You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Austin Nobis (Code Review)" <ge...@cloudera.org> on 2019/03/16 00:12:17 UTC
[Impala-ASF-CR] IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
Austin Nobis has uploaded this change for review. ( http://gerrit.cloudera.org:8080/12769
Change subject: IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted. This is still the case for ROLE based
authorization to preserve backward compatibility, but Ranger will throw an
exception when a GRANT/REVOKE statement excludes the USER keyword.
Testing:
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
11 files changed, 368 insertions(+), 130 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/1
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 1
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 10:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2564/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 10
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 17:26:01 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 11: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 11
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 17:25:21 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 1:
(21 comments)
I understand that we don't have most of the features implemented to easily write full E2E tests, but I feel like we should at least add a simple E2E test.
http://gerrit.cloudera.org:8080/#/c/12769/1//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/12769/1//COMMIT_MSG@7
PS1, Line 7:
nit: extra space
http://gerrit.cloudera.org:8080/#/c/12769/1//COMMIT_MSG@7
PS1, Line 7: r
nit: Ranger
http://gerrit.cloudera.org:8080/#/c/12769/1//COMMIT_MSG@17
PS1, Line 17: exception when a GRANT/REVOKE statement excludes the USER keyword.
Put the new syntax here. Also mention that the Sentry implementation doesn't support grant/revoke to/from user
http://gerrit.cloudera.org:8080/#/c/12769/1//COMMIT_MSG@19
PS1, Line 19: Testing:
Mention that the full E2E tests will be implemented in later patches once we get other pieces implemented.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/cup/sql-parser.cup
File fe/src/main/cup/sql-parser.cup:
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/cup/sql-parser.cup@999
PS1, Line 999: | KW_GRANT privilege_spec:priv KW_TO ident_or_default:role
: opt_with_grantopt:grant_opt
: {: RESULT = new GrantRevokePrivStmt(role, priv, true, grant_opt, TPrincipalType.ROLE); :
move this to L993 and mention that for backward compatibility, a grant without the principal type will be defaulted to ROLE
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/cup/sql-parser.cup@1014
PS1, Line 1014: | KW_REVOKE opt_grantopt_for:grant_opt privilege_spec:priv KW_FROM
: ident_or_default:role
: {: RESULT = new GrantRevokePrivStmt(role, priv, false, grant_opt, TPrincipalType.ROLE);
same here
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
File fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java:
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java@47
PS1, Line 47: private Role role_;
we should add a TODO to clean up this stuff since if Ranger supports RBAC, it will most likely not going to use the Role catalog
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java@66
PS1, Line 66: nt id = (principalType_ == TPrincipalType.ROLE) ? role_.getId() : -1;
can be inlined into L68 and also explain about the the -1 value.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java@84
PS1, Line 84: sb.append(principalName_);
need to update the toSql with the principal type. Make sure to update the ToSqlTest as well.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java@101
PS1, Line 101:
: if (principalType_ == TPrincipalType.ROLE) {
: role_ = analyzer.getCatalog().getAuthPolicy().getRole(principalName_);
: if (role_ == null) {
: throw new AnalysisException(String.format("Role '%s' does not exist.",
: principalName_));
: }
: }
We should move this check into the SentryAuthorizationManager. It's fine not to do this in this patch, but we need to make a note of it.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java
File fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java:
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@20
PS1, Line 20: public class RangerAuthorizationManager implements AuthorizationManager {
Add some comment.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@27
PS1, Line 27: auditHandler_ = new RangerDefaultAuditHandler();
: plugin_ = new RangerImpalaPlugin(rangerConfig.getServiceType(),
: rangerConfig.getAppId());
: plugin_.init();
We shouldn't be creating a new plugin. Update the constructor to take AuthorizationChecker.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@54
PS1, Line 54: return null;
this should be UnsupportedOperationException
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@97
PS1, Line 97: throw new RuntimeException(e);
Don't throw RuntimeException, throw InternalException instead. There's some logic that check the type of the exception.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@113
PS1, Line 113: throw new RuntimeException(e);
Same here.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@119
PS1, Line 119: return null;
throw UnsupportedOperationException
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@184
PS1, Line 184: if (level == TPrivilegeLevel.OWNER) {
: request.getAccessTypes().add(TPrivilegeLevel.ALL.name().toLowerCase());
: } else {
: request.getAccessTypes().add(level.name().toLowerCase());
: }
i don't think we want to put that here for now. OWNER privilege is really something that's just internally used but not exposed. We should revisit this again once we start working on the object ownership.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@209
PS1, Line 209: if (uri != null && uri.startsWith("/")) {
: uri = "hdfs://localhost:20500" + uri;
: }
This is only correct for unit testing.
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
File fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java:
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@3266
PS1, Line 3266: in DDL request
nit: we don't need this
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@3292
PS1, Line 3292: in DDL request
same here
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
File fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java:
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java@41
PS1, Line 41: import org.apache.impala.authorization.ranger.*;
nit: don't use wildcard import
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 1
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Sat, 16 Mar 2019 00:26:54 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 6:
(4 comments)
Mostly nits. LGTM.
http://gerrit.cloudera.org:8080/#/c/12769/6/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
File fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java:
http://gerrit.cloudera.org:8080/#/c/12769/6/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java@84
PS6, Line 84:
nit: remove extra new line
http://gerrit.cloudera.org:8080/#/c/12769/6/fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
File fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java:
http://gerrit.cloudera.org:8080/#/c/12769/6/fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java@1495
PS6, Line 1495: principal_types
nit: use camelCase
http://gerrit.cloudera.org:8080/#/c/12769/6/tests/authorization/test_ranger.py
File tests/authorization/test_ranger.py:
http://gerrit.cloudera.org:8080/#/c/12769/6/tests/authorization/test_ranger.py@44
PS6, Line 44: anobis_client
nit: non_admin_client?
http://gerrit.cloudera.org:8080/#/c/12769/6/tests/authorization/test_ranger.py@53
PS6, Line 53: user="admin")
nit: move to L52
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 6
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 26 Mar 2019 23:15:41 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 8:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/12769/8/tests/authorization/test_ranger.py
File tests/authorization/test_ranger.py:
http://gerrit.cloudera.org:8080/#/c/12769/8/tests/authorization/test_ranger.py@45
PS8, Line 45:
: admin_client.execute("grant select on database functional to user {0}".format(user),
: user="admin")
: # TODO: IMPALA-8293 use refresh authorization
: time.sleep(30)
: user_client.execute("show tables in functional", user=user)
: admin_client.execute("revoke select on database functional from user {0}"
: .format(user), user="admin")
can you use execute_query_expect_success here?
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 8
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 16:35:54 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 11:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/3961/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 11
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 17:25:22 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 4:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/12769/4/tests/authorization/test_grant_revoke.py
File tests/authorization/test_grant_revoke.py:
http://gerrit.cloudera.org:8080/#/c/12769/4/tests/authorization/test_grant_revoke.py@369
PS4, Line 369: @
flake8: F811 redefinition of unused 'test_grant_revoke' from line 88
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 4
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 26 Mar 2019 18:20:59 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has uploaded a new patch set (#10). ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted, i.e:
GRANT <privilege> ON <resource> TO <role>
This is still the case for ROLE based authorization to preserve backward
compatibility, but Ranger will throw an exception when a GRANT/REVOKE
statement excludes the USER keyword. The syntax for the new statement is:
GRANT <privilege> ON <resource> TO USER <user>
REVOKE <privilege> ON <resource> FROM USER <user>
Sentry does not support grant/revoke to/from user.
Testing:
- An additional end to end test, test_ranger.py, was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly with
Ranger.
- AuthorizationStmtTest has been refactored to use the new
RangerCatalogdAuthorizationManager grant/revoke methods for better
test coverage.
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A tests/authorization/test_ranger.py
13 files changed, 605 insertions(+), 224 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/10
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 10
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 10: Code-Review+2
Thanks for all the fixes.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 10
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 17:25:04 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 4:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2545/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 4
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 26 Mar 2019 19:08:14 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 11: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 11
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 21:57:02 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has uploaded a new patch set (#3). ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted. This is still the case for ROLE based
authorization to preserve backward compatibility, but Ranger will throw an
exception when a GRANT/REVOKE statement excludes the USER keyword.
An additional end to end test test_ranger.py was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly.
Testing:
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A fe/src/test/resources/xasecure-audit.xml
M tests/authorization/test_grant_revoke.py
A tests/authorization/test_ranger.py
15 files changed, 860 insertions(+), 227 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/3
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 3
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has uploaded a new patch set (#7). ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted, i.e:
GRANT <privilege> ON <resource> TO <role>
This is still the case for ROLE based authorization to preserve backward
compatibility, but Ranger will throw an exception when a GRANT/REVOKE
statement excludes the USER keyword. The syntax for the new statement is:
GRANT <privilege> ON <resource> TO USER <user>
REVOKE <privilege> ON <resource> FROM USER <user>
Sentry does not support grant/revoke to/from user.
Testing:
- An additional end to end test, test_ranger.py, was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly with
Ranger.
- AuthorizationStmtTest has been refactored to use the new
RangerCatalogdAuthorizationManager grant/revoke methods for better
test coverage.
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A tests/authorization/test_ranger.py
13 files changed, 598 insertions(+), 224 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/7
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 7
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 3:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/12769/3/tests/authorization/test_grant_revoke.py
File tests/authorization/test_grant_revoke.py:
http://gerrit.cloudera.org:8080/#/c/12769/3/tests/authorization/test_grant_revoke.py@369
PS3, Line 369: @
flake8: F811 redefinition of unused 'test_grant_revoke' from line 88
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 3
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 26 Mar 2019 18:20:19 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted, i.e:
GRANT <privilege> ON <resource> TO <role>
This is still the case for ROLE based authorization to preserve backward
compatibility, but Ranger will throw an exception when a GRANT/REVOKE
statement excludes the USER keyword. The syntax for the new statement is:
GRANT <privilege> ON <resource> TO USER <user>
REVOKE <privilege> ON <resource> FROM USER <user>
Sentry does not support grant/revoke to/from user.
Testing:
- An additional end to end test, test_ranger.py, was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly with
Ranger.
- AuthorizationStmtTest has been refactored to use the new
RangerCatalogdAuthorizationManager grant/revoke methods for better
test coverage.
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Reviewed-on: http://gerrit.cloudera.org:8080/12769
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A tests/authorization/test_ranger.py
13 files changed, 605 insertions(+), 224 deletions(-)
Approvals:
Impala Public Jenkins: Looks good to me, approved; Verified
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 12
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 9:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2562/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 9
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 17:16:42 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 1:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/2450/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 1
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Sat, 16 Mar 2019 00:47:08 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has uploaded a new patch set (#9). ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted, i.e:
GRANT <privilege> ON <resource> TO <role>
This is still the case for ROLE based authorization to preserve backward
compatibility, but Ranger will throw an exception when a GRANT/REVOKE
statement excludes the USER keyword. The syntax for the new statement is:
GRANT <privilege> ON <resource> TO USER <user>
REVOKE <privilege> ON <resource> FROM USER <user>
Sentry does not support grant/revoke to/from user.
Testing:
- An additional end to end test, test_ranger.py, was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly with
Ranger.
- AuthorizationStmtTest has been refactored to use the new
RangerCatalogdAuthorizationManager grant/revoke methods for better
test coverage.
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A tests/authorization/test_ranger.py
13 files changed, 598 insertions(+), 224 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/9
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 9
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 7:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/12769/7/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
File fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java:
http://gerrit.cloudera.org:8080/#/c/12769/7/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java@3005
PS7, Line 3005: RangerCatalogdAuthorizationManager.createGrantRevokeRequests(RANGER_ADMIN.getName(),
line too long (96 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 7
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 16:25:34 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has uploaded a new patch set (#4). ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted. This is still the case for ROLE based
authorization to preserve backward compatibility, but Ranger will throw an
exception when a GRANT/REVOKE statement excludes the USER keyword. The
syntax for the new statement is:
GRANT <privilege> ON <resource> TO USER <user>
REVOKE <privilege> ON <resource> FROM USER <user>
Sentry does not support grant/revoke to/from user.
Testing:
An additional end to end test, test_ranger.py, was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly.
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A fe/src/test/resources/xasecure-audit.xml
M tests/authorization/test_grant_revoke.py
A tests/authorization/test_ranger.py
15 files changed, 860 insertions(+), 227 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/4
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 4
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has uploaded a new patch set (#5). ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted. This is still the case for ROLE based
authorization to preserve backward compatibility, but Ranger will throw an
exception when a GRANT/REVOKE statement excludes the USER keyword. The
syntax for the new statement is:
GRANT <privilege> ON <resource> TO USER <user>
REVOKE <privilege> ON <resource> FROM USER <user>
Sentry does not support grant/revoke to/from user.
Testing:
An additional end to end test, test_ranger.py, was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly.
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A fe/src/test/resources/xasecure-audit.xml
A tests/authorization/test_ranger.py
14 files changed, 856 insertions(+), 227 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/5
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 5
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 5:
(18 comments)
http://gerrit.cloudera.org:8080/#/c/12769/4//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/12769/4//COMMIT_MSG@14
PS4, Line 14: ROLE via GRANT/REVOKE statements even
: when the ROLE keyword was omitted.
some example would be good
http://gerrit.cloudera.org:8080/#/c/12769/4//COMMIT_MSG@30
PS4, Line 30: works properly
nit: works properly with Ranger?
http://gerrit.cloudera.org:8080/#/c/12769/5//COMMIT_MSG
Commit Message:
http://gerrit.cloudera.org:8080/#/c/12769/5//COMMIT_MSG@26
PS5, Line 26: An additional end to end test, test_ranger.py, was added. A single test
: was added that grants and revokes for a user and asserts permissions on
: a table. The test uses sleep statements to work with Ranger's polling
: interval for policy changes. More end to end tests will be added in the
: future when the refresh authorization statement works properly.
nit: use a bullet point to be consistent with the other two bullet points
http://gerrit.cloudera.org:8080/#/c/12769/5//COMMIT_MSG@26
PS5, Line 26: An additional end to end test, test_ranger.py, was added. A single test
: was added that grants and revokes for a user and asserts permissions on
: a table. The test uses sleep statements to work with Ranger's polling
: interval for policy changes. More end to end tests will be added in the
: future when the refresh authorization statement works properly.
:
mention that AuthorizationStmtTest has been refactored to use the grant/revoke methods from the AuthorizationManager to provide greater code coverage.
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
File fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java:
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java@127
PS4, Line 127: @Override
: public void grantPrivilegeToUser(User requestingUser, TGrantRevokePrivParams params,
: TDdlExecResponse response) throws ImpalaException {
: }
:
: @Override
: public void revokePrivilegeFromUser(User requestingUser,
: TGrantRevokePrivParams params, TDdlExecResponse response) throws ImpalaException {
: }
throw UnsupportedOperationException
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java
File fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java:
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@50
PS4, Line 50: RangerAuthorizationManager
I believe this is meant for Catalogd. We should rename this to RangerCatalogdAuthorizationManager.
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@53
PS4, Line 53:
: public RangerAuthorizationManager(
: Supplier<? extends AuthorizationChecker> authzChecker) {
: Preconditions.checkNotNull(authzChecker);
: Preconditions.checkArgument(authzChecker.get() instanceof RangerAuthorizationChecker);
: auditHandler_ = new RangerDefaultAuditHandler();
: plugin_ = () -> ((RangerAuthorizationChecker) authzChecker.get())
: .getRangerImpalaPlugin();
: }
:
: public RangerAuthorizationManager(RangerImpalaPlugin plugin) {
: auditHandler_ = new RangerDefaultAuditHandler();
: plugin_ = () -> plugin;
: }
I think we can just have one constructor.
public RangerAuthorizationManager(Supplier<RangerImpalaPlugin> plugin)
http://gerrit.cloudera.org:8080/#/c/12769/5/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java
File fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java:
http://gerrit.cloudera.org:8080/#/c/12769/5/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@43
PS5, Line 43: An implementation of {@link AuthorizationManager} using Ranger.
update the comment that saying that it's used by catalogd
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
File fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java:
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@3266
PS4, Line 3266:
nit: add :
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@3294
PS4, Line 3294:
same as above
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
File fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java:
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java@42
PS4, Line 42: import org.apache.impala.authorization.ranger.*;
no wildcard import
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
File fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java:
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java@1495
PS4, Line 1495: identities
nit: principal type is a better name
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java@1670
PS4, Line 1670:
: @Test
: public void testGrantRevoke() {
: String defaultDb = System.getProperty("user.name");
: AnalysisContext context = createAnalysisCtx(createAuthorizationFactory());
: testToSql(context, "CREATE ROLE testrole");
: testToSql(context, "GRANT ALL ON SERVER server1 TO USER anobis");
: testToSql(context, "GRANT ALL ON SERVER server1 TO ROLE testrole");
: testToSql(context, "GRANT ALL ON SERVER server1 TO testrole",
: "GRANT ALL ON SERVER server1 TO ROLE testrole");
: }
what's the difference between this test and testGrantRevokePrivStmt?
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/test/resources/xasecure-audit.xml
File fe/src/test/resources/xasecure-audit.xml:
http://gerrit.cloudera.org:8080/#/c/12769/4/fe/src/test/resources/xasecure-audit.xml@1
PS4, Line 1: <?xml version="1.0"?>
do we need this file? I believe we already have hive-ranger-audit.xml.
http://gerrit.cloudera.org:8080/#/c/12769/4/tests/authorization/test_grant_revoke.py
File tests/authorization/test_grant_revoke.py:
http://gerrit.cloudera.org:8080/#/c/12769/4/tests/authorization/test_grant_revoke.py@369
PS4, Line 369:
> Done
What is this?
http://gerrit.cloudera.org:8080/#/c/12769/4/tests/authorization/test_ranger.py
File tests/authorization/test_ranger.py:
http://gerrit.cloudera.org:8080/#/c/12769/4/tests/authorization/test_ranger.py@26
PS4, Line 26: class TestRanger(CustomClusterTestSuite):
add pydoc class comment.
http://gerrit.cloudera.org:8080/#/c/12769/4/tests/authorization/test_ranger.py@45
PS4, Line 45: anobis
you need to use getuser() since the user created will vary.
http://gerrit.cloudera.org:8080/#/c/12769/4/tests/authorization/test_ranger.py@43
PS4, Line 43: # TODO: Use refresh authorization
: time.sleep(30)
: anobis_client.execute("show tables in functional", user="anobis")
: admin_client.execute("revoke select on database functional from user anobis",
: user="admin")
: # TODO: Use refresh authorization
add the ticket number IMPALA-8293 for the TODO
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 5
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 26 Mar 2019 18:42:44 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 7:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2560/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 7
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 17:09:18 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 3:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2544/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 3
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 26 Mar 2019 19:03:40 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has uploaded a new patch set (#8). ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted, i.e:
GRANT <privilege> ON <resource> TO <role>
This is still the case for ROLE based authorization to preserve backward
compatibility, but Ranger will throw an exception when a GRANT/REVOKE
statement excludes the USER keyword. The syntax for the new statement is:
GRANT <privilege> ON <resource> TO USER <user>
REVOKE <privilege> ON <resource> FROM USER <user>
Sentry does not support grant/revoke to/from user.
Testing:
- An additional end to end test, test_ranger.py, was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly with
Ranger.
- AuthorizationStmtTest has been refactored to use the new
RangerCatalogdAuthorizationManager grant/revoke methods for better
test coverage.
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A tests/authorization/test_ranger.py
13 files changed, 598 insertions(+), 224 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/8
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 8
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 5:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2547/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 5
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 26 Mar 2019 19:04:39 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 6:
Build Failed
https://jenkins.impala.io/job/gerrit-code-review-checks/2555/ : Initial code review checks failed. See linked job for details on the failure.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 6
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 26 Mar 2019 23:36:36 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 8:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2561/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 8
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Wed, 27 Mar 2019 17:12:55 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add ranger support for grant/revoke privilege to/from user
......................................................................
Patch Set 1:
(7 comments)
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
File fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java:
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java@134
PS1, Line 134: public void revokePrivilegeFromUser(User requestingUser, TGrantRevokePrivParams params,
line too long (91 > 90)
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java
File fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java:
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@118
PS1, Line 118: public TResultSet getPrivileges(TShowGrantPrincipalParams params) throws ImpalaException {
line too long (92 > 90)
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@196
PS1, Line 196: resource.put(RangerImpalaResourceBuilder.SERVER, getOrAll(privilege.getServer_name()));
line too long (91 > 90)
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@199
PS1, Line 199: resource.put(RangerImpalaResourceBuilder.COLUMN, getOrAll(privilege.getColumn_name()));
line too long (91 > 90)
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationManager.java@220
PS1, Line 220: resource.put(RangerImpalaResourceBuilder.SERVER, getOrAll(privilege.getServer_name()));
line too long (91 > 90)
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
File fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java:
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@3286
PS1, Line 3286: authzManager_.revokePrivilegeFromRole(requestingUser, grantRevokePrivParams, resp);
line too long (91 > 90)
http://gerrit.cloudera.org:8080/#/c/12769/1/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java@3289
PS1, Line 3289: authzManager_.revokePrivilegeFromUser(requestingUser, grantRevokePrivParams, resp);
line too long (91 > 90)
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 1
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Sat, 16 Mar 2019 00:13:14 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has uploaded a new patch set (#6). ( http://gerrit.cloudera.org:8080/12769 )
Change subject: IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
......................................................................
IMPALA-8225: Add Ranger support for grant/revoke privilege to/from user
This patch adds support for GRANT privilege statements to USER and
REVOKE privilege statements from USER. The RangerAuthorizationManager
class has been created and will throw UnsupportedOperationException when
an unimplemented method is called. The grammar has been updated to
support FROM USER and TO USER for GRANT/REVOKE statements. Previously,
privileges could be granted to a ROLE via GRANT/REVOKE statements even
when the ROLE keyword was omitted, i.e:
GRANT <privilege> ON <resource> TO <role>
This is still the case for ROLE based authorization to preserve backward
compatibility, but Ranger will throw an exception when a GRANT/REVOKE
statement excludes the USER keyword. The syntax for the new statement is:
GRANT <privilege> ON <resource> TO USER <user>
REVOKE <privilege> ON <resource> FROM USER <user>
Sentry does not support grant/revoke to/from user.
Testing:
- An additional end to end test, test_ranger.py, was added. A single test
was added that grants and revokes for a user and asserts permissions on
a table. The test uses sleep statements to work with Ranger's polling
interval for policy changes. More end to end tests will be added in the
future when the refresh authorization statement works properly with
Ranger.
- AuthorizationStmtTest has been refactored to use the new
RangerCatalogdAuthorizationManager grant/revoke methods for better
test coverage.
- Ran all FE tests
- Ran all E2E authorization tests
Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
---
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/GrantRevokePrivStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerAuthorizationFactory.java
A fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/test/java/org/apache/impala/analysis/AuthorizationStmtTest.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
A tests/authorization/test_ranger.py
13 files changed, 599 insertions(+), 223 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/69/12769/6
--
To view, visit http://gerrit.cloudera.org:8080/12769
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I6ee97bf41546d63385026c0e2b19545565402462
Gerrit-Change-Number: 12769
Gerrit-PatchSet: 6
Gerrit-Owner: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>