You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hive.apache.org by kh...@apache.org on 2015/04/30 11:31:17 UTC
hive git commit: HIVE-9681 : Extend HiveAuthorizationProvider to
support partition-sets (Mithun Radhakrishnan via Sushanth Sowmyan)
Repository: hive
Updated Branches:
refs/heads/master 4f77d5bc2 -> 9bc1b3bf2
HIVE-9681 : Extend HiveAuthorizationProvider to support partition-sets (Mithun Radhakrishnan via Sushanth Sowmyan)
Project: http://git-wip-us.apache.org/repos/asf/hive/repo
Commit: http://git-wip-us.apache.org/repos/asf/hive/commit/9bc1b3bf
Tree: http://git-wip-us.apache.org/repos/asf/hive/tree/9bc1b3bf
Diff: http://git-wip-us.apache.org/repos/asf/hive/diff/9bc1b3bf
Branch: refs/heads/master
Commit: 9bc1b3bf23ca6a74c4bfe061459a8a78753c7096
Parents: 4f77d5b
Author: Sushanth Sowmyan <kh...@gmail.com>
Authored: Thu Apr 30 02:30:31 2015 -0700
Committer: Sushanth Sowmyan <kh...@gmail.com>
Committed: Thu Apr 30 02:31:12 2015 -0700
----------------------------------------------------------------------
.../AuthorizationPreEventListener.java | 58 ++++++++++++++++----
...MultiPartitionAuthorizationProviderBase.java | 43 +++++++++++++++
2 files changed, 91 insertions(+), 10 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hive/blob/9bc1b3bf/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java
----------------------------------------------------------------------
diff --git a/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java b/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java
index 774a134..63ba327 100644
--- a/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java
+++ b/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/AuthorizationPreEventListener.java
@@ -21,6 +21,8 @@ package org.apache.hadoop.hive.ql.security.authorization;
import java.util.Iterator;
import java.util.List;
+import com.google.common.base.Function;
+import com.google.common.collect.Iterators;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.hadoop.conf.Configuration;
@@ -323,19 +325,55 @@ public class AuthorizationPreEventListener extends MetaStorePreEventListener {
}
}
+ private void authorizeDropMultiPartition(HiveMultiPartitionAuthorizationProviderBase authorizer,
+ final PreDropPartitionEvent context)
+ throws AuthorizationException, HiveException {
+ Iterator<Partition> partitionIterator = context.getPartitionIterator();
+
+ final TableWrapper table = new TableWrapper(context.getTable());
+ final Iterator<org.apache.hadoop.hive.ql.metadata.Partition> qlPartitionIterator =
+ Iterators.transform(partitionIterator, new Function<Partition, org.apache.hadoop.hive.ql.metadata.Partition>() {
+ @Override
+ public org.apache.hadoop.hive.ql.metadata.Partition apply(Partition partition) {
+ try {
+ return new PartitionWrapper(table, partition);
+ } catch (Exception exception) {
+ LOG.error("Could not construct partition-object for: " + partition, exception);
+ throw new RuntimeException(exception);
+ }
+ }
+ });
+
+ authorizer.authorize(new TableWrapper(context.getTable()),
+ new Iterable<org.apache.hadoop.hive.ql.metadata.Partition>() {
+ @Override
+ public Iterator<org.apache.hadoop.hive.ql.metadata.Partition> iterator() {
+ return qlPartitionIterator;
+ }
+ },
+ HiveOperation.ALTERTABLE_DROPPARTS.getInputRequiredPrivileges(),
+ HiveOperation.ALTERTABLE_DROPPARTS.getOutputRequiredPrivileges());
+ }
+
private void authorizeDropPartition(PreDropPartitionEvent context)
throws InvalidOperationException, MetaException {
try {
- TableWrapper tableWrapper = new TableWrapper(context.getTable());
- Iterator<Partition> partitionIterator = context.getPartitionIterator();
- while (partitionIterator.hasNext()) {
- org.apache.hadoop.hive.metastore.api.Partition mapiPart = partitionIterator.next();
- org.apache.hadoop.hive.ql.metadata.Partition wrappedPartition
- = new PartitionWrapper(tableWrapper, mapiPart);
- for (HiveMetastoreAuthorizationProvider authorizer : tAuthorizers.get()) {
- authorizer.authorize(wrappedPartition,
- HiveOperation.ALTERTABLE_DROPPARTS.getInputRequiredPrivileges(),
- HiveOperation.ALTERTABLE_DROPPARTS.getOutputRequiredPrivileges());
+ for (HiveMetastoreAuthorizationProvider authorizer : tAuthorizers.get()) {
+ if (authorizer instanceof HiveMultiPartitionAuthorizationProviderBase) {
+ // Authorize all dropped-partitions in one shot.
+ authorizeDropMultiPartition((HiveMultiPartitionAuthorizationProviderBase)authorizer, context);
+ }
+ else {
+ // Authorize individually.
+ TableWrapper table = new TableWrapper(context.getTable());
+ Iterator<Partition> partitionIterator = context.getPartitionIterator();
+ while (partitionIterator.hasNext()) {
+ authorizer.authorize(
+ new PartitionWrapper(table, partitionIterator.next()),
+ HiveOperation.ALTERTABLE_DROPPARTS.getInputRequiredPrivileges(),
+ HiveOperation.ALTERTABLE_DROPPARTS.getOutputRequiredPrivileges()
+ );
+ }
}
}
} catch (AuthorizationException e) {
http://git-wip-us.apache.org/repos/asf/hive/blob/9bc1b3bf/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/HiveMultiPartitionAuthorizationProviderBase.java
----------------------------------------------------------------------
diff --git a/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/HiveMultiPartitionAuthorizationProviderBase.java b/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/HiveMultiPartitionAuthorizationProviderBase.java
new file mode 100644
index 0000000..5c52326
--- /dev/null
+++ b/ql/src/java/org/apache/hadoop/hive/ql/security/authorization/HiveMultiPartitionAuthorizationProviderBase.java
@@ -0,0 +1,43 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.hive.ql.security.authorization;
+
+import org.apache.hadoop.hive.ql.metadata.AuthorizationException;
+import org.apache.hadoop.hive.ql.metadata.HiveException;
+import org.apache.hadoop.hive.ql.metadata.Partition;
+import org.apache.hadoop.hive.ql.metadata.Table;
+
+/**
+ * Abstract class that allows authorization of operations on partition-sets.
+ */
+public abstract class HiveMultiPartitionAuthorizationProviderBase extends HiveAuthorizationProviderBase {
+
+ /**
+ * Authorization method for partition sets.
+ * @param table The table in question
+ * @param partitions An Iterable representing the partition-set
+ * @param requiredReadPrivileges Read-privileges required
+ * @param requiredWritePrivileges Write-privileges required
+ * @throws HiveException
+ * @throws AuthorizationException
+ */
+ public abstract void authorize(Table table, Iterable<Partition> partitions,
+ Privilege[] requiredReadPrivileges, Privilege[] requiredWritePrivileges)
+ throws HiveException, AuthorizationException;
+}