You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sentry.apache.org by sr...@apache.org on 2014/05/29 08:39:06 UTC

[3/3] git commit: SENTRY-191: Sentry Policy Service should not require passing the RPC requestor's user/group information ( Prasad Mujumdar via Sravya Tirukkovalur)

SENTRY-191: Sentry Policy Service should not require passing the RPC requestor's user/group information ( Prasad Mujumdar via Sravya Tirukkovalur)


Project: http://git-wip-us.apache.org/repos/asf/incubator-sentry/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-sentry/commit/61a67cb9
Tree: http://git-wip-us.apache.org/repos/asf/incubator-sentry/tree/61a67cb9
Diff: http://git-wip-us.apache.org/repos/asf/incubator-sentry/diff/61a67cb9

Branch: refs/heads/master
Commit: 61a67cb956fe5552b15b335c2b9fb8fc4b8d2620
Parents: af795c0
Author: Sravya Tirukkovalur <sr...@clouera.com>
Authored: Wed May 28 23:38:11 2014 -0700
Committer: Sravya Tirukkovalur <sr...@clouera.com>
Committed: Wed May 28 23:38:39 2014 -0700

----------------------------------------------------------------------
 .../hive/ql/exec/SentryGrantRevokeTask.java     |  54 +++--
 .../provider/common/AuthorizationProvider.java  |   2 +
 .../common/HadoopGroupMappingService.java       |   6 +-
 sentry-provider/sentry-provider-db/pom.xml      |   5 +
 .../TAlterSentryRoleAddGroupsRequest.java       | 197 +++----------------
 .../TAlterSentryRoleDeleteGroupsRequest.java    | 197 +++----------------
 .../TAlterSentryRoleGrantPrivilegeRequest.java  | 161 +--------------
 .../TAlterSentryRoleRevokePrivilegeRequest.java | 161 +--------------
 .../thrift/TCreateSentryRoleRequest.java        | 161 +--------------
 .../service/thrift/TDropSentryRoleRequest.java  | 161 +--------------
 ...TListSentryPrivilegesForProviderRequest.java |  32 +--
 ...ListSentryPrivilegesForProviderResponse.java |  32 +--
 .../thrift/TListSentryPrivilegesRequest.java    | 161 +--------------
 .../thrift/TListSentryPrivilegesResponse.java   |  36 ++--
 .../service/thrift/TListSentryRolesRequest.java | 163 +--------------
 .../thrift/TListSentryRolesResponse.java        |  36 ++--
 .../db/service/thrift/TSentryActiveRoleSet.java |  32 +--
 .../provider/db/service/thrift/TSentryRole.java |  36 ++--
 .../thrift/SentryPolicyServiceClient.java       |  84 ++++----
 .../thrift/SentryPolicyStoreProcessor.java      |  56 +++++-
 .../sentry/service/thrift/ServiceConstants.java |   6 +
 .../main/resources/sentry_policy_service.thrift |  26 +--
 .../thrift/TestSentryServerWithoutKerberos.java |   8 +-
 .../thrift/TestSentryServiceIntegration.java    | 125 ++++++------
 .../thrift/SentryServiceIntegrationBase.java    |  20 ++
 .../provider/file/LocalGroupMappingService.java |   9 +-
 .../apache/sentry/provider/file/PolicyFile.java |  30 +--
 .../apache/sentry/tests/e2e/hive/Context.java   |   6 +-
 .../tests/e2e/hive/TestDatabaseProvider.java    |  81 ++++----
 29 files changed, 481 insertions(+), 1603 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/61a67cb9/sentry-binding/sentry-binding-hive/src/main/java/org/apache/hadoop/hive/ql/exec/SentryGrantRevokeTask.java
----------------------------------------------------------------------
diff --git a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/hadoop/hive/ql/exec/SentryGrantRevokeTask.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/hadoop/hive/ql/exec/SentryGrantRevokeTask.java
index faa71c7..f1e6247 100644
--- a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/hadoop/hive/ql/exec/SentryGrantRevokeTask.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/hadoop/hive/ql/exec/SentryGrantRevokeTask.java
@@ -111,27 +111,26 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
       Preconditions.checkNotNull(hiveAuthzBinding, "HiveAuthzBinding cannot be null");
       Preconditions.checkNotNull(authzConf, "HiveAuthConf cannot be null");
       Preconditions.checkNotNull(subject, "Subject cannot be null");
-      Preconditions.checkNotNull(subjectGroups, "Subject Groups cannot be null");
       server = Preconditions.checkNotNull(authzConf.get(AuthzConfVars.AUTHZ_SERVER_NAME.getVar()),
           "Config " + AuthzConfVars.AUTHZ_SERVER_NAME.getVar() + " is required");
       if (work.getRoleDDLDesc() != null) {
-        return processRoleDDL(conf, console, sentryClient, subject.getName(), subjectGroups,
+        return processRoleDDL(conf, console, sentryClient, subject.getName(),
             hiveAuthzBinding, work.getRoleDDLDesc());
       }
       if (work.getGrantDesc() != null) {
-        return processGrantDDL(conf, console, sentryClient, subject.getName(), subjectGroups,
+        return processGrantDDL(conf, console, sentryClient, subject.getName(),
             server, work.getGrantDesc());
       }
       if (work.getRevokeDesc() != null) {
-        return processRevokeDDL(conf, console, sentryClient, subject.getName(), subjectGroups,
+        return processRevokeDDL(conf, console, sentryClient, subject.getName(),
             server, work.getRevokeDesc());
       }
       if (work.getShowGrantDesc() != null) {
-        return processShowGrantDDL(conf, console, sentryClient, subject.getName(), subjectGroups,
+        return processShowGrantDDL(conf, console, sentryClient, subject.getName(),
             work.getShowGrantDesc());
       }
       if (work.getGrantRevokeRoleDDL() != null) {
-        return processGrantRevokeRoleDDL(conf, console, sentryClient, subject.getName(), subjectGroups,
+        return processGrantRevokeRoleDDL(conf, console, sentryClient, subject.getName(),
             work.getGrantRevokeRoleDDL());
       }
       throw new AssertionError("Unknown command passed to Sentry Grant/Revoke Task");
@@ -171,7 +170,7 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
 
   private int processRoleDDL(HiveConf conf, LogHelper console,
       SentryPolicyServiceClient sentryClient, String subject,
-      Set<String> subjectGroups, HiveAuthzBinding hiveAuthzBinding, RoleDDLDesc desc)
+      HiveAuthzBinding hiveAuthzBinding, RoleDDLDesc desc)
           throws SentryUserException {
     RoleDDLDesc.RoleOperation operation = desc.getOperation();
     DataOutputStream outStream = null;
@@ -181,10 +180,10 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
         hiveAuthzBinding.setActiveRoleSet(name);
         return RETURN_CODE_SUCCESS;
       } else if (operation.equals(RoleDDLDesc.RoleOperation.CREATE_ROLE)) {
-        sentryClient.createRole(subject, subjectGroups, name);
+        sentryClient.createRole(subject, name);
         return RETURN_CODE_SUCCESS;
       } else if (operation.equals(RoleDDLDesc.RoleOperation.DROP_ROLE)) {
-        sentryClient.dropRole(subject, subjectGroups, name);
+        sentryClient.dropRole(subject, name);
         return RETURN_CODE_SUCCESS;
       } else if (operation.equals(RoleDDLDesc.RoleOperation.SHOW_ROLE_GRANT)) {
         Set<TSentryRole> roles;
@@ -193,7 +192,7 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
           String msg = SentryHiveConstants.GRANT_REVOKE_NOT_SUPPORTED_FOR_PRINCIPAL + principalType;
           throw new HiveException(msg);
         }
-        roles = sentryClient.listRolesByGroupName(subject, subjectGroups, desc.getName() );
+        roles = sentryClient.listRolesByGroupName(subject, desc.getName() );
         writeToFile(writeRoleGrantsInfo(roles), desc.getResFile());
         return RETURN_CODE_SUCCESS;
       } else if(operation.equals(RoleDDLDesc.RoleOperation.SHOW_ROLES)) {
@@ -234,22 +233,22 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
 
   private int processGrantDDL(HiveConf conf, LogHelper console,
       SentryPolicyServiceClient sentryClient, String subject,
-      Set<String> subjectGroups, String server, GrantDesc desc) throws SentryUserException {
-    return processGrantRevokeDDL(console, sentryClient, subject, subjectGroups,
+      String server, GrantDesc desc) throws SentryUserException {
+    return processGrantRevokeDDL(console, sentryClient, subject, 
         server, true, desc.getPrincipals(), desc.getPrivileges(), desc.getPrivilegeSubjectDesc());
   }
 
 
   private int processRevokeDDL(HiveConf conf, LogHelper console,
       SentryPolicyServiceClient sentryClient, String subject,
-      Set<String> subjectGroups, String server, RevokeDesc desc) throws SentryUserException {
-    return processGrantRevokeDDL(console, sentryClient, subject, subjectGroups,
+      String server, RevokeDesc desc) throws SentryUserException {
+    return processGrantRevokeDDL(console, sentryClient, subject, 
         server, false, desc.getPrincipals(), desc.getPrivileges(),
         desc.getPrivilegeSubjectDesc());
   }
 
   private int processShowGrantDDL(HiveConf conf, LogHelper console, SentryPolicyServiceClient sentryClient,
-      String subject, Set<String> subjectGroups, ShowGrantDesc desc) throws SentryUserException{
+      String subject, ShowGrantDesc desc) throws SentryUserException{
     PrincipalDesc principalDesc = desc.getPrincipalDesc();
     PrivilegeObjectDesc hiveObjectDesc = desc.getHiveObj();
     String principalName = principalDesc.getName();
@@ -258,7 +257,7 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
 
     try {
       if (hiveObjectDesc == null) {
-        privileges = sentryClient.listPrivilegesByRoleName(subject, subjectGroups, principalName);
+        privileges = sentryClient.listPrivilegesByRoleName(subject, principalName);
         writeToFile(writeGrantInfo(privileges, principalName), desc.getResFile());
         return RETURN_CODE_SUCCESS;
       } else {
@@ -289,7 +288,7 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
   }
 
   private int processGrantRevokeRoleDDL(HiveConf conf, LogHelper console,
-      SentryPolicyServiceClient sentryClient, String subject, Set<String> subjectGroups,
+      SentryPolicyServiceClient sentryClient, String subject,
       GrantRevokeRoleDDL desc) throws SentryUserException {
     try {
       boolean grantRole = desc.getGrant();
@@ -304,9 +303,9 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
         String groupName = principal.getName();
         for (String roleName : roles) {
           if (grantRole) {
-            sentryClient.grantRoleToGroup(subject, subjectGroups, groupName, roleName);
+            sentryClient.grantRoleToGroup(subject, groupName, roleName);
           } else {
-            sentryClient.revokeRoleFromGroup(subject, subjectGroups, groupName, roleName);
+            sentryClient.revokeRoleFromGroup(subject, groupName, roleName);
           }
         }
       }
@@ -400,8 +399,7 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
   }
 
   private static int processGrantRevokeDDL(LogHelper console,
-      SentryPolicyServiceClient sentryClient, String subject,
-      Set<String> subjectGroups, String server,
+      SentryPolicyServiceClient sentryClient, String subject, String server,
       boolean isGrant, List<PrincipalDesc> principals,
  List<PrivilegeDesc> privileges,
       PrivilegeObjectDesc privSubjectObjDesc) throws SentryUserException {
@@ -458,22 +456,20 @@ public class SentryGrantRevokeTask extends Task<DDLWork> implements Serializable
         for (PrivilegeDesc privDesc : privileges) {
           if (isGrant) {
             if (serverName != null) {
-              sentryClient.grantServerPrivilege(subject, subjectGroups,
-                  princ.getName(), serverName);
+              sentryClient.grantServerPrivilege(subject, princ.getName(), serverName);
             } else if (uriPath != null) {
-              sentryClient.grantURIPrivilege(subject, subjectGroups,
-                  princ.getName(), server, uriPath);
+              sentryClient.grantURIPrivilege(subject, princ.getName(), server, uriPath);
             } else if (tableName == null) {
-              sentryClient.grantDatabasePrivilege(subject, subjectGroups, princ.getName(), server, dbName);
+              sentryClient.grantDatabasePrivilege(subject, princ.getName(), server, dbName);
             } else {
-              sentryClient.grantTablePrivilege(subject, subjectGroups, princ.getName(), server, dbName,
+              sentryClient.grantTablePrivilege(subject, princ.getName(), server, dbName,
                   tableName, privDesc.getPrivilege().getPriv().name());
             }
           } else {
             if (tableName == null) {
-              sentryClient.revokeDatabasePrivilege(subject, subjectGroups, princ.getName(), server, dbName);
+              sentryClient.revokeDatabasePrivilege(subject, princ.getName(), server, dbName);
             } else {
-              sentryClient.revokeTablePrivilege(subject, subjectGroups, princ.getName(), server, dbName,
+              sentryClient.revokeTablePrivilege(subject, princ.getName(), server, dbName,
                   tableName, privDesc.getPrivilege().getPriv().name());
             }
           }

http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/61a67cb9/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java
index de774f4..a88d2f8 100644
--- a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java
+++ b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java
@@ -33,6 +33,8 @@ import org.apache.sentry.core.common.Subject;
 @ThreadSafe
 public interface AuthorizationProvider {
 
+  public static String SENTRY_PROVIDER = "sentry.provider";
+
   /***
    * Returns validate subject privileges on given Authorizable object
    *

http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/61a67cb9/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/HadoopGroupMappingService.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/HadoopGroupMappingService.java b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/HadoopGroupMappingService.java
index 6c8fa95..14e2d05 100644
--- a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/HadoopGroupMappingService.java
+++ b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/HadoopGroupMappingService.java
@@ -21,8 +21,8 @@ import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 
+import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.security.Groups;
-import org.apache.sentry.provider.common.GroupMappingService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -36,6 +36,10 @@ public class HadoopGroupMappingService implements GroupMappingService {
     this.groups = groups;
   }
 
+  public HadoopGroupMappingService(Configuration conf, String resource) {
+    this(Groups.getUserToGroupsMappingService(conf));
+  }
+
   @Override
   public Set<String> getGroups(String user) {
     try {

http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/61a67cb9/sentry-provider/sentry-provider-db/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-db/pom.xml b/sentry-provider/sentry-provider-db/pom.xml
index fca6c52..e0532ca 100644
--- a/sentry-provider/sentry-provider-db/pom.xml
+++ b/sentry-provider/sentry-provider-db/pom.xml
@@ -83,6 +83,11 @@ limitations under the License.
       <artifactId>sentry-provider-common</artifactId>
     </dependency>
     <dependency>
+      <groupId>org.apache.sentry</groupId>
+      <artifactId>sentry-provider-file</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
       <groupId>org.apache.hive</groupId>
       <artifactId>hive-shims</artifactId>
       <scope>provided</scope>

http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/61a67cb9/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleAddGroupsRequest.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleAddGroupsRequest.java b/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleAddGroupsRequest.java
index 2701837..21efbd0 100644
--- a/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleAddGroupsRequest.java
+++ b/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleAddGroupsRequest.java
@@ -36,8 +36,7 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
 
   private static final org.apache.thrift.protocol.TField PROTOCOL_VERSION_FIELD_DESC = new org.apache.thrift.protocol.TField("protocol_version", org.apache.thrift.protocol.TType.I32, (short)1);
   private static final org.apache.thrift.protocol.TField REQUESTOR_USER_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("requestorUserName", org.apache.thrift.protocol.TType.STRING, (short)2);
-  private static final org.apache.thrift.protocol.TField REQUESTOR_GROUP_NAMES_FIELD_DESC = new org.apache.thrift.protocol.TField("requestorGroupNames", org.apache.thrift.protocol.TType.SET, (short)3);
-  private static final org.apache.thrift.protocol.TField ROLE_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("roleName", org.apache.thrift.protocol.TType.STRING, (short)4);
+  private static final org.apache.thrift.protocol.TField ROLE_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("roleName", org.apache.thrift.protocol.TType.STRING, (short)3);
   private static final org.apache.thrift.protocol.TField GROUPS_FIELD_DESC = new org.apache.thrift.protocol.TField("groups", org.apache.thrift.protocol.TType.SET, (short)5);
 
   private static final Map<Class<? extends IScheme>, SchemeFactory> schemes = new HashMap<Class<? extends IScheme>, SchemeFactory>();
@@ -48,7 +47,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
 
   private int protocol_version; // required
   private String requestorUserName; // required
-  private Set<String> requestorGroupNames; // required
   private String roleName; // required
   private Set<TSentryGroup> groups; // required
 
@@ -56,8 +54,7 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
   public enum _Fields implements org.apache.thrift.TFieldIdEnum {
     PROTOCOL_VERSION((short)1, "protocol_version"),
     REQUESTOR_USER_NAME((short)2, "requestorUserName"),
-    REQUESTOR_GROUP_NAMES((short)3, "requestorGroupNames"),
-    ROLE_NAME((short)4, "roleName"),
+    ROLE_NAME((short)3, "roleName"),
     GROUPS((short)5, "groups");
 
     private static final Map<String, _Fields> byName = new HashMap<String, _Fields>();
@@ -77,9 +74,7 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
           return PROTOCOL_VERSION;
         case 2: // REQUESTOR_USER_NAME
           return REQUESTOR_USER_NAME;
-        case 3: // REQUESTOR_GROUP_NAMES
-          return REQUESTOR_GROUP_NAMES;
-        case 4: // ROLE_NAME
+        case 3: // ROLE_NAME
           return ROLE_NAME;
         case 5: // GROUPS
           return GROUPS;
@@ -132,9 +127,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.I32)));
     tmpMap.put(_Fields.REQUESTOR_USER_NAME, new org.apache.thrift.meta_data.FieldMetaData("requestorUserName", org.apache.thrift.TFieldRequirementType.REQUIRED, 
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
-    tmpMap.put(_Fields.REQUESTOR_GROUP_NAMES, new org.apache.thrift.meta_data.FieldMetaData("requestorGroupNames", org.apache.thrift.TFieldRequirementType.REQUIRED, 
-        new org.apache.thrift.meta_data.SetMetaData(org.apache.thrift.protocol.TType.SET, 
-            new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING))));
     tmpMap.put(_Fields.ROLE_NAME, new org.apache.thrift.meta_data.FieldMetaData("roleName", org.apache.thrift.TFieldRequirementType.REQUIRED, 
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
     tmpMap.put(_Fields.GROUPS, new org.apache.thrift.meta_data.FieldMetaData("groups", org.apache.thrift.TFieldRequirementType.REQUIRED, 
@@ -152,7 +144,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
   public TAlterSentryRoleAddGroupsRequest(
     int protocol_version,
     String requestorUserName,
-    Set<String> requestorGroupNames,
     String roleName,
     Set<TSentryGroup> groups)
   {
@@ -160,7 +151,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
     this.protocol_version = protocol_version;
     setProtocol_versionIsSet(true);
     this.requestorUserName = requestorUserName;
-    this.requestorGroupNames = requestorGroupNames;
     this.roleName = roleName;
     this.groups = groups;
   }
@@ -174,13 +164,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
     if (other.isSetRequestorUserName()) {
       this.requestorUserName = other.requestorUserName;
     }
-    if (other.isSetRequestorGroupNames()) {
-      Set<String> __this__requestorGroupNames = new HashSet<String>();
-      for (String other_element : other.requestorGroupNames) {
-        __this__requestorGroupNames.add(other_element);
-      }
-      this.requestorGroupNames = __this__requestorGroupNames;
-    }
     if (other.isSetRoleName()) {
       this.roleName = other.roleName;
     }
@@ -202,7 +185,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
     this.protocol_version = 1;
 
     this.requestorUserName = null;
-    this.requestorGroupNames = null;
     this.roleName = null;
     this.groups = null;
   }
@@ -252,44 +234,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
     }
   }
 
-  public int getRequestorGroupNamesSize() {
-    return (this.requestorGroupNames == null) ? 0 : this.requestorGroupNames.size();
-  }
-
-  public java.util.Iterator<String> getRequestorGroupNamesIterator() {
-    return (this.requestorGroupNames == null) ? null : this.requestorGroupNames.iterator();
-  }
-
-  public void addToRequestorGroupNames(String elem) {
-    if (this.requestorGroupNames == null) {
-      this.requestorGroupNames = new HashSet<String>();
-    }
-    this.requestorGroupNames.add(elem);
-  }
-
-  public Set<String> getRequestorGroupNames() {
-    return this.requestorGroupNames;
-  }
-
-  public void setRequestorGroupNames(Set<String> requestorGroupNames) {
-    this.requestorGroupNames = requestorGroupNames;
-  }
-
-  public void unsetRequestorGroupNames() {
-    this.requestorGroupNames = null;
-  }
-
-  /** Returns true if field requestorGroupNames is set (has been assigned a value) and false otherwise */
-  public boolean isSetRequestorGroupNames() {
-    return this.requestorGroupNames != null;
-  }
-
-  public void setRequestorGroupNamesIsSet(boolean value) {
-    if (!value) {
-      this.requestorGroupNames = null;
-    }
-  }
-
   public String getRoleName() {
     return this.roleName;
   }
@@ -369,14 +313,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
       }
       break;
 
-    case REQUESTOR_GROUP_NAMES:
-      if (value == null) {
-        unsetRequestorGroupNames();
-      } else {
-        setRequestorGroupNames((Set<String>)value);
-      }
-      break;
-
     case ROLE_NAME:
       if (value == null) {
         unsetRoleName();
@@ -404,9 +340,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
     case REQUESTOR_USER_NAME:
       return getRequestorUserName();
 
-    case REQUESTOR_GROUP_NAMES:
-      return getRequestorGroupNames();
-
     case ROLE_NAME:
       return getRoleName();
 
@@ -428,8 +361,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
       return isSetProtocol_version();
     case REQUESTOR_USER_NAME:
       return isSetRequestorUserName();
-    case REQUESTOR_GROUP_NAMES:
-      return isSetRequestorGroupNames();
     case ROLE_NAME:
       return isSetRoleName();
     case GROUPS:
@@ -469,15 +400,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
         return false;
     }
 
-    boolean this_present_requestorGroupNames = true && this.isSetRequestorGroupNames();
-    boolean that_present_requestorGroupNames = true && that.isSetRequestorGroupNames();
-    if (this_present_requestorGroupNames || that_present_requestorGroupNames) {
-      if (!(this_present_requestorGroupNames && that_present_requestorGroupNames))
-        return false;
-      if (!this.requestorGroupNames.equals(that.requestorGroupNames))
-        return false;
-    }
-
     boolean this_present_roleName = true && this.isSetRoleName();
     boolean that_present_roleName = true && that.isSetRoleName();
     if (this_present_roleName || that_present_roleName) {
@@ -513,11 +435,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
     if (present_requestorUserName)
       builder.append(requestorUserName);
 
-    boolean present_requestorGroupNames = true && (isSetRequestorGroupNames());
-    builder.append(present_requestorGroupNames);
-    if (present_requestorGroupNames)
-      builder.append(requestorGroupNames);
-
     boolean present_roleName = true && (isSetRoleName());
     builder.append(present_roleName);
     if (present_roleName)
@@ -559,16 +476,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
         return lastComparison;
       }
     }
-    lastComparison = Boolean.valueOf(isSetRequestorGroupNames()).compareTo(typedOther.isSetRequestorGroupNames());
-    if (lastComparison != 0) {
-      return lastComparison;
-    }
-    if (isSetRequestorGroupNames()) {
-      lastComparison = org.apache.thrift.TBaseHelper.compareTo(this.requestorGroupNames, typedOther.requestorGroupNames);
-      if (lastComparison != 0) {
-        return lastComparison;
-      }
-    }
     lastComparison = Boolean.valueOf(isSetRoleName()).compareTo(typedOther.isSetRoleName());
     if (lastComparison != 0) {
       return lastComparison;
@@ -621,14 +528,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
     }
     first = false;
     if (!first) sb.append(", ");
-    sb.append("requestorGroupNames:");
-    if (this.requestorGroupNames == null) {
-      sb.append("null");
-    } else {
-      sb.append(this.requestorGroupNames);
-    }
-    first = false;
-    if (!first) sb.append(", ");
     sb.append("roleName:");
     if (this.roleName == null) {
       sb.append("null");
@@ -658,10 +557,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
       throw new org.apache.thrift.protocol.TProtocolException("Required field 'requestorUserName' is unset! Struct:" + toString());
     }
 
-    if (!isSetRequestorGroupNames()) {
-      throw new org.apache.thrift.protocol.TProtocolException("Required field 'requestorGroupNames' is unset! Struct:" + toString());
-    }
-
     if (!isSetRoleName()) {
       throw new org.apache.thrift.protocol.TProtocolException("Required field 'roleName' is unset! Struct:" + toString());
     }
@@ -725,25 +620,7 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
               org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
             }
             break;
-          case 3: // REQUESTOR_GROUP_NAMES
-            if (schemeField.type == org.apache.thrift.protocol.TType.SET) {
-              {
-                org.apache.thrift.protocol.TSet _set16 = iprot.readSetBegin();
-                struct.requestorGroupNames = new HashSet<String>(2*_set16.size);
-                for (int _i17 = 0; _i17 < _set16.size; ++_i17)
-                {
-                  String _elem18; // required
-                  _elem18 = iprot.readString();
-                  struct.requestorGroupNames.add(_elem18);
-                }
-                iprot.readSetEnd();
-              }
-              struct.setRequestorGroupNamesIsSet(true);
-            } else { 
-              org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
-            }
-            break;
-          case 4: // ROLE_NAME
+          case 3: // ROLE_NAME
             if (schemeField.type == org.apache.thrift.protocol.TType.STRING) {
               struct.roleName = iprot.readString();
               struct.setRoleNameIsSet(true);
@@ -754,14 +631,14 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
           case 5: // GROUPS
             if (schemeField.type == org.apache.thrift.protocol.TType.SET) {
               {
-                org.apache.thrift.protocol.TSet _set19 = iprot.readSetBegin();
-                struct.groups = new HashSet<TSentryGroup>(2*_set19.size);
-                for (int _i20 = 0; _i20 < _set19.size; ++_i20)
+                org.apache.thrift.protocol.TSet _set0 = iprot.readSetBegin();
+                struct.groups = new HashSet<TSentryGroup>(2*_set0.size);
+                for (int _i1 = 0; _i1 < _set0.size; ++_i1)
                 {
-                  TSentryGroup _elem21; // required
-                  _elem21 = new TSentryGroup();
-                  _elem21.read(iprot);
-                  struct.groups.add(_elem21);
+                  TSentryGroup _elem2; // required
+                  _elem2 = new TSentryGroup();
+                  _elem2.read(iprot);
+                  struct.groups.add(_elem2);
                 }
                 iprot.readSetEnd();
               }
@@ -791,18 +668,6 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
         oprot.writeString(struct.requestorUserName);
         oprot.writeFieldEnd();
       }
-      if (struct.requestorGroupNames != null) {
-        oprot.writeFieldBegin(REQUESTOR_GROUP_NAMES_FIELD_DESC);
-        {
-          oprot.writeSetBegin(new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRING, struct.requestorGroupNames.size()));
-          for (String _iter22 : struct.requestorGroupNames)
-          {
-            oprot.writeString(_iter22);
-          }
-          oprot.writeSetEnd();
-        }
-        oprot.writeFieldEnd();
-      }
       if (struct.roleName != null) {
         oprot.writeFieldBegin(ROLE_NAME_FIELD_DESC);
         oprot.writeString(struct.roleName);
@@ -812,9 +677,9 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
         oprot.writeFieldBegin(GROUPS_FIELD_DESC);
         {
           oprot.writeSetBegin(new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRUCT, struct.groups.size()));
-          for (TSentryGroup _iter23 : struct.groups)
+          for (TSentryGroup _iter3 : struct.groups)
           {
-            _iter23.write(oprot);
+            _iter3.write(oprot);
           }
           oprot.writeSetEnd();
         }
@@ -839,19 +704,12 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
       TTupleProtocol oprot = (TTupleProtocol) prot;
       oprot.writeI32(struct.protocol_version);
       oprot.writeString(struct.requestorUserName);
-      {
-        oprot.writeI32(struct.requestorGroupNames.size());
-        for (String _iter24 : struct.requestorGroupNames)
-        {
-          oprot.writeString(_iter24);
-        }
-      }
       oprot.writeString(struct.roleName);
       {
         oprot.writeI32(struct.groups.size());
-        for (TSentryGroup _iter25 : struct.groups)
+        for (TSentryGroup _iter4 : struct.groups)
         {
-          _iter25.write(oprot);
+          _iter4.write(oprot);
         }
       }
     }
@@ -863,28 +721,17 @@ public class TAlterSentryRoleAddGroupsRequest implements org.apache.thrift.TBase
       struct.setProtocol_versionIsSet(true);
       struct.requestorUserName = iprot.readString();
       struct.setRequestorUserNameIsSet(true);
-      {
-        org.apache.thrift.protocol.TSet _set26 = new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRING, iprot.readI32());
-        struct.requestorGroupNames = new HashSet<String>(2*_set26.size);
-        for (int _i27 = 0; _i27 < _set26.size; ++_i27)
-        {
-          String _elem28; // required
-          _elem28 = iprot.readString();
-          struct.requestorGroupNames.add(_elem28);
-        }
-      }
-      struct.setRequestorGroupNamesIsSet(true);
       struct.roleName = iprot.readString();
       struct.setRoleNameIsSet(true);
       {
-        org.apache.thrift.protocol.TSet _set29 = new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRUCT, iprot.readI32());
-        struct.groups = new HashSet<TSentryGroup>(2*_set29.size);
-        for (int _i30 = 0; _i30 < _set29.size; ++_i30)
+        org.apache.thrift.protocol.TSet _set5 = new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRUCT, iprot.readI32());
+        struct.groups = new HashSet<TSentryGroup>(2*_set5.size);
+        for (int _i6 = 0; _i6 < _set5.size; ++_i6)
         {
-          TSentryGroup _elem31; // required
-          _elem31 = new TSentryGroup();
-          _elem31.read(iprot);
-          struct.groups.add(_elem31);
+          TSentryGroup _elem7; // required
+          _elem7 = new TSentryGroup();
+          _elem7.read(iprot);
+          struct.groups.add(_elem7);
         }
       }
       struct.setGroupsIsSet(true);

http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/61a67cb9/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleDeleteGroupsRequest.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleDeleteGroupsRequest.java b/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleDeleteGroupsRequest.java
index c5c13cd..58e9870 100644
--- a/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleDeleteGroupsRequest.java
+++ b/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleDeleteGroupsRequest.java
@@ -36,8 +36,7 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
 
   private static final org.apache.thrift.protocol.TField PROTOCOL_VERSION_FIELD_DESC = new org.apache.thrift.protocol.TField("protocol_version", org.apache.thrift.protocol.TType.I32, (short)1);
   private static final org.apache.thrift.protocol.TField REQUESTOR_USER_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("requestorUserName", org.apache.thrift.protocol.TType.STRING, (short)2);
-  private static final org.apache.thrift.protocol.TField REQUESTOR_GROUP_NAMES_FIELD_DESC = new org.apache.thrift.protocol.TField("requestorGroupNames", org.apache.thrift.protocol.TType.SET, (short)3);
-  private static final org.apache.thrift.protocol.TField ROLE_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("roleName", org.apache.thrift.protocol.TType.STRING, (short)4);
+  private static final org.apache.thrift.protocol.TField ROLE_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("roleName", org.apache.thrift.protocol.TType.STRING, (short)3);
   private static final org.apache.thrift.protocol.TField GROUPS_FIELD_DESC = new org.apache.thrift.protocol.TField("groups", org.apache.thrift.protocol.TType.SET, (short)5);
 
   private static final Map<Class<? extends IScheme>, SchemeFactory> schemes = new HashMap<Class<? extends IScheme>, SchemeFactory>();
@@ -48,7 +47,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
 
   private int protocol_version; // required
   private String requestorUserName; // required
-  private Set<String> requestorGroupNames; // required
   private String roleName; // required
   private Set<TSentryGroup> groups; // required
 
@@ -56,8 +54,7 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
   public enum _Fields implements org.apache.thrift.TFieldIdEnum {
     PROTOCOL_VERSION((short)1, "protocol_version"),
     REQUESTOR_USER_NAME((short)2, "requestorUserName"),
-    REQUESTOR_GROUP_NAMES((short)3, "requestorGroupNames"),
-    ROLE_NAME((short)4, "roleName"),
+    ROLE_NAME((short)3, "roleName"),
     GROUPS((short)5, "groups");
 
     private static final Map<String, _Fields> byName = new HashMap<String, _Fields>();
@@ -77,9 +74,7 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
           return PROTOCOL_VERSION;
         case 2: // REQUESTOR_USER_NAME
           return REQUESTOR_USER_NAME;
-        case 3: // REQUESTOR_GROUP_NAMES
-          return REQUESTOR_GROUP_NAMES;
-        case 4: // ROLE_NAME
+        case 3: // ROLE_NAME
           return ROLE_NAME;
         case 5: // GROUPS
           return GROUPS;
@@ -132,9 +127,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.I32)));
     tmpMap.put(_Fields.REQUESTOR_USER_NAME, new org.apache.thrift.meta_data.FieldMetaData("requestorUserName", org.apache.thrift.TFieldRequirementType.REQUIRED, 
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
-    tmpMap.put(_Fields.REQUESTOR_GROUP_NAMES, new org.apache.thrift.meta_data.FieldMetaData("requestorGroupNames", org.apache.thrift.TFieldRequirementType.REQUIRED, 
-        new org.apache.thrift.meta_data.SetMetaData(org.apache.thrift.protocol.TType.SET, 
-            new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING))));
     tmpMap.put(_Fields.ROLE_NAME, new org.apache.thrift.meta_data.FieldMetaData("roleName", org.apache.thrift.TFieldRequirementType.REQUIRED, 
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
     tmpMap.put(_Fields.GROUPS, new org.apache.thrift.meta_data.FieldMetaData("groups", org.apache.thrift.TFieldRequirementType.REQUIRED, 
@@ -152,7 +144,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
   public TAlterSentryRoleDeleteGroupsRequest(
     int protocol_version,
     String requestorUserName,
-    Set<String> requestorGroupNames,
     String roleName,
     Set<TSentryGroup> groups)
   {
@@ -160,7 +151,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
     this.protocol_version = protocol_version;
     setProtocol_versionIsSet(true);
     this.requestorUserName = requestorUserName;
-    this.requestorGroupNames = requestorGroupNames;
     this.roleName = roleName;
     this.groups = groups;
   }
@@ -174,13 +164,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
     if (other.isSetRequestorUserName()) {
       this.requestorUserName = other.requestorUserName;
     }
-    if (other.isSetRequestorGroupNames()) {
-      Set<String> __this__requestorGroupNames = new HashSet<String>();
-      for (String other_element : other.requestorGroupNames) {
-        __this__requestorGroupNames.add(other_element);
-      }
-      this.requestorGroupNames = __this__requestorGroupNames;
-    }
     if (other.isSetRoleName()) {
       this.roleName = other.roleName;
     }
@@ -202,7 +185,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
     this.protocol_version = 1;
 
     this.requestorUserName = null;
-    this.requestorGroupNames = null;
     this.roleName = null;
     this.groups = null;
   }
@@ -252,44 +234,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
     }
   }
 
-  public int getRequestorGroupNamesSize() {
-    return (this.requestorGroupNames == null) ? 0 : this.requestorGroupNames.size();
-  }
-
-  public java.util.Iterator<String> getRequestorGroupNamesIterator() {
-    return (this.requestorGroupNames == null) ? null : this.requestorGroupNames.iterator();
-  }
-
-  public void addToRequestorGroupNames(String elem) {
-    if (this.requestorGroupNames == null) {
-      this.requestorGroupNames = new HashSet<String>();
-    }
-    this.requestorGroupNames.add(elem);
-  }
-
-  public Set<String> getRequestorGroupNames() {
-    return this.requestorGroupNames;
-  }
-
-  public void setRequestorGroupNames(Set<String> requestorGroupNames) {
-    this.requestorGroupNames = requestorGroupNames;
-  }
-
-  public void unsetRequestorGroupNames() {
-    this.requestorGroupNames = null;
-  }
-
-  /** Returns true if field requestorGroupNames is set (has been assigned a value) and false otherwise */
-  public boolean isSetRequestorGroupNames() {
-    return this.requestorGroupNames != null;
-  }
-
-  public void setRequestorGroupNamesIsSet(boolean value) {
-    if (!value) {
-      this.requestorGroupNames = null;
-    }
-  }
-
   public String getRoleName() {
     return this.roleName;
   }
@@ -369,14 +313,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
       }
       break;
 
-    case REQUESTOR_GROUP_NAMES:
-      if (value == null) {
-        unsetRequestorGroupNames();
-      } else {
-        setRequestorGroupNames((Set<String>)value);
-      }
-      break;
-
     case ROLE_NAME:
       if (value == null) {
         unsetRoleName();
@@ -404,9 +340,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
     case REQUESTOR_USER_NAME:
       return getRequestorUserName();
 
-    case REQUESTOR_GROUP_NAMES:
-      return getRequestorGroupNames();
-
     case ROLE_NAME:
       return getRoleName();
 
@@ -428,8 +361,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
       return isSetProtocol_version();
     case REQUESTOR_USER_NAME:
       return isSetRequestorUserName();
-    case REQUESTOR_GROUP_NAMES:
-      return isSetRequestorGroupNames();
     case ROLE_NAME:
       return isSetRoleName();
     case GROUPS:
@@ -469,15 +400,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
         return false;
     }
 
-    boolean this_present_requestorGroupNames = true && this.isSetRequestorGroupNames();
-    boolean that_present_requestorGroupNames = true && that.isSetRequestorGroupNames();
-    if (this_present_requestorGroupNames || that_present_requestorGroupNames) {
-      if (!(this_present_requestorGroupNames && that_present_requestorGroupNames))
-        return false;
-      if (!this.requestorGroupNames.equals(that.requestorGroupNames))
-        return false;
-    }
-
     boolean this_present_roleName = true && this.isSetRoleName();
     boolean that_present_roleName = true && that.isSetRoleName();
     if (this_present_roleName || that_present_roleName) {
@@ -513,11 +435,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
     if (present_requestorUserName)
       builder.append(requestorUserName);
 
-    boolean present_requestorGroupNames = true && (isSetRequestorGroupNames());
-    builder.append(present_requestorGroupNames);
-    if (present_requestorGroupNames)
-      builder.append(requestorGroupNames);
-
     boolean present_roleName = true && (isSetRoleName());
     builder.append(present_roleName);
     if (present_roleName)
@@ -559,16 +476,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
         return lastComparison;
       }
     }
-    lastComparison = Boolean.valueOf(isSetRequestorGroupNames()).compareTo(typedOther.isSetRequestorGroupNames());
-    if (lastComparison != 0) {
-      return lastComparison;
-    }
-    if (isSetRequestorGroupNames()) {
-      lastComparison = org.apache.thrift.TBaseHelper.compareTo(this.requestorGroupNames, typedOther.requestorGroupNames);
-      if (lastComparison != 0) {
-        return lastComparison;
-      }
-    }
     lastComparison = Boolean.valueOf(isSetRoleName()).compareTo(typedOther.isSetRoleName());
     if (lastComparison != 0) {
       return lastComparison;
@@ -621,14 +528,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
     }
     first = false;
     if (!first) sb.append(", ");
-    sb.append("requestorGroupNames:");
-    if (this.requestorGroupNames == null) {
-      sb.append("null");
-    } else {
-      sb.append(this.requestorGroupNames);
-    }
-    first = false;
-    if (!first) sb.append(", ");
     sb.append("roleName:");
     if (this.roleName == null) {
       sb.append("null");
@@ -658,10 +557,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
       throw new org.apache.thrift.protocol.TProtocolException("Required field 'requestorUserName' is unset! Struct:" + toString());
     }
 
-    if (!isSetRequestorGroupNames()) {
-      throw new org.apache.thrift.protocol.TProtocolException("Required field 'requestorGroupNames' is unset! Struct:" + toString());
-    }
-
     if (!isSetRoleName()) {
       throw new org.apache.thrift.protocol.TProtocolException("Required field 'roleName' is unset! Struct:" + toString());
     }
@@ -725,25 +620,7 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
               org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
             }
             break;
-          case 3: // REQUESTOR_GROUP_NAMES
-            if (schemeField.type == org.apache.thrift.protocol.TType.SET) {
-              {
-                org.apache.thrift.protocol.TSet _set32 = iprot.readSetBegin();
-                struct.requestorGroupNames = new HashSet<String>(2*_set32.size);
-                for (int _i33 = 0; _i33 < _set32.size; ++_i33)
-                {
-                  String _elem34; // required
-                  _elem34 = iprot.readString();
-                  struct.requestorGroupNames.add(_elem34);
-                }
-                iprot.readSetEnd();
-              }
-              struct.setRequestorGroupNamesIsSet(true);
-            } else { 
-              org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
-            }
-            break;
-          case 4: // ROLE_NAME
+          case 3: // ROLE_NAME
             if (schemeField.type == org.apache.thrift.protocol.TType.STRING) {
               struct.roleName = iprot.readString();
               struct.setRoleNameIsSet(true);
@@ -754,14 +631,14 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
           case 5: // GROUPS
             if (schemeField.type == org.apache.thrift.protocol.TType.SET) {
               {
-                org.apache.thrift.protocol.TSet _set35 = iprot.readSetBegin();
-                struct.groups = new HashSet<TSentryGroup>(2*_set35.size);
-                for (int _i36 = 0; _i36 < _set35.size; ++_i36)
+                org.apache.thrift.protocol.TSet _set8 = iprot.readSetBegin();
+                struct.groups = new HashSet<TSentryGroup>(2*_set8.size);
+                for (int _i9 = 0; _i9 < _set8.size; ++_i9)
                 {
-                  TSentryGroup _elem37; // required
-                  _elem37 = new TSentryGroup();
-                  _elem37.read(iprot);
-                  struct.groups.add(_elem37);
+                  TSentryGroup _elem10; // required
+                  _elem10 = new TSentryGroup();
+                  _elem10.read(iprot);
+                  struct.groups.add(_elem10);
                 }
                 iprot.readSetEnd();
               }
@@ -791,18 +668,6 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
         oprot.writeString(struct.requestorUserName);
         oprot.writeFieldEnd();
       }
-      if (struct.requestorGroupNames != null) {
-        oprot.writeFieldBegin(REQUESTOR_GROUP_NAMES_FIELD_DESC);
-        {
-          oprot.writeSetBegin(new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRING, struct.requestorGroupNames.size()));
-          for (String _iter38 : struct.requestorGroupNames)
-          {
-            oprot.writeString(_iter38);
-          }
-          oprot.writeSetEnd();
-        }
-        oprot.writeFieldEnd();
-      }
       if (struct.roleName != null) {
         oprot.writeFieldBegin(ROLE_NAME_FIELD_DESC);
         oprot.writeString(struct.roleName);
@@ -812,9 +677,9 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
         oprot.writeFieldBegin(GROUPS_FIELD_DESC);
         {
           oprot.writeSetBegin(new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRUCT, struct.groups.size()));
-          for (TSentryGroup _iter39 : struct.groups)
+          for (TSentryGroup _iter11 : struct.groups)
           {
-            _iter39.write(oprot);
+            _iter11.write(oprot);
           }
           oprot.writeSetEnd();
         }
@@ -839,19 +704,12 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
       TTupleProtocol oprot = (TTupleProtocol) prot;
       oprot.writeI32(struct.protocol_version);
       oprot.writeString(struct.requestorUserName);
-      {
-        oprot.writeI32(struct.requestorGroupNames.size());
-        for (String _iter40 : struct.requestorGroupNames)
-        {
-          oprot.writeString(_iter40);
-        }
-      }
       oprot.writeString(struct.roleName);
       {
         oprot.writeI32(struct.groups.size());
-        for (TSentryGroup _iter41 : struct.groups)
+        for (TSentryGroup _iter12 : struct.groups)
         {
-          _iter41.write(oprot);
+          _iter12.write(oprot);
         }
       }
     }
@@ -863,28 +721,17 @@ public class TAlterSentryRoleDeleteGroupsRequest implements org.apache.thrift.TB
       struct.setProtocol_versionIsSet(true);
       struct.requestorUserName = iprot.readString();
       struct.setRequestorUserNameIsSet(true);
-      {
-        org.apache.thrift.protocol.TSet _set42 = new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRING, iprot.readI32());
-        struct.requestorGroupNames = new HashSet<String>(2*_set42.size);
-        for (int _i43 = 0; _i43 < _set42.size; ++_i43)
-        {
-          String _elem44; // required
-          _elem44 = iprot.readString();
-          struct.requestorGroupNames.add(_elem44);
-        }
-      }
-      struct.setRequestorGroupNamesIsSet(true);
       struct.roleName = iprot.readString();
       struct.setRoleNameIsSet(true);
       {
-        org.apache.thrift.protocol.TSet _set45 = new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRUCT, iprot.readI32());
-        struct.groups = new HashSet<TSentryGroup>(2*_set45.size);
-        for (int _i46 = 0; _i46 < _set45.size; ++_i46)
+        org.apache.thrift.protocol.TSet _set13 = new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRUCT, iprot.readI32());
+        struct.groups = new HashSet<TSentryGroup>(2*_set13.size);
+        for (int _i14 = 0; _i14 < _set13.size; ++_i14)
         {
-          TSentryGroup _elem47; // required
-          _elem47 = new TSentryGroup();
-          _elem47.read(iprot);
-          struct.groups.add(_elem47);
+          TSentryGroup _elem15; // required
+          _elem15 = new TSentryGroup();
+          _elem15.read(iprot);
+          struct.groups.add(_elem15);
         }
       }
       struct.setGroupsIsSet(true);

http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/61a67cb9/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleGrantPrivilegeRequest.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleGrantPrivilegeRequest.java b/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleGrantPrivilegeRequest.java
index d934d54..62b6b31 100644
--- a/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleGrantPrivilegeRequest.java
+++ b/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleGrantPrivilegeRequest.java
@@ -36,8 +36,7 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
 
   private static final org.apache.thrift.protocol.TField PROTOCOL_VERSION_FIELD_DESC = new org.apache.thrift.protocol.TField("protocol_version", org.apache.thrift.protocol.TType.I32, (short)1);
   private static final org.apache.thrift.protocol.TField REQUESTOR_USER_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("requestorUserName", org.apache.thrift.protocol.TType.STRING, (short)2);
-  private static final org.apache.thrift.protocol.TField REQUESTOR_GROUP_NAMES_FIELD_DESC = new org.apache.thrift.protocol.TField("requestorGroupNames", org.apache.thrift.protocol.TType.SET, (short)3);
-  private static final org.apache.thrift.protocol.TField ROLE_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("roleName", org.apache.thrift.protocol.TType.STRING, (short)4);
+  private static final org.apache.thrift.protocol.TField ROLE_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("roleName", org.apache.thrift.protocol.TType.STRING, (short)3);
   private static final org.apache.thrift.protocol.TField PRIVILEGE_FIELD_DESC = new org.apache.thrift.protocol.TField("privilege", org.apache.thrift.protocol.TType.STRUCT, (short)5);
 
   private static final Map<Class<? extends IScheme>, SchemeFactory> schemes = new HashMap<Class<? extends IScheme>, SchemeFactory>();
@@ -48,7 +47,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
 
   private int protocol_version; // required
   private String requestorUserName; // required
-  private Set<String> requestorGroupNames; // required
   private String roleName; // required
   private TSentryPrivilege privilege; // required
 
@@ -56,8 +54,7 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
   public enum _Fields implements org.apache.thrift.TFieldIdEnum {
     PROTOCOL_VERSION((short)1, "protocol_version"),
     REQUESTOR_USER_NAME((short)2, "requestorUserName"),
-    REQUESTOR_GROUP_NAMES((short)3, "requestorGroupNames"),
-    ROLE_NAME((short)4, "roleName"),
+    ROLE_NAME((short)3, "roleName"),
     PRIVILEGE((short)5, "privilege");
 
     private static final Map<String, _Fields> byName = new HashMap<String, _Fields>();
@@ -77,9 +74,7 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
           return PROTOCOL_VERSION;
         case 2: // REQUESTOR_USER_NAME
           return REQUESTOR_USER_NAME;
-        case 3: // REQUESTOR_GROUP_NAMES
-          return REQUESTOR_GROUP_NAMES;
-        case 4: // ROLE_NAME
+        case 3: // ROLE_NAME
           return ROLE_NAME;
         case 5: // PRIVILEGE
           return PRIVILEGE;
@@ -132,9 +127,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.I32)));
     tmpMap.put(_Fields.REQUESTOR_USER_NAME, new org.apache.thrift.meta_data.FieldMetaData("requestorUserName", org.apache.thrift.TFieldRequirementType.REQUIRED, 
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
-    tmpMap.put(_Fields.REQUESTOR_GROUP_NAMES, new org.apache.thrift.meta_data.FieldMetaData("requestorGroupNames", org.apache.thrift.TFieldRequirementType.REQUIRED, 
-        new org.apache.thrift.meta_data.SetMetaData(org.apache.thrift.protocol.TType.SET, 
-            new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING))));
     tmpMap.put(_Fields.ROLE_NAME, new org.apache.thrift.meta_data.FieldMetaData("roleName", org.apache.thrift.TFieldRequirementType.REQUIRED, 
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
     tmpMap.put(_Fields.PRIVILEGE, new org.apache.thrift.meta_data.FieldMetaData("privilege", org.apache.thrift.TFieldRequirementType.REQUIRED, 
@@ -151,7 +143,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
   public TAlterSentryRoleGrantPrivilegeRequest(
     int protocol_version,
     String requestorUserName,
-    Set<String> requestorGroupNames,
     String roleName,
     TSentryPrivilege privilege)
   {
@@ -159,7 +150,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
     this.protocol_version = protocol_version;
     setProtocol_versionIsSet(true);
     this.requestorUserName = requestorUserName;
-    this.requestorGroupNames = requestorGroupNames;
     this.roleName = roleName;
     this.privilege = privilege;
   }
@@ -173,13 +163,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
     if (other.isSetRequestorUserName()) {
       this.requestorUserName = other.requestorUserName;
     }
-    if (other.isSetRequestorGroupNames()) {
-      Set<String> __this__requestorGroupNames = new HashSet<String>();
-      for (String other_element : other.requestorGroupNames) {
-        __this__requestorGroupNames.add(other_element);
-      }
-      this.requestorGroupNames = __this__requestorGroupNames;
-    }
     if (other.isSetRoleName()) {
       this.roleName = other.roleName;
     }
@@ -197,7 +180,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
     this.protocol_version = 1;
 
     this.requestorUserName = null;
-    this.requestorGroupNames = null;
     this.roleName = null;
     this.privilege = null;
   }
@@ -247,44 +229,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
     }
   }
 
-  public int getRequestorGroupNamesSize() {
-    return (this.requestorGroupNames == null) ? 0 : this.requestorGroupNames.size();
-  }
-
-  public java.util.Iterator<String> getRequestorGroupNamesIterator() {
-    return (this.requestorGroupNames == null) ? null : this.requestorGroupNames.iterator();
-  }
-
-  public void addToRequestorGroupNames(String elem) {
-    if (this.requestorGroupNames == null) {
-      this.requestorGroupNames = new HashSet<String>();
-    }
-    this.requestorGroupNames.add(elem);
-  }
-
-  public Set<String> getRequestorGroupNames() {
-    return this.requestorGroupNames;
-  }
-
-  public void setRequestorGroupNames(Set<String> requestorGroupNames) {
-    this.requestorGroupNames = requestorGroupNames;
-  }
-
-  public void unsetRequestorGroupNames() {
-    this.requestorGroupNames = null;
-  }
-
-  /** Returns true if field requestorGroupNames is set (has been assigned a value) and false otherwise */
-  public boolean isSetRequestorGroupNames() {
-    return this.requestorGroupNames != null;
-  }
-
-  public void setRequestorGroupNamesIsSet(boolean value) {
-    if (!value) {
-      this.requestorGroupNames = null;
-    }
-  }
-
   public String getRoleName() {
     return this.roleName;
   }
@@ -349,14 +293,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
       }
       break;
 
-    case REQUESTOR_GROUP_NAMES:
-      if (value == null) {
-        unsetRequestorGroupNames();
-      } else {
-        setRequestorGroupNames((Set<String>)value);
-      }
-      break;
-
     case ROLE_NAME:
       if (value == null) {
         unsetRoleName();
@@ -384,9 +320,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
     case REQUESTOR_USER_NAME:
       return getRequestorUserName();
 
-    case REQUESTOR_GROUP_NAMES:
-      return getRequestorGroupNames();
-
     case ROLE_NAME:
       return getRoleName();
 
@@ -408,8 +341,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
       return isSetProtocol_version();
     case REQUESTOR_USER_NAME:
       return isSetRequestorUserName();
-    case REQUESTOR_GROUP_NAMES:
-      return isSetRequestorGroupNames();
     case ROLE_NAME:
       return isSetRoleName();
     case PRIVILEGE:
@@ -449,15 +380,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
         return false;
     }
 
-    boolean this_present_requestorGroupNames = true && this.isSetRequestorGroupNames();
-    boolean that_present_requestorGroupNames = true && that.isSetRequestorGroupNames();
-    if (this_present_requestorGroupNames || that_present_requestorGroupNames) {
-      if (!(this_present_requestorGroupNames && that_present_requestorGroupNames))
-        return false;
-      if (!this.requestorGroupNames.equals(that.requestorGroupNames))
-        return false;
-    }
-
     boolean this_present_roleName = true && this.isSetRoleName();
     boolean that_present_roleName = true && that.isSetRoleName();
     if (this_present_roleName || that_present_roleName) {
@@ -493,11 +415,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
     if (present_requestorUserName)
       builder.append(requestorUserName);
 
-    boolean present_requestorGroupNames = true && (isSetRequestorGroupNames());
-    builder.append(present_requestorGroupNames);
-    if (present_requestorGroupNames)
-      builder.append(requestorGroupNames);
-
     boolean present_roleName = true && (isSetRoleName());
     builder.append(present_roleName);
     if (present_roleName)
@@ -539,16 +456,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
         return lastComparison;
       }
     }
-    lastComparison = Boolean.valueOf(isSetRequestorGroupNames()).compareTo(typedOther.isSetRequestorGroupNames());
-    if (lastComparison != 0) {
-      return lastComparison;
-    }
-    if (isSetRequestorGroupNames()) {
-      lastComparison = org.apache.thrift.TBaseHelper.compareTo(this.requestorGroupNames, typedOther.requestorGroupNames);
-      if (lastComparison != 0) {
-        return lastComparison;
-      }
-    }
     lastComparison = Boolean.valueOf(isSetRoleName()).compareTo(typedOther.isSetRoleName());
     if (lastComparison != 0) {
       return lastComparison;
@@ -601,14 +508,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
     }
     first = false;
     if (!first) sb.append(", ");
-    sb.append("requestorGroupNames:");
-    if (this.requestorGroupNames == null) {
-      sb.append("null");
-    } else {
-      sb.append(this.requestorGroupNames);
-    }
-    first = false;
-    if (!first) sb.append(", ");
     sb.append("roleName:");
     if (this.roleName == null) {
       sb.append("null");
@@ -638,10 +537,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
       throw new org.apache.thrift.protocol.TProtocolException("Required field 'requestorUserName' is unset! Struct:" + toString());
     }
 
-    if (!isSetRequestorGroupNames()) {
-      throw new org.apache.thrift.protocol.TProtocolException("Required field 'requestorGroupNames' is unset! Struct:" + toString());
-    }
-
     if (!isSetRoleName()) {
       throw new org.apache.thrift.protocol.TProtocolException("Required field 'roleName' is unset! Struct:" + toString());
     }
@@ -708,25 +603,7 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
               org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
             }
             break;
-          case 3: // REQUESTOR_GROUP_NAMES
-            if (schemeField.type == org.apache.thrift.protocol.TType.SET) {
-              {
-                org.apache.thrift.protocol.TSet _set48 = iprot.readSetBegin();
-                struct.requestorGroupNames = new HashSet<String>(2*_set48.size);
-                for (int _i49 = 0; _i49 < _set48.size; ++_i49)
-                {
-                  String _elem50; // required
-                  _elem50 = iprot.readString();
-                  struct.requestorGroupNames.add(_elem50);
-                }
-                iprot.readSetEnd();
-              }
-              struct.setRequestorGroupNamesIsSet(true);
-            } else { 
-              org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
-            }
-            break;
-          case 4: // ROLE_NAME
+          case 3: // ROLE_NAME
             if (schemeField.type == org.apache.thrift.protocol.TType.STRING) {
               struct.roleName = iprot.readString();
               struct.setRoleNameIsSet(true);
@@ -764,18 +641,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
         oprot.writeString(struct.requestorUserName);
         oprot.writeFieldEnd();
       }
-      if (struct.requestorGroupNames != null) {
-        oprot.writeFieldBegin(REQUESTOR_GROUP_NAMES_FIELD_DESC);
-        {
-          oprot.writeSetBegin(new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRING, struct.requestorGroupNames.size()));
-          for (String _iter51 : struct.requestorGroupNames)
-          {
-            oprot.writeString(_iter51);
-          }
-          oprot.writeSetEnd();
-        }
-        oprot.writeFieldEnd();
-      }
       if (struct.roleName != null) {
         oprot.writeFieldBegin(ROLE_NAME_FIELD_DESC);
         oprot.writeString(struct.roleName);
@@ -805,13 +670,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
       TTupleProtocol oprot = (TTupleProtocol) prot;
       oprot.writeI32(struct.protocol_version);
       oprot.writeString(struct.requestorUserName);
-      {
-        oprot.writeI32(struct.requestorGroupNames.size());
-        for (String _iter52 : struct.requestorGroupNames)
-        {
-          oprot.writeString(_iter52);
-        }
-      }
       oprot.writeString(struct.roleName);
       struct.privilege.write(oprot);
     }
@@ -823,17 +681,6 @@ public class TAlterSentryRoleGrantPrivilegeRequest implements org.apache.thrift.
       struct.setProtocol_versionIsSet(true);
       struct.requestorUserName = iprot.readString();
       struct.setRequestorUserNameIsSet(true);
-      {
-        org.apache.thrift.protocol.TSet _set53 = new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRING, iprot.readI32());
-        struct.requestorGroupNames = new HashSet<String>(2*_set53.size);
-        for (int _i54 = 0; _i54 < _set53.size; ++_i54)
-        {
-          String _elem55; // required
-          _elem55 = iprot.readString();
-          struct.requestorGroupNames.add(_elem55);
-        }
-      }
-      struct.setRequestorGroupNamesIsSet(true);
       struct.roleName = iprot.readString();
       struct.setRoleNameIsSet(true);
       struct.privilege = new TSentryPrivilege();

http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/61a67cb9/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleRevokePrivilegeRequest.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleRevokePrivilegeRequest.java b/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleRevokePrivilegeRequest.java
index ae7eaf3..bbd9536 100644
--- a/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleRevokePrivilegeRequest.java
+++ b/sentry-provider/sentry-provider-db/src/gen/thrift/gen-javabean/org/apache/sentry/provider/db/service/thrift/TAlterSentryRoleRevokePrivilegeRequest.java
@@ -36,8 +36,7 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
 
   private static final org.apache.thrift.protocol.TField PROTOCOL_VERSION_FIELD_DESC = new org.apache.thrift.protocol.TField("protocol_version", org.apache.thrift.protocol.TType.I32, (short)1);
   private static final org.apache.thrift.protocol.TField REQUESTOR_USER_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("requestorUserName", org.apache.thrift.protocol.TType.STRING, (short)2);
-  private static final org.apache.thrift.protocol.TField REQUESTOR_GROUP_NAMES_FIELD_DESC = new org.apache.thrift.protocol.TField("requestorGroupNames", org.apache.thrift.protocol.TType.SET, (short)3);
-  private static final org.apache.thrift.protocol.TField ROLE_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("roleName", org.apache.thrift.protocol.TType.STRING, (short)4);
+  private static final org.apache.thrift.protocol.TField ROLE_NAME_FIELD_DESC = new org.apache.thrift.protocol.TField("roleName", org.apache.thrift.protocol.TType.STRING, (short)3);
   private static final org.apache.thrift.protocol.TField PRIVILEGE_FIELD_DESC = new org.apache.thrift.protocol.TField("privilege", org.apache.thrift.protocol.TType.STRUCT, (short)5);
 
   private static final Map<Class<? extends IScheme>, SchemeFactory> schemes = new HashMap<Class<? extends IScheme>, SchemeFactory>();
@@ -48,7 +47,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
 
   private int protocol_version; // required
   private String requestorUserName; // required
-  private Set<String> requestorGroupNames; // required
   private String roleName; // required
   private TSentryPrivilege privilege; // required
 
@@ -56,8 +54,7 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
   public enum _Fields implements org.apache.thrift.TFieldIdEnum {
     PROTOCOL_VERSION((short)1, "protocol_version"),
     REQUESTOR_USER_NAME((short)2, "requestorUserName"),
-    REQUESTOR_GROUP_NAMES((short)3, "requestorGroupNames"),
-    ROLE_NAME((short)4, "roleName"),
+    ROLE_NAME((short)3, "roleName"),
     PRIVILEGE((short)5, "privilege");
 
     private static final Map<String, _Fields> byName = new HashMap<String, _Fields>();
@@ -77,9 +74,7 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
           return PROTOCOL_VERSION;
         case 2: // REQUESTOR_USER_NAME
           return REQUESTOR_USER_NAME;
-        case 3: // REQUESTOR_GROUP_NAMES
-          return REQUESTOR_GROUP_NAMES;
-        case 4: // ROLE_NAME
+        case 3: // ROLE_NAME
           return ROLE_NAME;
         case 5: // PRIVILEGE
           return PRIVILEGE;
@@ -132,9 +127,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.I32)));
     tmpMap.put(_Fields.REQUESTOR_USER_NAME, new org.apache.thrift.meta_data.FieldMetaData("requestorUserName", org.apache.thrift.TFieldRequirementType.REQUIRED, 
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
-    tmpMap.put(_Fields.REQUESTOR_GROUP_NAMES, new org.apache.thrift.meta_data.FieldMetaData("requestorGroupNames", org.apache.thrift.TFieldRequirementType.REQUIRED, 
-        new org.apache.thrift.meta_data.SetMetaData(org.apache.thrift.protocol.TType.SET, 
-            new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING))));
     tmpMap.put(_Fields.ROLE_NAME, new org.apache.thrift.meta_data.FieldMetaData("roleName", org.apache.thrift.TFieldRequirementType.REQUIRED, 
         new org.apache.thrift.meta_data.FieldValueMetaData(org.apache.thrift.protocol.TType.STRING)));
     tmpMap.put(_Fields.PRIVILEGE, new org.apache.thrift.meta_data.FieldMetaData("privilege", org.apache.thrift.TFieldRequirementType.REQUIRED, 
@@ -151,7 +143,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
   public TAlterSentryRoleRevokePrivilegeRequest(
     int protocol_version,
     String requestorUserName,
-    Set<String> requestorGroupNames,
     String roleName,
     TSentryPrivilege privilege)
   {
@@ -159,7 +150,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
     this.protocol_version = protocol_version;
     setProtocol_versionIsSet(true);
     this.requestorUserName = requestorUserName;
-    this.requestorGroupNames = requestorGroupNames;
     this.roleName = roleName;
     this.privilege = privilege;
   }
@@ -173,13 +163,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
     if (other.isSetRequestorUserName()) {
       this.requestorUserName = other.requestorUserName;
     }
-    if (other.isSetRequestorGroupNames()) {
-      Set<String> __this__requestorGroupNames = new HashSet<String>();
-      for (String other_element : other.requestorGroupNames) {
-        __this__requestorGroupNames.add(other_element);
-      }
-      this.requestorGroupNames = __this__requestorGroupNames;
-    }
     if (other.isSetRoleName()) {
       this.roleName = other.roleName;
     }
@@ -197,7 +180,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
     this.protocol_version = 1;
 
     this.requestorUserName = null;
-    this.requestorGroupNames = null;
     this.roleName = null;
     this.privilege = null;
   }
@@ -247,44 +229,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
     }
   }
 
-  public int getRequestorGroupNamesSize() {
-    return (this.requestorGroupNames == null) ? 0 : this.requestorGroupNames.size();
-  }
-
-  public java.util.Iterator<String> getRequestorGroupNamesIterator() {
-    return (this.requestorGroupNames == null) ? null : this.requestorGroupNames.iterator();
-  }
-
-  public void addToRequestorGroupNames(String elem) {
-    if (this.requestorGroupNames == null) {
-      this.requestorGroupNames = new HashSet<String>();
-    }
-    this.requestorGroupNames.add(elem);
-  }
-
-  public Set<String> getRequestorGroupNames() {
-    return this.requestorGroupNames;
-  }
-
-  public void setRequestorGroupNames(Set<String> requestorGroupNames) {
-    this.requestorGroupNames = requestorGroupNames;
-  }
-
-  public void unsetRequestorGroupNames() {
-    this.requestorGroupNames = null;
-  }
-
-  /** Returns true if field requestorGroupNames is set (has been assigned a value) and false otherwise */
-  public boolean isSetRequestorGroupNames() {
-    return this.requestorGroupNames != null;
-  }
-
-  public void setRequestorGroupNamesIsSet(boolean value) {
-    if (!value) {
-      this.requestorGroupNames = null;
-    }
-  }
-
   public String getRoleName() {
     return this.roleName;
   }
@@ -349,14 +293,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
       }
       break;
 
-    case REQUESTOR_GROUP_NAMES:
-      if (value == null) {
-        unsetRequestorGroupNames();
-      } else {
-        setRequestorGroupNames((Set<String>)value);
-      }
-      break;
-
     case ROLE_NAME:
       if (value == null) {
         unsetRoleName();
@@ -384,9 +320,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
     case REQUESTOR_USER_NAME:
       return getRequestorUserName();
 
-    case REQUESTOR_GROUP_NAMES:
-      return getRequestorGroupNames();
-
     case ROLE_NAME:
       return getRoleName();
 
@@ -408,8 +341,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
       return isSetProtocol_version();
     case REQUESTOR_USER_NAME:
       return isSetRequestorUserName();
-    case REQUESTOR_GROUP_NAMES:
-      return isSetRequestorGroupNames();
     case ROLE_NAME:
       return isSetRoleName();
     case PRIVILEGE:
@@ -449,15 +380,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
         return false;
     }
 
-    boolean this_present_requestorGroupNames = true && this.isSetRequestorGroupNames();
-    boolean that_present_requestorGroupNames = true && that.isSetRequestorGroupNames();
-    if (this_present_requestorGroupNames || that_present_requestorGroupNames) {
-      if (!(this_present_requestorGroupNames && that_present_requestorGroupNames))
-        return false;
-      if (!this.requestorGroupNames.equals(that.requestorGroupNames))
-        return false;
-    }
-
     boolean this_present_roleName = true && this.isSetRoleName();
     boolean that_present_roleName = true && that.isSetRoleName();
     if (this_present_roleName || that_present_roleName) {
@@ -493,11 +415,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
     if (present_requestorUserName)
       builder.append(requestorUserName);
 
-    boolean present_requestorGroupNames = true && (isSetRequestorGroupNames());
-    builder.append(present_requestorGroupNames);
-    if (present_requestorGroupNames)
-      builder.append(requestorGroupNames);
-
     boolean present_roleName = true && (isSetRoleName());
     builder.append(present_roleName);
     if (present_roleName)
@@ -539,16 +456,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
         return lastComparison;
       }
     }
-    lastComparison = Boolean.valueOf(isSetRequestorGroupNames()).compareTo(typedOther.isSetRequestorGroupNames());
-    if (lastComparison != 0) {
-      return lastComparison;
-    }
-    if (isSetRequestorGroupNames()) {
-      lastComparison = org.apache.thrift.TBaseHelper.compareTo(this.requestorGroupNames, typedOther.requestorGroupNames);
-      if (lastComparison != 0) {
-        return lastComparison;
-      }
-    }
     lastComparison = Boolean.valueOf(isSetRoleName()).compareTo(typedOther.isSetRoleName());
     if (lastComparison != 0) {
       return lastComparison;
@@ -601,14 +508,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
     }
     first = false;
     if (!first) sb.append(", ");
-    sb.append("requestorGroupNames:");
-    if (this.requestorGroupNames == null) {
-      sb.append("null");
-    } else {
-      sb.append(this.requestorGroupNames);
-    }
-    first = false;
-    if (!first) sb.append(", ");
     sb.append("roleName:");
     if (this.roleName == null) {
       sb.append("null");
@@ -638,10 +537,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
       throw new org.apache.thrift.protocol.TProtocolException("Required field 'requestorUserName' is unset! Struct:" + toString());
     }
 
-    if (!isSetRequestorGroupNames()) {
-      throw new org.apache.thrift.protocol.TProtocolException("Required field 'requestorGroupNames' is unset! Struct:" + toString());
-    }
-
     if (!isSetRoleName()) {
       throw new org.apache.thrift.protocol.TProtocolException("Required field 'roleName' is unset! Struct:" + toString());
     }
@@ -708,25 +603,7 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
               org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
             }
             break;
-          case 3: // REQUESTOR_GROUP_NAMES
-            if (schemeField.type == org.apache.thrift.protocol.TType.SET) {
-              {
-                org.apache.thrift.protocol.TSet _set56 = iprot.readSetBegin();
-                struct.requestorGroupNames = new HashSet<String>(2*_set56.size);
-                for (int _i57 = 0; _i57 < _set56.size; ++_i57)
-                {
-                  String _elem58; // required
-                  _elem58 = iprot.readString();
-                  struct.requestorGroupNames.add(_elem58);
-                }
-                iprot.readSetEnd();
-              }
-              struct.setRequestorGroupNamesIsSet(true);
-            } else { 
-              org.apache.thrift.protocol.TProtocolUtil.skip(iprot, schemeField.type);
-            }
-            break;
-          case 4: // ROLE_NAME
+          case 3: // ROLE_NAME
             if (schemeField.type == org.apache.thrift.protocol.TType.STRING) {
               struct.roleName = iprot.readString();
               struct.setRoleNameIsSet(true);
@@ -764,18 +641,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
         oprot.writeString(struct.requestorUserName);
         oprot.writeFieldEnd();
       }
-      if (struct.requestorGroupNames != null) {
-        oprot.writeFieldBegin(REQUESTOR_GROUP_NAMES_FIELD_DESC);
-        {
-          oprot.writeSetBegin(new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRING, struct.requestorGroupNames.size()));
-          for (String _iter59 : struct.requestorGroupNames)
-          {
-            oprot.writeString(_iter59);
-          }
-          oprot.writeSetEnd();
-        }
-        oprot.writeFieldEnd();
-      }
       if (struct.roleName != null) {
         oprot.writeFieldBegin(ROLE_NAME_FIELD_DESC);
         oprot.writeString(struct.roleName);
@@ -805,13 +670,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
       TTupleProtocol oprot = (TTupleProtocol) prot;
       oprot.writeI32(struct.protocol_version);
       oprot.writeString(struct.requestorUserName);
-      {
-        oprot.writeI32(struct.requestorGroupNames.size());
-        for (String _iter60 : struct.requestorGroupNames)
-        {
-          oprot.writeString(_iter60);
-        }
-      }
       oprot.writeString(struct.roleName);
       struct.privilege.write(oprot);
     }
@@ -823,17 +681,6 @@ public class TAlterSentryRoleRevokePrivilegeRequest implements org.apache.thrift
       struct.setProtocol_versionIsSet(true);
       struct.requestorUserName = iprot.readString();
       struct.setRequestorUserNameIsSet(true);
-      {
-        org.apache.thrift.protocol.TSet _set61 = new org.apache.thrift.protocol.TSet(org.apache.thrift.protocol.TType.STRING, iprot.readI32());
-        struct.requestorGroupNames = new HashSet<String>(2*_set61.size);
-        for (int _i62 = 0; _i62 < _set61.size; ++_i62)
-        {
-          String _elem63; // required
-          _elem63 = iprot.readString();
-          struct.requestorGroupNames.add(_elem63);
-        }
-      }
-      struct.setRequestorGroupNamesIsSet(true);
       struct.roleName = iprot.readString();
       struct.setRoleNameIsSet(true);
       struct.privilege = new TSentryPrivilege();