You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sentry.apache.org by br...@apache.org on 2013/10/22 21:22:06 UTC
[5/5] git commit: SENTRY-43 - Refactor into policy specific modules
(Gregory Chanan via Brock Noland)
SENTRY-43 - Refactor into policy specific modules (Gregory Chanan via Brock Noland)
Project: http://git-wip-us.apache.org/repos/asf/incubator-sentry/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-sentry/commit/77ac2593
Tree: http://git-wip-us.apache.org/repos/asf/incubator-sentry/tree/77ac2593
Diff: http://git-wip-us.apache.org/repos/asf/incubator-sentry/diff/77ac2593
Branch: refs/heads/master
Commit: 77ac2593fd70fe232ee23eb7208f0595c5ad4cdc
Parents: 44f44e1
Author: Brock Noland <br...@apache.org>
Authored: Tue Oct 22 14:21:49 2013 -0500
Committer: Brock Noland <br...@apache.org>
Committed: Tue Oct 22 14:21:49 2013 -0500
----------------------------------------------------------------------
pom.xml | 11 +-
sentry-binding/sentry-binding-hive/pom.xml | 2 +-
.../binding/hive/authz/HiveAuthzBinding.java | 6 +-
.../sentry/binding/hive/conf/HiveAuthzConf.java | 2 +-
sentry-binding/sentry-binding-solr/pom.xml | 3 +-
.../binding/solr/authz/SolrAuthzBinding.java | 4 +-
.../sentry/binding/solr/conf/SolrAuthzConf.java | 2 +-
.../core/common/AuthorizationProvider.java | 38 ---
.../core/common/NoAuthorizationProvider.java | 30 --
sentry-dist/pom.xml | 8 +-
sentry-dist/src/main/assembly/src.xml | 7 +-
sentry-policy/pom.xml | 38 +++
sentry-policy/sentry-policy-common/pom.xml | 45 +++
.../sentry/policy/common/PermissionFactory.java | 26 ++
.../sentry/policy/common/PolicyEngine.java | 46 +++
.../sentry/policy/common/RoleValidator.java | 26 ++
sentry-policy/sentry-policy-db/pom.xml | 92 ++++++
.../policy/db/AbstractDBRoleValidator.java | 50 ++++
.../sentry/policy/db/DBModelAuthorizables.java | 60 ++++
.../sentry/policy/db/DBWildcardPermission.java | 197 +++++++++++++
.../sentry/policy/db/DatabaseMustMatch.java | 43 +++
.../policy/db/DatabaseRequiredInRole.java | 70 +++++
.../sentry/policy/db/ServerNameMustMatch.java | 43 +++
.../sentry/policy/db/ServersAllIsInvalid.java | 39 +++
.../sentry/policy/db/SimpleDBPolicyEngine.java | 142 ++++++++++
.../db/AbstractTestSimplePolicyEngine.java | 163 +++++++++++
.../sentry/policy/db/DBPolicyFileBackend.java | 26 ++
.../policy/db/TestDBModelAuthorizables.java | 81 ++++++
.../policy/db/TestDBWildcardPermission.java | 283 +++++++++++++++++++
.../policy/db/TestDatabaseRequiredInRole.java | 48 ++++
.../policy/db/TestPolicyParsingNegative.java | 240 ++++++++++++++++
...sourceAuthorizationProviderGeneralCases.java | 178 ++++++++++++
...sourceAuthorizationProviderSpecialCases.java | 121 ++++++++
.../policy/db/TestSimpleDBPolicyEngineDFS.java | 118 ++++++++
.../db/TestSimpleDBPolicyEngineLocalFS.java | 43 +++
.../src/test/resources/log4j.properties | 31 ++
.../test-authz-provider-other-group.ini | 22 ++
.../src/test/resources/test-authz-provider.ini | 32 +++
sentry-policy/sentry-policy-search/pom.xml | 86 ++++++
.../search/AbstractSearchRoleValidator.java | 50 ++++
.../policy/search/CollectionRequiredInRole.java | 44 +++
.../policy/search/SearchModelAuthorizables.java | 48 ++++
.../policy/search/SearchWildcardPermission.java | 152 ++++++++++
.../policy/search/SimpleSearchPolicyEngine.java | 114 ++++++++
.../search/AbstractTestSearchPolicyEngine.java | 133 +++++++++
.../policy/search/SearchPolicyFileBackend.java | 26 ++
.../search/TestCollectionRequiredInRole.java | 62 ++++
...SearchAuthorizationProviderGeneralCases.java | 179 ++++++++++++
...SearchAuthorizationProviderSpecialCases.java | 81 ++++++
.../search/TestSearchModelAuthorizables.java | 60 ++++
.../search/TestSearchPolicyEngineDFS.java | 81 ++++++
.../search/TestSearchPolicyEngineLocalFS.java | 43 +++
.../policy/search/TestSearchPolicyNegative.java | 111 ++++++++
.../search/TestSearchWildcardPermission.java | 206 ++++++++++++++
.../src/test/resources/log4j.properties | 31 ++
.../src/test/resources/test-authz-provider.ini | 31 ++
sentry-provider/pom.xml | 2 -
sentry-provider/sentry-provider-common/pom.xml | 4 +-
.../provider/common/AuthorizationProvider.java | 41 +++
.../common/NoAuthorizationProvider.java | 34 +++
.../provider/common/PermissionFactory.java | 26 --
.../sentry/provider/common/PolicyEngine.java | 46 ---
.../sentry/provider/common/ProviderBackend.java | 1 +
.../sentry/provider/common/RoleValidator.java | 26 --
...adoopGroupResourceAuthorizationProvider.java | 3 +-
...LocalGroupResourceAuthorizationProvider.java | 2 +-
.../file/ResourceAuthorizationProvider.java | 6 +-
.../file/SimpleFileProviderBackend.java | 2 +-
.../sentry-provider-policy-db/pom.xml | 92 ------
.../provider/db/AbstractDBRoleValidator.java | 50 ----
.../provider/db/DBModelAuthorizables.java | 60 ----
.../provider/db/DBWildcardPermission.java | 197 -------------
.../sentry/provider/db/DatabaseMustMatch.java | 43 ---
.../provider/db/DatabaseRequiredInRole.java | 70 -----
.../sentry/provider/db/ServerNameMustMatch.java | 43 ---
.../sentry/provider/db/ServersAllIsInvalid.java | 39 ---
.../provider/db/SimpleDBPolicyEngine.java | 142 ----------
.../db/AbstractTestSimplePolicyEngine.java | 163 -----------
.../sentry/provider/db/DBPolicyFileBackend.java | 26 --
.../provider/db/TestDBModelAuthorizables.java | 81 ------
.../provider/db/TestDBWildcardPermission.java | 283 -------------------
.../provider/db/TestDatabaseRequiredInRole.java | 48 ----
.../provider/db/TestPolicyParsingNegative.java | 240 ----------------
...sourceAuthorizationProviderGeneralCases.java | 178 ------------
...sourceAuthorizationProviderSpecialCases.java | 121 --------
.../db/TestSimpleDBPolicyEngineDFS.java | 118 --------
.../db/TestSimpleDBPolicyEngineLocalFS.java | 43 ---
.../src/test/resources/log4j.properties | 31 --
.../test-authz-provider-other-group.ini | 22 --
.../src/test/resources/test-authz-provider.ini | 32 ---
.../sentry-provider-policy-search/pom.xml | 86 ------
.../search/AbstractSearchRoleValidator.java | 50 ----
.../search/CollectionRequiredInRole.java | 44 ---
.../search/SearchModelAuthorizables.java | 48 ----
.../search/SearchWildcardPermission.java | 152 ----------
.../search/SimpleSearchPolicyEngine.java | 114 --------
.../search/AbstractTestSearchPolicyEngine.java | 133 ---------
.../search/SearchPolicyFileBackend.java | 26 --
.../search/TestCollectionRequiredInRole.java | 62 ----
...SearchAuthorizationProviderGeneralCases.java | 179 ------------
...SearchAuthorizationProviderSpecialCases.java | 81 ------
.../search/TestSearchModelAuthorizables.java | 60 ----
.../search/TestSearchPolicyEngineDFS.java | 81 ------
.../search/TestSearchPolicyEngineLocalFS.java | 43 ---
.../search/TestSearchPolicyNegative.java | 111 --------
.../search/TestSearchWildcardPermission.java | 206 --------------
.../src/test/resources/log4j.properties | 31 --
.../src/test/resources/test-authz-provider.ini | 31 --
sentry-tests/sentry-tests-hive/pom.xml | 2 +-
.../tests/e2e/hive/TestPerDBConfiguration.java | 2 +-
110 files changed, 3957 insertions(+), 3854 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/pom.xml
----------------------------------------------------------------------
diff --git a/pom.xml b/pom.xml
index cc41c76..997b1f4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -262,13 +262,18 @@ limitations under the License.
</dependency>
<dependency>
<groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-policy-db</artifactId>
+ <artifactId>sentry-policy-common</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-policy-db</artifactId>
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-policy-search</artifactId>
+ <artifactId>sentry-policy-search</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
@@ -283,6 +288,7 @@ limitations under the License.
<module>sentry-core</module>
<module>sentry-binding</module>
<module>sentry-provider</module>
+ <module>sentry-policy</module>
<module>sentry-tests</module>
<module>sentry-dist</module>
</modules>
@@ -328,6 +334,7 @@ limitations under the License.
<exclude>**.patch</exclude>
<exclude>README*</exclude>
<exclude>.project</exclude>
+ <exclude>**/target/</exclude>
<exclude>.settings</exclude>
<exclude>.metadata/</exclude>
<exclude>.classpath</exclude>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-binding/sentry-binding-hive/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-binding/sentry-binding-hive/pom.xml b/sentry-binding/sentry-binding-hive/pom.xml
index 2b09a47..74f9065 100644
--- a/sentry-binding/sentry-binding-hive/pom.xml
+++ b/sentry-binding/sentry-binding-hive/pom.xml
@@ -81,7 +81,7 @@ limitations under the License.
</dependency>
<dependency>
<groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-policy-db</artifactId>
+ <artifactId>sentry-policy-db</artifactId>
<scope>test</scope>
</dependency>
<dependency>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzBinding.java
----------------------------------------------------------------------
diff --git a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzBinding.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzBinding.java
index d0ec4de..a769991 100644
--- a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzBinding.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzBinding.java
@@ -33,14 +33,14 @@ import org.apache.hadoop.hive.ql.session.SessionState;
import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
import org.apache.sentry.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
import org.apache.sentry.core.common.Action;
-import org.apache.sentry.core.common.AuthorizationProvider;
-import org.apache.sentry.core.common.NoAuthorizationProvider;
import org.apache.sentry.core.common.Subject;
import org.apache.sentry.core.model.db.DBModelAction;
import org.apache.sentry.core.model.db.DBModelAuthorizable;
import org.apache.sentry.core.model.db.DBModelAuthorizable.AuthorizableType;
import org.apache.sentry.core.model.db.Server;
-import org.apache.sentry.provider.common.PolicyEngine;
+import org.apache.sentry.policy.common.PolicyEngine;
+import org.apache.sentry.provider.common.AuthorizationProvider;
+import org.apache.sentry.provider.common.NoAuthorizationProvider;
import org.apache.sentry.provider.common.ProviderBackend;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/conf/HiveAuthzConf.java
----------------------------------------------------------------------
diff --git a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/conf/HiveAuthzConf.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/conf/HiveAuthzConf.java
index 7df12a6..2d562a5 100644
--- a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/conf/HiveAuthzConf.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/conf/HiveAuthzConf.java
@@ -45,7 +45,7 @@ public class HiveAuthzConf extends Configuration {
"org.apache.sentry.provider.file.ResourceAuthorizationProvider"),
AUTHZ_PROVIDER_RESOURCE("sentry.hive.provider.resource", ""),
AUTHZ_PROVIDER_BACKEND("sentry.hive.provider.backend", "org.apache.sentry.provider.file.SimpleFileProviderBackend"),
- AUTHZ_POLICY_ENGINE("sentry.hive.policy.engine", "org.apache.sentry.provider.db.SimpleDBPolicyEngine"),
+ AUTHZ_POLICY_ENGINE("sentry.hive.policy.engine", "org.apache.sentry.policy.db.SimpleDBPolicyEngine"),
AUTHZ_SERVER_NAME("sentry.hive.server", "HS2"),
AUTHZ_RESTRICT_DEFAULT_DB("sentry.hive.restrict.defaultDB", "false"),
SENTRY_TESTING_MODE("sentry.hive.testing.mode", "false"),
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-binding/sentry-binding-solr/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-binding/sentry-binding-solr/pom.xml b/sentry-binding/sentry-binding-solr/pom.xml
index 554ee8a..4ed491a 100644
--- a/sentry-binding/sentry-binding-solr/pom.xml
+++ b/sentry-binding/sentry-binding-solr/pom.xml
@@ -53,8 +53,7 @@ limitations under the License.
</dependency>
<dependency>
<groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-policy-search</artifactId>
- <scope>test</scope>
+ <artifactId>sentry-policy-search</artifactId>
</dependency>
<dependency>
<groupId>org.apache.hadoop</groupId>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/authz/SolrAuthzBinding.java
----------------------------------------------------------------------
diff --git a/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/authz/SolrAuthzBinding.java b/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/authz/SolrAuthzBinding.java
index 506176c..94f9c57 100644
--- a/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/authz/SolrAuthzBinding.java
+++ b/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/authz/SolrAuthzBinding.java
@@ -20,13 +20,13 @@ import java.lang.reflect.Constructor;
import java.util.Arrays;
import java.util.Set;
-import org.apache.sentry.core.common.AuthorizationProvider;
import org.apache.sentry.core.common.Subject;
import org.apache.sentry.core.model.search.Collection;
import org.apache.sentry.core.model.search.SearchModelAction;
import org.apache.sentry.binding.solr.conf.SolrAuthzConf;
import org.apache.sentry.binding.solr.conf.SolrAuthzConf.AuthzConfVars;
-import org.apache.sentry.provider.common.PolicyEngine;
+import org.apache.sentry.policy.common.PolicyEngine;
+import org.apache.sentry.provider.common.AuthorizationProvider;
import org.apache.sentry.provider.common.ProviderBackend;
import org.slf4j.Logger;
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/conf/SolrAuthzConf.java
----------------------------------------------------------------------
diff --git a/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/conf/SolrAuthzConf.java b/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/conf/SolrAuthzConf.java
index c40c379..c9ee8ba 100644
--- a/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/conf/SolrAuthzConf.java
+++ b/sentry-binding/sentry-binding-solr/src/main/java/org/apache/sentry/binding/solr/conf/SolrAuthzConf.java
@@ -37,7 +37,7 @@ public class SolrAuthzConf extends Configuration {
"org.apache.sentry.provider.file.ResourceAuthorizationProvider"),
AUTHZ_PROVIDER_RESOURCE("sentry.solr.provider.resource", ""),
AUTHZ_PROVIDER_BACKEND("sentry.solr.provider.backend", "org.apache.sentry.provider.file.SimpleFileProviderBackend"),
- AUTHZ_POLICY_ENGINE("sentry.solr.policy.engine", "org.apache.sentry.provider.search.SimpleSearchPolicyEngine");
+ AUTHZ_POLICY_ENGINE("sentry.solr.policy.engine", "org.apache.sentry.policy.search.SimpleSearchPolicyEngine");
private final String varName;
private final String defaultVal;
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-core/sentry-core-common/src/main/java/org/apache/sentry/core/common/AuthorizationProvider.java
----------------------------------------------------------------------
diff --git a/sentry-core/sentry-core-common/src/main/java/org/apache/sentry/core/common/AuthorizationProvider.java b/sentry-core/sentry-core-common/src/main/java/org/apache/sentry/core/common/AuthorizationProvider.java
deleted file mode 100644
index 0239f12..0000000
--- a/sentry-core/sentry-core-common/src/main/java/org/apache/sentry/core/common/AuthorizationProvider.java
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.core.common;
-
-import java.util.List;
-import java.util.Set;
-
-
-public interface AuthorizationProvider {
-
- /***
- * Returns validate subject privileges on given Authorizable object
- *
- * @param subject: UserID to validate privileges
- * @param authorizableHierarchy : List of object accroding to namespace hierarchy.
- * eg. Server->Db->Table or Server->Function
- * The privileges will be validated from the higher to lower scope
- * @param actions : Privileges to validate
- * @return
- * True if the subject is authorized to perform requested action on the given object
- */
- public boolean hasAccess(Subject subject, List<? extends Authorizable> authorizableHierarchy, Set<? extends Action> actions);
-
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-core/sentry-core-common/src/main/java/org/apache/sentry/core/common/NoAuthorizationProvider.java
----------------------------------------------------------------------
diff --git a/sentry-core/sentry-core-common/src/main/java/org/apache/sentry/core/common/NoAuthorizationProvider.java b/sentry-core/sentry-core-common/src/main/java/org/apache/sentry/core/common/NoAuthorizationProvider.java
deleted file mode 100644
index 3bcd08b..0000000
--- a/sentry-core/sentry-core-common/src/main/java/org/apache/sentry/core/common/NoAuthorizationProvider.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.core.common;
-
-import java.util.List;
-import java.util.Set;
-
-public class NoAuthorizationProvider implements AuthorizationProvider {
-
- @Override
- public boolean hasAccess(Subject subject, List<? extends Authorizable> authorizableHierarchy,
- Set<? extends Action> actions) {
- return false;
- }
-
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-dist/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-dist/pom.xml b/sentry-dist/pom.xml
index 7a27b82..1190fe1 100644
--- a/sentry-dist/pom.xml
+++ b/sentry-dist/pom.xml
@@ -56,11 +56,15 @@ limitations under the License.
</dependency>
<dependency>
<groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-policy-db</artifactId>
+ <artifactId>sentry-policy-common</artifactId>
</dependency>
<dependency>
<groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-policy-search</artifactId>
+ <artifactId>sentry-policy-db</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-policy-search</artifactId>
</dependency>
</dependencies>
<build>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-dist/src/main/assembly/src.xml
----------------------------------------------------------------------
diff --git a/sentry-dist/src/main/assembly/src.xml b/sentry-dist/src/main/assembly/src.xml
index f1ebaf5..323488b 100644
--- a/sentry-dist/src/main/assembly/src.xml
+++ b/sentry-dist/src/main/assembly/src.xml
@@ -46,8 +46,10 @@
<include>org.apache.sentry:sentry-provider</include>
<include>org.apache.sentry:sentry-provider-common</include>
<include>org.apache.sentry:sentry-provider-file</include>
- <include>org.apache.sentry:sentry-provider-policy-db</include>
- <include>org.apache.sentry:sentry-provider-policy-search</include>
+ <include>org.apache.sentry:sentry-policy</include>
+ <include>org.apache.sentry:sentry-policy-common</include>
+ <include>org.apache.sentry:sentry-policy-db</include>
+ <include>org.apache.sentry:sentry-policy-search</include>
<include>org.apache.sentry:sentry-tests</include>
<include>org.apache.sentry:sentry-tests-hive</include>
<include>org.apache.sentry:sentry-dist</include>
@@ -97,6 +99,7 @@
<exclude>sentry-core/**</exclude>
<exclude>sentry-dist/**</exclude>
<exclude>sentry-provider/**</exclude>
+ <exclude>sentry-policy/**</exclude>
<exclude>sentry-test/**</exclude>
<exclude>**/target/**</exclude>
<exclude>**/.classpath</exclude>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-policy/pom.xml b/sentry-policy/pom.xml
new file mode 100644
index 0000000..75eeae2
--- /dev/null
+++ b/sentry-policy/pom.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements. See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry</artifactId>
+ <version>1.3.0-incubating-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>sentry-policy</artifactId>
+ <name>Sentry Policies</name>
+ <packaging>pom</packaging>
+
+ <modules>
+ <module>sentry-policy-common</module>
+ <module>sentry-policy-db</module>
+ <module>sentry-policy-search</module>
+ </modules>
+
+</project>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-common/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-common/pom.xml b/sentry-policy/sentry-policy-common/pom.xml
new file mode 100644
index 0000000..ce10a8c
--- /dev/null
+++ b/sentry-policy/sentry-policy-common/pom.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements. See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+ <modelVersion>4.0.0</modelVersion>
+ <parent>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-policy</artifactId>
+ <version>1.3.0-incubating-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>sentry-policy-common</artifactId>
+ <name>Sentry Policy Common</name>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-core-common</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.shiro</groupId>
+ <artifactId>shiro-core</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>com.google.guava</groupId>
+ <artifactId>guava</artifactId>
+ </dependency>
+ </dependencies>
+
+</project>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/PermissionFactory.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/PermissionFactory.java b/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/PermissionFactory.java
new file mode 100644
index 0000000..45fd7bd
--- /dev/null
+++ b/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/PermissionFactory.java
@@ -0,0 +1,26 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.common;
+
+import org.apache.shiro.authz.Permission;
+
+/**
+ * Factory for creating Shiro permissions
+ */
+public interface PermissionFactory {
+ Permission createPermission(String permission);
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/PolicyEngine.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/PolicyEngine.java b/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/PolicyEngine.java
new file mode 100644
index 0000000..693de1b
--- /dev/null
+++ b/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/PolicyEngine.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.sentry.policy.common;
+
+import java.util.List;
+
+import org.apache.sentry.core.common.Authorizable;
+
+import com.google.common.collect.ImmutableSetMultimap;
+
+public interface PolicyEngine {
+
+ /**
+ * The permission factory to use in order to compare permissions in {@link getPermission}.
+ * This is typically a factory that returns a permission used to evaluate wildcards.
+ * @return the permission factory
+ */
+ public PermissionFactory getPermissionFactory();
+
+ /**
+ * Get permissions associated with a group. Returns Strings which can be resolved
+ * by the caller. Strings are returned to separate the PolicyFile class from the
+ * type of permissions used in a policy file. Additionally it is possible further
+ * processing of the permissions is needed before resolving to a permission object.
+ * @param authorizeable object
+ * @param group name
+ * @return non-null immutable set of permissions
+ */
+ public ImmutableSetMultimap<String, String> getPermissions(List<? extends Authorizable> authorizables, List<String> groups);
+
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/RoleValidator.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/RoleValidator.java b/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/RoleValidator.java
new file mode 100644
index 0000000..8390364
--- /dev/null
+++ b/sentry-policy/sentry-policy-common/src/main/java/org/apache/sentry/policy/common/RoleValidator.java
@@ -0,0 +1,26 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.common;
+
+import javax.annotation.Nullable;
+
+import org.apache.shiro.config.ConfigurationException;
+
+public interface RoleValidator {
+
+ public void validate(@Nullable String database, String role) throws ConfigurationException;
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/pom.xml b/sentry-policy/sentry-policy-db/pom.xml
new file mode 100644
index 0000000..159cff2
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/pom.xml
@@ -0,0 +1,92 @@
+<?xml version="1.0"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements. See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+ <modelVersion>4.0.0</modelVersion>
+ <parent>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-policy</artifactId>
+ <version>1.3.0-incubating-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>sentry-policy-db</artifactId>
+ <name>Sentry Policy for Databases</name>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-common</artifactId>
+ </dependency>
+
+ <dependency>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-minicluster</artifactId>
+ <scope>test</scope>
+ </dependency>
+
+ <dependency>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>log4j</groupId>
+ <artifactId>log4j</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.shiro</groupId>
+ <artifactId>shiro-core</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>com.google.guava</groupId>
+ <artifactId>guava</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-api</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-log4j12</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-core-common</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-core-model-db</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-provider-common</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-provider-file</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-provider-common</artifactId>
+ <scope>test</scope>
+ <type>test-jar</type>
+ <version>${project.version}</version>
+ </dependency>
+ </dependencies>
+
+</project>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/AbstractDBRoleValidator.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/AbstractDBRoleValidator.java b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/AbstractDBRoleValidator.java
new file mode 100644
index 0000000..722a4be
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/AbstractDBRoleValidator.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_SPLITTER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.PRIVILEGE_PREFIX;
+
+import java.util.List;
+
+import org.apache.sentry.policy.common.RoleValidator;
+import org.apache.sentry.core.model.db.DBModelAuthorizable;
+import org.apache.shiro.config.ConfigurationException;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.Lists;
+
+public abstract class AbstractDBRoleValidator implements RoleValidator {
+
+ @VisibleForTesting
+ public static Iterable<DBModelAuthorizable> parseRole(String string) {
+ List<DBModelAuthorizable> result = Lists.newArrayList();
+ for(String section : AUTHORIZABLE_SPLITTER.split(string)) {
+ // XXX this ugly hack is because action is not an authorizeable
+ if(!section.toLowerCase().startsWith(PRIVILEGE_PREFIX)) {
+ DBModelAuthorizable authorizable = DBModelAuthorizables.from(section);
+ if(authorizable == null) {
+ String msg = "No authorizable found for " + section;
+ throw new ConfigurationException(msg);
+ }
+ result.add(authorizable);
+ }
+ }
+ return result;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DBModelAuthorizables.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DBModelAuthorizables.java b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DBModelAuthorizables.java
new file mode 100644
index 0000000..f4b32e1
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DBModelAuthorizables.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import org.apache.sentry.core.model.db.AccessURI;
+import org.apache.sentry.core.model.db.DBModelAuthorizable;
+import org.apache.sentry.core.model.db.DBModelAuthorizable.AuthorizableType;
+import org.apache.sentry.core.model.db.Database;
+import org.apache.sentry.core.model.db.Server;
+import org.apache.sentry.core.model.db.Table;
+import org.apache.sentry.core.model.db.View;
+import org.apache.sentry.provider.file.KeyValue;
+
+public class DBModelAuthorizables {
+
+ public static DBModelAuthorizable from(KeyValue keyValue) {
+ String prefix = keyValue.getKey().toLowerCase();
+ String name = keyValue.getValue().toLowerCase();
+ for(AuthorizableType type : AuthorizableType.values()) {
+ if(prefix.equalsIgnoreCase(type.name())) {
+ return from(type, name);
+ }
+ }
+ return null;
+ }
+ public static DBModelAuthorizable from(String s) {
+ return from(new KeyValue(s));
+ }
+
+ private static DBModelAuthorizable from(AuthorizableType type, String name) {
+ switch (type) {
+ case Server:
+ return new Server(name);
+ case Db:
+ return new Database(name);
+ case Table:
+ return new Table(name);
+ case View:
+ return new View(name);
+ case URI:
+ return new AccessURI(name);
+ default:
+ return null;
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DBWildcardPermission.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DBWildcardPermission.java b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DBWildcardPermission.java
new file mode 100644
index 0000000..e84e5b9
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DBWildcardPermission.java
@@ -0,0 +1,197 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// copied from apache shiro
+
+package org.apache.sentry.policy.db;
+
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_SPLITTER;
+
+import java.io.File;
+import java.io.Serializable;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.List;
+
+import org.apache.commons.lang.text.StrSubstitutor;
+import org.apache.sentry.core.model.db.AccessConstants;
+import org.apache.sentry.core.model.db.DBModelAuthorizable.AuthorizableType;
+import org.apache.sentry.policy.common.PermissionFactory;
+import org.apache.sentry.provider.file.KeyValue;
+import org.apache.sentry.provider.file.PolicyFileConstants;
+import org.apache.shiro.authz.Permission;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Preconditions;
+import com.google.common.base.Strings;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.Lists;
+
+// XXX this class is made ugly by the fact that Action is not a Authorizable.
+public class DBWildcardPermission implements Permission, Serializable {
+ private static final Logger LOGGER = LoggerFactory
+ .getLogger(DBWildcardPermission.class);
+ private static final long serialVersionUID = -6785051263922740818L;
+
+ private final ImmutableList<KeyValue> parts;
+
+ public DBWildcardPermission(String wildcardString) {
+ wildcardString = Strings.nullToEmpty(wildcardString).trim();
+ if (wildcardString.isEmpty()) {
+ throw new IllegalArgumentException("Wildcard string cannot be null or empty.");
+ }
+ List<KeyValue>parts = Lists.newArrayList();
+ for (String authorizable : AUTHORIZABLE_SPLITTER.trimResults().split(wildcardString)) {
+ if (authorizable.isEmpty()) {
+ throw new IllegalArgumentException("Privilege '" + wildcardString + "' has an empty section");
+ }
+ parts.add(new KeyValue(authorizable));
+ }
+ if (parts.isEmpty()) {
+ throw new AssertionError("Should never occur: " + wildcardString);
+ }
+ this.parts = ImmutableList.copyOf(parts);
+ }
+
+
+ @Override
+ public boolean implies(Permission p) {
+ // By default only supports comparisons with other DBWildcardPermissions
+ if (!(p instanceof DBWildcardPermission)) {
+ return false;
+ }
+
+ DBWildcardPermission wp = (DBWildcardPermission) p;
+
+ List<KeyValue> otherParts = wp.parts;
+ if(equals(wp)) {
+ return true;
+ }
+ int index = 0;
+ for (KeyValue otherPart : otherParts) {
+ // If this permission has less parts than the other permission, everything
+ // after the number of parts contained
+ // in this permission is automatically implied, so return true
+ if (parts.size() - 1 < index) {
+ return true;
+ } else {
+ KeyValue part = parts.get(index);
+ // are the keys even equal
+ if(!part.getKey().equalsIgnoreCase(otherPart.getKey())) {
+ return false;
+ }
+ if (!impliesKeyValue(part, otherPart)) {
+ return false;
+ }
+ index++;
+ }
+ }
+ // If this permission has more parts than
+ // the other parts, only imply it if
+ // all of the other parts are wildcards
+ for (; index < parts.size(); index++) {
+ KeyValue part = parts.get(index);
+ if (!part.getValue().equals(AccessConstants.ALL)) {
+ return false;
+ }
+ }
+
+ return true;
+ }
+
+ private boolean impliesKeyValue(KeyValue policyPart, KeyValue requestPart) {
+ Preconditions.checkState(policyPart.getKey().equalsIgnoreCase(requestPart.getKey()),
+ "Please report, this method should not be called with two different keys");
+ if(policyPart.getValue().equals(AccessConstants.ALL) || policyPart.equals(requestPart)) {
+ return true;
+ } else if (!PolicyFileConstants.PRIVILEGE_NAME.equalsIgnoreCase(policyPart.getKey())
+ && AccessConstants.ALL.equalsIgnoreCase(requestPart.getValue())) {
+ /* permission request is to match with any object of given type */
+ return true;
+ } else if(policyPart.getKey().equalsIgnoreCase(AuthorizableType.URI.name())) {
+ return impliesURI(policyPart.getValue(), requestPart.getValue());
+ }
+ return false;
+ }
+
+ /**
+ * URI is a a special case. For URI's, /a implies /a/b.
+ * Therefore the test is "/a/b".startsWith("/a");
+ */
+ @VisibleForTesting
+ protected static boolean impliesURI(String policy, String request) {
+ try {
+ URI policyURI = new URI(new StrSubstitutor(System.getProperties()).replace(policy));
+ URI requestURI = new URI(request);
+ if(policyURI.getScheme() == null || policyURI.getPath() == null) {
+ LOGGER.warn("Policy URI " + policy + " is not valid. Either no scheme or no path.");
+ return false;
+ }
+ if(requestURI.getScheme() == null || requestURI.getPath() == null) {
+ LOGGER.warn("Request URI " + request + " is not valid. Either no scheme or no path.");
+ return false;
+ }
+ // schemes are equal &&
+ // request path does not contain relative parts /a/../b &&
+ // request path starts with policy path &&
+ // authorities (nullable) are equal
+ String requestPath = requestURI.getPath() + File.separator;
+ String policyPath = policyURI.getPath() + File.separator;
+ if(policyURI.getScheme().equals(requestURI.getScheme()) &&
+ requestURI.getPath().equals(new URI(request).normalize().getPath()) &&
+ requestPath.startsWith(policyPath) &&
+ Strings.nullToEmpty(policyURI.getAuthority()).equals(Strings.nullToEmpty(requestURI.getAuthority()))) {
+ return true;
+ }
+ return false;
+ } catch (URISyntaxException e) {
+ LOGGER.warn("Request URI " + request + " is not a URI", e);
+ return false;
+ }
+ }
+
+ @Override
+ public String toString() {
+ return AUTHORIZABLE_JOINER.join(parts);
+ }
+
+ @Override
+ public boolean equals(Object o) {
+ if (o instanceof DBWildcardPermission) {
+ DBWildcardPermission wp = (DBWildcardPermission) o;
+ return parts.equals(wp.parts);
+ }
+ return false;
+ }
+
+ @Override
+ public int hashCode() {
+ return parts.hashCode();
+ }
+
+ public static class DBWildcardPermissionFactory implements PermissionFactory {
+ @Override
+ public Permission createPermission(String permission) {
+ return new DBWildcardPermission(permission);
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DatabaseMustMatch.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DatabaseMustMatch.java b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DatabaseMustMatch.java
new file mode 100644
index 0000000..a7c2091
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DatabaseMustMatch.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import org.apache.sentry.core.model.db.DBModelAuthorizable;
+import org.apache.sentry.core.model.db.Database;
+import org.apache.shiro.config.ConfigurationException;
+
+public class DatabaseMustMatch extends AbstractDBRoleValidator {
+
+ @Override
+ public void validate(String database, String role) throws ConfigurationException {
+ /*
+ * Rule only applies to rules in per database policy file
+ */
+ if(database != null) {
+ Iterable<DBModelAuthorizable> authorizables = parseRole(role);
+ for(DBModelAuthorizable authorizable : authorizables) {
+ if(authorizable instanceof Database &&
+ !database.equalsIgnoreCase(authorizable.getName())) {
+ String msg = "Role " + role + " references db " +
+ authorizable.getName() + ", but is only allowed to reference "
+ + database;
+ throw new ConfigurationException(msg);
+ }
+ }
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DatabaseRequiredInRole.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DatabaseRequiredInRole.java b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DatabaseRequiredInRole.java
new file mode 100644
index 0000000..48b36a6
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/DatabaseRequiredInRole.java
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import javax.annotation.Nullable;
+
+import org.apache.sentry.core.model.db.AccessURI;
+import org.apache.sentry.core.model.db.Database;
+import org.apache.sentry.core.model.db.DBModelAuthorizable;
+import org.apache.shiro.config.ConfigurationException;
+
+public class DatabaseRequiredInRole extends AbstractDBRoleValidator {
+
+ @Override
+ public void validate(@Nullable String database, String role) throws ConfigurationException {
+ /*
+ * Rule only applies to rules in per database policy file
+ */
+ if(database != null) {
+ Iterable<DBModelAuthorizable> authorizables = parseRole(role);
+ /*
+ * Each permission in a non-global file must have a database
+ * object except for URIs.
+ *
+ * We allow URIs to be specified in the per DB policy file for
+ * ease of mangeability. URIs will contain to remain server scope
+ * objects.
+ */
+ boolean foundDatabaseInAuthorizables = false;
+ boolean foundURIInAuthorizables = false;
+ boolean allowURIInAuthorizables = false;
+
+ if ("true".equalsIgnoreCase(
+ System.getProperty(SimpleDBPolicyEngine.ACCESS_ALLOW_URI_PER_DB_POLICYFILE))) {
+ allowURIInAuthorizables = true;
+ }
+
+ for(DBModelAuthorizable authorizable : authorizables) {
+ if(authorizable instanceof Database) {
+ foundDatabaseInAuthorizables = true;
+ }
+ if (authorizable instanceof AccessURI) {
+ if (foundDatabaseInAuthorizables) {
+ String msg = "URI object is specified at DB scope in " + role;
+ throw new ConfigurationException(msg);
+ }
+ foundURIInAuthorizables = true;
+ }
+ }
+ if(!foundDatabaseInAuthorizables && !(foundURIInAuthorizables && allowURIInAuthorizables)) {
+ String msg = "Missing database object in " + role;
+ throw new ConfigurationException(msg);
+ }
+ }
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/ServerNameMustMatch.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/ServerNameMustMatch.java b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/ServerNameMustMatch.java
new file mode 100644
index 0000000..8ddf1dd
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/ServerNameMustMatch.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import javax.annotation.Nullable;
+
+import org.apache.sentry.core.model.db.DBModelAuthorizable;
+import org.apache.sentry.core.model.db.Server;
+import org.apache.shiro.config.ConfigurationException;
+
+public class ServerNameMustMatch extends AbstractDBRoleValidator {
+
+ private final String serverName;
+ public ServerNameMustMatch(String serverName) {
+ this.serverName = serverName;
+ }
+ @Override
+ public void validate(@Nullable String database, String role) throws ConfigurationException {
+ Iterable<DBModelAuthorizable> authorizables = parseRole(role);
+ for(DBModelAuthorizable authorizable : authorizables) {
+ if(authorizable instanceof Server && !serverName.equalsIgnoreCase(authorizable.getName())) {
+ String msg = "Server name " + authorizable.getName() + " in "
+ + role + " is invalid. Expected " + serverName;
+ throw new ConfigurationException(msg);
+ }
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/ServersAllIsInvalid.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/ServersAllIsInvalid.java b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/ServersAllIsInvalid.java
new file mode 100644
index 0000000..9445b0b
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/ServersAllIsInvalid.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import javax.annotation.Nullable;
+
+import org.apache.sentry.core.model.db.DBModelAuthorizable;
+import org.apache.sentry.core.model.db.Server;
+import org.apache.shiro.config.ConfigurationException;
+
+public class ServersAllIsInvalid extends AbstractDBRoleValidator {
+
+ @Override
+ public void validate(@Nullable String database, String role) throws ConfigurationException {
+ Iterable<DBModelAuthorizable> authorizables = parseRole(role);
+ for(DBModelAuthorizable authorizable : authorizables) {
+ if(authorizable instanceof Server &&
+ authorizable.getName().equals(Server.ALL.getName())) {
+ String msg = "Invalid value for " + authorizable.getAuthzType() + " in " + role;
+ throw new ConfigurationException(msg);
+ }
+ }
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/SimpleDBPolicyEngine.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/SimpleDBPolicyEngine.java b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/SimpleDBPolicyEngine.java
new file mode 100644
index 0000000..1d72f87
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/main/java/org/apache/sentry/policy/db/SimpleDBPolicyEngine.java
@@ -0,0 +1,142 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import javax.annotation.Nullable;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map.Entry;
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.fs.Path;
+import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.core.model.db.AccessURI;
+import org.apache.sentry.core.model.db.Database;
+import org.apache.sentry.policy.common.PermissionFactory;
+import org.apache.sentry.policy.common.PolicyEngine;
+import org.apache.sentry.policy.common.RoleValidator;
+import org.apache.sentry.provider.common.ProviderBackend;
+import org.apache.sentry.provider.common.Roles;
+import org.apache.sentry.provider.file.SimpleFileProviderBackend;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.annotations.VisibleForTesting;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.ImmutableSetMultimap;
+import com.google.common.collect.Lists;
+
+public class SimpleDBPolicyEngine implements PolicyEngine {
+
+ private static final Logger LOGGER = LoggerFactory
+ .getLogger(SimpleDBPolicyEngine.class);
+
+ public final static String ACCESS_ALLOW_URI_PER_DB_POLICYFILE = "sentry.allow.uri.db.policyfile";
+
+ private ProviderBackend providerBackend;
+
+ public SimpleDBPolicyEngine(String serverName, ProviderBackend providerBackend) {
+ List<? extends RoleValidator> validators =
+ Lists.newArrayList(new ServersAllIsInvalid(), new DatabaseMustMatch(),
+ new DatabaseRequiredInRole(), new ServerNameMustMatch(serverName));
+ this.providerBackend = providerBackend;
+ this.providerBackend.process(validators);
+ }
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public PermissionFactory getPermissionFactory() {
+ return new DBWildcardPermission.DBWildcardPermissionFactory();
+ }
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public ImmutableSetMultimap<String, String> getPermissions(List<? extends Authorizable> authorizables, List<String> groups) {
+ String database = null;
+ Boolean isURI = false;
+ for(Authorizable authorizable : authorizables) {
+ if(authorizable instanceof Database) {
+ database = authorizable.getName();
+ }
+ if (authorizable instanceof AccessURI) {
+ isURI = true;
+ }
+ }
+
+ if(LOGGER.isDebugEnabled()) {
+ LOGGER.debug("Getting permissions for {} via {}", groups, database);
+ }
+ ImmutableSetMultimap.Builder<String, String> resultBuilder = ImmutableSetMultimap.builder();
+ for(String group : groups) {
+ resultBuilder.putAll(group, getDBRoles(database, group, isURI, providerBackend.getRoles()));
+ }
+ ImmutableSetMultimap<String, String> result = resultBuilder.build();
+ if(LOGGER.isDebugEnabled()) {
+ LOGGER.debug("result = " + result);
+ }
+ return result;
+ }
+
+ private ImmutableSet<String> getDBRoles(@Nullable String database,
+ String group, Boolean isURI, Roles roles) {
+ ImmutableSetMultimap<String, String> globalRoles = roles.getGlobalRoles();
+ ImmutableMap<String, ImmutableSetMultimap<String, String>> perDatabaseRoles = roles.getPerDatabaseRoles();
+ ImmutableSet.Builder<String> resultBuilder = ImmutableSet.builder();
+ String allowURIPerDbFile =
+ System.getProperty(SimpleDBPolicyEngine.ACCESS_ALLOW_URI_PER_DB_POLICYFILE);
+ Boolean consultPerDbRolesForURI = isURI && ("true".equalsIgnoreCase(allowURIPerDbFile));
+
+ // handle Database.ALL
+ if (Database.ALL.getName().equals(database)) {
+ for(Entry<String, ImmutableSetMultimap<String, String>> dbListEntry : perDatabaseRoles.entrySet()) {
+ if (dbListEntry.getValue().containsKey(group)) {
+ resultBuilder.addAll(dbListEntry.getValue().get(group));
+ }
+ }
+ } else if(database != null) {
+ ImmutableSetMultimap<String, String> dbPolicies = perDatabaseRoles.get(database);
+ if(dbPolicies != null && dbPolicies.containsKey(group)) {
+ resultBuilder.addAll(dbPolicies.get(group));
+ }
+ }
+
+ if (consultPerDbRolesForURI) {
+ for(String db : perDatabaseRoles.keySet()) {
+ ImmutableSetMultimap<String, String> dbPolicies = perDatabaseRoles.get(db);
+ if(dbPolicies != null && dbPolicies.containsKey(group)) {
+ resultBuilder.addAll(dbPolicies.get(group));
+ }
+ }
+ }
+
+ if(globalRoles.containsKey(group)) {
+ resultBuilder.addAll(globalRoles.get(group));
+ }
+ ImmutableSet<String> result = resultBuilder.build();
+ if(LOGGER.isDebugEnabled()) {
+ LOGGER.debug("Database {}, Group {}, Result {}",
+ new Object[]{ database, group, result});
+ }
+ return result;
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/AbstractTestSimplePolicyEngine.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/AbstractTestSimplePolicyEngine.java b/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/AbstractTestSimplePolicyEngine.java
new file mode 100644
index 0000000..89ca737
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/AbstractTestSimplePolicyEngine.java
@@ -0,0 +1,163 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.List;
+import java.util.Set;
+import java.util.TreeSet;
+
+import junit.framework.Assert;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.core.model.db.Database;
+import org.apache.sentry.policy.common.PolicyEngine;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import com.google.common.collect.Lists;
+import com.google.common.collect.Sets;
+import com.google.common.io.Files;
+
+public abstract class AbstractTestSimplePolicyEngine {
+ private static final String PERM_SERVER1_CUSTOMERS_SELECT = "server=server1->db=customers->table=purchases->action=select";
+ private static final String PERM_SERVER1_CUSTOMERS_DB_CUSTOMERS_PARTIAL_SELECT = "server=server1->db=customers->table=purchases_partial->action=select";
+ private static final String PERM_SERVER1_ANALYST_ALL = "server=server1->db=analyst1";
+ private static final String PERM_SERVER1_JUNIOR_ANALYST_ALL = "server=server1->db=jranalyst1";
+ private static final String PERM_SERVER1_JUNIOR_ANALYST_READ = "server=server1->db=jranalyst1->table=*->action=select";
+ private static final String PERM_SERVER1_OTHER_GROUP_DB_CUSTOMERS_SELECT = "server=server1->db=other_group_db->table=purchases->action=select";
+
+ private static final String PERM_SERVER1_ADMIN = "server=server1";
+ private PolicyEngine policy;
+ private static File baseDir;
+ private List<Authorizable> authorizables = Lists.newArrayList();
+
+ @BeforeClass
+ public static void setupClazz() throws IOException {
+ baseDir = Files.createTempDir();
+ }
+
+ @AfterClass
+ public static void teardownClazz() throws IOException {
+ if(baseDir != null) {
+ FileUtils.deleteQuietly(baseDir);
+ }
+ }
+
+ protected void setPolicy(PolicyEngine policy) {
+ this.policy = policy;
+ }
+ protected static File getBaseDir() {
+ return baseDir;
+ }
+ @Before
+ public void setup() throws IOException {
+ afterSetup();
+ }
+ @After
+ public void teardown() throws IOException {
+ beforeTeardown();
+ }
+ protected void afterSetup() throws IOException {
+
+ }
+
+ protected void beforeTeardown() throws IOException {
+
+ }
+
+ @Test
+ public void testManager() throws Exception {
+ Set<String> expected = Sets.newTreeSet(Sets.newHashSet(
+ PERM_SERVER1_CUSTOMERS_SELECT, PERM_SERVER1_ANALYST_ALL,
+ PERM_SERVER1_JUNIOR_ANALYST_ALL, PERM_SERVER1_JUNIOR_ANALYST_READ,
+ PERM_SERVER1_CUSTOMERS_DB_CUSTOMERS_PARTIAL_SELECT
+ ));
+ Assert.assertEquals(expected.toString(),
+ new TreeSet<String>(policy.getPermissions(authorizables, list("manager")).values())
+ .toString());
+ }
+
+ @Test
+ public void testAnalyst() throws Exception {
+ Set<String> expected = Sets.newTreeSet(Sets.newHashSet(
+ PERM_SERVER1_CUSTOMERS_SELECT, PERM_SERVER1_ANALYST_ALL,
+ PERM_SERVER1_JUNIOR_ANALYST_READ));
+ Assert.assertEquals(expected.toString(),
+ new TreeSet<String>(policy.getPermissions(authorizables, list("analyst")).values())
+ .toString());
+ }
+
+ @Test
+ public void testJuniorAnalyst() throws Exception {
+ Set<String> expected = Sets.newTreeSet(Sets
+ .newHashSet(PERM_SERVER1_JUNIOR_ANALYST_ALL,
+ PERM_SERVER1_CUSTOMERS_DB_CUSTOMERS_PARTIAL_SELECT));
+ Assert.assertEquals(expected.toString(),
+ new TreeSet<String>(policy.getPermissions(authorizables, list("jranalyst")).values())
+ .toString());
+ }
+
+ @Test
+ public void testAdmin() throws Exception {
+ Set<String> expected = Sets.newTreeSet(Sets.newHashSet(PERM_SERVER1_ADMIN));
+ Assert.assertEquals(expected.toString(),
+ new TreeSet<String>(policy.getPermissions(authorizables, list("admin")).values())
+ .toString());
+ }
+
+
+ @Test
+ public void testOtherGroup() throws Exception {
+ authorizables.add(new Database("other_group_db"));
+ Set<String> expected = Sets.newTreeSet(Sets.newHashSet(
+ PERM_SERVER1_OTHER_GROUP_DB_CUSTOMERS_SELECT));
+ Assert.assertEquals(expected.toString(),
+ new TreeSet<String>(policy.getPermissions(authorizables, list("other_group")).values())
+ .toString());
+ }
+
+ @Test
+ public void testDbAll() throws Exception {
+ authorizables.add(new Database(Database.ALL.getName()));
+ Set<String> expected = Sets.newTreeSet(Sets
+ .newHashSet(PERM_SERVER1_JUNIOR_ANALYST_ALL,
+ PERM_SERVER1_CUSTOMERS_DB_CUSTOMERS_PARTIAL_SELECT));
+ Assert.assertEquals(expected.toString(),
+ new TreeSet<String>(policy.getPermissions(authorizables, list("jranalyst")).values())
+ .toString());
+ }
+
+ @Test
+ public void testDbAllforOtherGroup() throws Exception {
+ authorizables.add(new Database(Database.ALL.getName()));
+ Set<String> expected = Sets.newTreeSet(Sets.newHashSet(
+ PERM_SERVER1_OTHER_GROUP_DB_CUSTOMERS_SELECT));
+ Assert.assertEquals(expected.toString(),
+ new TreeSet<String>(policy.getPermissions(authorizables, list("other_group")).values())
+ .toString());
+ }
+
+ private static List<String> list(String... values) {
+ return Lists.newArrayList(values);
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/DBPolicyFileBackend.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/DBPolicyFileBackend.java b/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/DBPolicyFileBackend.java
new file mode 100644
index 0000000..d8d68b7
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/DBPolicyFileBackend.java
@@ -0,0 +1,26 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.db;
+
+import java.io.IOException;
+import org.apache.sentry.provider.file.SimpleFileProviderBackend;
+
+public class DBPolicyFileBackend extends SimpleDBPolicyEngine {
+ public DBPolicyFileBackend(String resource, String server) throws IOException{
+ super(server, new SimpleFileProviderBackend(resource));
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/TestDBModelAuthorizables.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/TestDBModelAuthorizables.java b/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/TestDBModelAuthorizables.java
new file mode 100644
index 0000000..23b03d4
--- /dev/null
+++ b/sentry-policy/sentry-policy-db/src/test/java/org/apache/sentry/policy/db/TestDBModelAuthorizables.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sentry.policy.db;
+import static junit.framework.Assert.assertEquals;
+import static junit.framework.Assert.assertNull;
+
+
+import org.apache.sentry.core.model.db.AccessURI;
+import org.apache.sentry.core.model.db.Database;
+import org.apache.sentry.core.model.db.Server;
+import org.apache.sentry.core.model.db.Table;
+import org.apache.sentry.core.model.db.View;
+import org.apache.sentry.policy.db.DBModelAuthorizables;
+import org.junit.Test;
+
+public class TestDBModelAuthorizables {
+
+ @Test
+ public void testServer() throws Exception {
+ Server server = (Server)DBModelAuthorizables.from("SeRvEr=server1");
+ assertEquals("server1", server.getName());
+ }
+ @Test
+ public void testDb() throws Exception {
+ Database db = (Database)DBModelAuthorizables.from("dB=db1");
+ assertEquals("db1", db.getName());
+ }
+ @Test
+ public void testTable() throws Exception {
+ Table table = (Table)DBModelAuthorizables.from("tAbLe=t1");
+ assertEquals("t1", table.getName());
+ }
+ @Test
+ public void testView() throws Exception {
+ View view = (View)DBModelAuthorizables.from("vIeW=v1");
+ assertEquals("v1", view.getName());
+ }
+ @Test
+ public void testURI() throws Exception {
+ AccessURI uri = (AccessURI)DBModelAuthorizables.from("UrI=hdfs://uri1:8200/blah");
+ assertEquals("hdfs://uri1:8200/blah", uri.getName());
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testNoKV() throws Exception {
+ System.out.println(DBModelAuthorizables.from("nonsense"));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testTooManyKV() throws Exception {
+ System.out.println(DBModelAuthorizables.from("k=v1=v2"));
+ }
+ @Test(expected=IllegalArgumentException.class)
+ public void testEmptyKey() throws Exception {
+ System.out.println(DBModelAuthorizables.from("=v"));
+ }
+ @Test(expected=IllegalArgumentException.class)
+ public void testEmptyValue() throws Exception {
+ System.out.println(DBModelAuthorizables.from("k="));
+ }
+ @Test
+ public void testNotAuthorizable() throws Exception {
+ assertNull(DBModelAuthorizables.from("k=v"));
+ }
+}