : " + currentUserName + " is not" + " allowed to revoke role. " + ADMIN_ONLY_MSG + " Otherwise, " + HAS_ADMIN_PRIV_MSG);
    }
    for (HivePrincipal hivePrincipal : hivePrincipals) {
        for (String roleName : roleNames) {
            try {
                IMetaStoreClient mClient = metastoreClientFactory.getHiveMetastoreClient();
                mClient.revoke_role(roleName, hivePrincipal.getName(), AuthorizationUtils.getThriftPrincipalType(hivePrincipal.getType()), grantOption);
            } catch (Exception e) {
                String msg = "Error revoking roles for " + hivePrincipal.getName() + " to role " + roleName;
                throw SQLAuthorizationUtils.getPluginException(msg, e);
            }
        }
    }
}