You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@impala.apache.org by "Fredy Wijaya (Code Review)" <ge...@cloudera.org> on 2019/04/09 03:18:09 UTC
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Fredy Wijaya has uploaded this change for review. ( http://gerrit.cloudera.org:8080/12963
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
IMPALA-8385: Refactor Sentry admin user check
This patch moves the hardcoded Sentry admin user check from the generic
"show roles" and "show grant" catalog operations to Sentry authorization
plugin, i.e. SentryImpaladAuthorizationManager. This patch also removes
isAdmin() from AuthorizationManager interface.
Testing:
- Added a new authorization E2E test to test for Sentry admin check
- Ran all FE tests
- Ran all authorization E2E tests
Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
---
M be/src/catalog/catalog-server.cc
M be/src/catalog/catalog.cc
M be/src/catalog/catalog.h
M be/src/exec/catalog-op-executor.cc
M be/src/exec/catalog-op-executor.h
M be/src/service/client-request-state.cc
M be/src/service/fe-support.cc
M common/thrift/CatalogService.thrift
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/FeSupport.java
M fe/src/main/java/org/apache/impala/service/JniCatalog.java
A tests/authorization/test_sentry.py
16 files changed, 186 insertions(+), 76 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/63/12963/4
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 4
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#6). ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
IMPALA-8385: Refactor Sentry admin user check
This patch moves the hardcoded Sentry admin user check from the generic
"show roles" and "show grant" catalog operations to Sentry authorization
plugin, i.e. SentryImpaladAuthorizationManager. This patch also removes
isAdmin() from AuthorizationManager interface.
Testing:
- Added a new authorization E2E test to test for Sentry admin check
- Ran all FE tests
- Ran all authorization E2E tests
Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
---
M be/src/catalog/catalog-server.cc
M be/src/catalog/catalog.cc
M be/src/catalog/catalog.h
M be/src/exec/catalog-op-executor.cc
M be/src/exec/catalog-op-executor.h
M be/src/service/client-request-state.cc
M be/src/service/fe-support.cc
M common/thrift/CatalogService.thrift
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/FeSupport.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniCatalog.java
A tests/authorization/test_sentry.py
17 files changed, 197 insertions(+), 82 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/63/12963/6
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 6
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Austin Nobis (Code Review)" <ge...@cloudera.org>.
Austin Nobis has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 5:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/12963/5/tests/authorization/test_sentry.py
File tests/authorization/test_sentry.py:
http://gerrit.cloudera.org:8080/#/c/12963/5/tests/authorization/test_sentry.py@39
PS5, Line 39: non_admin = "foobar"
Consider using unique_name instead of "foobar"
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 5
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 15:36:19 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 6:
(1 comment)
http://gerrit.cloudera.org:8080/#/c/12963/5/tests/authorization/test_sentry.py
File tests/authorization/test_sentry.py:
http://gerrit.cloudera.org:8080/#/c/12963/5/tests/authorization/test_sentry.py@39
PS5, Line 39: non_admin = unique_name
> Consider using unique_name instead of "foobar"
Done
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 6
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 16:36:58 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 7: Code-Review+2
(2 comments)
Carry Bharath's +2.
http://gerrit.cloudera.org:8080/#/c/12963/5/fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
File fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java:
http://gerrit.cloudera.org:8080/#/c/12963/5/fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java@69
PS5, Line 69: private final FeCatalogManager catalog_;
: private final Supplier<? extends S
> you could get rid of this using JniUtil. serializeToThrift(input) ?
Ah, yuo're right. Done.
http://gerrit.cloudera.org:8080/#/c/12963/5/fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java@238
PS5, Line 238: ng_user(user);
> nit: call it validateSentryAdmin...() ? Since it validates and throws..
Done
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 7
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 17:27:30 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 4:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2696/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 4
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 04:03:53 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 6:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2703/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 6
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 17:15:57 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Bharath Vissapragada (Code Review)" <ge...@cloudera.org>.
Bharath Vissapragada has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 6: Code-Review+2
(2 comments)
lgtm.
http://gerrit.cloudera.org:8080/#/c/12963/5/fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
File fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java:
http://gerrit.cloudera.org:8080/#/c/12963/5/fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java@69
PS5, Line 69: private final static TBinaryProtocol.Factory THRIFT_PROTOCOL =
: new TBinaryProtocol.Factory();
you could get rid of this using JniUtil. serializeToThrift(input) ?
http://gerrit.cloudera.org:8080/#/c/12963/5/fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java@238
PS5, Line 238: checkSentryAdmin
nit: call it validateSentryAdmin...() ? Since it validates and throws..
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 6
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 16:48:02 +0000
Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 5:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2697/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 5
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 05:42:43 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#5). ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
IMPALA-8385: Refactor Sentry admin user check
This patch moves the hardcoded Sentry admin user check from the generic
"show roles" and "show grant" catalog operations to Sentry authorization
plugin, i.e. SentryImpaladAuthorizationManager. This patch also removes
isAdmin() from AuthorizationManager interface.
Testing:
- Added a new authorization E2E test to test for Sentry admin check
- Ran all FE tests
- Ran all authorization E2E tests
Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
---
M be/src/catalog/catalog-server.cc
M be/src/catalog/catalog.cc
M be/src/catalog/catalog.h
M be/src/exec/catalog-op-executor.cc
M be/src/exec/catalog-op-executor.h
M be/src/service/client-request-state.cc
M be/src/service/fe-support.cc
M common/thrift/CatalogService.thrift
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/FeSupport.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniCatalog.java
A tests/authorization/test_sentry.py
17 files changed, 197 insertions(+), 82 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/63/12963/5
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 5
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 8:
Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/4002/ DRY_RUN=false
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 8
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 17:28:11 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 8: Verified+1
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 8
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 22:29:18 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
IMPALA-8385: Refactor Sentry admin user check
This patch moves the hardcoded Sentry admin user check from the generic
"show roles" and "show grant" catalog operations to Sentry authorization
plugin, i.e. SentryImpaladAuthorizationManager. This patch also removes
isAdmin() from AuthorizationManager interface.
Testing:
- Added a new authorization E2E test to test for Sentry admin check
- Ran all FE tests
- Ran all authorization E2E tests
Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Reviewed-on: http://gerrit.cloudera.org:8080/12963
Reviewed-by: Impala Public Jenkins <im...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
M be/src/catalog/catalog-server.cc
M be/src/catalog/catalog.cc
M be/src/catalog/catalog.h
M be/src/exec/catalog-op-executor.cc
M be/src/exec/catalog-op-executor.h
M be/src/service/client-request-state.cc
M be/src/service/fe-support.cc
M common/thrift/CatalogService.thrift
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/FeSupport.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniCatalog.java
A tests/authorization/test_sentry.py
17 files changed, 194 insertions(+), 82 deletions(-)
Approvals:
Impala Public Jenkins: Looks good to me, approved; Verified
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 9
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 7:
Build Successful
https://jenkins.impala.io/job/gerrit-code-review-checks/2705/ : Initial code review checks passed. Use gerrit-verify-dryrun-external or gerrit-verify-dryrun to run full precommit tests.
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 7
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 18:11:33 +0000
Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Fredy Wijaya (Code Review)" <ge...@cloudera.org>.
Fredy Wijaya has uploaded a new patch set (#7). ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
IMPALA-8385: Refactor Sentry admin user check
This patch moves the hardcoded Sentry admin user check from the generic
"show roles" and "show grant" catalog operations to Sentry authorization
plugin, i.e. SentryImpaladAuthorizationManager. This patch also removes
isAdmin() from AuthorizationManager interface.
Testing:
- Added a new authorization E2E test to test for Sentry admin check
- Ran all FE tests
- Ran all authorization E2E tests
Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
---
M be/src/catalog/catalog-server.cc
M be/src/catalog/catalog.cc
M be/src/catalog/catalog.h
M be/src/exec/catalog-op-executor.cc
M be/src/exec/catalog-op-executor.h
M be/src/service/client-request-state.cc
M be/src/service/fe-support.cc
M common/thrift/CatalogService.thrift
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoneAuthorizationFactory.java
M fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryCatalogdAuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/sentry/SentryImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/FeSupport.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniCatalog.java
A tests/authorization/test_sentry.py
17 files changed, 194 insertions(+), 82 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/63/12963/7
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 7
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
[Impala-ASF-CR] IMPALA-8385: Refactor Sentry admin user check
Posted by "Impala Public Jenkins (Code Review)" <ge...@cloudera.org>.
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/12963 )
Change subject: IMPALA-8385: Refactor Sentry admin user check
......................................................................
Patch Set 8: Code-Review+2
--
To view, visit http://gerrit.cloudera.org:8080/12963
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I911228b09af7eed5d5dc002b20591ef64dc625d3
Gerrit-Change-Number: 12963
Gerrit-PatchSet: 8
Gerrit-Owner: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Austin Nobis <an...@cloudera.com>
Gerrit-Reviewer: Bharath Vissapragada <bh...@cloudera.com>
Gerrit-Reviewer: Fredy Wijaya <fw...@cloudera.com>
Gerrit-Reviewer: Impala Public Jenkins <im...@cloudera.com>
Gerrit-Comment-Date: Tue, 09 Apr 2019 17:28:10 +0000
Gerrit-HasComments: No