SentryPolicyService.java

Go to the documentation of this file.

// Copyright 2014 Cloudera Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package com.cloudera.impala.util;

import java.util.List;

import org.apache.sentry.SentryUserException;
import org.apache.sentry.provider.db.SentryAccessDeniedException;
import org.apache.sentry.provider.db.SentryAlreadyExistsException;
import org.apache.sentry.provider.db.service.thrift.SentryPolicyServiceClient;
import org.apache.sentry.provider.db.service.thrift.TSentryGrantOption;
import org.apache.sentry.provider.db.service.thrift.TSentryPrivilege;
import org.apache.sentry.provider.db.service.thrift.TSentryRole;
import org.apache.sentry.service.thrift.SentryServiceClientFactory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.cloudera.impala.authorization.SentryConfig;
import com.cloudera.impala.authorization.User;
import com.cloudera.impala.catalog.AuthorizationException;
import com.cloudera.impala.catalog.RolePrivilege;
import com.cloudera.impala.common.ImpalaException;
import com.cloudera.impala.common.InternalException;
import com.cloudera.impala.thrift.TPrivilege;
import com.cloudera.impala.thrift.TPrivilegeLevel;
import com.cloudera.impala.thrift.TPrivilegeScope;
import com.google.common.collect.Lists;

public class SentryPolicyService {
  private final static Logger LOG = LoggerFactory.getLogger(SentryPolicyService.class);
  private final String ACCESS_DENIED_ERROR_MSG =
      "User '%s' does not have privileges to execute: %s";
  private final SentryConfig config_;

  class SentryServiceClient {
    private final SentryPolicyServiceClient client_;

    public SentryServiceClient() throws InternalException {
      client_ = createClient();
    }

    public SentryPolicyServiceClient get() {
      return client_;
    }

    public void close() {
      client_.close();
    }

    private SentryPolicyServiceClient createClient() throws InternalException {
      SentryPolicyServiceClient client;
      try {
        client = SentryServiceClientFactory.create(config_.getConfig());
      } catch (Exception e) {
        throw new InternalException("Error creating Sentry Service client: ", e);
      }
      return client;
    }
  }

  public SentryPolicyService(SentryConfig config) {
    config_ = config;
  }

  public void dropRole(User requestingUser, String roleName, boolean ifExists)
      throws ImpalaException {
    LOG.trace(String.format("Dropping role: %s on behalf of: %s", roleName,
        requestingUser.getName()));
    SentryServiceClient client = new SentryServiceClient();
    try {
      if (ifExists) {
        client.get().dropRoleIfExists(requestingUser.getShortName(), roleName);
      } else {
        client.get().dropRole(requestingUser.getShortName(), roleName);
      }
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "DROP_ROLE"));
    } catch (SentryUserException e) {
      throw new InternalException("Error dropping role: ", e);
    } finally {
      client.close();
    }
  }

  public void createRole(User requestingUser, String roleName, boolean ifNotExists)
      throws ImpalaException {
    LOG.trace(String.format("Creating role: %s on behalf of: %s", roleName,
        requestingUser.getName()));
    SentryServiceClient client = new SentryServiceClient();
    try {
      client.get().createRole(requestingUser.getShortName(), roleName);
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "CREATE_ROLE"));
    } catch (SentryAlreadyExistsException e) {
      if (ifNotExists) return;
      throw new InternalException("Error creating role: ", e);
    } catch (SentryUserException e) {
      throw new InternalException("Error creating role: ", e);
    } finally {
      client.close();
    }
  }

  public void grantRoleToGroup(User requestingUser, String roleName, String groupName)
      throws ImpalaException {
    LOG.trace(String.format("Granting role '%s' to group '%s' on behalf of: %s",
        roleName, groupName, requestingUser.getName()));
    SentryServiceClient client = new SentryServiceClient();
    try {
      client.get().grantRoleToGroup(requestingUser.getShortName(), groupName, roleName);
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "GRANT_ROLE"));
    } catch (SentryUserException e) {
      throw new InternalException(
          "Error making 'grantRoleToGroup' RPC to Sentry Service: ", e);
    } finally {
      client.close();
    }
  }


  public void revokeRoleFromGroup(User requestingUser, String roleName, String groupName)
      throws ImpalaException {
    LOG.trace(String.format("Revoking role '%s' from group '%s' on behalf of: %s",
        roleName, groupName, requestingUser.getName()));
    SentryServiceClient client = new SentryServiceClient();
    try {
      client.get().revokeRoleFromGroup(requestingUser.getShortName(),
          groupName, roleName);
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "REVOKE_ROLE"));
    } catch (SentryUserException e) {
      throw new InternalException(
          "Error making 'revokeRoleFromGroup' RPC to Sentry Service: ", e);
    } finally {
      client.close();
    }
  }

  public void grantRolePrivilege(User requestingUser, String roleName,
      TPrivilege privilege) throws ImpalaException {
    LOG.trace(String.format("Granting role '%s' privilege '%s' on '%s' on behalf of: %s",
        roleName, privilege.toString(), privilege.getScope().toString(),
        requestingUser.getName()));
    SentryServiceClient client = new SentryServiceClient();
    try {
      switch (privilege.getScope()) {
        case SERVER:
          client.get().grantServerPrivilege(requestingUser.getShortName(), roleName,
              privilege.getServer_name(), privilege.isHas_grant_opt());
          break;
        case DATABASE:
          client.get().grantDatabasePrivilege(requestingUser.getShortName(), roleName,
              privilege.getServer_name(), privilege.getDb_name(),
              privilege.getPrivilege_level().toString(),
              privilege.isHas_grant_opt());
          break;
        case TABLE:
          String tblName = privilege.getTable_name();
          String dbName = privilege.getDb_name();
          client.get().grantTablePrivilege(requestingUser.getShortName(), roleName,
              privilege.getServer_name(), dbName, tblName,
              privilege.getPrivilege_level().toString(),
              privilege.isHas_grant_opt());
          break;
        case URI:
          client.get().grantURIPrivilege(requestingUser.getShortName(),
              roleName, privilege.getServer_name(), privilege.getUri(),
              privilege.isHas_grant_opt());
          break;
      }
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "GRANT_PRIVILEGE"));
    } catch (SentryUserException e) {
      throw new InternalException(
          "Error making 'grantPrivilege*' RPC to Sentry Service: ", e);
    } finally {
      client.close();
    }
  }

  public void revokeRolePrivilege(User requestingUser, String roleName,
      TPrivilege privilege) throws ImpalaException {
    LOG.trace(String.format("Revoking role '%s' privilege '%s' on '%s' on behalf of: %s",
        roleName, privilege.toString(), privilege.getScope().toString(),
        requestingUser.getName()));
    SentryServiceClient client = new SentryServiceClient();
    try {
      switch (privilege.getScope()) {
        case SERVER:
          client.get().revokeServerPrivilege(requestingUser.getShortName(), roleName,
              privilege.getServer_name(), null);
          break;
        case DATABASE:
          client.get().revokeDatabasePrivilege(requestingUser.getShortName(), roleName,
              privilege.getServer_name(), privilege.getDb_name(),
              privilege.getPrivilege_level().toString(), null);
          break;
        case TABLE:
          String tblName = privilege.getTable_name();
          String dbName = privilege.getDb_name();
          client.get().revokeTablePrivilege(requestingUser.getShortName(), roleName,
              privilege.getServer_name(), dbName, tblName,
              privilege.getPrivilege_level().toString(),
              null);
          break;
        case URI:
          client.get().revokeURIPrivilege(requestingUser.getShortName(),
              roleName, privilege.getServer_name(), privilege.getUri(),
              null);
          break;
      }
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "REVOKE_PRIVILEGE"));
    } catch (SentryUserException e) {
      throw new InternalException(
          "Error making 'revokePrivilege*' RPC to Sentry Service: ", e);
    } finally {
      client.close();
    }
  }

  public List<TSentryRole> listUserRoles(User requestingUser)
      throws ImpalaException {
    SentryServiceClient client = new SentryServiceClient();
    try {
      return Lists.newArrayList(client.get().listUserRoles(
          requestingUser.getShortName()));
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "LIST_USER_ROLES"));
    } catch (SentryUserException e) {
      throw new InternalException(
          "Error making 'listUserRoles' RPC to Sentry Service: ", e);
    } finally {
      client.close();
    }
  }

  public List<TSentryRole> listAllRoles(User requestingUser) throws ImpalaException {
    SentryServiceClient client = new SentryServiceClient();
    try {
      return Lists.newArrayList(client.get().listRoles(requestingUser.getShortName()));
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "LIST_ROLES"));
    } catch (SentryUserException e) {
      throw new InternalException("Error making 'listRoles' RPC to Sentry Service: ", e);
    } finally {
      client.close();
    }
  }

  public List<TSentryPrivilege> listRolePrivileges(User requestingUser, String roleName)
      throws ImpalaException {
    SentryServiceClient client = new SentryServiceClient();
    try {
      return Lists.newArrayList(client.get().listAllPrivilegesByRoleName(
          requestingUser.getShortName(), roleName));
    } catch (SentryAccessDeniedException e) {
      throw new AuthorizationException(String.format(ACCESS_DENIED_ERROR_MSG,
          requestingUser.getName(), "LIST_ROLE_PRIVILEGES"));
    } catch (SentryUserException e) {
      throw new InternalException("Error making 'listAllPrivilegesByRoleName' RPC to " +
          "Sentry Service: ", e);
    } finally {
      client.close();
    }
  }

  public static TPrivilege sentryPrivilegeToTPrivilege(TSentryPrivilege sentryPriv) {
    TPrivilege privilege = new TPrivilege();
    privilege.setServer_name(sentryPriv.getServerName());
    if (sentryPriv.isSetDbName()) privilege.setDb_name(sentryPriv.getDbName());
    if (sentryPriv.isSetTableName()) privilege.setTable_name(sentryPriv.getTableName());
    if (sentryPriv.isSetURI()) privilege.setUri(sentryPriv.getURI());
    privilege.setScope(Enum.valueOf(TPrivilegeScope.class,
        sentryPriv.getPrivilegeScope().toUpperCase()));
    if (sentryPriv.getAction().equals("*")) {
      privilege.setPrivilege_level(TPrivilegeLevel.ALL);
    } else {
      privilege.setPrivilege_level(Enum.valueOf(TPrivilegeLevel.class,
          sentryPriv.getAction().toUpperCase()));
    }
    privilege.setPrivilege_name(RolePrivilege.buildRolePrivilegeName(privilege));
    privilege.setCreate_time_ms(sentryPriv.getCreateTime());
    if (sentryPriv.isSetGrantOption() &&
        sentryPriv.getGrantOption() == TSentryGrantOption.TRUE) {
      privilege.setHas_grant_opt(true);
    } else {
      privilege.setHas_grant_opt(false);
    }
    return privilege;
  }
}