Examples with HivePrivilegeInfo org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeInfo used on opensource projects

Example 1 with HivePrivilegeInfo

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeInfo in project hive by apache.

the class DDLTask method showGrants.

private int showGrants(Hive db, ShowGrantDesc showGrantDesc) throws HiveException {
    HiveAuthorizer authorizer = getSessionAuthorizer(db);
    try {
        List<HivePrivilegeInfo> privInfos = authorizer.showPrivileges(getAuthorizationTranslator(authorizer).getHivePrincipal(showGrantDesc.getPrincipalDesc()), getAuthorizationTranslator(authorizer).getHivePrivilegeObject(showGrantDesc.getHiveObj()));
        boolean testMode = conf.getBoolVar(HiveConf.ConfVars.HIVE_IN_TEST);
        writeToFile(writeGrantInfo(privInfos, testMode), showGrantDesc.getResFile());
    } catch (IOException e) {
        throw new HiveException("Error in show grant statement", e);
    }
    return 0;
}

Example 2 with HivePrivilegeInfo

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeInfo in project hive by apache.

the class ShowGrantOperation method writeGrantInfo.

private String writeGrantInfo(List<HivePrivilegeInfo> privileges, boolean testMode) {
    if (CollectionUtils.isEmpty(privileges)) {
        return "";
    }
    // sort the list to get sorted (deterministic) output (for ease of testing)
    Collections.sort(privileges, new Comparator<HivePrivilegeInfo>() {

        @Override
        public int compare(HivePrivilegeInfo o1, HivePrivilegeInfo o2) {
            int compare = o1.getObject().compareTo(o2.getObject());
            if (compare == 0) {
                compare = o1.getPrincipal().compareTo(o2.getPrincipal());
            }
            if (compare == 0) {
                compare = o1.getPrivilege().compareTo(o2.getPrivilege());
            }
            return compare;
        }
    });
    StringBuilder builder = new StringBuilder();
    for (HivePrivilegeInfo privilege : privileges) {
        HivePrincipal principal = privilege.getPrincipal();
        HivePrivilegeObject resource = privilege.getObject();
        HivePrincipal grantor = privilege.getGrantorPrincipal();
        ShowUtils.appendNonNull(builder, resource.getDbname(), true);
        ShowUtils.appendNonNull(builder, resource.getObjectName());
        ShowUtils.appendNonNull(builder, resource.getPartKeys());
        ShowUtils.appendNonNull(builder, resource.getColumns());
        ShowUtils.appendNonNull(builder, principal.getName());
        ShowUtils.appendNonNull(builder, principal.getType());
        ShowUtils.appendNonNull(builder, privilege.getPrivilege().getName());
        ShowUtils.appendNonNull(builder, privilege.isGrantOption());
        ShowUtils.appendNonNull(builder, testMode ? -1 : privilege.getGrantTime() * 1000L);
        ShowUtils.appendNonNull(builder, grantor.getName());
    }
    return builder.toString();
}

Example 3 with HivePrivilegeInfo

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeInfo in project hive by apache.

the class AuthorizationUtils method getPrivilegeInfos.

public static List<HivePrivilegeInfo> getPrivilegeInfos(List<HiveObjectPrivilege> privs) throws HiveException {
    List<HivePrivilegeInfo> hivePrivs = new ArrayList<HivePrivilegeInfo>();
    for (HiveObjectPrivilege priv : privs) {
        PrivilegeGrantInfo grantorInfo = priv.getGrantInfo();
        HiveObjectRef privObject = priv.getHiveObject();
        HivePrincipal hivePrincipal = getHivePrincipal(priv.getPrincipalName(), priv.getPrincipalType());
        HivePrincipal grantor = getHivePrincipal(grantorInfo.getGrantor(), grantorInfo.getGrantorType());
        HivePrivilegeObject object = getHiveObjectRef(privObject);
        HivePrivilege privilege = new HivePrivilege(grantorInfo.getPrivilege(), null);
        hivePrivs.add(new HivePrivilegeInfo(hivePrincipal, privilege, object, grantor, grantorInfo.isGrantOption(), grantorInfo.getCreateTime()));
    }
    return hivePrivs;
}

Example 4 with HivePrivilegeInfo

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeInfo in project hive by apache.

the class SQLStdHiveAccessController method showPrivileges.

@Override
public List<HivePrivilegeInfo> showPrivileges(HivePrincipal principal, HivePrivilegeObject privObj) throws HiveAuthzPluginException {
    try {
        // First authorize the call
        if (principal == null) {
            // only the admin is allowed to list privileges for any user
            if (!isUserAdmin()) {
                throw new HiveAccessControlException("User : " + currentUserName + " has to specify" + " a user name or role in the show grant. " + ADMIN_ONLY_MSG);
            }
        } else {
            // principal is specified, authorize on it
            if (!isUserAdmin()) {
                ensureShowGrantAllowed(principal);
            }
        }
        IMetaStoreClient mClient = metastoreClientFactory.getHiveMetastoreClient();
        List<HivePrivilegeInfo> resPrivInfos = new ArrayList<HivePrivilegeInfo>();
        String principalName = principal == null ? null : principal.getName();
        PrincipalType principalType = principal == null ? null : AuthorizationUtils.getThriftPrincipalType(principal.getType());
        // get metastore/thrift privilege object using metastore api
        List<HiveObjectPrivilege> msObjPrivs = mClient.list_privileges(principalName, principalType, SQLAuthorizationUtils.getThriftHiveObjectRef(privObj));
        // convert the metastore thrift objects to result objects
        for (HiveObjectPrivilege msObjPriv : msObjPrivs) {
            // result principal
            HivePrincipal resPrincipal = new HivePrincipal(msObjPriv.getPrincipalName(), AuthorizationUtils.getHivePrincipalType(msObjPriv.getPrincipalType()));
            // result privilege
            PrivilegeGrantInfo msGrantInfo = msObjPriv.getGrantInfo();
            HivePrivilege resPrivilege = new HivePrivilege(msGrantInfo.getPrivilege(), null);
            // result object
            HiveObjectRef msObjRef = msObjPriv.getHiveObject();
            if (!isSupportedObjectType(msObjRef.getObjectType())) {
                // ignore them
                continue;
            }
            HivePrivilegeObject resPrivObj = new HivePrivilegeObject(getPluginPrivilegeObjType(msObjRef.getObjectType()), msObjRef.getDbName(), msObjRef.getObjectName(), msObjRef.getPartValues(), msObjRef.getColumnName());
            // result grantor principal
            HivePrincipal grantorPrincipal = new HivePrincipal(msGrantInfo.getGrantor(), AuthorizationUtils.getHivePrincipalType(msGrantInfo.getGrantorType()));
            HivePrivilegeInfo resPrivInfo = new HivePrivilegeInfo(resPrincipal, resPrivilege, resPrivObj, grantorPrincipal, msGrantInfo.isGrantOption(), msGrantInfo.getCreateTime());
            resPrivInfos.add(resPrivInfo);
        }
        return resPrivInfos;
    } catch (Exception e) {
        throw SQLAuthorizationUtils.getPluginException("Error showing privileges", e);
    }
}

Example 5 with HivePrivilegeInfo

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeInfo in project ranger by apache.

the class RangerHivePlugin method showPrivileges.

@Override
public List<HivePrivilegeInfo> showPrivileges(HivePrincipal principal, HivePrivilegeObject privObj) throws HiveAuthzPluginException {
    List<HivePrivilegeInfo> ret;
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> RangerHiveAuthorizer.showPrivileges ==>  principal: " + principal + "HivePrivilegeObject : " + privObj.getObjectName());
    }
    if (hivePlugin == null) {
        new HiveAuthzPluginException("RangerHiveAuthorizer.showPrivileges error: hivePlugin is null");
    }
    try {
        HiveObjectRef msObjRef = AuthorizationUtils.getThriftHiveObjectRef(privObj);
        if (msObjRef.getDbName() == null) {
            throw new HiveAuthzPluginException("RangerHiveAuthorizer.showPrivileges() only supports SHOW PRIVILEGES for Hive resources and not user level");
        }
        ret = getHivePrivilegeInfos(principal, privObj);
    } catch (Exception e) {
        LOG.error("RangerHiveAuthorizer.showPrivileges() error", e);
        throw new HiveAuthzPluginException("RangerHiveAuthorizer.showPrivileges() error: " + e.getMessage(), e);
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerHiveAuthorizer.showPrivileges() Result: " + ret);
    }
    return ret;
}