Examples with HivePrivilegeObject org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject used on opensource projects

Example 16 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class SQLStdHiveAuthorizationValidator method checkPrivileges.

private void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> hiveObjects, IMetaStoreClient metastoreClient, String userName, IOType ioType, List<String> deniedMessages) throws HiveAuthzPluginException, HiveAccessControlException {
    if (hiveObjects == null) {
        return;
    }
    // Special-casing for ADMIN-level operations that do not require object checking.
    if (Operation2Privilege.isAdminPrivOperation(hiveOpType)) {
        // Require ADMIN privilege
        if (!privController.isUserAdmin()) {
            deniedMessages.add(SQLPrivTypeGrant.ADMIN_PRIV.toString() + " on " + ioType);
        }
        // Ignore object, fail if not admin, succeed if admin.
        return;
    }
    // Compare required privileges and available privileges for each hive object
    for (HivePrivilegeObject hiveObj : hiveObjects) {
        RequiredPrivileges requiredPrivs = Operation2Privilege.getRequiredPrivs(hiveOpType, hiveObj, ioType);
        if (requiredPrivs.getRequiredPrivilegeSet().isEmpty()) {
            // no privileges required, so don't need to check this object privileges
            continue;
        }
        // find available privileges
        // start with an empty priv set;
        RequiredPrivileges availPrivs = new RequiredPrivileges();
        switch(hiveObj.getType()) {
            case LOCAL_URI:
            case DFS_URI:
                availPrivs = SQLAuthorizationUtils.getPrivilegesFromFS(new Path(hiveObj.getObjectName()), conf, userName);
                break;
            case PARTITION:
                // ignore partitions
                continue;
            case COMMAND_PARAMS:
            case FUNCTION:
                // solely on the type
                if (privController.isUserAdmin()) {
                    availPrivs.addPrivilege(SQLPrivTypeGrant.ADMIN_PRIV);
                }
                break;
            default:
                availPrivs = SQLAuthorizationUtils.getPrivilegesFromMetaStore(metastoreClient, userName, hiveObj, privController.getCurrentRoleNames(), privController.isUserAdmin());
        }
        // Verify that there are no missing privileges
        Collection<SQLPrivTypeGrant> missingPriv = requiredPrivs.findMissingPrivs(availPrivs);
        SQLAuthorizationUtils.addMissingPrivMsg(missingPriv, hiveObj, deniedMessages);
    }
}

Example 17 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class DDLTask method grantOrRevokePrivileges.

private int grantOrRevokePrivileges(Hive db, List<PrincipalDesc> principals, List<PrivilegeDesc> privileges, PrivilegeObjectDesc privSubjectDesc, String grantor, PrincipalType grantorType, boolean grantOption, boolean isGrant) throws HiveException {
    HiveAuthorizer authorizer = getSessionAuthorizer(db);
    // Convert to object types used by the authorization plugin interface
    List<HivePrincipal> hivePrincipals = AuthorizationUtils.getHivePrincipals(principals, getAuthorizationTranslator(authorizer));
    List<HivePrivilege> hivePrivileges = AuthorizationUtils.getHivePrivileges(privileges, getAuthorizationTranslator(authorizer));
    HivePrivilegeObject hivePrivObject = getAuthorizationTranslator(authorizer).getHivePrivilegeObject(privSubjectDesc);
    HivePrincipal grantorPrincipal = new HivePrincipal(grantor, AuthorizationUtils.getHivePrincipalType(grantorType));
    if (isGrant) {
        authorizer.grantPrivileges(hivePrincipals, hivePrivileges, hivePrivObject, grantorPrincipal, grantOption);
    } else {
        authorizer.revokePrivileges(hivePrincipals, hivePrivileges, hivePrivObject, grantorPrincipal, grantOption);
    }
    // no exception thrown, so looks good
    return 0;
}

Example 18 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class DDLTask method writeGrantInfo.

static String writeGrantInfo(List<HivePrivilegeInfo> privileges, boolean testMode) {
    if (privileges == null || privileges.isEmpty()) {
        return "";
    }
    StringBuilder builder = new StringBuilder();
    // sort the list to get sorted (deterministic) output (for ease of testing)
    Collections.sort(privileges, new Comparator<HivePrivilegeInfo>() {

        @Override
        public int compare(HivePrivilegeInfo o1, HivePrivilegeInfo o2) {
            int compare = o1.getObject().compareTo(o2.getObject());
            if (compare == 0) {
                compare = o1.getPrincipal().compareTo(o2.getPrincipal());
            }
            if (compare == 0) {
                compare = o1.getPrivilege().compareTo(o2.getPrivilege());
            }
            return compare;
        }
    });
    for (HivePrivilegeInfo privilege : privileges) {
        HivePrincipal principal = privilege.getPrincipal();
        HivePrivilegeObject resource = privilege.getObject();
        HivePrincipal grantor = privilege.getGrantorPrincipal();
        appendNonNull(builder, resource.getDbname(), true);
        appendNonNull(builder, resource.getObjectName());
        appendNonNull(builder, resource.getPartKeys());
        appendNonNull(builder, resource.getColumns());
        appendNonNull(builder, principal.getName());
        appendNonNull(builder, principal.getType());
        appendNonNull(builder, privilege.getPrivilege().getName());
        appendNonNull(builder, privilege.isGrantOption());
        appendNonNull(builder, testMode ? -1 : privilege.getGrantTime() * 1000L);
        appendNonNull(builder, grantor.getName());
    }
    return builder.toString();
}

Example 19 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project hive by apache.

the class Driver method getHivePrivObjects.

private static List<HivePrivilegeObject> getHivePrivObjects(Set<? extends Entity> privObjects, Map<String, List<String>> tableName2Cols) {
    List<HivePrivilegeObject> hivePrivobjs = new ArrayList<HivePrivilegeObject>();
    if (privObjects == null) {
        return hivePrivobjs;
    }
    for (Entity privObject : privObjects) {
        HivePrivilegeObjectType privObjType = AuthorizationUtils.getHivePrivilegeObjectType(privObject.getType());
        if (privObject.isDummy()) {
            // do not authorize dummy readEntity or writeEntity
            continue;
        }
        if (privObject instanceof ReadEntity && !((ReadEntity) privObject).isDirect()) {
            // See description of the isDirect in ReadEntity
            continue;
        }
        if (privObject instanceof WriteEntity && ((WriteEntity) privObject).isTempURI()) {
            // do not authorize temporary uris
            continue;
        }
        // support for authorization on partitions needs to be added
        String dbname = null;
        String objName = null;
        List<String> partKeys = null;
        List<String> columns = null;
        String className = null;
        switch(privObject.getType()) {
            case DATABASE:
                dbname = privObject.getDatabase().getName();
                break;
            case TABLE:
                dbname = privObject.getTable().getDbName();
                objName = privObject.getTable().getTableName();
                columns = tableName2Cols == null ? null : tableName2Cols.get(Table.getCompleteName(dbname, objName));
                break;
            case DFS_DIR:
            case LOCAL_DIR:
                objName = privObject.getD().toString();
                break;
            case FUNCTION:
                if (privObject.getDatabase() != null) {
                    dbname = privObject.getDatabase().getName();
                }
                objName = privObject.getFunctionName();
                className = privObject.getClassName();
                break;
            case DUMMYPARTITION:
            case PARTITION:
                // not currently handled
                continue;
            case SERVICE_NAME:
                objName = privObject.getServiceName();
                break;
            default:
                throw new AssertionError("Unexpected object type");
        }
        HivePrivObjectActionType actionType = AuthorizationUtils.getActionType(privObject);
        HivePrivilegeObject hPrivObject = new HivePrivilegeObject(privObjType, dbname, objName, partKeys, columns, actionType, null, className);
        hivePrivobjs.add(hPrivObject);
    }
    return hivePrivobjs;
}

Example 20 with HivePrivilegeObject

use of org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject in project ranger by apache.

the class RangerHivePlugin method applyRowFilterAndColumnMasking.

@Override
public List<HivePrivilegeObject> applyRowFilterAndColumnMasking(HiveAuthzContext queryContext, List<HivePrivilegeObject> hiveObjs) throws SemanticException {
    List<HivePrivilegeObject> ret = new ArrayList<HivePrivilegeObject>();
    if (LOG.isDebugEnabled()) {
        LOG.debug("==> applyRowFilterAndColumnMasking(" + queryContext + ", objCount=" + hiveObjs.size() + ")");
    }
    RangerPerfTracer perf = null;
    if (RangerPerfTracer.isPerfTraceEnabled(PERF_HIVEAUTH_REQUEST_LOG)) {
        perf = RangerPerfTracer.getPerfTracer(PERF_HIVEAUTH_REQUEST_LOG, "RangerHiveAuthorizer.applyRowFilterAndColumnMasking()");
    }
    if (CollectionUtils.isNotEmpty(hiveObjs)) {
        for (HivePrivilegeObject hiveObj : hiveObjs) {
            HivePrivilegeObjectType hiveObjType = hiveObj.getType();
            if (hiveObjType == null) {
                hiveObjType = HivePrivilegeObjectType.TABLE_OR_VIEW;
            }
            if (LOG.isDebugEnabled()) {
                LOG.debug("applyRowFilterAndColumnMasking(hiveObjType=" + hiveObjType + ")");
            }
            boolean needToTransform = false;
            if (hiveObjType == HivePrivilegeObjectType.TABLE_OR_VIEW) {
                String database = hiveObj.getDbname();
                String table = hiveObj.getObjectName();
                String rowFilterExpr = getRowFilterExpression(queryContext, database, table);
                if (StringUtils.isNotBlank(rowFilterExpr)) {
                    if (LOG.isDebugEnabled()) {
                        LOG.debug("rowFilter(database=" + database + ", table=" + table + "): " + rowFilterExpr);
                    }
                    hiveObj.setRowFilterExpression(rowFilterExpr);
                    needToTransform = true;
                }
                if (CollectionUtils.isNotEmpty(hiveObj.getColumns())) {
                    List<String> columnTransformers = new ArrayList<String>();
                    for (String column : hiveObj.getColumns()) {
                        boolean isColumnTransformed = addCellValueTransformerAndCheckIfTransformed(queryContext, database, table, column, columnTransformers);
                        if (LOG.isDebugEnabled()) {
                            LOG.debug("addCellValueTransformerAndCheckIfTransformed(database=" + database + ", table=" + table + ", column=" + column + "): " + isColumnTransformed);
                        }
                        needToTransform = needToTransform || isColumnTransformed;
                    }
                    hiveObj.setCellValueTransformers(columnTransformers);
                }
            }
            if (needToTransform) {
                ret.add(hiveObj);
            }
        }
    }
    RangerPerfTracer.log(perf);
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== applyRowFilterAndColumnMasking(" + queryContext + ", objCount=" + hiveObjs.size() + "): retCount=" + ret.size());
    }
    return ret;
}