You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sentry.apache.org by br...@apache.org on 2013/10/22 21:22:04 UTC
[3/5] SENTRY-43 - Refactor into policy specific modules (Gregory
Chanan via Brock Noland)
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchAuthorizationProviderGeneralCases.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchAuthorizationProviderGeneralCases.java b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchAuthorizationProviderGeneralCases.java
new file mode 100644
index 0000000..4bbaf3a
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchAuthorizationProviderGeneralCases.java
@@ -0,0 +1,179 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.search;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Set;
+
+import junit.framework.Assert;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.sentry.core.common.Action;
+import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.core.common.Subject;
+import org.apache.sentry.core.model.search.SearchConstants;
+import org.apache.sentry.core.model.search.SearchModelAction;
+import org.apache.sentry.core.model.search.Collection;
+import org.apache.sentry.provider.common.MockGroupMappingServiceProvider;
+import org.apache.sentry.provider.file.HadoopGroupResourceAuthorizationProvider;
+import org.apache.sentry.provider.file.PolicyFiles;
+import org.apache.sentry.provider.file.ResourceAuthorizationProvider;
+import org.junit.After;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Objects;
+import com.google.common.collect.HashMultimap;
+import com.google.common.collect.Multimap;
+import com.google.common.io.Files;
+
+
+public class TestSearchAuthorizationProviderGeneralCases {
+
+ private static final Logger LOGGER = LoggerFactory
+ .getLogger(TestSearchAuthorizationProviderGeneralCases.class);
+
+ private static final Multimap<String, String> USER_TO_GROUP_MAP = HashMultimap
+ .create();
+
+ private static final Subject SUB_ADMIN = new Subject("admin1");
+ private static final Subject SUB_MANAGER = new Subject("manager1");
+ private static final Subject SUB_ANALYST = new Subject("analyst1");
+ private static final Subject SUB_JUNIOR_ANALYST = new Subject("jranalyst1");
+
+ private static final Collection COLL_PURCHASES = new Collection("purchases");
+ private static final Collection COLL_ANALYST1 = new Collection("analyst1");
+ private static final Collection COLL_JRANALYST1 = new Collection("jranalyst1");
+ private static final Collection COLL_TMP = new Collection("tmpcollection");
+ private static final Collection COLL_PURCHASES_PARTIAL = new Collection("purchases_partial");
+
+ private static final SearchModelAction ALL = SearchModelAction.ALL;
+ private static final SearchModelAction QUERY = SearchModelAction.QUERY;
+ private static final SearchModelAction UPDATE = SearchModelAction.UPDATE;
+
+ static {
+ USER_TO_GROUP_MAP.putAll(SUB_ADMIN.getName(), Arrays.asList("admin"));
+ USER_TO_GROUP_MAP.putAll(SUB_MANAGER.getName(), Arrays.asList("manager"));
+ USER_TO_GROUP_MAP.putAll(SUB_ANALYST.getName(), Arrays.asList("analyst"));
+ USER_TO_GROUP_MAP.putAll(SUB_JUNIOR_ANALYST.getName(),
+ Arrays.asList("jranalyst"));
+ }
+
+ private final ResourceAuthorizationProvider authzProvider;
+ private File baseDir;
+
+ public TestSearchAuthorizationProviderGeneralCases() throws IOException {
+ baseDir = Files.createTempDir();
+ PolicyFiles.copyToDir(baseDir, "test-authz-provider.ini");
+ authzProvider = new HadoopGroupResourceAuthorizationProvider(
+ new SearchPolicyFileBackend(new File(baseDir, "test-authz-provider.ini").getPath()),
+ new MockGroupMappingServiceProvider(USER_TO_GROUP_MAP));
+
+ }
+
+ @After
+ public void teardown() {
+ if(baseDir != null) {
+ FileUtils.deleteQuietly(baseDir);
+ }
+ }
+
+ private void doTestAuthProviderOnCollection(Subject subject,
+ Collection collection, Set<? extends Action> expectedPass) throws Exception {
+ Set<SearchModelAction> allActions = EnumSet.of(SearchModelAction.ALL, SearchModelAction.QUERY, SearchModelAction.UPDATE);
+ for(SearchModelAction action : allActions) {
+ doTestResourceAuthorizationProvider(subject, collection,
+ EnumSet.of(action), expectedPass.contains(action));
+ }
+ }
+
+ private void doTestResourceAuthorizationProvider(Subject subject,
+ Collection collection,
+ Set<? extends Action> privileges, boolean expected) throws Exception {
+ List<Authorizable> authzHierarchy = Arrays.asList(new Authorizable[] {
+ collection
+ });
+ Objects.ToStringHelper helper = Objects.toStringHelper("TestParameters");
+ helper.add("Subject", subject).add("Collection", collection)
+ .add("Privileges", privileges).add("authzHierarchy", authzHierarchy);
+ LOGGER.info("Running with " + helper.toString());
+ Assert.assertEquals(helper.toString(), expected,
+ authzProvider.hasAccess(subject, authzHierarchy, privileges));
+ LOGGER.info("Passed " + helper.toString());
+ }
+
+ @Test
+ public void testAdmin() throws Exception {
+ Set<SearchModelAction> allActions = EnumSet.allOf(SearchModelAction.class);
+ doTestAuthProviderOnCollection(SUB_ADMIN, COLL_PURCHASES, allActions);
+ doTestAuthProviderOnCollection(SUB_ADMIN, COLL_ANALYST1, allActions);
+ doTestAuthProviderOnCollection(SUB_ADMIN, COLL_JRANALYST1, allActions);
+ doTestAuthProviderOnCollection(SUB_ADMIN, COLL_TMP, allActions);
+ doTestAuthProviderOnCollection(SUB_ADMIN, COLL_PURCHASES_PARTIAL, allActions);
+ }
+
+ @Test
+ public void testManager() throws Exception {
+ Set<SearchModelAction> updateOnly = EnumSet.of(SearchModelAction.UPDATE);
+ doTestAuthProviderOnCollection(SUB_MANAGER, COLL_PURCHASES, updateOnly);
+
+ Set<SearchModelAction> allActions = EnumSet.allOf(SearchModelAction.class);
+ doTestAuthProviderOnCollection(SUB_MANAGER, COLL_ANALYST1, allActions);
+ doTestAuthProviderOnCollection(SUB_MANAGER, COLL_JRANALYST1, allActions);
+
+ Set<SearchModelAction> queryUpdateOnly = EnumSet.of(QUERY, UPDATE);
+ doTestAuthProviderOnCollection(SUB_MANAGER, COLL_TMP, queryUpdateOnly);
+
+ Set<SearchModelAction> queryOnly = EnumSet.of(SearchModelAction.QUERY);
+ doTestAuthProviderOnCollection(SUB_MANAGER, COLL_PURCHASES_PARTIAL, queryOnly);
+ }
+
+ @Test
+ public void testAnalyst() throws Exception {
+ Set<SearchModelAction> updateOnly = EnumSet.of(SearchModelAction.UPDATE);
+ doTestAuthProviderOnCollection(SUB_ANALYST, COLL_PURCHASES, updateOnly);
+
+ Set<SearchModelAction> allActions = EnumSet.allOf(SearchModelAction.class);
+ doTestAuthProviderOnCollection(SUB_ANALYST, COLL_ANALYST1, allActions);
+ doTestAuthProviderOnCollection(SUB_ANALYST, COLL_JRANALYST1, allActions);
+
+ Set<SearchModelAction> queryUpdateOnly = EnumSet.of(QUERY, UPDATE);
+ doTestAuthProviderOnCollection(SUB_ANALYST, COLL_TMP, queryUpdateOnly);
+
+ Set<SearchModelAction> noActions = EnumSet.noneOf(SearchModelAction.class);
+ doTestAuthProviderOnCollection(SUB_ANALYST, COLL_PURCHASES_PARTIAL, noActions);
+ }
+
+ @Test
+ public void testJuniorAnalyst() throws Exception {
+ Set<SearchModelAction> allActions = EnumSet.allOf(SearchModelAction.class);
+ doTestAuthProviderOnCollection(SUB_JUNIOR_ANALYST, COLL_JRANALYST1, allActions);
+
+ Set<SearchModelAction> queryOnly = EnumSet.of(SearchModelAction.QUERY);
+ doTestAuthProviderOnCollection(SUB_JUNIOR_ANALYST, COLL_PURCHASES_PARTIAL, queryOnly);
+
+ Set<SearchModelAction> noActions = EnumSet.noneOf(SearchModelAction.class);
+ doTestAuthProviderOnCollection(SUB_JUNIOR_ANALYST, COLL_PURCHASES, noActions);
+ doTestAuthProviderOnCollection(SUB_JUNIOR_ANALYST, COLL_ANALYST1, noActions);
+ doTestAuthProviderOnCollection(SUB_JUNIOR_ANALYST, COLL_TMP, noActions);
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchAuthorizationProviderSpecialCases.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchAuthorizationProviderSpecialCases.java b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchAuthorizationProviderSpecialCases.java
new file mode 100644
index 0000000..2a7872d
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchAuthorizationProviderSpecialCases.java
@@ -0,0 +1,81 @@
+ /*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.search;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Set;
+
+import junit.framework.Assert;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.core.common.Action;
+import org.apache.sentry.core.common.Subject;
+import org.apache.sentry.core.model.search.Collection;
+import org.apache.sentry.core.model.search.SearchModelAction;
+import org.apache.sentry.provider.common.AuthorizationProvider;
+import org.apache.sentry.provider.file.LocalGroupResourceAuthorizationProvider;
+import org.apache.sentry.provider.file.PolicyFile;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.io.Files;
+
+public class TestSearchAuthorizationProviderSpecialCases {
+ private AuthorizationProvider authzProvider;
+ private PolicyFile policyFile;
+ private File baseDir;
+ private File iniFile;
+ private String initResource;
+ @Before
+ public void setup() throws IOException {
+ baseDir = Files.createTempDir();
+ iniFile = new File(baseDir, "policy.ini");
+ initResource = "file://" + iniFile.getPath();
+ policyFile = new PolicyFile();
+ }
+
+ @After
+ public void teardown() throws IOException {
+ if(baseDir != null) {
+ FileUtils.deleteQuietly(baseDir);
+ }
+ }
+
+ @Test
+ public void testDuplicateEntries() throws Exception {
+ Subject user1 = new Subject("user1");
+ Collection collection1 = new Collection("collection1");
+ Set<? extends Action> actions = EnumSet.allOf(SearchModelAction.class);
+ policyFile.addGroupsToUser(user1.getName(), true, "group1", "group1")
+ .addRolesToGroup("group1", true, "role1", "role1")
+ .addPermissionsToRole("role1", true, "collection=" + collection1.getName(),
+ "collection=" + collection1.getName());
+ policyFile.write(iniFile);
+ SearchPolicyFileBackend policy = new SearchPolicyFileBackend(initResource);
+ authzProvider = new LocalGroupResourceAuthorizationProvider(initResource, policy);
+ List<? extends Authorizable> authorizableHierarchy = ImmutableList.of(collection1);
+ Assert.assertTrue(authorizableHierarchy.toString(),
+ authzProvider.hasAccess(user1, authorizableHierarchy, actions));
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchModelAuthorizables.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchModelAuthorizables.java b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchModelAuthorizables.java
new file mode 100644
index 0000000..bd06b7e
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchModelAuthorizables.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sentry.policy.search;
+import static junit.framework.Assert.assertEquals;
+import static junit.framework.Assert.assertNull;
+
+
+import org.apache.sentry.core.model.search.Collection;
+import org.apache.sentry.policy.search.SearchModelAuthorizables;
+import org.junit.Test;
+
+public class TestSearchModelAuthorizables {
+
+ @Test
+ public void testServer() throws Exception {
+ Collection coll = (Collection)SearchModelAuthorizables.from("CoLleCtiOn=collection1");
+ assertEquals("collection1", coll.getName());
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testNoKV() throws Exception {
+ System.out.println(SearchModelAuthorizables.from("nonsense"));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testTooManyKV() throws Exception {
+ System.out.println(SearchModelAuthorizables.from("k=v1=v2"));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testEmptyKey() throws Exception {
+ System.out.println(SearchModelAuthorizables.from("=v"));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testEmptyValue() throws Exception {
+ System.out.println(SearchModelAuthorizables.from("k="));
+ }
+
+ @Test
+ public void testNotAuthorizable() throws Exception {
+ assertNull(SearchModelAuthorizables.from("k=v"));
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyEngineDFS.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyEngineDFS.java b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyEngineDFS.java
new file mode 100644
index 0000000..1683eec
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyEngineDFS.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.search;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.List;
+
+import junit.framework.Assert;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.fs.FileSystem;
+import org.apache.hadoop.fs.Path;
+import org.apache.hadoop.hdfs.MiniDFSCluster;
+import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.provider.file.PolicyFile;
+import org.apache.sentry.provider.file.PolicyFiles;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import com.google.common.collect.ImmutableSetMultimap;
+import com.google.common.collect.Lists;
+import com.google.common.io.Files;
+
+public class TestSearchPolicyEngineDFS extends AbstractTestSearchPolicyEngine {
+
+ private static MiniDFSCluster dfsCluster;
+ private static FileSystem fileSystem;
+ private static Path root;
+ private static Path etc;
+
+ @BeforeClass
+ public static void setupLocalClazz() throws IOException {
+ File baseDir = getBaseDir();
+ Assert.assertNotNull(baseDir);
+ File dfsDir = new File(baseDir, "dfs");
+ Assert.assertTrue(dfsDir.isDirectory() || dfsDir.mkdirs());
+ Configuration conf = new Configuration();
+ conf.set(MiniDFSCluster.HDFS_MINIDFS_BASEDIR, dfsDir.getPath());
+ dfsCluster = new MiniDFSCluster.Builder(conf).numDataNodes(2).build();
+ fileSystem = dfsCluster.getFileSystem();
+ root = new Path(fileSystem.getUri().toString());
+ etc = new Path(root, "/etc");
+ fileSystem.mkdirs(etc);
+ }
+
+ @AfterClass
+ public static void teardownLocalClazz() {
+ if(dfsCluster != null) {
+ dfsCluster.shutdown();
+ }
+ }
+
+ @Override
+ protected void afterSetup() throws IOException {
+ fileSystem.delete(etc, true);
+ fileSystem.mkdirs(etc);
+ PolicyFiles.copyToDir(fileSystem, etc, "test-authz-provider.ini");
+ setPolicy(new SearchPolicyFileBackend(new Path(etc, "test-authz-provider.ini").toString()));
+ }
+
+ @Override
+ protected void beforeTeardown() throws IOException {
+ fileSystem.delete(etc, true);
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyEngineLocalFS.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyEngineLocalFS.java b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyEngineLocalFS.java
new file mode 100644
index 0000000..77048cf
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyEngineLocalFS.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.search;
+
+import java.io.File;
+import java.io.IOException;
+
+import junit.framework.Assert;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.sentry.provider.file.PolicyFiles;
+
+public class TestSearchPolicyEngineLocalFS extends AbstractTestSearchPolicyEngine {
+
+ @Override
+ protected void afterSetup() throws IOException {
+ File baseDir = getBaseDir();
+ Assert.assertNotNull(baseDir);
+ Assert.assertTrue(baseDir.isDirectory() || baseDir.mkdirs());
+ PolicyFiles.copyToDir(baseDir, "test-authz-provider.ini");
+ setPolicy(new SearchPolicyFileBackend(new File(baseDir, "test-authz-provider.ini").getPath()));
+ }
+ @Override
+ protected void beforeTeardown() throws IOException {
+ File baseDir = getBaseDir();
+ Assert.assertNotNull(baseDir);
+ FileUtils.deleteQuietly(baseDir);
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyNegative.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyNegative.java b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyNegative.java
new file mode 100644
index 0000000..0770aa8
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchPolicyNegative.java
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.policy.search;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.Arrays;
+
+import junit.framework.Assert;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.shiro.config.ConfigurationException;
+import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.core.model.search.Collection;
+import org.apache.sentry.policy.common.PolicyEngine;
+import org.apache.sentry.provider.file.PolicyFile;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.google.common.base.Charsets;
+import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Lists;
+import com.google.common.io.Files;
+
+public class TestSearchPolicyNegative {
+
+ @SuppressWarnings("unused")
+ private static final Logger LOGGER = LoggerFactory
+ .getLogger(TestSearchPolicyNegative.class);
+
+ private File baseDir;
+ private File globalPolicyFile;
+ private File otherPolicyFile;
+
+ @Before
+ public void setup() {
+ baseDir = Files.createTempDir();
+ globalPolicyFile = new File(baseDir, "global.ini");
+ otherPolicyFile = new File(baseDir, "other.ini");
+ }
+
+ @After
+ public void teardown() {
+ if(baseDir != null) {
+ FileUtils.deleteQuietly(baseDir);
+ }
+ }
+
+ private void append(String from, File to) throws IOException {
+ Files.append(from + "\n", to, Charsets.UTF_8);
+ }
+
+ @Test
+ public void testPerDbFileException() throws Exception {
+ append("[databases]", globalPolicyFile);
+ append("other_group_db = " + otherPolicyFile.getPath(), globalPolicyFile);
+ append("[groups]", otherPolicyFile);
+ append("other_group = malicious_role", otherPolicyFile);
+ append("[roles]", otherPolicyFile);
+ append("malicious_role = collection=*", otherPolicyFile);
+ try {
+ PolicyEngine policy = new SearchPolicyFileBackend(globalPolicyFile.getPath());
+ Assert.fail("Excepted ConfigurationException");
+ } catch (ConfigurationException ce) {}
+ }
+
+ @Test
+ public void testCollectionRequiredInRole() throws Exception {
+ append("[groups]", globalPolicyFile);
+ append("group = malicious_role", globalPolicyFile);
+ append("[roles]", globalPolicyFile);
+ append("malicious_role = action=query", globalPolicyFile);
+ PolicyEngine policy = new SearchPolicyFileBackend(globalPolicyFile.getPath());
+ ImmutableSet<String> permissions = policy.getPermissions(
+ Arrays.asList(new Authorizable[] {
+ new Collection("collection1"),
+ }), Lists.newArrayList("group")).get("group");
+ Assert.assertTrue(permissions.toString(), permissions.isEmpty());
+ }
+
+ @Test
+ public void testGroupIncorrect() throws Exception {
+ append("[groups]", globalPolicyFile);
+ append("group = malicious_role", globalPolicyFile);
+ append("[roles]", globalPolicyFile);
+ append("malicious_role = collection=*", globalPolicyFile);
+ PolicyEngine policy = new SearchPolicyFileBackend(globalPolicyFile.getPath());
+ ImmutableSet<String> permissions = policy.getPermissions(
+ Arrays.asList(new Authorizable[] {
+ Collection.ALL
+ }), Lists.newArrayList("incorrectGroup")).get("incorrectGroup");
+ Assert.assertTrue(permissions.toString(), permissions.isEmpty());
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchWildcardPermission.java
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchWildcardPermission.java b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchWildcardPermission.java
new file mode 100644
index 0000000..b20595d
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/java/org/apache/sentry/policy/search/TestSearchWildcardPermission.java
@@ -0,0 +1,206 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sentry.policy.search;
+import static junit.framework.Assert.assertEquals;
+import static junit.framework.Assert.assertFalse;
+import static junit.framework.Assert.assertTrue;
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.KV_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.KV_SEPARATOR;
+
+import org.apache.sentry.core.model.search.SearchConstants;
+import org.apache.sentry.provider.file.KeyValue;
+import org.apache.shiro.authz.Permission;
+import org.junit.Test;
+
+public class TestSearchWildcardPermission {
+
+ private static final String ALL = SearchConstants.ALL;
+
+ @Test
+ public void testSimpleNoAction() throws Exception {
+ Permission collection1 = create(new KeyValue("collection", "coll1"));
+ Permission collection2 = create(new KeyValue("collection", "coll2"));
+ Permission collection1Case = create(new KeyValue("colleCtIon", "coLl1"));
+
+ assertTrue(collection1.implies(collection1));
+ assertTrue(collection2.implies(collection2));
+ assertTrue(collection1.implies(collection1Case));
+ assertTrue(collection1Case.implies(collection1));
+
+ assertFalse(collection1.implies(collection2));
+ assertFalse(collection1Case.implies(collection2));
+ assertFalse(collection2.implies(collection1));
+ assertFalse(collection2.implies(collection1Case));
+ }
+
+ @Test
+ public void testSimpleAction() throws Exception {
+ Permission query =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", "query"));
+ Permission update =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", "update"));
+ Permission queryCase =
+ create(new KeyValue("colleCtIon", "coLl1"), new KeyValue("AcTiOn", "QuERy"));
+
+ assertTrue(query.implies(query));
+ assertTrue(update.implies(update));
+ assertTrue(query.implies(queryCase));
+ assertTrue(queryCase.implies(query));
+
+ assertFalse(query.implies(update));
+ assertFalse(queryCase.implies(update));
+ assertFalse(update.implies(query));
+ assertFalse(update.implies(queryCase));
+ }
+
+ @Test
+ public void testRoleShorterThanRequest() throws Exception {
+ Permission collection1 = create(new KeyValue("collection", "coll1"));
+ Permission query =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", "query"));
+ Permission update =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", "update"));
+ Permission all =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", ALL));
+
+ assertTrue(collection1.implies(query));
+ assertTrue(collection1.implies(update));
+ assertTrue(collection1.implies(all));
+
+ assertFalse(query.implies(collection1));
+ assertFalse(update.implies(collection1));
+ assertTrue(all.implies(collection1));
+ }
+
+ @Test
+ public void testCollectionAll() throws Exception {
+ Permission collectionAll = create(new KeyValue("collection", ALL));
+ Permission collection1 = create(new KeyValue("collection", "coll1"));
+ assertTrue(collectionAll.implies(collection1));
+ assertTrue(collection1.implies(collectionAll));
+
+ Permission allUpdate =
+ create(new KeyValue("collection", ALL), new KeyValue("action", "update"));
+ Permission allQuery =
+ create(new KeyValue("collection", ALL), new KeyValue("action", "query"));
+ Permission coll1Update =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", "update"));
+ Permission coll1Query =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", "query"));
+ assertTrue(allUpdate.implies(coll1Update));
+ assertTrue(allQuery.implies(coll1Query));
+ assertTrue(coll1Update.implies(allUpdate));
+ assertTrue(coll1Query.implies(allQuery));
+ assertFalse(allUpdate.implies(coll1Query));
+ assertFalse(coll1Update.implies(coll1Query));
+ assertFalse(allQuery.implies(coll1Update));
+ assertFalse(coll1Query.implies(allUpdate));
+ assertFalse(allUpdate.implies(allQuery));
+ assertFalse(allQuery.implies(allUpdate));
+ assertFalse(coll1Update.implies(coll1Query));
+ assertFalse(coll1Query.implies(coll1Update));
+
+ // test different length paths
+ assertTrue(collectionAll.implies(allUpdate));
+ assertTrue(collectionAll.implies(allQuery));
+ assertTrue(collectionAll.implies(coll1Update));
+ assertTrue(collectionAll.implies(coll1Query));
+ assertFalse(allUpdate.implies(collectionAll));
+ assertFalse(allQuery.implies(collectionAll));
+ assertFalse(coll1Update.implies(collectionAll));
+ assertFalse(coll1Query.implies(collectionAll));
+ }
+
+ @Test
+ public void testActionAll() throws Exception {
+ Permission coll1All =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", ALL));
+ Permission coll1Update =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", "update"));
+ Permission coll1Query =
+ create(new KeyValue("collection", "coll1"), new KeyValue("action", "query"));
+ assertTrue(coll1All.implies(coll1All));
+ assertTrue(coll1All.implies(coll1Update));
+ assertTrue(coll1All.implies(coll1Query));
+ assertFalse(coll1Update.implies(coll1All));
+ assertFalse(coll1Query.implies(coll1All));
+
+ // test different lengths
+ Permission coll1 =
+ create(new KeyValue("collection", "coll1"));
+ assertTrue(coll1All.implies(coll1));
+ assertTrue(coll1.implies(coll1All));
+ }
+
+ @Test
+ public void testUnexpected() throws Exception {
+ Permission p = new Permission() {
+ @Override
+ public boolean implies(Permission p) {
+ return false;
+ }
+ };
+ Permission collection1 = create(new KeyValue("collection", "coll1"));
+ assertFalse(collection1.implies(null));
+ assertFalse(collection1.implies(p));
+ assertFalse(collection1.equals(null));
+ assertFalse(collection1.equals(p));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testNullString() throws Exception {
+ System.out.println(create((String)null));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testEmptyString() throws Exception {
+ System.out.println(create(""));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testEmptyKey() throws Exception {
+ System.out.println(create(KV_JOINER.join("collection", "")));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testEmptyValue() throws Exception {
+ System.out.println(create(KV_JOINER.join("", "coll1")));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testEmptyPart() throws Exception {
+ System.out.println(create(AUTHORIZABLE_JOINER.
+ join(KV_JOINER.join("collection1", "coll1"), "")));
+ }
+
+ @Test(expected=IllegalArgumentException.class)
+ public void testOnlySeperators() throws Exception {
+ System.out.println(create(AUTHORIZABLE_JOINER.
+ join(KV_SEPARATOR, KV_SEPARATOR, KV_SEPARATOR)));
+ }
+
+ static SearchWildcardPermission create(KeyValue... keyValues) {
+ return create(AUTHORIZABLE_JOINER.join(keyValues));
+
+ }
+ static SearchWildcardPermission create(String s) {
+ return new SearchWildcardPermission(s);
+ }
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/resources/log4j.properties
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/resources/log4j.properties b/sentry-policy/sentry-policy-search/src/test/resources/log4j.properties
new file mode 100644
index 0000000..c41373c
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/resources/log4j.properties
@@ -0,0 +1,31 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Define some default values that can be overridden by system properties.
+#
+# For testing, it may also be convenient to specify
+
+log4j.rootLogger=DEBUG,console
+
+log4j.appender.console=org.apache.log4j.ConsoleAppender
+log4j.appender.console.target=System.err
+log4j.appender.console.layout=org.apache.log4j.PatternLayout
+log4j.appender.console.layout.ConversionPattern=%d (%t) [%p - %l] %m%n
+
+log4j.logger.org.apache.hadoop.conf.Configuration=INFO
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-policy/sentry-policy-search/src/test/resources/test-authz-provider.ini
----------------------------------------------------------------------
diff --git a/sentry-policy/sentry-policy-search/src/test/resources/test-authz-provider.ini b/sentry-policy/sentry-policy-search/src/test/resources/test-authz-provider.ini
new file mode 100644
index 0000000..8af8162
--- /dev/null
+++ b/sentry-policy/sentry-policy-search/src/test/resources/test-authz-provider.ini
@@ -0,0 +1,31 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+[groups]
+manager = analyst_role, junior_analyst_role
+analyst = analyst_role
+jranalyst = junior_analyst_role
+admin = admin
+
+[roles]
+analyst_role = collection=purchases->action=update, \
+ collection=analyst1, \
+ collection=jranalyst1->action=*, \
+ collection=tmpcollection->action=update, \
+ collection=tmpcollection->action=query
+junior_analyst_role = collection=jranalyst1, collection=purchases_partial->action=query
+admin = collection=*
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-provider/pom.xml b/sentry-provider/pom.xml
index 2a16800..b1594cf 100644
--- a/sentry-provider/pom.xml
+++ b/sentry-provider/pom.xml
@@ -32,8 +32,6 @@ limitations under the License.
<modules>
<module>sentry-provider-common</module>
<module>sentry-provider-file</module>
- <module>sentry-provider-policy-db</module>
- <module>sentry-provider-policy-search</module>
</modules>
</project>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-common/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/pom.xml b/sentry-provider/sentry-provider-common/pom.xml
index f7be9dd..321f7c6 100644
--- a/sentry-provider/sentry-provider-common/pom.xml
+++ b/sentry-provider/sentry-provider-common/pom.xml
@@ -33,8 +33,8 @@ limitations under the License.
<artifactId>sentry-core-common</artifactId>
</dependency>
<dependency>
- <groupId>org.apache.shiro</groupId>
- <artifactId>shiro-core</artifactId>
+ <groupId>org.apache.sentry</groupId>
+ <artifactId>sentry-policy-common</artifactId>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java
new file mode 100644
index 0000000..4351c3f
--- /dev/null
+++ b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/AuthorizationProvider.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.provider.common;
+
+import java.util.List;
+import java.util.Set;
+
+import org.apache.sentry.core.common.Action;
+import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.core.common.Subject;
+
+public interface AuthorizationProvider {
+
+ /***
+ * Returns validate subject privileges on given Authorizable object
+ *
+ * @param subject: UserID to validate privileges
+ * @param authorizableHierarchy : List of object accroding to namespace hierarchy.
+ * eg. Server->Db->Table or Server->Function
+ * The privileges will be validated from the higher to lower scope
+ * @param actions : Privileges to validate
+ * @return
+ * True if the subject is authorized to perform requested action on the given object
+ */
+ public boolean hasAccess(Subject subject, List<? extends Authorizable> authorizableHierarchy, Set<? extends Action> actions);
+
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/NoAuthorizationProvider.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/NoAuthorizationProvider.java b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/NoAuthorizationProvider.java
new file mode 100644
index 0000000..9cdda97
--- /dev/null
+++ b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/NoAuthorizationProvider.java
@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.provider.common;
+
+import java.util.List;
+import java.util.Set;
+
+import org.apache.sentry.core.common.Action;
+import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.core.common.Subject;
+
+public class NoAuthorizationProvider implements AuthorizationProvider {
+
+ @Override
+ public boolean hasAccess(Subject subject, List<? extends Authorizable> authorizableHierarchy,
+ Set<? extends Action> actions) {
+ return false;
+ }
+
+}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/PermissionFactory.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/PermissionFactory.java b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/PermissionFactory.java
deleted file mode 100644
index 5e7c7dd..0000000
--- a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/PermissionFactory.java
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.provider.common;
-
-import org.apache.shiro.authz.Permission;
-
-/**
- * Factory for creating Shiro permissions
- */
-public interface PermissionFactory {
- Permission createPermission(String permission);
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/PolicyEngine.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/PolicyEngine.java b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/PolicyEngine.java
deleted file mode 100644
index ce0ea26..0000000
--- a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/PolicyEngine.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.sentry.provider.common;
-
-import java.util.List;
-
-import org.apache.sentry.core.common.Authorizable;
-
-import com.google.common.collect.ImmutableSetMultimap;
-
-public interface PolicyEngine {
-
- /**
- * The permission factory to use in order to compare permissions in {@link getPermission}.
- * This is typically a factory that returns a permission used to evaluate wildcards.
- * @return the permission factory
- */
- public PermissionFactory getPermissionFactory();
-
- /**
- * Get permissions associated with a group. Returns Strings which can be resolved
- * by the caller. Strings are returned to separate the PolicyFile class from the
- * type of permissions used in a policy file. Additionally it is possible further
- * processing of the permissions is needed before resolving to a permission object.
- * @param authorizeable object
- * @param group name
- * @return non-null immutable set of permissions
- */
- public ImmutableSetMultimap<String, String> getPermissions(List<? extends Authorizable> authorizables, List<String> groups);
-
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/ProviderBackend.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/ProviderBackend.java b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/ProviderBackend.java
index 32ac8b2..415a509 100644
--- a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/ProviderBackend.java
+++ b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/ProviderBackend.java
@@ -18,6 +18,7 @@ package org.apache.sentry.provider.common;
import javax.annotation.Nullable;
import java.util.List;
+import org.apache.sentry.policy.common.RoleValidator;
import com.google.common.collect.ImmutableSet;
/**
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/RoleValidator.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/RoleValidator.java b/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/RoleValidator.java
deleted file mode 100644
index efd44f1..0000000
--- a/sentry-provider/sentry-provider-common/src/main/java/org/apache/sentry/provider/common/RoleValidator.java
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.provider.common;
-
-import javax.annotation.Nullable;
-
-import org.apache.shiro.config.ConfigurationException;
-
-public interface RoleValidator {
-
- public void validate(@Nullable String database, String role) throws ConfigurationException;
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupResourceAuthorizationProvider.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupResourceAuthorizationProvider.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupResourceAuthorizationProvider.java
index 24c0a5a..ff3adf1 100644
--- a/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupResourceAuthorizationProvider.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupResourceAuthorizationProvider.java
@@ -21,8 +21,9 @@ import java.io.IOException;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.security.Groups;
+import org.apache.sentry.policy.common.RoleValidator;
+import org.apache.sentry.policy.common.PolicyEngine;
import org.apache.sentry.provider.common.GroupMappingService;
-import org.apache.sentry.provider.common.PolicyEngine;
import org.apache.sentry.provider.file.HadoopGroupMappingService;
import org.apache.sentry.provider.file.ResourceAuthorizationProvider;
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupResourceAuthorizationProvider.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupResourceAuthorizationProvider.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupResourceAuthorizationProvider.java
index 96f260e..374e989 100644
--- a/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupResourceAuthorizationProvider.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupResourceAuthorizationProvider.java
@@ -17,7 +17,7 @@
package org.apache.sentry.provider.file;
-import org.apache.sentry.provider.common.PolicyEngine;
+import org.apache.sentry.policy.common.PolicyEngine;
import org.apache.sentry.provider.file.LocalGroupMappingService;
import org.apache.sentry.provider.file.ResourceAuthorizationProvider;
import java.io.IOException;
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ResourceAuthorizationProvider.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ResourceAuthorizationProvider.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ResourceAuthorizationProvider.java
index 3933314..c7d983d 100644
--- a/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ResourceAuthorizationProvider.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ResourceAuthorizationProvider.java
@@ -26,11 +26,11 @@ import java.util.Set;
import org.apache.sentry.core.common.Action;
import org.apache.sentry.core.common.Authorizable;
-import org.apache.sentry.core.common.AuthorizationProvider;
import org.apache.sentry.core.common.Subject;
+import org.apache.sentry.policy.common.PermissionFactory;
+import org.apache.sentry.policy.common.PolicyEngine;
+import org.apache.sentry.provider.common.AuthorizationProvider;
import org.apache.sentry.provider.common.GroupMappingService;
-import org.apache.sentry.provider.common.PermissionFactory;
-import org.apache.sentry.provider.common.PolicyEngine;
import org.apache.shiro.authz.Permission;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/SimpleFileProviderBackend.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/SimpleFileProviderBackend.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/SimpleFileProviderBackend.java
index 373050e..5e0aa66 100644
--- a/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/SimpleFileProviderBackend.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/SimpleFileProviderBackend.java
@@ -36,9 +36,9 @@ import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.FileSystem;
import org.apache.hadoop.fs.Path;
import org.apache.sentry.core.common.Authorizable;
+import org.apache.sentry.policy.common.RoleValidator;
import org.apache.sentry.provider.common.ProviderBackend;
import org.apache.sentry.provider.common.Roles;
-import org.apache.sentry.provider.common.RoleValidator;
import org.apache.shiro.config.ConfigurationException;
import org.apache.shiro.config.Ini;
import org.apache.shiro.util.PermissionUtils;
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-policy-db/pom.xml
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-policy-db/pom.xml b/sentry-provider/sentry-provider-policy-db/pom.xml
deleted file mode 100644
index 2245d75..0000000
--- a/sentry-provider/sentry-provider-policy-db/pom.xml
+++ /dev/null
@@ -1,92 +0,0 @@
-<?xml version="1.0"?>
-<!--
-Licensed to the Apache Software Foundation (ASF) under one or more
-contributor license agreements. See the NOTICE file distributed with
-this work for additional information regarding copyright ownership.
-The ASF licenses this file to You under the Apache License, Version 2.0
-(the "License"); you may not use this file except in compliance with
-the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
--->
-<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
- <modelVersion>4.0.0</modelVersion>
- <parent>
- <groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider</artifactId>
- <version>1.3.0-incubating-SNAPSHOT</version>
- </parent>
-
- <artifactId>sentry-provider-policy-db</artifactId>
- <name>Sentry Provider and Policy for Databases</name>
-
- <dependencies>
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-common</artifactId>
- </dependency>
-
- <dependency>
- <groupId>org.apache.hadoop</groupId>
- <artifactId>hadoop-minicluster</artifactId>
- <scope>test</scope>
- </dependency>
-
- <dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>log4j</groupId>
- <artifactId>log4j</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.shiro</groupId>
- <artifactId>shiro-core</artifactId>
- </dependency>
- <dependency>
- <groupId>com.google.guava</groupId>
- <artifactId>guava</artifactId>
- </dependency>
- <dependency>
- <groupId>org.slf4j</groupId>
- <artifactId>slf4j-api</artifactId>
- </dependency>
- <dependency>
- <groupId>org.slf4j</groupId>
- <artifactId>slf4j-log4j12</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.sentry</groupId>
- <artifactId>sentry-core-common</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.sentry</groupId>
- <artifactId>sentry-core-model-db</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-common</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-file</artifactId>
- </dependency>
- <dependency>
- <groupId>org.apache.sentry</groupId>
- <artifactId>sentry-provider-common</artifactId>
- <scope>test</scope>
- <type>test-jar</type>
- <version>${project.version}</version>
- </dependency>
- </dependencies>
-
-</project>
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/AbstractDBRoleValidator.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/AbstractDBRoleValidator.java b/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/AbstractDBRoleValidator.java
deleted file mode 100644
index 3f8241b..0000000
--- a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/AbstractDBRoleValidator.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.provider.db;
-
-import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_SPLITTER;
-import static org.apache.sentry.provider.file.PolicyFileConstants.PRIVILEGE_PREFIX;
-
-import java.util.List;
-
-import org.apache.sentry.provider.common.RoleValidator;
-import org.apache.sentry.core.model.db.DBModelAuthorizable;
-import org.apache.shiro.config.ConfigurationException;
-
-import com.google.common.annotations.VisibleForTesting;
-import com.google.common.collect.Lists;
-
-public abstract class AbstractDBRoleValidator implements RoleValidator {
-
- @VisibleForTesting
- public static Iterable<DBModelAuthorizable> parseRole(String string) {
- List<DBModelAuthorizable> result = Lists.newArrayList();
- for(String section : AUTHORIZABLE_SPLITTER.split(string)) {
- // XXX this ugly hack is because action is not an authorizeable
- if(!section.toLowerCase().startsWith(PRIVILEGE_PREFIX)) {
- DBModelAuthorizable authorizable = DBModelAuthorizables.from(section);
- if(authorizable == null) {
- String msg = "No authorizable found for " + section;
- throw new ConfigurationException(msg);
- }
- result.add(authorizable);
- }
- }
- return result;
- }
-
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DBModelAuthorizables.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DBModelAuthorizables.java b/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DBModelAuthorizables.java
deleted file mode 100644
index c454831..0000000
--- a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DBModelAuthorizables.java
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.provider.db;
-
-import org.apache.sentry.core.model.db.AccessURI;
-import org.apache.sentry.core.model.db.DBModelAuthorizable;
-import org.apache.sentry.core.model.db.DBModelAuthorizable.AuthorizableType;
-import org.apache.sentry.core.model.db.Database;
-import org.apache.sentry.core.model.db.Server;
-import org.apache.sentry.core.model.db.Table;
-import org.apache.sentry.core.model.db.View;
-import org.apache.sentry.provider.file.KeyValue;
-
-public class DBModelAuthorizables {
-
- public static DBModelAuthorizable from(KeyValue keyValue) {
- String prefix = keyValue.getKey().toLowerCase();
- String name = keyValue.getValue().toLowerCase();
- for(AuthorizableType type : AuthorizableType.values()) {
- if(prefix.equalsIgnoreCase(type.name())) {
- return from(type, name);
- }
- }
- return null;
- }
- public static DBModelAuthorizable from(String s) {
- return from(new KeyValue(s));
- }
-
- private static DBModelAuthorizable from(AuthorizableType type, String name) {
- switch (type) {
- case Server:
- return new Server(name);
- case Db:
- return new Database(name);
- case Table:
- return new Table(name);
- case View:
- return new View(name);
- case URI:
- return new AccessURI(name);
- default:
- return null;
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DBWildcardPermission.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DBWildcardPermission.java b/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DBWildcardPermission.java
deleted file mode 100644
index 1270fb2..0000000
--- a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DBWildcardPermission.java
+++ /dev/null
@@ -1,197 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-// copied from apache shiro
-
-package org.apache.sentry.provider.db;
-
-import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
-import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_SPLITTER;
-
-import java.io.File;
-import java.io.Serializable;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.util.List;
-
-import org.apache.commons.lang.text.StrSubstitutor;
-import org.apache.sentry.core.model.db.AccessConstants;
-import org.apache.sentry.core.model.db.DBModelAuthorizable.AuthorizableType;
-import org.apache.sentry.provider.common.PermissionFactory;
-import org.apache.sentry.provider.file.KeyValue;
-import org.apache.sentry.provider.file.PolicyFileConstants;
-import org.apache.shiro.authz.Permission;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.google.common.annotations.VisibleForTesting;
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.Lists;
-
-// XXX this class is made ugly by the fact that Action is not a Authorizable.
-public class DBWildcardPermission implements Permission, Serializable {
- private static final Logger LOGGER = LoggerFactory
- .getLogger(DBWildcardPermission.class);
- private static final long serialVersionUID = -6785051263922740818L;
-
- private final ImmutableList<KeyValue> parts;
-
- public DBWildcardPermission(String wildcardString) {
- wildcardString = Strings.nullToEmpty(wildcardString).trim();
- if (wildcardString.isEmpty()) {
- throw new IllegalArgumentException("Wildcard string cannot be null or empty.");
- }
- List<KeyValue>parts = Lists.newArrayList();
- for (String authorizable : AUTHORIZABLE_SPLITTER.trimResults().split(wildcardString)) {
- if (authorizable.isEmpty()) {
- throw new IllegalArgumentException("Privilege '" + wildcardString + "' has an empty section");
- }
- parts.add(new KeyValue(authorizable));
- }
- if (parts.isEmpty()) {
- throw new AssertionError("Should never occur: " + wildcardString);
- }
- this.parts = ImmutableList.copyOf(parts);
- }
-
-
- @Override
- public boolean implies(Permission p) {
- // By default only supports comparisons with other DBWildcardPermissions
- if (!(p instanceof DBWildcardPermission)) {
- return false;
- }
-
- DBWildcardPermission wp = (DBWildcardPermission) p;
-
- List<KeyValue> otherParts = wp.parts;
- if(equals(wp)) {
- return true;
- }
- int index = 0;
- for (KeyValue otherPart : otherParts) {
- // If this permission has less parts than the other permission, everything
- // after the number of parts contained
- // in this permission is automatically implied, so return true
- if (parts.size() - 1 < index) {
- return true;
- } else {
- KeyValue part = parts.get(index);
- // are the keys even equal
- if(!part.getKey().equalsIgnoreCase(otherPart.getKey())) {
- return false;
- }
- if (!impliesKeyValue(part, otherPart)) {
- return false;
- }
- index++;
- }
- }
- // If this permission has more parts than
- // the other parts, only imply it if
- // all of the other parts are wildcards
- for (; index < parts.size(); index++) {
- KeyValue part = parts.get(index);
- if (!part.getValue().equals(AccessConstants.ALL)) {
- return false;
- }
- }
-
- return true;
- }
-
- private boolean impliesKeyValue(KeyValue policyPart, KeyValue requestPart) {
- Preconditions.checkState(policyPart.getKey().equalsIgnoreCase(requestPart.getKey()),
- "Please report, this method should not be called with two different keys");
- if(policyPart.getValue().equals(AccessConstants.ALL) || policyPart.equals(requestPart)) {
- return true;
- } else if (!PolicyFileConstants.PRIVILEGE_NAME.equalsIgnoreCase(policyPart.getKey())
- && AccessConstants.ALL.equalsIgnoreCase(requestPart.getValue())) {
- /* permission request is to match with any object of given type */
- return true;
- } else if(policyPart.getKey().equalsIgnoreCase(AuthorizableType.URI.name())) {
- return impliesURI(policyPart.getValue(), requestPart.getValue());
- }
- return false;
- }
-
- /**
- * URI is a a special case. For URI's, /a implies /a/b.
- * Therefore the test is "/a/b".startsWith("/a");
- */
- @VisibleForTesting
- protected static boolean impliesURI(String policy, String request) {
- try {
- URI policyURI = new URI(new StrSubstitutor(System.getProperties()).replace(policy));
- URI requestURI = new URI(request);
- if(policyURI.getScheme() == null || policyURI.getPath() == null) {
- LOGGER.warn("Policy URI " + policy + " is not valid. Either no scheme or no path.");
- return false;
- }
- if(requestURI.getScheme() == null || requestURI.getPath() == null) {
- LOGGER.warn("Request URI " + request + " is not valid. Either no scheme or no path.");
- return false;
- }
- // schemes are equal &&
- // request path does not contain relative parts /a/../b &&
- // request path starts with policy path &&
- // authorities (nullable) are equal
- String requestPath = requestURI.getPath() + File.separator;
- String policyPath = policyURI.getPath() + File.separator;
- if(policyURI.getScheme().equals(requestURI.getScheme()) &&
- requestURI.getPath().equals(new URI(request).normalize().getPath()) &&
- requestPath.startsWith(policyPath) &&
- Strings.nullToEmpty(policyURI.getAuthority()).equals(Strings.nullToEmpty(requestURI.getAuthority()))) {
- return true;
- }
- return false;
- } catch (URISyntaxException e) {
- LOGGER.warn("Request URI " + request + " is not a URI", e);
- return false;
- }
- }
-
- @Override
- public String toString() {
- return AUTHORIZABLE_JOINER.join(parts);
- }
-
- @Override
- public boolean equals(Object o) {
- if (o instanceof DBWildcardPermission) {
- DBWildcardPermission wp = (DBWildcardPermission) o;
- return parts.equals(wp.parts);
- }
- return false;
- }
-
- @Override
- public int hashCode() {
- return parts.hashCode();
- }
-
- public static class DBWildcardPermissionFactory implements PermissionFactory {
- @Override
- public Permission createPermission(String permission) {
- return new DBWildcardPermission(permission);
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DatabaseMustMatch.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DatabaseMustMatch.java b/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DatabaseMustMatch.java
deleted file mode 100644
index adfd2a3..0000000
--- a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DatabaseMustMatch.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.provider.db;
-
-import org.apache.sentry.core.model.db.DBModelAuthorizable;
-import org.apache.sentry.core.model.db.Database;
-import org.apache.shiro.config.ConfigurationException;
-
-public class DatabaseMustMatch extends AbstractDBRoleValidator {
-
- @Override
- public void validate(String database, String role) throws ConfigurationException {
- /*
- * Rule only applies to rules in per database policy file
- */
- if(database != null) {
- Iterable<DBModelAuthorizable> authorizables = parseRole(role);
- for(DBModelAuthorizable authorizable : authorizables) {
- if(authorizable instanceof Database &&
- !database.equalsIgnoreCase(authorizable.getName())) {
- String msg = "Role " + role + " references db " +
- authorizable.getName() + ", but is only allowed to reference "
- + database;
- throw new ConfigurationException(msg);
- }
- }
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DatabaseRequiredInRole.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DatabaseRequiredInRole.java b/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DatabaseRequiredInRole.java
deleted file mode 100644
index c85807d..0000000
--- a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/DatabaseRequiredInRole.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.provider.db;
-
-import javax.annotation.Nullable;
-
-import org.apache.sentry.core.model.db.AccessURI;
-import org.apache.sentry.core.model.db.Database;
-import org.apache.sentry.core.model.db.DBModelAuthorizable;
-import org.apache.shiro.config.ConfigurationException;
-
-public class DatabaseRequiredInRole extends AbstractDBRoleValidator {
-
- @Override
- public void validate(@Nullable String database, String role) throws ConfigurationException {
- /*
- * Rule only applies to rules in per database policy file
- */
- if(database != null) {
- Iterable<DBModelAuthorizable> authorizables = parseRole(role);
- /*
- * Each permission in a non-global file must have a database
- * object except for URIs.
- *
- * We allow URIs to be specified in the per DB policy file for
- * ease of mangeability. URIs will contain to remain server scope
- * objects.
- */
- boolean foundDatabaseInAuthorizables = false;
- boolean foundURIInAuthorizables = false;
- boolean allowURIInAuthorizables = false;
-
- if ("true".equalsIgnoreCase(
- System.getProperty(SimpleDBPolicyEngine.ACCESS_ALLOW_URI_PER_DB_POLICYFILE))) {
- allowURIInAuthorizables = true;
- }
-
- for(DBModelAuthorizable authorizable : authorizables) {
- if(authorizable instanceof Database) {
- foundDatabaseInAuthorizables = true;
- }
- if (authorizable instanceof AccessURI) {
- if (foundDatabaseInAuthorizables) {
- String msg = "URI object is specified at DB scope in " + role;
- throw new ConfigurationException(msg);
- }
- foundURIInAuthorizables = true;
- }
- }
- if(!foundDatabaseInAuthorizables && !(foundURIInAuthorizables && allowURIInAuthorizables)) {
- String msg = "Missing database object in " + role;
- throw new ConfigurationException(msg);
- }
- }
- }
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/ServerNameMustMatch.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/ServerNameMustMatch.java b/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/ServerNameMustMatch.java
deleted file mode 100644
index 577f71f..0000000
--- a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/ServerNameMustMatch.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.provider.db;
-
-import javax.annotation.Nullable;
-
-import org.apache.sentry.core.model.db.DBModelAuthorizable;
-import org.apache.sentry.core.model.db.Server;
-import org.apache.shiro.config.ConfigurationException;
-
-public class ServerNameMustMatch extends AbstractDBRoleValidator {
-
- private final String serverName;
- public ServerNameMustMatch(String serverName) {
- this.serverName = serverName;
- }
- @Override
- public void validate(@Nullable String database, String role) throws ConfigurationException {
- Iterable<DBModelAuthorizable> authorizables = parseRole(role);
- for(DBModelAuthorizable authorizable : authorizables) {
- if(authorizable instanceof Server && !serverName.equalsIgnoreCase(authorizable.getName())) {
- String msg = "Server name " + authorizable.getName() + " in "
- + role + " is invalid. Expected " + serverName;
- throw new ConfigurationException(msg);
- }
- }
- }
-
-}
http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/77ac2593/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/ServersAllIsInvalid.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/ServersAllIsInvalid.java b/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/ServersAllIsInvalid.java
deleted file mode 100644
index be33830..0000000
--- a/sentry-provider/sentry-provider-policy-db/src/main/java/org/apache/sentry/provider/db/ServersAllIsInvalid.java
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.sentry.provider.db;
-
-import javax.annotation.Nullable;
-
-import org.apache.sentry.core.model.db.DBModelAuthorizable;
-import org.apache.sentry.core.model.db.Server;
-import org.apache.shiro.config.ConfigurationException;
-
-public class ServersAllIsInvalid extends AbstractDBRoleValidator {
-
- @Override
- public void validate(@Nullable String database, String role) throws ConfigurationException {
- Iterable<DBModelAuthorizable> authorizables = parseRole(role);
- for(DBModelAuthorizable authorizable : authorizables) {
- if(authorizable instanceof Server &&
- authorizable.getName().equals(Server.ALL.getName())) {
- String msg = "Invalid value for " + authorizable.getAuthzType() + " in " + role;
- throw new ConfigurationException(msg);
- }
- }
- }
-
-}