Examples with HiveAuthzPluginException org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException used on opensource projects

Example 16 with HiveAuthzPluginException

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException in project hive by apache.

the class GenericUDFRestrictInformationSchema method initialize.

@Override
public ObjectInspector initialize(ObjectInspector[] arguments) throws UDFArgumentException {
    if (arguments.length != 0) {
        throw new UDFArgumentLengthException("The function RestrictInformationSchema does not take any arguments, but found " + arguments.length);
    }
    if (enabled == null) {
        HiveConf hiveConf = SessionState.getSessionConf();
        boolean enableHS2PolicyProvider = false;
        boolean enableMetastorePolicyProvider = false;
        HiveAuthorizer authorizer = SessionState.get().getAuthorizerV2();
        try {
            if (hiveConf.getBoolVar(HiveConf.ConfVars.HIVE_AUTHORIZATION_ENABLED) && authorizer.getHivePolicyProvider() != null) {
                enableHS2PolicyProvider = true;
            }
        } catch (HiveAuthzPluginException e) {
            LOG.warn("Error getting HivePolicyProvider", e);
        }
        if (!enableHS2PolicyProvider) {
            if (MetastoreConf.getVar(hiveConf, MetastoreConf.ConfVars.PRE_EVENT_LISTENERS) != null && !MetastoreConf.getVar(hiveConf, MetastoreConf.ConfVars.PRE_EVENT_LISTENERS).isEmpty() && HiveConf.getVar(hiveConf, HiveConf.ConfVars.HIVE_METASTORE_AUTHORIZATION_MANAGER) != null) {
                List<HiveMetastoreAuthorizationProvider> authorizerProviders;
                try {
                    authorizerProviders = HiveUtils.getMetaStoreAuthorizeProviderManagers(hiveConf, HiveConf.ConfVars.HIVE_METASTORE_AUTHORIZATION_MANAGER, SessionState.get().getAuthenticator());
                    for (HiveMetastoreAuthorizationProvider authProvider : authorizerProviders) {
                        if (authProvider.getHivePolicyProvider() != null) {
                            enableMetastorePolicyProvider = true;
                            break;
                        }
                    }
                } catch (HiveAuthzPluginException e) {
                    LOG.warn("Error getting HivePolicyProvider", e);
                } catch (HiveException e) {
                    LOG.warn("Error instantiating hive.security.metastore.authorization.manager", e);
                }
            }
        }
        if (enableHS2PolicyProvider || enableMetastorePolicyProvider) {
            enabled = new BooleanWritable(true);
        } else {
            enabled = new BooleanWritable(false);
        }
    }
    return PrimitiveObjectInspectorFactory.writableBooleanObjectInspector;
}

Example 17 with HiveAuthzPluginException

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException in project hive by apache.

the class SQLAuthorizationUtils method getThriftPrivilegesBag.

/**
 * Create thrift privileges bag
 *
 * @param hivePrincipals
 * @param hivePrivileges
 * @param hivePrivObject
 * @param grantorPrincipal
 * @param grantOption
 * @return
 * @throws HiveAuthzPluginException
 */
static PrivilegeBag getThriftPrivilegesBag(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException {
    HiveObjectRef privObj = getThriftHiveObjectRef(hivePrivObject);
    PrivilegeBag privBag = new PrivilegeBag();
    for (HivePrivilege privilege : hivePrivileges) {
        if (privilege.getColumns() != null && privilege.getColumns().size() > 0) {
            throw new HiveAuthzPluginException("Privileges on columns not supported currently" + " in sql standard authorization mode");
        }
        if (!SUPPORTED_PRIVS_SET.contains(privilege.getName().toUpperCase(Locale.US))) {
            throw new HiveAuthzPluginException("Privilege: " + privilege.getName() + " is not supported in sql standard authorization mode");
        }
        PrivilegeGrantInfo grantInfo = getThriftPrivilegeGrantInfo(privilege, grantorPrincipal, grantOption, 0);
        for (HivePrincipal principal : hivePrincipals) {
            HiveObjectPrivilege objPriv = new HiveObjectPrivilege(privObj, principal.getName(), AuthorizationUtils.getThriftPrincipalType(principal.getType()), grantInfo, "SQL");
            privBag.addToPrivileges(objPriv);
        }
    }
    return privBag;
}

Example 18 with HiveAuthzPluginException

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException in project hive by apache.

the class SQLStdHiveAccessController method getRolesFromMS.

private List<HiveRoleGrant> getRolesFromMS() throws HiveAuthzPluginException {
    try {
        List<RolePrincipalGrant> roles = getRoleGrants(currentUserName, PrincipalType.USER);
        Map<String, HiveRoleGrant> name2Rolesmap = new HashMap<String, HiveRoleGrant>();
        getAllRoleAncestors(name2Rolesmap, roles);
        List<HiveRoleGrant> currentRoles = new ArrayList<HiveRoleGrant>(roles.size());
        for (HiveRoleGrant role : name2Rolesmap.values()) {
            if (!HMSHandler.ADMIN.equalsIgnoreCase(role.getRoleName())) {
                currentRoles.add(role);
            } else {
                this.adminRole = role;
            }
        }
        return currentRoles;
    } catch (Exception e) {
        throw SQLAuthorizationUtils.getPluginException("Failed to retrieve roles for " + currentUserName, e);
    }
}