Examples with HivePrivilegeObject org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject used on opensource projects

Example 46 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class AddPartitionEvent method getOutputHObjs.

private List<HivePrivilegeObject> getOutputHObjs() {
    LOG.debug("==> AddPartitionEvent.getOutputHObjs()");
    List<HivePrivilegeObject> ret = new ArrayList<>();
    PreAddPartitionEvent event = (PreAddPartitionEvent) preEventContext;
    Table table = event.getTable();
    ret.add(getHivePrivilegeObject(table));
    List<Partition> partitions = event.getPartitions();
    if (partitions != null) {
        for (Partition partition : partitions) {
            String uri = getSdLocation(partition.getSd());
            if (StringUtils.isNotEmpty(uri)) {
                ret.add(getHivePrivilegeObjectDfsUri(uri));
            }
        }
    }
    COMMAND_STR = buildCommandString(COMMAND_STR, table);
    LOG.debug("<== AddPartitionEvent.getOutputHObjs(): ret={}", ret);
    return ret;
}

Example 47 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class CreateDatabaseEvent method getOutputHObjs.

private List<HivePrivilegeObject> getOutputHObjs() {
    LOG.debug("==> CreateDatabaseEvent.getOutputHObjs()");
    List<HivePrivilegeObject> ret = new ArrayList<>();
    PreCreateDatabaseEvent event = (PreCreateDatabaseEvent) preEventContext;
    Database database = event.getDatabase();
    String uri = (database != null) ? database.getLocationUri() : "";
    if (database != null) {
        ret.add(getHivePrivilegeObject(database));
        if (StringUtils.isNotEmpty(uri)) {
            ret.add(getHivePrivilegeObjectDfsUri(uri));
        }
        COMMAND_STR = buildCommandString(COMMAND_STR, database);
        LOG.debug("<== CreateDatabaseEvent.getOutputHObjs(): ret={}", ret);
    }
    return ret;
}

Example 48 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class CreateTableEvent method getOutputHObjs.

private List<HivePrivilegeObject> getOutputHObjs() {
    LOG.debug("==> CreateTableEvent.getOutputHObjs()");
    List<HivePrivilegeObject> ret = new ArrayList<>();
    PreCreateTableEvent event = (PreCreateTableEvent) preEventContext;
    Table table = event.getTable();
    String uri = getSdLocation(table.getSd());
    ret.add(getHivePrivilegeObject(table));
    if (StringUtils.isNotEmpty(uri)) {
        ret.add(new HivePrivilegeObject(HivePrivilegeObjectType.DFS_URI, null, uri));
    }
    COMMAND_STR = buildCommandString(COMMAND_STR, table);
    LOG.debug("<== CreateTableEvent.getOutputHObjs(): ret={}", ret);
    return ret;
}

Example 49 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class DropFunctionEvent method getInputHObjs.

private List<HivePrivilegeObject> getInputHObjs() {
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> DropFunctionEvent.getInputHObjs()");
    }
    List<HivePrivilegeObject> ret = new ArrayList<>();
    PreDropFunctionEvent event = (PreDropFunctionEvent) preEventContext;
    Function function = event.getFunction();
    List<ResourceUri> uris = function.getResourceUris();
    ret.add(new HivePrivilegeObject(HivePrivilegeObject.HivePrivilegeObjectType.FUNCTION, function.getDbName(), function.getFunctionName(), null, null, HivePrivilegeObject.HivePrivObjectActionType.OTHER, null, function.getClassName(), function.getOwnerName(), function.getOwnerType()));
    if (uris != null && !uris.isEmpty()) {
        for (ResourceUri uri : uris) {
            ret.add(new HivePrivilegeObject(HivePrivilegeObject.HivePrivilegeObjectType.DFS_URI, null, uri.getUri()));
        }
    }
    COMMAND_STR = buildCommandString(function);
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== DropFunctionEvent.getInputHObjs(): ret=" + ret);
    }
    return ret;
}

Example 50 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class SQLStdHiveAuthorizationValidator method checkPrivileges.

private void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> hiveObjects, IMetaStoreClient metastoreClient, String userName, IOType ioType, List<String> deniedMessages) throws HiveAuthzPluginException, HiveAccessControlException {
    if (hiveObjects == null) {
        return;
    }
    // Special-casing for ADMIN-level operations that do not require object checking.
    if (Operation2Privilege.isAdminPrivOperation(hiveOpType)) {
        // Require ADMIN privilege
        if (!privController.isUserAdmin()) {
            deniedMessages.add(SQLPrivTypeGrant.ADMIN_PRIV.toString() + " on " + ioType);
        }
        // Ignore object, fail if not admin, succeed if admin.
        return;
    }
    // Compare required privileges and available privileges for each hive object
    for (HivePrivilegeObject hiveObj : hiveObjects) {
        RequiredPrivileges requiredPrivs = Operation2Privilege.getRequiredPrivs(hiveOpType, hiveObj, ioType);
        if (requiredPrivs.getRequiredPrivilegeSet().isEmpty()) {
            // no privileges required, so don't need to check this object privileges
            continue;
        }
        // find available privileges
        // start with an empty priv set;
        RequiredPrivileges availPrivs = new RequiredPrivileges();
        switch(hiveObj.getType()) {
            case LOCAL_URI:
            case DFS_URI:
                availPrivs = SQLAuthorizationUtils.getPrivilegesFromFS(new Path(hiveObj.getObjectName()), conf, userName);
                break;
            case PARTITION:
                // ignore partitions
                continue;
            case COMMAND_PARAMS:
            case SERVICE_NAME:
                // solely on the type
                if (privController.isUserAdmin()) {
                    availPrivs.addPrivilege(SQLPrivTypeGrant.ADMIN_PRIV);
                }
                break;
            case FUNCTION:
                // standard authorization.
                continue;
            default:
                availPrivs = SQLAuthorizationUtils.getPrivilegesFromMetaStore(metastoreClient, userName, hiveObj, privController.getCurrentRoleNames(), privController.isUserAdmin());
        }
        // Verify that there are no missing privileges
        Collection<SQLPrivTypeGrant> missingPriv = requiredPrivs.findMissingPrivs(availPrivs);
        SQLAuthorizationUtils.addMissingPrivMsg(missingPriv, hiveObj, deniedMessages);
    }
}