You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sentry.apache.org by Li Li <li...@cloudera.com> on 2016/10/04 22:23:16 UTC
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/
-----------------------------------------------------------
(Updated Oct. 4, 2016, 10:23 p.m.)
Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
Changes
-------
Add flag to enable / disable admin servlet. This webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Repository: sentry
Description (updated)
-------
Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Diffs (updated)
-----
sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
Diff: https://reviews.apache.org/r/45859/diff/
Testing (updated)
-------
Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Thanks,
Li Li
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Li Li <li...@cloudera.com>.
> On Oct. 7, 2016, 12:28 a.m., Alexander Kolbasov wrote:
> > sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java, line 92
> > <https://reviews.apache.org/r/45859/diff/4/?file=1522419#file1522419line92>
> >
> > Since you are going to the trouble of disabling cache it makes sense to disable it for different browsers and proxies.
I see. Will fixed.
- Li
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/#review151614
-----------------------------------------------------------
On Oct. 7, 2016, 12:26 a.m., Li Li wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45859/
> -----------------------------------------------------------
>
> (Updated Oct. 7, 2016, 12:26 a.m.)
>
>
> Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Diffs
> -----
>
> sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
>
> Diff: https://reviews.apache.org/r/45859/diff/
>
>
> Testing
> -------
>
> Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Thanks,
>
> Li Li
>
>
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Alexander Kolbasov <ak...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/#review151614
-----------------------------------------------------------
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java (line 92)
<https://reviews.apache.org/r/45859/#comment220049>
Since you are going to the trouble of disabling cache it makes sense to disable it for different browsers and proxies.
- Alexander Kolbasov
On Oct. 7, 2016, 12:26 a.m., Li Li wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45859/
> -----------------------------------------------------------
>
> (Updated Oct. 7, 2016, 12:26 a.m.)
>
>
> Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Diffs
> -----
>
> sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
>
> Diff: https://reviews.apache.org/r/45859/diff/
>
>
> Testing
> -------
>
> Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Thanks,
>
> Li Li
>
>
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Anne Yu <an...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/#review151834
-----------------------------------------------------------
Ship it!
Thanks Lili for your patch.
- Anne Yu
On Oct. 7, 2016, 5:36 p.m., Li Li wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45859/
> -----------------------------------------------------------
>
> (Updated Oct. 7, 2016, 5:36 p.m.)
>
>
> Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Diffs
> -----
>
> sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
>
> Diff: https://reviews.apache.org/r/45859/diff/
>
>
> Testing
> -------
>
> Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Thanks,
>
> Li Li
>
>
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Li Li <li...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/
-----------------------------------------------------------
(Updated Oct. 7, 2016, 5:36 p.m.)
Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
Repository: sentry
Description
-------
Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Diffs (updated)
-----
sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
Diff: https://reviews.apache.org/r/45859/diff/
Testing
-------
Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Thanks,
Li Li
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Li Li <li...@cloudera.com>.
> On Oct. 7, 2016, 5:25 p.m., Anne Yu wrote:
> > sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java, line 18
> > <https://reviews.apache.org/r/45859/diff/6/?file=1526012#file1526012line18>
> >
> > Just a minor issue. I've seen across codes, license is on usually the top then package definition and imports followed afterwards.
> >
> > https://github.com/apache/hive/blob/master/common/src/java/org/apache/hadoop/hive/common/FileUtils.java
good catch! will fix it
- Li
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/#review151825
-----------------------------------------------------------
On Oct. 7, 2016, 12:38 a.m., Li Li wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45859/
> -----------------------------------------------------------
>
> (Updated Oct. 7, 2016, 12:38 a.m.)
>
>
> Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Diffs
> -----
>
> sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
>
> Diff: https://reviews.apache.org/r/45859/diff/
>
>
> Testing
> -------
>
> Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Thanks,
>
> Li Li
>
>
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Anne Yu <an...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/#review151825
-----------------------------------------------------------
Fix it, then Ship it!
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java (line 18)
<https://reviews.apache.org/r/45859/#comment220366>
Just a minor issue. I've seen across codes, license is on usually the top then package definition and imports followed afterwards.
https://github.com/apache/hive/blob/master/common/src/java/org/apache/hadoop/hive/common/FileUtils.java
- Anne Yu
On Oct. 7, 2016, 12:38 a.m., Li Li wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45859/
> -----------------------------------------------------------
>
> (Updated Oct. 7, 2016, 12:38 a.m.)
>
>
> Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Diffs
> -----
>
> sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
>
> Diff: https://reviews.apache.org/r/45859/diff/
>
>
> Testing
> -------
>
> Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Thanks,
>
> Li Li
>
>
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Li Li <li...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/
-----------------------------------------------------------
(Updated Oct. 7, 2016, 12:38 a.m.)
Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
Repository: sentry
Description
-------
Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Diffs (updated)
-----
sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
Diff: https://reviews.apache.org/r/45859/diff/
Testing
-------
Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Thanks,
Li Li
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Li Li <li...@cloudera.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/
-----------------------------------------------------------
(Updated Oct. 7, 2016, 12:26 a.m.)
Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
Repository: sentry
Description
-------
Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Diffs (updated)
-----
sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
Diff: https://reviews.apache.org/r/45859/diff/
Testing
-------
Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
Thanks,
Li Li
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Li Li <li...@cloudera.com>.
> On Oct. 6, 2016, 12:05 a.m., Alexander Kolbasov wrote:
> > sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java, line 39
> > <https://reviews.apache.org/r/45859/diff/4/?file=1522419#file1522419line39>
> >
> > Please add some comment explaining where did this teplate come from. Did you invent it? Did you copy it from somewhere?
sure. I copied the way used in com.codahale.metrics.servlets.AdminServlet, and the contents is different since we are using the twitter bootstrap kit. Also here we only use the TEMPLATE as a static html with some links referenced to other debug pages.
> On Oct. 6, 2016, 12:05 a.m., Alexander Kolbasov wrote:
> > sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java, line 92
> > <https://reviews.apache.org/r/45859/diff/4/?file=1522419#file1522419line92>
> >
> > Do you need to add
> >
> > Pragma: no-cache
> > Expires: 0
> >
> > as well to disable caching? Different clients usig differet mechanisms.
since it is only used for admin to debug / test, I assume there are not many clients using it.
Also do we really want it is cached, since it contains very sensitive info?
- Li
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/#review151591
-----------------------------------------------------------
On Oct. 4, 2016, 10:23 p.m., Li Li wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45859/
> -----------------------------------------------------------
>
> (Updated Oct. 4, 2016, 10:23 p.m.)
>
>
> Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Diffs
> -----
>
> sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
>
> Diff: https://reviews.apache.org/r/45859/diff/
>
>
> Testing
> -------
>
> Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Thanks,
>
> Li Li
>
>
Re: Review Request 45859: SENTRY-1120: Show role / privileges info in
Sentry Service Webpage
Posted by Alexander Kolbasov <ak...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/45859/#review151591
-----------------------------------------------------------
Fix it, then Ship it!
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java (line 39)
<https://reviews.apache.org/r/45859/#comment220015>
Please add some comment explaining where did this teplate come from. Did you invent it? Did you copy it from somewhere?
sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java (line 92)
<https://reviews.apache.org/r/45859/#comment220024>
Do you need to add
Pragma: no-cache
Expires: 0
as well to disable caching? Different clients usig differet mechanisms.
- Alexander Kolbasov
On Oct. 4, 2016, 10:23 p.m., Li Li wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/45859/
> -----------------------------------------------------------
>
> (Updated Oct. 4, 2016, 10:23 p.m.)
>
>
> Review request for sentry, Alexander Kolbasov, Anne Yu, Hao Hao, Lenni Kuff, and Sravya Tirukkovalur.
>
>
> Repository: sentry
>
>
> Description
> -------
>
> Show role / privileges info in Sentry Service Webpage. Since it is only used for debug / test currently, this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Diffs
> -----
>
> sentry-service/sentry-service-common/src/main/java/org/apache/sentry/service/thrift/ServiceConstants.java 5ec364c460e74d0a9dae8a28c20042360157b8a0
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryAdminServlet.java PRE-CREATION
> sentry-service/sentry-service-server/src/main/java/org/apache/sentry/provider/db/service/thrift/SentryWebServer.java a42f395270996da345ce49edca909e0438383759
>
> Diff: https://reviews.apache.org/r/45859/diff/
>
>
> Testing
> -------
>
> Already tested in kerberos cluster. When sentry.service.web.authentication.type is set to KERBEROS, only the SENTRY_WEB_SECURITY_ALLOW_CONNECT_USERS can see this page. Also this webpage can be seen only when SENTRY_WEB_ADMIN_SERVLET_ENABLED is true.
>
>
> Thanks,
>
> Li Li
>
>