You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Fredy Wijaya (Code Review)" <ge...@cloudera.org> on 2018/07/25 04:26:36 UTC

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions 

Fredy Wijaya has uploaded this change for review. ( http://gerrit.cloudera.org:8080/11039


Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in prepartion to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
20 files changed, 886 insertions(+), 553 deletions(-)



  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/7
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 7
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 26:

Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/3012/ DRY_RUN=false


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 26
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 18:45:48 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 20:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/335/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 20
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 02:18:30 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 13:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/65/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 13
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 21:30:58 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 15:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/15/fe/src/main/java/org/apache/impala/util/SentryProxy.java
File fe/src/main/java/org/apache/impala/util/SentryProxy.java:

http://gerrit.cloudera.org:8080/#/c/11039/15/fe/src/main/java/org/apache/impala/util/SentryProxy.java@334
PS15, Line 334:         PrincipalPrivilege existingPriv = catalog_.getPrincipalPrivilege(roleName, privilege);
line too long (94 > 90)



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 15
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Sun, 05 Aug 2018 04:30:21 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 14:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/192/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 14
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Sun, 05 Aug 2018 04:58:26 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 20:

(2 comments)

http://gerrit.cloudera.org:8080/#/c/11039/20/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/20/common/thrift/CatalogObjects.thrift@481
PS20, Line 481: // https://github.com/apache/sentry/blob/3d062f39ce6a047138660a7b3d0024bde916c5b4/sentry-service/sentry-service-api/src/gen/thrift/gen-javabean/org/apache/sentry/api/service/thrift/TSentryPrincipalType.java
line too long (206 > 90)


http://gerrit.cloudera.org:8080/#/c/11039/20/fe/src/main/java/org/apache/impala/catalog/Principal.java
File fe/src/main/java/org/apache/impala/catalog/Principal.java:

http://gerrit.cloudera.org:8080/#/c/11039/20/fe/src/main/java/org/apache/impala/catalog/Principal.java@44
PS20, Line 44:   protected Principal(String principalName, TPrincipalType type, Set<String> grantGroups) {
line too long (91 > 90)



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 20
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 01:58:18 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 18:

(11 comments)

I have to rebase because of merge conflicts.

http://gerrit.cloudera.org:8080/#/c/11039/16/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/16/common/thrift/CatalogObjects.thrift@480
PS16, Line 480: // Represents a principal type that maps to Sentry principal type.
> add a comment about what is a principal since its unclear what its used for
Done


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
File fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java@46
PS16, Line 46: prin
> rename to principal_
Yes, the intent is to extend this statement to users as well. Done.


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
File fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java@32
PS16, Line 32: ROLE
> this will always apply only to role, not user, if I understand it correctly
There's a separate JIRA for SHOW GRANT USER: https://issues.apache.org/jira/browse/IMPALA-6989. I have CR for that JIRA that I haven't published yet pending this CR.


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Catalog.java
File fe/src/main/java/org/apache/impala/catalog/Catalog.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Catalog.java@517
PS16, Line 517: .
> use String.format
Done


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
File fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java@473
PS16, Line 473: thriftPrincipal.getPrincipal_name(), thriftPrincipal.getPrincipal_type()
> why not simplify and make the arg here just thriftPrincipal?
The problem is there's an overloaded version of AuthorizationPolicy.getPrincipal(int principalId, TPrincipalType type). Interestingly, TPrincipal has two fields principal_name and principal_id. TPrivilege also has a property that contains principal_id. Creating AuthorizationPolicy.getPrincipal(TPrincipal) when we always use the principal_name can be somewhat confusing.


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java@477
PS16, Line 477: thriftPrincipal.getPrincipal_name(),
              :           thriftPrincipal.getPrincipal_type()
> same question here.
Same explanation as above.


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java
File fe/src/main/java/org/apache/impala/catalog/Principal.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@66
PS16, Line 66: is retu
> nit: is
Done


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@84
PS16, Line 84: privilegeName
> is there any assumption about case with the name?
The case shouldn't matter. We just take what Sentry returns.


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@128
PS16, Line 128: to t
> nit: to this
Done


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@129
PS16, Line 129: .
> nit: remove
Done


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@167
PS16, Line 167: Role
> why does the case differ from the all-caps on L150?
This is mostly used for printing an error message. By making "Role" or "User". It's easy to make it all upper case or all lower case by calling .toUpperCase() and toLowerCase() respectively.



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 18
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 03:43:06 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 25:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/25/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/25/common/thrift/CatalogObjects.thrift@481
PS25, Line 481: // https://github.com/apache/sentry/blob/3d062f39ce6a047138660a7b3d0024bde916c5b4/sentry-service/sentry-service-api/src/gen/thrift/gen-javabean/org/apache/sentry/api/service/thrift/TSentryPrincipalType.java
line too long (206 > 90)



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 25
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 18:02:44 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 19:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/328/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 19
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 20:19:20 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 10:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/53/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 10
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 16:57:19 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 20:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
File fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java:

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@239
PS18, Line 239: 
> Both of those examples can be dealt with using type-specific apis, e.g., ge
I updated the code. Let me know what you think.



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 20
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 01:56:49 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#24). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in preparation to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal that can be either
Role or User. The authorization tests are updated to run the tests with
user and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
M fe/src/main/java/org/apache/impala/catalog/Role.java
A fe/src/main/java/org/apache/impala/catalog/User.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 1,010 insertions(+), 479 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/24
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 24
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 16:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/194/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 16
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Sun, 05 Aug 2018 05:08:43 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 7:

Build Started https://jenkins.impala.io/job/gerrit-code-review-checks/51/ 

Running initial code review checks. This is experimental - please report any issues to tarmstrong@cloudera.com or on this JIRA: IMPALA-7317


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 7
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 04:26:45 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Vuk Ercegovac (Code Review)" <ge...@cloudera.org>.
Vuk Ercegovac has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 24: Code-Review+2

thx for the changes.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 24
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 17:54:34 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Adam Holley (Code Review)" <ge...@cloudera.org>.
Adam Holley has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 10: Code-Review+1


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 10
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 16:39:30 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 16: Code-Review+1

(1 comment)

Fixed formatting and carry Adam's +1.

http://gerrit.cloudera.org:8080/#/c/11039/15/fe/src/main/java/org/apache/impala/util/SentryProxy.java
File fe/src/main/java/org/apache/impala/util/SentryProxy.java:

http://gerrit.cloudera.org:8080/#/c/11039/15/fe/src/main/java/org/apache/impala/util/SentryProxy.java@334
PS15, Line 334:         PrincipalPrivilege existingPriv = catalog_.getPrincipalPrivilege(roleName,
> line too long (94 > 90)
Done



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 16
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Sun, 05 Aug 2018 04:34:24 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 25:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/351/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 25
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 18:35:10 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 24:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/24/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/24/common/thrift/CatalogObjects.thrift@481
PS24, Line 481: // https://github.com/apache/sentry/blob/3d062f39ce6a047138660a7b3d0024bde916c5b4/sentry-service/sentry-service-api/src/gen/thrift/gen-javabean/org/apache/sentry/api/service/thrift/TSentryPrincipalType.java
line too long (206 > 90)



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 24
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 17:26:25 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#15). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in prepartion to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 986 insertions(+), 554 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/15
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 15
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#20). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in preparation to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal that can be either
Role or User. The authorization tests are updated to run the tests with
user and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
M fe/src/main/java/org/apache/impala/catalog/Role.java
A fe/src/main/java/org/apache/impala/catalog/User.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
22 files changed, 1,043 insertions(+), 516 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/20
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 20
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#10). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in prepartion to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
20 files changed, 889 insertions(+), 553 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/10
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 10
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 8:

Build Started https://jenkins.impala.io/job/gerrit-code-review-checks/52/ 

Running initial code review checks. This is experimental - please report any issues to tarmstrong@cloudera.com or on this JIRA: IMPALA-7317


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 8
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 05:20:55 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Adam Holley (Code Review)" <ge...@cloudera.org>.
Adam Holley has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 8:

(5 comments)

http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
File fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java:

http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java@52
PS8, Line 52: params.getPrivilege().setPrincipal_id(role_.getId());
need setPrincipal_type()


http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
File fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java:

http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@48
PS8, Line 48: A role/user can have 0 or more privileges
I think we need to document that the difference between roles and users is the roles list will have all roles defined in Sentry.  The users list will only contain users that have privileges.  It will not represent all users in the system.


http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@227
PS8, Line 227: .
nit: "and type."


http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@252
PS8, Line 252:    * Removes a principal for a given principal type. Returns the removed principal or null
nit: "name and"


http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@253
PS8, Line 253:    * if no principal with this name existed.
nit: "and type"



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 8
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 15:59:34 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 10:

Build Started https://jenkins.impala.io/job/gerrit-code-review-checks/53/ 

Running initial code review checks. This is experimental - please report any issues to tarmstrong@cloudera.com or on this JIRA: IMPALA-7317


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 10
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 16:22:17 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#16). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in prepartion to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 987 insertions(+), 554 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/16
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 16
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#12). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in prepartion to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
20 files changed, 896 insertions(+), 553 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/12
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 12
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#19). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in preparation to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 976 insertions(+), 556 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/19
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 19
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 25:

> Patch Set 24:
> 
> Build Failed 
> 
> https://jenkins.impala.io/job/gerrit-code-review-checks/348/ : Initial code review checks failed. See linked job for details on the failure.

This needs a rebase due to a new script in bin/jenkins.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 25
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 18:02:38 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 26: Code-Review+2


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 26
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 18:45:47 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 12: Code-Review+1

Rebased and carry Adam's +1


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 12
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 16:54:25 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 14:

(4 comments)

http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java
File fe/src/main/java/org/apache/impala/util/SentryProxy.java:

http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java@257
PS14, Line 257:   public synchronized Principal dropRole(User user, String roleName) throws ImpalaException {
line too long (93 > 90)


http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java@269
PS14, Line 269:   public synchronized Principal grantRoleGroup(User user, String roleName, String groupName)
line too long (92 > 90)


http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java@282
PS14, Line 282:   public synchronized Principal revokeRoleGroup(User user, String roleName, String groupName)
line too long (93 > 90)


http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java@333
PS14, Line 333:         PrincipalPrivilege existingPriv = catalog_.getPrincipalPrivilege(roleName, privilege);
line too long (94 > 90)



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 14
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Sun, 05 Aug 2018 04:25:31 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 15:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/193/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 15
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Sun, 05 Aug 2018 04:58:52 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#13). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in prepartion to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 983 insertions(+), 553 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/13
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 13
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 12:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/54/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 12
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 17:20:57 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 19:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/19/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/19/common/thrift/CatalogObjects.thrift@481
PS19, Line 481: // https://github.com/apache/sentry/blob/3d062f39ce6a047138660a7b3d0024bde916c5b4/sentry-service/sentry-service-api/src/gen/thrift/gen-javabean/org/apache/sentry/api/service/thrift/TSentryPrincipalType.java
line too long (206 > 90)



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 19
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 19:45:55 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Vuk Ercegovac (Code Review)" <ge...@cloudera.org>.
Vuk Ercegovac has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 19:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
File fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java:

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@239
PS18, Line 239: 
> I thought about doing this initially but I hit a Java limitation of generic
Both of those examples can be dealt with using type-specific apis, e.g., getRoleCache/getUserCache and addRole/addUser. Similarly, the caches are already type specific.. no need to use Principal there. Might break something else, but I didn't try re-working this.



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 19
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 21:49:21 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 21:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/21/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/21/common/thrift/CatalogObjects.thrift@481
PS21, Line 481: // https://github.com/apache/sentry/blob/3d062f39ce6a047138660a7b3d0024bde916c5b4/sentry-service/sentry-service-api/src/gen/thrift/gen-javabean/org/apache/sentry/api/service/thrift/TSentryPrincipalType.java
line too long (206 > 90)



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 21
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 02:00:27 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Vuk Ercegovac (Code Review)" <ge...@cloudera.org>.
Vuk Ercegovac has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 21:

(9 comments)

looks like an improvement. I found several places where the super-type was used where the child would have sufficed. There may be other places as well. Will make another pass.

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
File fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java:

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java@93
PS21, Line 93: Role name in
these are roles now. if they will be extended to include user, pls add a todo.


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
File fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java:

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@208
PS21, Line 208:     Principal role = getPrincipal(roleName, TPrincipalType.ROLE);
can simplify to just:
return roleCache_.get(roleName);


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@234
PS21, Line 234: getPrincipal(
can't this just be:
return userCache_.get(userName);


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@299
PS21, Line 299:  
nit: extra ws


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
File fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java:

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@2973
PS21, Line 2973: Principal
Role


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@3015
PS21, Line 3015: Principal
Role


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/util/SentryProxy.java
File fe/src/main/java/org/apache/impala/util/SentryProxy.java:

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/util/SentryProxy.java@135
PS21, Line 135: Principal
Role


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/util/SentryProxy.java@137
PS21, Line 137: Principal
Role


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/util/SentryProxy.java@238
PS21, Line 238: Principal
Role; can be more specific now to match the method. Same with the cases below.



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 21
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 05:49:20 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 24:

(6 comments)

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
File fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java:

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java@93
PS21, Line 93: 
> these are roles now. if they will be extended to include user, pls add a to
Done


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
File fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java:

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@208
PS21, Line 208:     return roleCache_.get(roleName);
> can simplify to just:
Done


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@234
PS21, Line 234: 
> can't this just be:
Done


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@299
PS21, Line 299: s
> nit: extra ws
Done


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
File fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java:

http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@2973
PS21, Line 2973: Role role
> Role
Done


http://gerrit.cloudera.org:8080/#/c/11039/21/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@3015
PS21, Line 3015: Role role
> Role
Done



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 24
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 17:25:01 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 15: Code-Review+1

(3 comments)

Fixed formatting and carry Adam's +1.

http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java
File fe/src/main/java/org/apache/impala/util/SentryProxy.java:

http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java@257
PS14, Line 257:   public synchronized Principal dropRole(User user, String roleName)
> line too long (93 > 90)
Done


http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java@269
PS14, Line 269:    */
> line too long (92 > 90)
Done


http://gerrit.cloudera.org:8080/#/c/11039/14/fe/src/main/java/org/apache/impala/util/SentryProxy.java@282
PS14, Line 282:    */
> line too long (93 > 90)
Done



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 15
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Sun, 05 Aug 2018 04:29:59 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 18:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/18/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/18/common/thrift/CatalogObjects.thrift@481
PS18, Line 481: // https://github.com/apache/sentry/blob/3d062f39ce6a047138660a7b3d0024bde916c5b4/sentry-service/sentry-service-api/src/gen/thrift/gen-javabean/org/apache/sentry/api/service/thrift/TSentryPrincipalType.java
> line too long (206 > 90)
Will need to ignore this because it's a link.



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 18
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 03:45:09 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 25: Code-Review+2

Rebased and carry Vuk's +2.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 25
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 18:01:59 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#8). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in prepartion to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
20 files changed, 885 insertions(+), 553 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/8
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 8
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 24:

Build Failed 

https://jenkins.impala.io/job/gerrit-code-review-checks/348/ : Initial code review checks failed. See linked job for details on the failure.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 24
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 17:58:45 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 21:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/20/fe/src/main/java/org/apache/impala/catalog/Principal.java
File fe/src/main/java/org/apache/impala/catalog/Principal.java:

http://gerrit.cloudera.org:8080/#/c/11039/20/fe/src/main/java/org/apache/impala/catalog/Principal.java@44
PS20, Line 44:   protected Principal(String principalName, TPrincipalType type,
> line too long (91 > 90)
Done



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 21
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 01:59:38 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 10:

(5 comments)

http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
File fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java:

http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java@52
PS8, Line 52: params.setPrivilege(privilegeSpec_.toThrift().get(0))
> need setPrincipal_type()
Done


http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
File fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java:

http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@48
PS8, Line 48: The roleCache_ contains all roles defined
> I think we need to document that the difference between roles and users is 
Yeah good idea. Done.


http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@227
PS8, Line 227: 
> nit: "and type."
Done


http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@252
PS8, Line 252: 
> nit: "name and"
Done


http://gerrit.cloudera.org:8080/#/c/11039/8/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@253
PS8, Line 253:   /**
> nit: "and type"
Done



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 10
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 16:22:09 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Vuk Ercegovac (Code Review)" <ge...@cloudera.org>.
Vuk Ercegovac has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 16:

(11 comments)

initial comments. will get to the bigger ones next (AuthorizationPolicy, CatalogServiceCatalog, SentryProxy, tests)

http://gerrit.cloudera.org:8080/#/c/11039/16/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/16/common/thrift/CatalogObjects.thrift@480
PS16, Line 480: // Represents a principal type
add a comment about what is a principal since its unclear what its used for. might make sense for the comment to explain TPrincipal below. if this maps to some concept in Sentry, then perhaps it makes sense to add a link to docs there.


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
File fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java@46
PS16, Line 46: role
rename to principal_
the intent is to extend this stmt to users as well? if so, perhaps add a todo to change roleName_


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
File fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java@32
PS16, Line 32: ROLE
this will always apply only to role, not user, if I understand it correctly (otherwise, I'd expect a "show grant user ..."). would it make sense to assert that role_ is always of the ROLE flavor?


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Catalog.java
File fe/src/main/java/org/apache/impala/catalog/Catalog.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Catalog.java@517
PS16, Line 517: +
use String.format


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
File fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java@473
PS16, Line 473: thriftPrincipal.getPrincipal_name(), thriftPrincipal.getPrincipal_type()
why not simplify and make the arg here just thriftPrincipal?


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java@477
PS16, Line 477: thriftPrincipal.getPrincipal_name(),
              :           thriftPrincipal.getPrincipal_type()
same question here.


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java
File fe/src/main/java/org/apache/impala/catalog/Principal.java:

http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@66
PS16, Line 66: will be
nit: is


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@84
PS16, Line 84: privilegeName
is there any assumption about case with the name?


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@128
PS16, Line 128: this
nit: to this


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@129
PS16, Line 129:  the principal
nit: remove


http://gerrit.cloudera.org:8080/#/c/11039/16/fe/src/main/java/org/apache/impala/catalog/Principal.java@167
PS16, Line 167: Role
why does the case differ from the all-caps on L150?



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 16
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 02:06:46 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 18:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/11039/18/common/thrift/CatalogObjects.thrift
File common/thrift/CatalogObjects.thrift:

http://gerrit.cloudera.org:8080/#/c/11039/18/common/thrift/CatalogObjects.thrift@481
PS18, Line 481: // https://github.com/apache/sentry/blob/3d062f39ce6a047138660a7b3d0024bde916c5b4/sentry-service/sentry-service-api/src/gen/thrift/gen-javabean/org/apache/sentry/api/service/thrift/TSentryPrincipalType.java
line too long (206 > 90)



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 18
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 03:43:39 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#18). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in preparation to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 989 insertions(+), 556 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/18
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 18
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Adam Holley (Code Review)" <ge...@cloudera.org>.
Adam Holley has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 13: Code-Review+1


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 13
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 21:10:31 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Vuk Ercegovac (Code Review)" <ge...@cloudera.org>.
Vuk Ercegovac has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 18:

(6 comments)

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
File fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java:

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@49
PS18, Line 49: role/user
perhaps define this as a PrincipalType, then use it in the remaining places here?


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@59
PS18, Line 59: he principal ID to using the princi
couldn't parse this (nor could I before). perhaps replace 'using' with 'probe'?


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@68
PS18, Line 68: name
nit: names


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@239
PS18, Line 239: Principal
I can see that it makes sense to model the Thrift as an object that contains a type. Would it make more sense to model it in Java using separate classes so that we get basic type-checking? For example, the return type here is more specifically List<Role>. A Principal as super-class can still make sense when you have heterogeneous collections. Thoughts?


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
File fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java:

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java@449
PS18, Line 449: for (Principal user: getAllUsers()) {
              :       addPrincipalToCatalogDelta(user, ctx);
              :     }
why is this change here? I was expecting a change like this in the patch that addresses users.


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
File fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java:

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java@2326
PS18, Line 2326:       super(test);
pull these up to single line where applicable.



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 18
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 06:40:37 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in preparation to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal that can be either
Role or User. The authorization tests are updated to run the tests with
user and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Reviewed-on: http://gerrit.cloudera.org:8080/11039
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
M fe/src/main/java/org/apache/impala/catalog/Role.java
A fe/src/main/java/org/apache/impala/catalog/User.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 1,010 insertions(+), 479 deletions(-)

Approvals:
  Impala Public Jenkins: Looks good to me, approved; Verified

-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 27
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#14). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in prepartion to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal to store either role
or user. The authorization tests are updated to run the tests with user
and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
D fe/src/main/java/org/apache/impala/catalog/Role.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 983 insertions(+), 552 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/14
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 14
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 13:

Build Started https://jenkins.impala.io/job/gerrit-code-review-checks/65/ 

Running initial code review checks. This is experimental - please report any issues to tarmstrong@cloudera.com or on this JIRA: IMPALA-7317


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 13
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 21:07:14 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#21). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in preparation to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal that can be either
Role or User. The authorization tests are updated to run the tests with
user and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/CreateDropRoleStmt.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
M fe/src/main/java/org/apache/impala/catalog/Role.java
A fe/src/main/java/org/apache/impala/catalog/User.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
22 files changed, 1,044 insertions(+), 516 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/21
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 21
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 26: Verified+1


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 26
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 22:02:45 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 7:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/51/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 7
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 05:04:07 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 18:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/316/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 18
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 04:17:40 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 14: Code-Review+1

Rebased and carry +1


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 14
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Sun, 05 Aug 2018 04:24:52 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 19:

(6 comments)

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
File fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java:

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@49
PS18, Line 49: principal
> perhaps define this as a PrincipalType, then use it in the remaining places
Done


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@59
PS18, Line 59: et the principal ID to probe the pr
> couldn't parse this (nor could I before). perhaps replace 'using' with 'pro
Done


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@68
PS18, Line 68: 
> nit: names
Done


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java@239
PS18, Line 239: 
> I can see that it makes sense to model the Thrift as an object that contain
I thought about doing this initially but I hit a Java limitation of generics since Java generics is invariant. Here's my attempt.

class Principal { .. }
class Role extends Principal { .. }
class User extends Principal { .. }

private final CatalogObjectCache<Role> roleCache_ = new CatalogObjectCache<>();
private final CatalogObjectCache<User> userCache_ = new CatalogObjectCache<>();

// need to update the generic parameter to ? extends Principal
private CatalogObjectCache<? extends Principal> getPrincipalCache(TPrincipalType type) {
  return type == TPrincipalType.ROLE ? roleCache_  : userCache_;
}

public synchronized void addPrincipal(Principal principal) {
  CatalogObjectCache<? extends Principal> cache = getPrincipalCache(principal.getPrincipalType());
  cache.add(principal); // compilation error
  ....
}

Another possible option is to keep the caches to use Principal, but when we retrieve an element from the cache, we need to perform a cast. The worst thing for List<Role> getAllRoles or List<User> getAllUsers, we need to iterate every element in of List<Principal> and return an appropriate List<User> or List<Role> since we can't just cast List<Principal> to List<User> or List<Role> since Java's List is invariant.

I'm open for a better suggestion.


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
File fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java:

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java@449
PS18, Line 449: for (Principal user: getAllUsers()) {
              :       addPrincipalToCatalogDelta(user, ctx);
              :     }
> why is this change here? I was expecting a change like this in the patch th
It's a way so that we can test if the refactor works. The update in AuthorizationStmtTest requires this change. It is not something that we expose externally yet. We only use it internally.


http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
File fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java:

http://gerrit.cloudera.org:8080/#/c/11039/18/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java@2326
PS18, Line 2326:     public void create(TPrivilege[]... privileges) throws ImpalaException {
> pull these up to single line where applicable.
Done.



-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 19
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Tue, 14 Aug 2018 19:45:04 +0000
Gerrit-HasComments: Yes

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#25). ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................

IMPALA-7342: Add initial support for user-level permissions

This patch refactors the authorization code in preparation to add initial
support for for user-level permissions (IMPALA-6794) and object ownership
(IMPALA-7075). It introduces the notion of Principal that can be either
Role or User. The authorization tests are updated to run the tests with
user and role permissions.

Testing:
- Update authorization tests
- Ran core tests

Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
---
M be/src/catalog/catalog-util.cc
M common/thrift/CatalogObjects.thrift
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/analysis/PrivilegeSpec.java
M fe/src/main/java/org/apache/impala/analysis/ShowGrantRoleStmt.java
M fe/src/main/java/org/apache/impala/catalog/AuthorizationPolicy.java
M fe/src/main/java/org/apache/impala/catalog/Catalog.java
M fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
M fe/src/main/java/org/apache/impala/catalog/ImpaladCatalog.java
A fe/src/main/java/org/apache/impala/catalog/Principal.java
R fe/src/main/java/org/apache/impala/catalog/PrincipalPrivilege.java
M fe/src/main/java/org/apache/impala/catalog/Role.java
A fe/src/main/java/org/apache/impala/catalog/User.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/main/java/org/apache/impala/util/SentryPolicyService.java
M fe/src/main/java/org/apache/impala/util/SentryProxy.java
M fe/src/test/java/org/apache/impala/analysis/AnalyzeAuthStmtsTest.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/catalog/CatalogTest.java
M fe/src/test/java/org/apache/impala/testutil/ImpaladTestCatalog.java
21 files changed, 1,010 insertions(+), 479 deletions(-)


  git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/39/11039/25
-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 25
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 8:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/52/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 8
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 06:11:40 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 12:

Build Started https://jenkins.impala.io/job/gerrit-code-review-checks/54/ 

Running initial code review checks. This is experimental - please report any issues to tarmstrong@cloudera.com or on this JIRA: IMPALA-7317


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 12
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 25 Jul 2018 16:54:22 +0000
Gerrit-HasComments: No

[Impala-ASF-CR] IMPALA-7342: Add initial support for user-level permissions

Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/11039 )

Change subject: IMPALA-7342: Add initial support for user-level permissions
......................................................................


Patch Set 21:

Build Successful 

https://jenkins.impala.io/job/gerrit-code-review-checks/336/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.


-- 
To view, visit http://gerrit.cloudera.org:8080/11039
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I07e0d46d2e50d35bd64ee573b5aa4b779eb9e62f
Gerrit-Change-Number: 11039
Gerrit-PatchSet: 21
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Adam Holley <ah...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Reviewer: Vuk Ercegovac <ve...@cloudera.com>
Gerrit-Comment-Date: Wed, 15 Aug 2018 02:36:01 +0000
Gerrit-HasComments: No