You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hive.apache.org by gu...@apache.org on 2014/02/14 11:53:39 UTC
svn commit: r1568236 [14/25] - in /hive/branches/tez: ./ bin/
cli/src/java/org/apache/hadoop/hive/cli/
cli/src/test/org/apache/hadoop/hive/cli/
common/src/java/org/apache/hadoop/hive/common/type/
common/src/java/org/apache/hadoop/hive/conf/ conf/ data/...
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java Fri Feb 14 10:53:31 2014
@@ -59,25 +59,68 @@ public class AuthorizationPreEventListen
public static final Log LOG = LogFactory.getLog(
AuthorizationPreEventListener.class);
- private static HiveConf conf;
- private static HiveMetastoreAuthorizationProvider authorizer;
- private static HiveMetastoreAuthenticationProvider authenticator;
+ private final ThreadLocal<Configuration> tConfig = new ThreadLocal<Configuration>() {
+ @Override
+ protected Configuration initialValue() {
+ return new HiveConf(AuthorizationPreEventListener.class);
+ }
+ };
+
+ private final ThreadLocal<HiveMetastoreAuthenticationProvider> tAuthenticator
+ = new ThreadLocal<HiveMetastoreAuthenticationProvider>() {
+ @Override
+ protected HiveMetastoreAuthenticationProvider initialValue() {
+ try {
+ return (HiveMetastoreAuthenticationProvider) HiveUtils.getAuthenticator(
+ tConfig.get(), HiveConf.ConfVars.HIVE_METASTORE_AUTHENTICATOR_MANAGER);
+ } catch (HiveException he) {
+ throw new IllegalStateException("Authentication provider instantiation failure",he);
+ }
+ }
+ };
+
+ private final ThreadLocal<HiveMetastoreAuthorizationProvider> tAuthorizer
+ = new ThreadLocal<HiveMetastoreAuthorizationProvider>() {
+ @Override
+ protected HiveMetastoreAuthorizationProvider initialValue() {
+ try {
+ return (HiveMetastoreAuthorizationProvider) HiveUtils.getAuthorizeProviderManager(
+ tConfig.get(), HiveConf.ConfVars.HIVE_METASTORE_AUTHORIZATION_MANAGER, tAuthenticator.get());
+ } catch (HiveException he) {
+ throw new IllegalStateException("Authorization provider instantiation failure",he);
+ }
+ }
+ };
+
+ private final ThreadLocal<Boolean> tConfigSetOnAuths = new ThreadLocal<Boolean>() {
+ @Override
+ protected Boolean initialValue() {
+ return false;
+ }
+ };
public AuthorizationPreEventListener(Configuration config) throws HiveException {
super(config);
-
- authenticator = (HiveMetastoreAuthenticationProvider) HiveUtils.getAuthenticator(
- config, HiveConf.ConfVars.HIVE_METASTORE_AUTHENTICATOR_MANAGER);
- authorizer = (HiveMetastoreAuthorizationProvider) HiveUtils.getAuthorizeProviderManager(
- config, HiveConf.ConfVars.HIVE_METASTORE_AUTHORIZATION_MANAGER, authenticator);
}
@Override
public void onEvent(PreEventContext context) throws MetaException, NoSuchObjectException,
InvalidOperationException {
- authenticator.setMetaStoreHandler(context.getHandler());
- authorizer.setMetaStoreHandler(context.getHandler());
+ if (!tConfigSetOnAuths.get()){
+ // The reason we do this guard is because when we do not have a good way of initializing
+ // the config to the handler's thread local config until this call, so we do it then.
+ // Once done, though, we need not repeat this linking, we simply call setMetaStoreHandler
+ // and let the AuthorizationProvider and AuthenticationProvider do what they want.
+ tConfig.set(context.getHandler().getConf());
+ // Warning note : HMSHandler.getHiveConf() is not thread-unique, .getConf() is.
+ tAuthenticator.get().setConf(tConfig.get());
+ tAuthorizer.get().setConf(tConfig.get());
+ tConfigSetOnAuths.set(true); // set so we don't repeat this initialization
+ }
+
+ tAuthenticator.get().setMetaStoreHandler(context.getHandler());
+ tAuthorizer.get().setMetaStoreHandler(context.getHandler());
switch (context.getEventType()) {
case CREATE_TABLE:
@@ -116,7 +159,7 @@ public class AuthorizationPreEventListen
private void authorizeCreateDatabase(PreCreateDatabaseEvent context)
throws InvalidOperationException, MetaException {
try {
- authorizer.authorize(new Database(context.getDatabase()),
+ tAuthorizer.get().authorize(new Database(context.getDatabase()),
HiveOperation.CREATEDATABASE.getInputRequiredPrivileges(),
HiveOperation.CREATEDATABASE.getOutputRequiredPrivileges());
} catch (AuthorizationException e) {
@@ -129,7 +172,7 @@ public class AuthorizationPreEventListen
private void authorizeDropDatabase(PreDropDatabaseEvent context)
throws InvalidOperationException, MetaException {
try {
- authorizer.authorize(new Database(context.getDatabase()),
+ tAuthorizer.get().authorize(new Database(context.getDatabase()),
HiveOperation.DROPDATABASE.getInputRequiredPrivileges(),
HiveOperation.DROPDATABASE.getOutputRequiredPrivileges());
} catch (AuthorizationException e) {
@@ -142,7 +185,7 @@ public class AuthorizationPreEventListen
private void authorizeCreateTable(PreCreateTableEvent context)
throws InvalidOperationException, MetaException {
try {
- authorizer.authorize(getTableFromApiTable(context.getTable()),
+ tAuthorizer.get().authorize(getTableFromApiTable(context.getTable()),
HiveOperation.CREATETABLE.getInputRequiredPrivileges(),
HiveOperation.CREATETABLE.getOutputRequiredPrivileges());
} catch (AuthorizationException e) {
@@ -155,7 +198,7 @@ public class AuthorizationPreEventListen
private void authorizeDropTable(PreDropTableEvent context)
throws InvalidOperationException, MetaException {
try {
- authorizer.authorize(getTableFromApiTable(context.getTable()),
+ tAuthorizer.get().authorize(getTableFromApiTable(context.getTable()),
HiveOperation.DROPTABLE.getInputRequiredPrivileges(),
HiveOperation.DROPTABLE.getOutputRequiredPrivileges());
} catch (AuthorizationException e) {
@@ -168,7 +211,7 @@ public class AuthorizationPreEventListen
private void authorizeAlterTable(PreAlterTableEvent context)
throws InvalidOperationException, MetaException {
try {
- authorizer.authorize(getTableFromApiTable(context.getOldTable()),
+ tAuthorizer.get().authorize(getTableFromApiTable(context.getOldTable()),
null,
new Privilege[]{Privilege.ALTER_METADATA});
} catch (AuthorizationException e) {
@@ -182,7 +225,7 @@ public class AuthorizationPreEventListen
throws InvalidOperationException, MetaException {
try {
org.apache.hadoop.hive.metastore.api.Partition mapiPart = context.getPartition();
- authorizer.authorize(getPartitionFromApiPartition(mapiPart, context),
+ tAuthorizer.get().authorize(getPartitionFromApiPartition(mapiPart, context),
HiveOperation.ALTERTABLE_ADDPARTS.getInputRequiredPrivileges(),
HiveOperation.ALTERTABLE_ADDPARTS.getOutputRequiredPrivileges());
} catch (AuthorizationException e) {
@@ -198,7 +241,7 @@ public class AuthorizationPreEventListen
throws InvalidOperationException, MetaException {
try {
org.apache.hadoop.hive.metastore.api.Partition mapiPart = context.getPartition();
- authorizer.authorize(getPartitionFromApiPartition(mapiPart, context),
+ tAuthorizer.get().authorize(getPartitionFromApiPartition(mapiPart, context),
HiveOperation.ALTERTABLE_DROPPARTS.getInputRequiredPrivileges(),
HiveOperation.ALTERTABLE_DROPPARTS.getOutputRequiredPrivileges());
} catch (AuthorizationException e) {
@@ -214,7 +257,7 @@ public class AuthorizationPreEventListen
throws InvalidOperationException, MetaException {
try {
org.apache.hadoop.hive.metastore.api.Partition mapiPart = context.getNewPartition();
- authorizer.authorize(getPartitionFromApiPartition(mapiPart, context),
+ tAuthorizer.get().authorize(getPartitionFromApiPartition(mapiPart, context),
null,
new Privilege[]{Privilege.ALTER_METADATA});
} catch (AuthorizationException e) {
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/PrivilegeRegistry.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/PrivilegeRegistry.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/PrivilegeRegistry.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/PrivilegeRegistry.java Fri Feb 14 10:53:31 2014
@@ -30,31 +30,16 @@ import org.apache.hadoop.hive.ql.session
public class PrivilegeRegistry {
protected static Map<PrivilegeType, Privilege> Registry = null;
+ protected static Map<PrivilegeType, Privilege> RegistryV2 = null;
public static Privilege getPrivilege(PrivilegeType privilegeType) {
- initializeRegistry();
return Registry.get(privilegeType);
}
- private static void initializeRegistry() {
- if(Registry != null){
- //already initialized, nothing to do
- return;
- }
- //population of registry done in separate synchronized call
- populateRegistry();
- }
-
/**
- * Add entries to registry. This needs to be synchronized to avoid Registry being populated
- * multiple times.
+ * Add entries to registry.
*/
- private static synchronized void populateRegistry() {
- //do check again in synchronized block
- if(Registry != null){
- //already initialized, nothing to do
- return;
- }
+ static {
Registry = new HashMap<PrivilegeType, Privilege>();
//add the privileges supported in authorization mode V1
@@ -68,23 +53,28 @@ public class PrivilegeRegistry {
Registry.put(Privilege.SELECT.getPriv(), Privilege.SELECT);
Registry.put(Privilege.SHOW_DATABASE.getPriv(),
Privilege.SHOW_DATABASE);
- if(SessionState.get().isAuthorizationModeV2()){
- //add the privileges not supported in V1
- //The list of privileges supported in V2 is implementation defined,
- //so just pass everything that syntax supports.
- Registry.put(Privilege.INSERT.getPriv(), Privilege.INSERT);
- Registry.put(Privilege.DELETE.getPriv(), Privilege.DELETE);
- }
+
+ //add the privileges not supported in V1
+ //The list of privileges supported in V2 is implementation defined,
+ //so just pass everything that syntax supports.
+ RegistryV2 = new HashMap<PrivilegeType, Privilege>();
+ RegistryV2.putAll(Registry);
+ RegistryV2.put(Privilege.INSERT.getPriv(), Privilege.INSERT);
+ RegistryV2.put(Privilege.DELETE.getPriv(), Privilege.DELETE);
}
public static Privilege getPrivilege(int privilegeToken) {
- initializeRegistry();
- return Registry.get(PrivilegeType.getPrivTypeByToken(privilegeToken));
+ PrivilegeType ptype = PrivilegeType.getPrivTypeByToken(privilegeToken);
+ return getPrivilegeFromRegistry(ptype);
}
public static Privilege getPrivilege(String privilegeName) {
- initializeRegistry();
- return Registry.get(PrivilegeType.getPrivTypeByName(privilegeName));
+ PrivilegeType ptype = PrivilegeType.getPrivTypeByName(privilegeName);
+ return getPrivilegeFromRegistry(ptype);
+ }
+
+ private static Privilege getPrivilegeFromRegistry(PrivilegeType ptype) {
+ return SessionState.get().isAuthorizationModeV2() ? RegistryV2.get(ptype) : Registry.get(ptype);
}
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/PrivilegeType.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/PrivilegeType.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/PrivilegeType.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/PrivilegeType.java Fri Feb 14 10:53:31 2014
@@ -67,9 +67,7 @@ public enum PrivilegeType {
* @return corresponding PrivilegeType
*/
public static PrivilegeType getPrivTypeByToken(int token) {
- if(token2Type == null){
- populateToken2Type();
- }
+ populateToken2Type();
PrivilegeType privType = token2Type.get(token);
if(privType != null){
return privType;
@@ -93,9 +91,7 @@ public enum PrivilegeType {
* @return corresponding PrivilegeType
*/
public static PrivilegeType getPrivTypeByName(String privilegeName) {
- if(name2Type == null){
- populateName2Type();
- }
+ populateName2Type();
String canonicalizedName = privilegeName.toLowerCase();
PrivilegeType privType = name2Type.get(canonicalizedName);
if(privType != null){
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAccessController.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAccessController.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAccessController.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAccessController.java Fri Feb 14 10:53:31 2014
@@ -19,42 +19,50 @@ package org.apache.hadoop.hive.ql.securi
import java.util.List;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
+import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
+
/**
* Interface that is invoked by access control commands, including grant/revoke role/privileges,
* create/drop roles, and commands to read the state of authorization rules.
* Methods here have corresponding methods in HiveAuthorizer, check method documentation there.
*/
+@LimitedPrivate(value = { "" })
+@Evolving
public interface HiveAccessController {
void grantPrivileges(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges,
HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption)
- throws HiveAuthorizationPluginException;;
+ throws HiveAuthzPluginException, HiveAccessControlException;
void revokePrivileges(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges,
HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption)
- throws HiveAuthorizationPluginException;;
+ throws HiveAuthzPluginException, HiveAccessControlException;
void createRole(String roleName, HivePrincipal adminGrantor)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
void dropRole(String roleName)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
- List<String> getRoles(HivePrincipal hivePrincipal)
- throws HiveAuthorizationPluginException;
+ List<HiveRole> getRoles(HivePrincipal hivePrincipal)
+ throws HiveAuthzPluginException, HiveAccessControlException;
void grantRole(List<HivePrincipal> hivePrincipals, List<String> roles, boolean grantOption,
HivePrincipal grantorPrinc)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
void revokeRole(List<HivePrincipal> hivePrincipals, List<String> roles, boolean grantOption,
HivePrincipal grantorPrinc)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
List<String> getAllRoles()
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
List<HivePrivilegeInfo> showPrivileges(HivePrincipal principal, HivePrivilegeObject privObj)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
+
+ void setCurrentRole(String roleName) throws HiveAuthzPluginException, HiveAccessControlException;
+ List<HiveRole> getCurrentRoles() throws HiveAuthzPluginException;
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizationValidator.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizationValidator.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizationValidator.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizationValidator.java Fri Feb 14 10:53:31 2014
@@ -19,24 +19,28 @@ package org.apache.hadoop.hive.ql.securi
import java.util.List;
-import org.apache.hadoop.hive.common.classification.InterfaceAudience.Public;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
/**
* Interface used to check if user has privileges to perform certain action.
* Methods here have corresponding methods in HiveAuthorizer, check method documentation there.
*/
-@Public
+@LimitedPrivate(value = { "" })
@Evolving
public interface HiveAuthorizationValidator {
+
/**
- * Check if current user has privileges to perform given operation type hiveOpType on the given
- * input and output objects
+ * Check if current user has privileges to perform given operation type
+ * hiveOpType on the given input and output objects
+ *
* @param hiveOpType
* @param inputHObjs
* @param outputHObjs
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> inputHObjs,
- List<HivePrivilegeObject> outputHObjs) throws HiveAuthorizationPluginException;
+ List<HivePrivilegeObject> outputHObjs) throws HiveAuthzPluginException, HiveAccessControlException;
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizer.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizer.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizer.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizer.java Fri Feb 14 10:53:31 2014
@@ -19,7 +19,7 @@ package org.apache.hadoop.hive.ql.securi
import java.util.List;
-import org.apache.hadoop.hive.common.classification.InterfaceAudience.Public;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
import org.apache.hadoop.hive.ql.security.authorization.HiveAuthorizationProvider;
@@ -33,7 +33,7 @@ import org.apache.hadoop.hive.ql.securit
* statements and does not make assumptions about the privileges needed for a hive operation.
* This is referred to as V2 authorizer in other parts of the code.
*/
-@Public
+@LimitedPrivate(value = { "" })
@Evolving
public interface HiveAuthorizer {
@@ -51,11 +51,12 @@ public interface HiveAuthorizer {
* @param hivePrivObject
* @param grantorPrincipal
* @param grantOption
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
void grantPrivileges(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges,
HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
* Revoke privileges for principals on the object
@@ -64,38 +65,42 @@ public interface HiveAuthorizer {
* @param hivePrivObject
* @param grantorPrincipal
* @param grantOption
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
void revokePrivileges(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges,
HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
* Create role
* @param roleName
* @param adminGrantor - The user in "[ WITH ADMIN <user> ]" clause of "create role"
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
void createRole(String roleName, HivePrincipal adminGrantor)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
* Drop role
* @param roleName
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
void dropRole(String roleName)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
* Get roles that this user/role belongs to
* @param hivePrincipal - user or role
* @return list of roles
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
- List<String> getRoles(HivePrincipal hivePrincipal)
- throws HiveAuthorizationPluginException;
+ List<HiveRole> getRoles(HivePrincipal hivePrincipal)
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
* Grant roles in given roles list to principals in given hivePrincipals list
@@ -103,11 +108,12 @@ public interface HiveAuthorizer {
* @param roles
* @param grantOption
* @param grantorPrinc
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
void grantRole(List<HivePrincipal> hivePrincipals, List<String> roles, boolean grantOption,
HivePrincipal grantorPrinc)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
@@ -116,45 +122,49 @@ public interface HiveAuthorizer {
* @param roles
* @param grantOption
* @param grantorPrinc
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
void revokeRole(List<HivePrincipal> hivePrincipals, List<String> roles, boolean grantOption,
HivePrincipal grantorPrinc)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
* Check if user has privileges to do this action on these objects
* @param hiveOpType
* @param inputsHObjs
* @param outputHObjs
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> inputsHObjs,
List<HivePrivilegeObject> outputHObjs)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
* @return all existing roles
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
List<String> getAllRoles()
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
/**
* Show privileges for given principal on given object
* @param principal
* @param privObj
* @return
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
+ * @throws HiveAccessControlException
*/
List<HivePrivilegeInfo> showPrivileges(HivePrincipal principal, HivePrivilegeObject privObj)
- throws HiveAuthorizationPluginException;
+ throws HiveAuthzPluginException, HiveAccessControlException;
+ void setCurrentRole(String roleName) throws HiveAccessControlException, HiveAuthzPluginException;
+
+ List<HiveRole> getCurrentRoles() throws HiveAuthzPluginException;
//other functions to be added -
//showUsersInRole(rolename)
- //isSuperuser(username)
-
-
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizerFactory.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizerFactory.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizerFactory.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizerFactory.java Fri Feb 14 10:53:31 2014
@@ -17,16 +17,17 @@
*/
package org.apache.hadoop.hive.ql.security.authorization.plugin;
-import org.apache.hadoop.hive.common.classification.InterfaceAudience.Public;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
import org.apache.hadoop.hive.conf.HiveConf;
+import org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider;
/**
* Implementation of this interface specified through hive configuration will be used to
* create {@link HiveAuthorizer} instance used for hive authorization.
*
*/
-@Public
+@LimitedPrivate(value = { "" })
@Evolving
public interface HiveAuthorizerFactory {
/**
@@ -35,9 +36,10 @@ public interface HiveAuthorizerFactory {
* for the current thread. Each invocation of method in HiveAuthorizer can happen in
* different thread, so get the current instance in each method invocation.
* @param conf - current HiveConf
- * @param hiveCurrentUser - user for current session
+ * @param hiveAuthenticator - authenticator, provides user name
* @return new instance of HiveAuthorizer
+ * @throws HiveAuthzPluginException
*/
HiveAuthorizer createHiveAuthorizer(HiveMetastoreClientFactory metastoreClientFactory,
- HiveConf conf, String hiveCurrentUser);
+ HiveConf conf, HiveAuthenticationProvider hiveAuthenticator) throws HiveAuthzPluginException;
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizerImpl.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizerImpl.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizerImpl.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveAuthorizerImpl.java Fri Feb 14 10:53:31 2014
@@ -19,7 +19,7 @@ package org.apache.hadoop.hive.ql.securi
import java.util.List;
-import org.apache.hadoop.hive.common.classification.InterfaceAudience.Public;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
/**
@@ -28,7 +28,7 @@ import org.apache.hadoop.hive.common.cla
* {@link HiveAccessController} and {@link HiveAuthorizationValidator} to constructor.
*
*/
-@Public
+@LimitedPrivate(value = { "" })
@Evolving
public class HiveAuthorizerImpl implements HiveAuthorizer {
HiveAccessController accessController;
@@ -42,7 +42,7 @@ public class HiveAuthorizerImpl implemen
@Override
public void grantPrivileges(List<HivePrincipal> hivePrincipals,
List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject,
- HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthorizationPluginException {
+ HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException, HiveAccessControlException {
accessController.grantPrivileges(hivePrincipals, hivePrivileges, hivePrivObject,
grantorPrincipal, grantOption);
}
@@ -50,52 +50,52 @@ public class HiveAuthorizerImpl implemen
@Override
public void revokePrivileges(List<HivePrincipal> hivePrincipals,
List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject,
- HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthorizationPluginException {
+ HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException, HiveAccessControlException {
accessController.revokePrivileges(hivePrincipals, hivePrivileges, hivePrivObject,
grantorPrincipal, grantOption);
}
@Override
- public void createRole(String roleName, HivePrincipal adminGrantor) throws HiveAuthorizationPluginException {
+ public void createRole(String roleName, HivePrincipal adminGrantor) throws HiveAuthzPluginException, HiveAccessControlException {
accessController.createRole(roleName, adminGrantor);
}
@Override
- public void dropRole(String roleName) throws HiveAuthorizationPluginException {
+ public void dropRole(String roleName) throws HiveAuthzPluginException, HiveAccessControlException {
accessController.dropRole(roleName);
}
@Override
- public List<String> getRoles(HivePrincipal hivePrincipal) throws HiveAuthorizationPluginException {
+ public List<HiveRole> getRoles(HivePrincipal hivePrincipal) throws HiveAuthzPluginException, HiveAccessControlException {
return accessController.getRoles(hivePrincipal);
}
@Override
public void grantRole(List<HivePrincipal> hivePrincipals, List<String> roles,
- boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthorizationPluginException {
+ boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthzPluginException, HiveAccessControlException {
accessController.grantRole(hivePrincipals, roles, grantOption, grantorPrinc);
}
@Override
public void revokeRole(List<HivePrincipal> hivePrincipals, List<String> roles,
- boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthorizationPluginException {
+ boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthzPluginException, HiveAccessControlException {
accessController.revokeRole(hivePrincipals, roles, grantOption, grantorPrinc);
}
@Override
public void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> inputHObjs,
- List<HivePrivilegeObject> outputHObjs) throws HiveAuthorizationPluginException {
+ List<HivePrivilegeObject> outputHObjs) throws HiveAuthzPluginException, HiveAccessControlException {
authValidator.checkPrivileges(hiveOpType, inputHObjs, outputHObjs);
}
@Override
- public List<String> getAllRoles() throws HiveAuthorizationPluginException {
+ public List<String> getAllRoles() throws HiveAuthzPluginException, HiveAccessControlException {
return accessController.getAllRoles();
}
@Override
public List<HivePrivilegeInfo> showPrivileges(HivePrincipal principal,
- HivePrivilegeObject privObj) throws HiveAuthorizationPluginException {
+ HivePrivilegeObject privObj) throws HiveAuthzPluginException, HiveAccessControlException {
return accessController.showPrivileges(principal, privObj);
}
@@ -104,9 +104,16 @@ public class HiveAuthorizerImpl implemen
return VERSION.V1;
}
+ @Override
+ public void setCurrentRole(String roleName) throws HiveAccessControlException, HiveAuthzPluginException {
+ accessController.setCurrentRole(roleName);
+ }
+ @Override
+ public List<HiveRole> getCurrentRoles() throws HiveAuthzPluginException {
+ return accessController.getCurrentRoles();
+ }
// other access control functions
-
// void validateAuthority(HiveAction, inputs, outputs){
// authValidator.validateAuthority(HiveAction, inputs, outputs);
// }
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveMetastoreClientFactory.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveMetastoreClientFactory.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveMetastoreClientFactory.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveMetastoreClientFactory.java Fri Feb 14 10:53:31 2014
@@ -17,14 +17,14 @@
*/
package org.apache.hadoop.hive.ql.security.authorization.plugin;
-import java.io.IOException;
-
-import org.apache.hadoop.hive.common.classification.InterfaceAudience.Public;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
+import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
import org.apache.hadoop.hive.metastore.IMetaStoreClient;
/**
* Factory for getting current valid instance of IMetaStoreClient
*/
-@Public
+@LimitedPrivate(value = { "" })
+@Evolving
public interface HiveMetastoreClientFactory {
- IMetaStoreClient getHiveMetastoreClient() throws IOException;
+ IMetaStoreClient getHiveMetastoreClient() throws HiveAuthzPluginException;
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveMetastoreClientFactoryImpl.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveMetastoreClientFactoryImpl.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveMetastoreClientFactoryImpl.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveMetastoreClientFactoryImpl.java Fri Feb 14 10:53:31 2014
@@ -18,8 +18,6 @@
package org.apache.hadoop.hive.ql.security.authorization.plugin;
-import java.io.IOException;
-
import org.apache.hadoop.hive.common.classification.InterfaceAudience.Private;
import org.apache.hadoop.hive.metastore.IMetaStoreClient;
import org.apache.hadoop.hive.metastore.api.MetaException;
@@ -32,13 +30,14 @@ import org.apache.hadoop.hive.ql.metadat
public class HiveMetastoreClientFactoryImpl implements HiveMetastoreClientFactory{
@Override
- public IMetaStoreClient getHiveMetastoreClient() throws IOException {
+ public IMetaStoreClient getHiveMetastoreClient() throws HiveAuthzPluginException {
+ String errMsg = "Error getting metastore client";
try {
return Hive.get().getMSC();
} catch (MetaException e) {
- throw new IOException(e);
+ throw new HiveAuthzPluginException(errMsg, e);
} catch (HiveException e) {
- throw new IOException(e);
+ throw new HiveAuthzPluginException(errMsg, e);
}
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveOperationType.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveOperationType.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveOperationType.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HiveOperationType.java Fri Feb 14 10:53:31 2014
@@ -17,12 +17,14 @@
*/
package org.apache.hadoop.hive.ql.security.authorization.plugin;
-import org.apache.hadoop.hive.common.classification.InterfaceAudience.Public;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
+import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
/**
* List of hive operations types.
*/
-@Public
+@LimitedPrivate(value = { "" })
+@Evolving
public enum HiveOperationType {
EXPLAIN,
LOAD,
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrincipal.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrincipal.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrincipal.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrincipal.java Fri Feb 14 10:53:31 2014
@@ -17,15 +17,25 @@
*/
package org.apache.hadoop.hive.ql.security.authorization.plugin;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
+import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
+
/**
* Represents the user or role in grant/revoke statements
*/
+@LimitedPrivate(value = { "" })
+@Evolving
public class HivePrincipal {
public enum HivePrincipalType{
USER, ROLE, UNKNOWN
}
+ @Override
+ public String toString() {
+ return "Principal [name=" + name + ", type=" + type + "]";
+ }
+
private final String name;
private final HivePrincipalType type;
@@ -40,4 +50,32 @@ public class HivePrincipal {
return type;
}
+ @Override
+ public int hashCode() {
+ final int prime = 31;
+ int result = 1;
+ result = prime * result + ((name == null) ? 0 : name.hashCode());
+ result = prime * result + ((type == null) ? 0 : type.hashCode());
+ return result;
+ }
+
+ @Override
+ public boolean equals(Object obj) {
+ if (this == obj)
+ return true;
+ if (obj == null)
+ return false;
+ if (getClass() != obj.getClass())
+ return false;
+ HivePrincipal other = (HivePrincipal) obj;
+ if (name == null) {
+ if (other.name != null)
+ return false;
+ } else if (!name.equals(other.name))
+ return false;
+ if (type != other.type)
+ return false;
+ return true;
+ }
+
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilege.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilege.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilege.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilege.java Fri Feb 14 10:53:31 2014
@@ -18,16 +18,27 @@
package org.apache.hadoop.hive.ql.security.authorization.plugin;
import java.util.List;
+import java.util.Locale;
+
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
+import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
/**
* Represents the hive privilege being granted/revoked
*/
+@LimitedPrivate(value = { "" })
+@Evolving
public class HivePrivilege {
+ @Override
+ public String toString() {
+ return "Privilege [name=" + name + ", columns=" + columns + "]";
+ }
+
private final String name;
private final List<String> columns;
public HivePrivilege(String name, List<String> columns){
- this.name = name;
+ this.name = name.toUpperCase(Locale.US);
this.columns = columns;
}
@@ -39,4 +50,37 @@ public class HivePrivilege {
return columns;
}
+ @Override
+ public int hashCode() {
+ final int prime = 31;
+ int result = 1;
+ result = prime * result + ((columns == null) ? 0 : columns.hashCode());
+ result = prime * result + ((name == null) ? 0 : name.hashCode());
+ return result;
+ }
+
+ @Override
+ public boolean equals(Object obj) {
+ if (this == obj)
+ return true;
+ if (obj == null)
+ return false;
+ if (getClass() != obj.getClass())
+ return false;
+ HivePrivilege other = (HivePrivilege) obj;
+ if (columns == null) {
+ if (other.columns != null)
+ return false;
+ } else if (!columns.equals(other.columns))
+ return false;
+ if (name == null) {
+ if (other.name != null)
+ return false;
+ } else if (!name.equals(other.name))
+ return false;
+ return true;
+ }
+
+
+
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeInfo.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeInfo.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeInfo.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeInfo.java Fri Feb 14 10:53:31 2014
@@ -17,15 +17,14 @@
*/
package org.apache.hadoop.hive.ql.security.authorization.plugin;
-import org.apache.hadoop.hive.common.classification.InterfaceAudience.Public;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
import org.apache.hadoop.hive.common.classification.InterfaceStability.Evolving;
/**
* Represents a privilege granted for an object to a principal
*/
-@Public
+@LimitedPrivate(value = { "" })
@Evolving
-
public class HivePrivilegeInfo{
private final HivePrincipal principal;
private final HivePrivilege privilege;
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeObject.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeObject.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeObject.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/HivePrivilegeObject.java Fri Feb 14 10:53:31 2014
@@ -17,16 +17,22 @@
*/
package org.apache.hadoop.hive.ql.security.authorization.plugin;
-import org.apache.hadoop.hive.common.classification.InterfaceAudience.Public;
+import org.apache.hadoop.hive.common.classification.InterfaceAudience.LimitedPrivate;
import org.apache.hadoop.hive.common.classification.InterfaceStability.Unstable;
/**
* Represents the object on which privilege is being granted/revoked
*/
-@Public
+@LimitedPrivate(value = { "" })
@Unstable
public class HivePrivilegeObject {
+ @Override
+ public String toString() {
+ return "Hive Object [type=" + type + ", dbname=" + dbname + ", table/viewname="
+ + tableviewname + "]";
+ }
+
public enum HivePrivilegeObjectType { DATABASE, TABLE, VIEW, PARTITION, URI};
private final HivePrivilegeObjectType type;
private final String dbname;
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAccessController.java Fri Feb 14 10:53:31 2014
@@ -18,93 +18,161 @@
package org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd;
import java.util.ArrayList;
-import java.util.Arrays;
import java.util.HashSet;
import java.util.List;
-import java.util.Locale;
import java.util.Set;
import org.apache.hadoop.classification.InterfaceAudience.Private;
import org.apache.hadoop.hive.conf.HiveConf;
+import org.apache.hadoop.hive.metastore.HiveMetaStore;
import org.apache.hadoop.hive.metastore.IMetaStoreClient;
import org.apache.hadoop.hive.metastore.api.HiveObjectPrivilege;
import org.apache.hadoop.hive.metastore.api.HiveObjectRef;
import org.apache.hadoop.hive.metastore.api.HiveObjectType;
import org.apache.hadoop.hive.metastore.api.MetaException;
+import org.apache.hadoop.hive.metastore.api.PrincipalType;
import org.apache.hadoop.hive.metastore.api.PrivilegeBag;
import org.apache.hadoop.hive.metastore.api.PrivilegeGrantInfo;
import org.apache.hadoop.hive.metastore.api.Role;
import org.apache.hadoop.hive.ql.metadata.HiveException;
+import org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider;
import org.apache.hadoop.hive.ql.security.authorization.AuthorizationUtils;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessController;
-import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizationPluginException;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveMetastoreClientFactory;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal.HivePrincipalType;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilege;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeInfo;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject.HivePrivilegeObjectType;
-
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveRole;
/**
- * Implements functionality of access control statements for sql standard based authorization
+ * Implements functionality of access control statements for sql standard based
+ * authorization
*/
@Private
public class SQLStdHiveAccessController implements HiveAccessController {
- private HiveMetastoreClientFactory metastoreClientFactory;
- private static final String [] SUPPORTED_PRIVS = {"INSERT", "UPDATE", "DELETE", "SELECT", "ALL"};
- private static final Set<String> SUPPORTED_PRIVS_SET
- = new HashSet<String>(Arrays.asList(SUPPORTED_PRIVS));
-
+ private final HiveMetastoreClientFactory metastoreClientFactory;
+ private final HiveAuthenticationProvider authenticator;
+ private String currentUserName;
+ private List<HiveRole> currentRoles;
+ private HiveRole adminRole;
- SQLStdHiveAccessController(HiveMetastoreClientFactory metastoreClientFactory,
- HiveConf conf, String hiveCurrentUser){
+ SQLStdHiveAccessController(HiveMetastoreClientFactory metastoreClientFactory, HiveConf conf,
+ HiveAuthenticationProvider authenticator) throws HiveAuthzPluginException {
this.metastoreClientFactory = metastoreClientFactory;
+ this.authenticator = authenticator;
+ initUserRoles();
+ }
+
+ /**
+ * (Re-)initialize currentRoleNames if necessary.
+ * @throws HiveAuthzPluginException
+ */
+ private void initUserRoles() throws HiveAuthzPluginException {
+ //to aid in testing through .q files, authenticator is passed as argument to
+ // the interface. this helps in being able to switch the user within a session.
+ // so we need to check if the user has changed
+ String newUserName = authenticator.getUserName();
+ if(currentUserName == newUserName){
+ //no need to (re-)initialize the currentUserName, currentRoles fields
+ return;
+ }
+ this.currentUserName = newUserName;
+ this.currentRoles = getRolesFromMS();
}
+ private List<HiveRole> getRolesFromMS() throws HiveAuthzPluginException {
+ List<Role> roles;
+ try {
+ roles = metastoreClientFactory.getHiveMetastoreClient().
+ list_roles(currentUserName, PrincipalType.USER);
+ List<HiveRole> currentRoles = new ArrayList<HiveRole>(roles.size());
+ for (Role role : roles) {
+ if (!HiveMetaStore.ADMIN.equalsIgnoreCase(role.getRoleName())) {
+ currentRoles.add(new HiveRole(role));
+ } else {
+ this.adminRole = new HiveRole(role);
+ }
+ }
+ return currentRoles;
+ } catch (Exception e) {
+ throw new HiveAuthzPluginException("Failed to retrieve roles for "+
+ currentUserName, e);
+ }
+ }
@Override
public void grantPrivileges(List<HivePrincipal> hivePrincipals,
List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject,
- HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthorizationPluginException {
+ HivePrincipal grantorPrincipal, boolean grantOption)
+ throws HiveAuthzPluginException, HiveAccessControlException {
+
+ // expand ALL privileges, if any
+ hivePrivileges = expandAllPrivileges(hivePrivileges);
- PrivilegeBag privBag =
- getThriftPrivilegesBag(hivePrincipals, hivePrivileges, hivePrivObject, grantorPrincipal,
- grantOption);
+ SQLAuthorizationUtils.validatePrivileges(hivePrivileges);
+
+ IMetaStoreClient metastoreClient = metastoreClientFactory.getHiveMetastoreClient();
+ // authorize the grant
+ GrantPrivAuthUtils.authorize(hivePrincipals, hivePrivileges, hivePrivObject, grantOption,
+ metastoreClient, authenticator.getUserName());
+
+ // grant
+ PrivilegeBag privBag = getThriftPrivilegesBag(hivePrincipals, hivePrivileges, hivePrivObject,
+ grantorPrincipal, grantOption);
try {
- metastoreClientFactory.getHiveMetastoreClient().grant_privileges(privBag);
+ metastoreClient.grant_privileges(privBag);
} catch (Exception e) {
- throw new HiveAuthorizationPluginException("Error granting privileges", e);
+ throw new HiveAuthzPluginException("Error granting privileges", e);
}
}
+ private List<HivePrivilege> expandAllPrivileges(List<HivePrivilege> hivePrivileges) {
+ Set<HivePrivilege> hivePrivSet = new HashSet<HivePrivilege>();
+ for (HivePrivilege hivePrivilege : hivePrivileges) {
+ if (hivePrivilege.getName().equals("ALL")) {
+ // expand to all supported privileges
+ for (SQLPrivilegeType privType : SQLPrivilegeType.values()) {
+ hivePrivSet.add(new HivePrivilege(privType.name(), hivePrivilege.getColumns()));
+ }
+ } else {
+ hivePrivSet.add(hivePrivilege);
+ }
+ }
+ return new ArrayList<HivePrivilege>(hivePrivSet);
+ }
+
/**
* Create thrift privileges bag
+ *
* @param hivePrincipals
* @param hivePrivileges
* @param hivePrivObject
* @param grantorPrincipal
* @param grantOption
* @return
- * @throws HiveAuthorizationPluginException
+ * @throws HiveAuthzPluginException
*/
private PrivilegeBag getThriftPrivilegesBag(List<HivePrincipal> hivePrincipals,
List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject,
- HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthorizationPluginException {
- HiveObjectRef privObj = getThriftHiveObjectRef(hivePrivObject);
+ HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException {
+
+ HiveObjectRef privObj = SQLAuthorizationUtils.getThriftHiveObjectRef(hivePrivObject);
PrivilegeBag privBag = new PrivilegeBag();
- for(HivePrivilege privilege : hivePrivileges){
- if(privilege.getColumns() != null && privilege.getColumns().size() > 0){
- throw new HiveAuthorizationPluginException("Privileges on columns not supported currently"
+ for (HivePrivilege privilege : hivePrivileges) {
+ if (privilege.getColumns() != null && privilege.getColumns().size() > 0) {
+ throw new HiveAuthzPluginException("Privileges on columns not supported currently"
+ " in sql standard authorization mode");
}
- if(!SUPPORTED_PRIVS_SET.contains(privilege.getName().toUpperCase(Locale.US))){
- throw new HiveAuthorizationPluginException("Privilege: " + privilege.getName() +
- " is not supported in sql standard authorization mode");
- }
- PrivilegeGrantInfo grantInfo = getThriftPrivilegeGrantInfo(privilege, grantorPrincipal, grantOption);
- for(HivePrincipal principal : hivePrincipals){
+
+ PrivilegeGrantInfo grantInfo = getThriftPrivilegeGrantInfo(privilege, grantorPrincipal,
+ grantOption);
+ for (HivePrincipal principal : hivePrincipals) {
HiveObjectPrivilege objPriv = new HiveObjectPrivilege(privObj, principal.getName(),
AuthorizationUtils.getThriftPrincipalType(principal.getType()), grantInfo);
privBag.addToPrivileges(objPriv);
@@ -114,101 +182,110 @@ public class SQLStdHiveAccessController
}
private PrivilegeGrantInfo getThriftPrivilegeGrantInfo(HivePrivilege privilege,
- HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthorizationPluginException {
- try {
- return AuthorizationUtils.getThriftPrivilegeGrantInfo(privilege, grantorPrincipal, grantOption);
- } catch (HiveException e) {
- throw new HiveAuthorizationPluginException(e);
- }
- }
-
- /**
- * Create a thrift privilege object from the plugin interface privilege object
- * @param privObj
- * @return
- * @throws HiveAuthorizationPluginException
- */
- private HiveObjectRef getThriftHiveObjectRef(HivePrivilegeObject privObj)
- throws HiveAuthorizationPluginException {
+ HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException {
try {
- return AuthorizationUtils.getThriftHiveObjectRef(privObj);
+ return AuthorizationUtils.getThriftPrivilegeGrantInfo(privilege, grantorPrincipal,
+ grantOption);
} catch (HiveException e) {
- throw new HiveAuthorizationPluginException(e);
+ throw new HiveAuthzPluginException(e);
}
}
@Override
public void revokePrivileges(List<HivePrincipal> hivePrincipals,
List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject,
- HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthorizationPluginException {
+ HivePrincipal grantorPrincipal, boolean grantOption)
+ throws HiveAuthzPluginException, HiveAccessControlException {
+ SQLAuthorizationUtils.validatePrivileges(hivePrivileges);
+
+ IMetaStoreClient metastoreClient = metastoreClientFactory.getHiveMetastoreClient();
+ // authorize the revoke, and get the set of privileges to be revoked
+ List<HiveObjectPrivilege> revokePrivs = RevokePrivAuthUtils
+ .authorizeAndGetRevokePrivileges(hivePrincipals, hivePrivileges, hivePrivObject,
+ grantOption, metastoreClient, authenticator.getUserName());
- PrivilegeBag privBag =
- getThriftPrivilegesBag(hivePrincipals, hivePrivileges, hivePrivObject, grantorPrincipal,
- grantOption);
try {
- metastoreClientFactory.getHiveMetastoreClient().revoke_privileges(privBag);
+ // unfortunately, the metastore api revokes all privileges that match on
+ // principal, privilege object type it does not filter on the grator
+ // username.
+ // So this will revoke privileges that are granted by other users.This is
+ // not SQL compliant behavior. Need to change/add a metastore api
+ // that has desired behavior.
+ metastoreClient.revoke_privileges(new PrivilegeBag(revokePrivs));
} catch (Exception e) {
- throw new HiveAuthorizationPluginException("Error revoking privileges", e);
+ throw new HiveAuthzPluginException("Error revoking privileges", e);
}
}
@Override
public void createRole(String roleName, HivePrincipal adminGrantor)
- throws HiveAuthorizationPluginException {
+ throws HiveAuthzPluginException, HiveAccessControlException {
+ // only user belonging to admin role can create new roles.
+ if (!this.isUserAdmin(new HivePrincipal(currentUserName,HivePrincipalType.USER))) {
+ throw new HiveAccessControlException("Current user : " + currentUserName+ " is not"
+ + " allowed to add roles. Only users belonging to admin role can add new roles.");
+ }
try {
String grantorName = adminGrantor == null ? null : adminGrantor.getName();
- metastoreClientFactory.getHiveMetastoreClient()
- .create_role(new Role(roleName, 0, grantorName));
+ metastoreClientFactory.getHiveMetastoreClient().create_role(
+ new Role(roleName, 0, grantorName));
} catch (Exception e) {
- throw new HiveAuthorizationPluginException("Error create role", e);
+ throw new HiveAuthzPluginException("Error create role", e);
}
}
@Override
- public void dropRole(String roleName) throws HiveAuthorizationPluginException {
+ public void dropRole(String roleName) throws HiveAuthzPluginException, HiveAccessControlException {
+ // only user belonging to admin role can drop existing role
+ if (!this.isUserAdmin(new HivePrincipal(currentUserName,HivePrincipalType.USER))) {
+ throw new HiveAccessControlException("Current user : " + currentUserName+ " is not"
+ + " allowed to drop role. Only users belonging to admin role can drop roles.");
+ }
try {
metastoreClientFactory.getHiveMetastoreClient().drop_role(roleName);
} catch (Exception e) {
- throw new HiveAuthorizationPluginException("Error dropping role", e);
+ throw new HiveAuthzPluginException("Error dropping role", e);
}
}
@Override
- public List<String> getRoles(HivePrincipal hivePrincipal) throws HiveAuthorizationPluginException {
+ public List<HiveRole> getRoles(HivePrincipal hivePrincipal) throws HiveAuthzPluginException {
try {
List<Role> roles = metastoreClientFactory.getHiveMetastoreClient().list_roles(
hivePrincipal.getName(), AuthorizationUtils.getThriftPrincipalType(hivePrincipal.getType()));
- List<String> roleNames = new ArrayList<String>(roles.size());
- for(Role role : roles){
- roleNames.add(role.getRoleName());
+ List<HiveRole> hiveRoles = new ArrayList<HiveRole>(roles.size());
+ for (Role role : roles){
+ hiveRoles.add(new HiveRole(role));
}
- return roleNames;
+ return hiveRoles;
} catch (Exception e) {
- throw new HiveAuthorizationPluginException(
- "Error listing roles for user" + hivePrincipal.getName(), e);
+ throw new HiveAuthzPluginException("Error listing roles for user "
+ + hivePrincipal.getName(), e);
}
}
@Override
public void grantRole(List<HivePrincipal> hivePrincipals, List<String> roleNames,
- boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthorizationPluginException {
- for(HivePrincipal hivePrincipal : hivePrincipals){
- for(String roleName : roleNames){
+ boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthzPluginException,
+ HiveAccessControlException {
+ if (!this.isUserAdmin(new HivePrincipal(currentUserName,HivePrincipalType.USER))) {
+ throw new HiveAccessControlException("Current user : " + currentUserName+ " is not"
+ + " allowed to grant role. Currently only users belonging to admin role can grant roles.");
+ }
+ for (HivePrincipal hivePrincipal : hivePrincipals) {
+ for (String roleName : roleNames) {
try {
IMetaStoreClient mClient = metastoreClientFactory.getHiveMetastoreClient();
- mClient.grant_role(roleName,
- hivePrincipal.getName(),
+ mClient.grant_role(roleName, hivePrincipal.getName(),
AuthorizationUtils.getThriftPrincipalType(hivePrincipal.getType()),
grantorPrinc.getName(),
- AuthorizationUtils.getThriftPrincipalType(grantorPrinc.getType()),
- grantOption
- );
+ AuthorizationUtils.getThriftPrincipalType(grantorPrinc.getType()), grantOption);
} catch (MetaException e) {
- throw new HiveAuthorizationPluginException(e.getMessage(), e);
+ throw new HiveAuthzPluginException(e.getMessage(), e);
} catch (Exception e) {
- String msg = "Error granting roles for " + hivePrincipal.getName() + " to role "
+ String msg = "Error granting roles for " + hivePrincipal.getName() + " to role "
+ roleName + ": " + e.getMessage();
- throw new HiveAuthorizationPluginException(msg, e);
+ throw new HiveAuthzPluginException(msg, e);
}
}
}
@@ -216,77 +293,77 @@ public class SQLStdHiveAccessController
@Override
public void revokeRole(List<HivePrincipal> hivePrincipals, List<String> roleNames,
- boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthorizationPluginException {
- if(grantOption){
- //removing grant privileges only is not supported in metastore api
- throw new HiveAuthorizationPluginException("Revoking only the admin privileges on "
- + "role is not currently supported");
+ boolean grantOption, HivePrincipal grantorPrinc) throws HiveAuthzPluginException,
+ HiveAccessControlException {
+ if (grantOption) {
+ // removing grant privileges only is not supported in metastore api
+ throw new HiveAuthzPluginException("Revoking only the admin privileges on "
+ + "role is not currently supported");
+ }
+ if (!this.isUserAdmin(new HivePrincipal(currentUserName,HivePrincipalType.USER))) {
+ throw new HiveAccessControlException("Current user : " + currentUserName+ " is not"
+ + " allowed to revoke role. Currently only users belonging to admin role can revoke roles.");
}
- for(HivePrincipal hivePrincipal : hivePrincipals){
- for(String roleName : roleNames){
+ for (HivePrincipal hivePrincipal : hivePrincipals) {
+ for (String roleName : roleNames) {
try {
IMetaStoreClient mClient = metastoreClientFactory.getHiveMetastoreClient();
- mClient.revoke_role(roleName,
- hivePrincipal.getName(),
- AuthorizationUtils.getThriftPrincipalType(hivePrincipal.getType())
- );
- } catch (Exception e) {
- String msg = "Error revoking roles for " + hivePrincipal.getName() + " to role " + roleName
- + hivePrincipal.getName();
- throw new HiveAuthorizationPluginException(msg, e);
+ mClient.revoke_role(roleName, hivePrincipal.getName(),
+ AuthorizationUtils.getThriftPrincipalType(hivePrincipal.getType()));
+ } catch (Exception e) {
+ String msg = "Error revoking roles for " + hivePrincipal.getName() + " to role "
+ + roleName;
+ throw new HiveAuthzPluginException(msg, e);
}
}
}
}
@Override
- public List<String> getAllRoles() throws HiveAuthorizationPluginException {
+ public List<String> getAllRoles() throws HiveAuthzPluginException, HiveAccessControlException {
+ // only user belonging to admin role can list role
+ if (!this.isUserAdmin(new HivePrincipal(currentUserName,HivePrincipalType.USER))) {
+ throw new HiveAccessControlException("Current user : " + currentUserName+ " is not"
+ + " allowed to list roles. Only users belonging to admin role can list roles.");
+ }
try {
return metastoreClientFactory.getHiveMetastoreClient().listRoleNames();
} catch (Exception e) {
- throw new HiveAuthorizationPluginException("Error listing all roles", e);
+ throw new HiveAuthzPluginException("Error listing all roles", e);
}
}
-
@Override
public List<HivePrivilegeInfo> showPrivileges(HivePrincipal principal, HivePrivilegeObject privObj)
- throws HiveAuthorizationPluginException {
+ throws HiveAuthzPluginException {
try {
-
- List<HivePrivilegeInfo> resPrivInfos = new ArrayList<HivePrivilegeInfo>();
IMetaStoreClient mClient = metastoreClientFactory.getHiveMetastoreClient();
+ List<HivePrivilegeInfo> resPrivInfos = new ArrayList<HivePrivilegeInfo>();
+ // get metastore/thrift privilege object using metastore api
+ List<HiveObjectPrivilege> msObjPrivs = mClient.list_privileges(principal.getName(),
+ AuthorizationUtils.getThriftPrincipalType(principal.getType()),
+ SQLAuthorizationUtils.getThriftHiveObjectRef(privObj));
+
- //get metastore/thrift privilege object using metastore api
- List<HiveObjectPrivilege> msObjPrivs
- = mClient.list_privileges(principal.getName(),
- AuthorizationUtils.getThriftPrincipalType(principal.getType()),
- getThriftHiveObjectRef(privObj));
-
- //convert the metastore thrift objects to result objects
- for(HiveObjectPrivilege msObjPriv : msObjPrivs){
- //result principal
- HivePrincipal resPrincipal =
- new HivePrincipal(msObjPriv.getPrincipalName(),
- AuthorizationUtils.getHivePrincipalType(msObjPriv.getPrincipalType()));
+ // convert the metastore thrift objects to result objects
+ for (HiveObjectPrivilege msObjPriv : msObjPrivs) {
+ // result principal
+ HivePrincipal resPrincipal = new HivePrincipal(msObjPriv.getPrincipalName(),
+ AuthorizationUtils.getHivePrincipalType(msObjPriv.getPrincipalType()));
- //result privilege
+ // result privilege
PrivilegeGrantInfo msGrantInfo = msObjPriv.getGrantInfo();
HivePrivilege resPrivilege = new HivePrivilege(msGrantInfo.getPrivilege(), null);
- //result object
+ // result object
HiveObjectRef msObjRef = msObjPriv.getHiveObject();
HivePrivilegeObject resPrivObj = new HivePrivilegeObject(
- getPluginObjType(msObjRef.getObjectType()),
- msObjRef.getDbName(),
- msObjRef.getObjectName()
- );
-
- //result grantor principal
- HivePrincipal grantorPrincipal =
- new HivePrincipal(msGrantInfo.getGrantor(),
- AuthorizationUtils.getHivePrincipalType(msGrantInfo.getGrantorType()));
+ getPluginObjType(msObjRef.getObjectType()), msObjRef.getDbName(),
+ msObjRef.getObjectName());
+ // result grantor principal
+ HivePrincipal grantorPrincipal = new HivePrincipal(msGrantInfo.getGrantor(),
+ AuthorizationUtils.getHivePrincipalType(msGrantInfo.getGrantorType()));
HivePrivilegeInfo resPrivInfo = new HivePrivilegeInfo(resPrincipal, resPrivilege,
resPrivObj, grantorPrincipal, msGrantInfo.isGrantOption());
@@ -294,17 +371,15 @@ public class SQLStdHiveAccessController
}
return resPrivInfos;
- }
- catch (Exception e) {
- throw new HiveAuthorizationPluginException("Error showing privileges", e);
+ } catch (Exception e) {
+ throw new HiveAuthzPluginException("Error showing privileges", e);
}
}
-
private HivePrivilegeObjectType getPluginObjType(HiveObjectType objectType)
- throws HiveAuthorizationPluginException {
- switch(objectType){
+ throws HiveAuthzPluginException {
+ switch (objectType) {
case DATABASE:
return HivePrivilegeObjectType.DATABASE;
case TABLE:
@@ -312,10 +387,64 @@ public class SQLStdHiveAccessController
case COLUMN:
case GLOBAL:
case PARTITION:
- throw new HiveAuthorizationPluginException("Unsupported object type " + objectType);
+ throw new HiveAuthzPluginException("Unsupported object type " + objectType);
default:
throw new AssertionError("Unexpected object type " + objectType);
}
}
+ @Override
+ public void setCurrentRole(String roleName) throws HiveAccessControlException,
+ HiveAuthzPluginException {
+
+ if ("NONE".equalsIgnoreCase(roleName)) {
+ // for set role NONE, reset roles to default roles.
+ currentRoles.clear();
+ currentRoles.addAll(getRolesFromMS());
+ return;
+ }
+ for (HiveRole role : getRolesFromMS()) {
+ // set to one of the roles user belongs to.
+ if (role.getRoleName().equalsIgnoreCase(roleName)) {
+ currentRoles.clear();
+ currentRoles.add(role);
+ return;
+ }
+ }
+ // set to ADMIN role, if user belongs there.
+ if (HiveMetaStore.ADMIN.equalsIgnoreCase(roleName) && null != this.adminRole) {
+ currentRoles.clear();
+ currentRoles.add(adminRole);
+ return;
+ }
+ // If we are here it means, user is requesting a role he doesn't belong to.
+ throw new HiveAccessControlException(currentUserName +" doesn't belong to role "
+ +roleName);
+ }
+
+ @Override
+ public List<HiveRole> getCurrentRoles() throws HiveAuthzPluginException {
+ initUserRoles();
+ return currentRoles;
+ }
+
+ /**
+ * @param principal
+ * @return true only if current role of user is Admin
+ * @throws HiveAuthzPluginException
+ */
+ private boolean isUserAdmin(HivePrincipal principal) throws HiveAuthzPluginException {
+ List<HiveRole> roles;
+ try {
+ roles = getCurrentRoles();
+ } catch (Exception e) {
+ throw new HiveAuthzPluginException(e);
+ }
+ for (HiveRole role : roles){
+ if (role.getRoleName().equalsIgnoreCase(HiveMetaStore.ADMIN)) {
+ return true;
+ }
+ }
+ return false;
+ }
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAuthorizationValidator.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAuthorizationValidator.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAuthorizationValidator.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAuthorizationValidator.java Fri Feb 14 10:53:31 2014
@@ -17,18 +17,66 @@
*/
package org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd;
+import java.util.Collection;
import java.util.List;
-import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizationPluginException;
+import org.apache.hadoop.hive.conf.HiveConf;
+import org.apache.hadoop.hive.metastore.IMetaStoreClient;
+import org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizationValidator;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveMetastoreClientFactory;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveOperationType;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal.HivePrincipalType;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject;
public class SQLStdHiveAuthorizationValidator implements HiveAuthorizationValidator {
+ private final HiveMetastoreClientFactory metastoreClientFactory;
+ private final HiveConf conf;
+ private final HiveAuthenticationProvider authenticator;
+
+ public SQLStdHiveAuthorizationValidator(HiveMetastoreClientFactory metastoreClientFactory,
+ HiveConf conf, HiveAuthenticationProvider authenticator) {
+ this.metastoreClientFactory = metastoreClientFactory;
+ this.conf = conf;
+ this.authenticator = authenticator;
+ }
+
@Override
public void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> inputHObjs,
- List<HivePrivilegeObject> outputHObjs) throws HiveAuthorizationPluginException {
+ List<HivePrivilegeObject> outputHObjs) throws HiveAuthzPluginException, HiveAccessControlException {
+ String userName = authenticator.getUserName();
+ IMetaStoreClient metastoreClient = metastoreClientFactory.getHiveMetastoreClient();
+
+ // get privileges required on input and check
+ SQLPrivTypeGrant[] inputPrivs = Operation2Privilege.getInputPrivs(hiveOpType);
+ checkPrivileges(inputPrivs, inputHObjs, metastoreClient, userName);
+
+ // get privileges required on input and check
+ SQLPrivTypeGrant[] outputPrivs = Operation2Privilege.getOutputPrivs(hiveOpType);
+ checkPrivileges(outputPrivs, outputHObjs, metastoreClient, userName);
+
+ }
+
+ private void checkPrivileges(SQLPrivTypeGrant[] reqPrivs,
+ List<HivePrivilegeObject> hObjs, IMetaStoreClient metastoreClient, String userName)
+ throws HiveAuthzPluginException, HiveAccessControlException {
+ RequiredPrivileges requiredInpPrivs = new RequiredPrivileges();
+ requiredInpPrivs.addAll(reqPrivs);
+
+ // check if this user has these privileges on the objects
+ for (HivePrivilegeObject hObj : hObjs) {
+ // get the privileges that this user has on the object
+ RequiredPrivileges availPrivs = SQLAuthorizationUtils.getPrivilegesFromMetaStore(
+ metastoreClient, userName, hObj);
+ Collection<SQLPrivTypeGrant> missingPriv = requiredInpPrivs
+ .findMissingPrivs(availPrivs);
+ SQLAuthorizationUtils.assertNoMissingPrivilege(missingPriv, new HivePrincipal(userName,
+ HivePrincipalType.USER), hObj);
+ }
}
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAuthorizerFactory.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAuthorizerFactory.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAuthorizerFactory.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/plugin/sqlstd/SQLStdHiveAuthorizerFactory.java Fri Feb 14 10:53:31 2014
@@ -19,19 +19,22 @@ package org.apache.hadoop.hive.ql.securi
import org.apache.hadoop.hive.common.classification.InterfaceAudience.Private;
import org.apache.hadoop.hive.conf.HiveConf;
+import org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizer;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizerFactory;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizerImpl;
+import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveMetastoreClientFactory;
@Private
public class SQLStdHiveAuthorizerFactory implements HiveAuthorizerFactory{
@Override
public HiveAuthorizer createHiveAuthorizer(HiveMetastoreClientFactory metastoreClientFactory,
- HiveConf conf, String hiveCurrentUser) {
+ HiveConf conf, HiveAuthenticationProvider authenticator) throws HiveAuthzPluginException {
+
return new HiveAuthorizerImpl(
- new SQLStdHiveAccessController(metastoreClientFactory, conf, hiveCurrentUser),
- new SQLStdHiveAuthorizationValidator()
+ new SQLStdHiveAccessController(metastoreClientFactory, conf, authenticator),
+ new SQLStdHiveAuthorizationValidator(metastoreClientFactory, conf, authenticator)
);
}
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/session/SessionState.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/session/SessionState.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/session/SessionState.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/session/SessionState.java Fri Feb 14 10:53:31 2014
@@ -54,6 +54,7 @@ import org.apache.hadoop.hive.ql.metadat
import org.apache.hadoop.hive.ql.metadata.HiveUtils;
import org.apache.hadoop.hive.ql.plan.HiveOperation;
import org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider;
+import org.apache.hadoop.hive.ql.security.SessionStateUserAuthenticator;
import org.apache.hadoop.hive.ql.security.authorization.HiveAuthorizationProvider;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizer;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizerFactory;
@@ -340,29 +341,39 @@ public class SessionState {
*/
private void setupAuth() {
- if(authenticator != null){
- //auth has been initialized
+ if (authenticator != null) {
+ // auth has been initialized
return;
}
try {
- authenticator = HiveUtils.getAuthenticator(
- getConf(),HiveConf.ConfVars.HIVE_AUTHENTICATOR_MANAGER);
- authorizer = HiveUtils.getAuthorizeProviderManager(
- getConf(), HiveConf.ConfVars.HIVE_AUTHORIZATION_MANAGER,
- authenticator, true);
-
- if(authorizer == null){
- //if it was null, the new authorization plugin must be specified in config
- HiveAuthorizerFactory authorizerFactory =
- HiveUtils.getAuthorizerFactory(getConf(), HiveConf.ConfVars.HIVE_AUTHORIZATION_MANAGER);
- String authUser = userName == null ? authenticator.getUserName() : userName;
+ authenticator = HiveUtils.getAuthenticator(getConf(),
+ HiveConf.ConfVars.HIVE_AUTHENTICATOR_MANAGER);
+
+ if (userName != null) {
+ // if username is set through the session, use an authenticator that
+ // just returns the sessionstate user
+ authenticator = new SessionStateUserAuthenticator(this);
+ }
+ authenticator.setSessionState(this);
+
+ authorizer = HiveUtils.getAuthorizeProviderManager(getConf(),
+ HiveConf.ConfVars.HIVE_AUTHORIZATION_MANAGER, authenticator, true);
+
+ if (authorizer == null) {
+ // if it was null, the new authorization plugin must be specified in
+ // config
+ HiveAuthorizerFactory authorizerFactory = HiveUtils.getAuthorizerFactory(getConf(),
+ HiveConf.ConfVars.HIVE_AUTHORIZATION_MANAGER);
+
authorizerV2 = authorizerFactory.createHiveAuthorizer(new HiveMetastoreClientFactoryImpl(),
- getConf(), authUser);
- }
- else{
- createTableGrants = CreateTableAutomaticGrant.create(getConf());
+ getConf(), authenticator);
+ // grant all privileges for table to its owner
+ getConf().setVar(ConfVars.HIVE_AUTHORIZATION_TABLE_OWNER_GRANTS, "insert,select,update,delete");
}
+
+ createTableGrants = CreateTableAutomaticGrant.create(getConf());
+
} catch (HiveException e) {
throw new RuntimeException(e);
}
@@ -594,16 +605,19 @@ public class SessionState {
*/
public static enum ResourceType {
FILE(new ResourceHook() {
+ @Override
public String preHook(Set<String> cur, String s) {
return validateFile(cur, s);
}
+ @Override
public boolean postHook(Set<String> cur, String s) {
return true;
}
}),
JAR(new ResourceHook() {
+ @Override
public String preHook(Set<String> cur, String s) {
String newJar = validateFile(cur, s);
if (newJar != null) {
@@ -613,16 +627,19 @@ public class SessionState {
}
}
+ @Override
public boolean postHook(Set<String> cur, String s) {
return unregisterJar(s);
}
}),
ARCHIVE(new ResourceHook() {
+ @Override
public String preHook(Set<String> cur, String s) {
return validateFile(cur, s);
}
+ @Override
public boolean postHook(Set<String> cur, String s) {
return true;
}
@@ -821,6 +838,7 @@ public class SessionState {
}
public CreateTableAutomaticGrant getCreateTableGrants() {
+ setupAuth();
return createTableGrants;
}
@@ -947,4 +965,9 @@ public class SessionState {
public void setTezSession(TezSessionState session) {
this.tezSessionState = session;
}
+
+ public String getUserName() {
+ return userName;
+ }
+
}
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/stats/CounterStatsAggregatorTez.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/stats/CounterStatsAggregatorTez.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/stats/CounterStatsAggregatorTez.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/stats/CounterStatsAggregatorTez.java Fri Feb 14 10:53:31 2014
@@ -57,17 +57,21 @@ public class CounterStatsAggregatorTez i
@Override
public String aggregateStats(String keyPrefix, String statType) {
- if (delegate) {
- return mrAggregator.aggregateStats(keyPrefix, statType);
- }
+ String result;
- long value = 0;
- for (String groupName : counters.getGroupNames()) {
- if (groupName.startsWith(keyPrefix)) {
- value += counters.getGroup(groupName).findCounter(statType).getValue();
+ if (delegate) {
+ result = mrAggregator.aggregateStats(keyPrefix, statType);
+ } else {
+ long value = 0;
+ for (String groupName : counters.getGroupNames()) {
+ if (groupName.startsWith(keyPrefix)) {
+ value += counters.getGroup(groupName).findCounter(statType).getValue();
+ }
}
+ result = String.valueOf(value);
}
- return String.valueOf(value);
+ LOG.info("Counter based stats for ("+keyPrefix+") are: "+result);
+ return result;
}
@Override
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFDegrees.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFDegrees.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFDegrees.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFDegrees.java Fri Feb 14 10:53:31 2014
@@ -20,7 +20,6 @@ package org.apache.hadoop.hive.ql.udf;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.hadoop.hive.ql.exec.Description;
-import org.apache.hadoop.hive.ql.exec.UDF;
import org.apache.hadoop.hive.ql.exec.vector.VectorizedExpressions;
import org.apache.hadoop.hive.ql.exec.vector.expressions.gen.FuncDegreesDoubleToDouble;
import org.apache.hadoop.hive.ql.exec.vector.expressions.gen.FuncDegreesLongToDouble;
@@ -34,7 +33,7 @@ import org.apache.hadoop.hive.serde2.io.
" -1\n"
)
@VectorizedExpressions({FuncDegreesLongToDouble.class, FuncDegreesDoubleToDouble.class})
-public class UDFDegrees extends UDF{
+public class UDFDegrees extends UDFMath {
@SuppressWarnings("unused")
private static Log LOG = LogFactory.getLog(UDFDegrees.class.getName());
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFJson.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFJson.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFJson.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFJson.java Fri Feb 14 10:53:31 2014
@@ -186,6 +186,11 @@ public class UDFJson extends UDF {
if (mKeyGroup1 == null) {
if (mKey == null) {
mKey = patternKey.matcher(path);
+ mKeyMatches = mKey.matches() ? Boolean.TRUE : Boolean.FALSE;
+ mKeyMatchesCache.put(path, mKeyMatches);
+ if (!mKeyMatches.booleanValue()) {
+ return null;
+ }
}
mKeyGroup1 = mKey.group(1);
mKeyGroup1Cache.put(path, mKeyGroup1);
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFToByte.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFToByte.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFToByte.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFToByte.java Fri Feb 14 10:53:31 2014
@@ -20,6 +20,7 @@ package org.apache.hadoop.hive.ql.udf;
import org.apache.hadoop.hive.ql.exec.UDF;
import org.apache.hadoop.hive.ql.exec.vector.VectorizedExpressions;
+import org.apache.hadoop.hive.ql.exec.vector.expressions.CastDecimalToLong;
import org.apache.hadoop.hive.ql.exec.vector.expressions.gen.CastDoubleToLong;
import org.apache.hadoop.hive.ql.exec.vector.expressions.gen.CastTimestampToLongViaLongToLong;
import org.apache.hadoop.hive.serde2.io.ByteWritable;
@@ -39,7 +40,8 @@ import org.apache.hadoop.io.Text;
* UDFToByte.
*
*/
-@VectorizedExpressions({CastTimestampToLongViaLongToLong.class, CastDoubleToLong.class})
+@VectorizedExpressions({CastTimestampToLongViaLongToLong.class, CastDoubleToLong.class,
+ CastDecimalToLong.class})
public class UDFToByte extends UDF {
private final ByteWritable byteWritable = new ByteWritable();
Modified: hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFToDouble.java
URL: http://svn.apache.org/viewvc/hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFToDouble.java?rev=1568236&r1=1568235&r2=1568236&view=diff
==============================================================================
--- hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFToDouble.java (original)
+++ hive/branches/tez/ql/src/java/org/apache/hadoop/hive/ql/udf/UDFToDouble.java Fri Feb 14 10:53:31 2014
@@ -20,6 +20,7 @@ package org.apache.hadoop.hive.ql.udf;
import org.apache.hadoop.hive.ql.exec.UDF;
import org.apache.hadoop.hive.ql.exec.vector.VectorizedExpressions;
+import org.apache.hadoop.hive.ql.exec.vector.expressions.CastDecimalToDouble;
import org.apache.hadoop.hive.ql.exec.vector.expressions.gen.CastLongToDouble;
import org.apache.hadoop.hive.ql.exec.vector.expressions.gen.CastTimestampToDoubleViaLongToDouble;
import org.apache.hadoop.hive.serde2.io.ByteWritable;
@@ -37,7 +38,8 @@ import org.apache.hadoop.io.Text;
* UDFToDouble.
*
*/
-@VectorizedExpressions({CastTimestampToDoubleViaLongToDouble.class, CastLongToDouble.class})
+@VectorizedExpressions({CastTimestampToDoubleViaLongToDouble.class, CastLongToDouble.class,
+ CastDecimalToDouble.class})
public class UDFToDouble extends UDF {
private final DoubleWritable doubleWritable = new DoubleWritable();