org.apache.hadoop.hive.ql.security.authorization.plugin

Class HiveAuthorizerImpl

java.lang.Object

org.apache.hadoop.hive.ql.security.authorization.plugin.AbstractHiveAuthorizer

org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizerImpl

All Implemented Interfaces:

HiveAuthorizer

@InterfaceAudience.LimitedPrivate(value="")
 @InterfaceStability.Evolving
public class HiveAuthorizerImpl
extends AbstractHiveAuthorizer

Convenience implementation of HiveAuthorizer. You can customize the behavior by passing different implementations of HiveAccessController and HiveAuthorizationValidator to constructor.

Nested Class Summary

Nested classes/interfaces inherited from interface org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizer

HiveAuthorizer.VERSION

Constructor Summary

Constructors

Constructor and Description
HiveAuthorizerImpl(HiveAccessController accessController, HiveAuthorizationValidator authValidator)

Method Summary

Modifier and Type	Method and Description
void	applyAuthorizationConfigPolicy(HiveConf hiveConf) Modify the given HiveConf object to configure authorization related parameters or other parameters related to hive security
List<HivePrivilegeObject>	applyRowFilterAndColumnMasking(HiveAuthzContext context, List<HivePrivilegeObject> privObjs) applyRowFilterAndColumnMasking is called once for each table in a query.
void	checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> inputHObjs, List<HivePrivilegeObject> outputHObjs, HiveAuthzContext context) Check if user has privileges to do this action on these objects
void	createRole(String roleName, HivePrincipal adminGrantor) Create role
void	dropRole(String roleName) Drop role
List<HivePrivilegeObject>	filterListCmdObjects(List<HivePrivilegeObject> listObjs, HiveAuthzContext context) Filter out any objects that should not be shown to the user, from the list of tables or databases coming from a 'show tables' or 'show databases' command
List<String>	getAllRoles()
List<String>	getCurrentRoleNames()
List<HiveRoleGrant>	getPrincipalGrantInfoForRole(String roleName) Get the grant information for principals granted the given role
List<HiveRoleGrant>	getRoleGrantInfoForPrincipal(HivePrincipal principal) Get the grant information of roles the given principal belongs to
HiveAuthorizer.VERSION	getVersion()
void	grantPrivileges(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption) Grant privileges for principals on the object
void	grantRole(List<HivePrincipal> hivePrincipals, List<String> roles, boolean grantOption, HivePrincipal grantorPrinc) Grant roles in given roles list to principals in given hivePrincipals list
boolean	needTransform() needTransform() is called once per user in a query.
void	revokePrivileges(List<HivePrincipal> hivePrincipals, List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject, HivePrincipal grantorPrincipal, boolean grantOption) Revoke privileges for principals on the object
void	revokeRole(List<HivePrincipal> hivePrincipals, List<String> roles, boolean grantOption, HivePrincipal grantorPrinc) Revoke roles in given roles list to principals in given hivePrincipals list
void	setCurrentRole(String roleName) Set the current role to roleName argument
List<HivePrivilegeInfo>	showPrivileges(HivePrincipal principal, HivePrivilegeObject privObj) Show privileges for given principal on given object

Methods inherited from class org.apache.hadoop.hive.ql.security.authorization.plugin.AbstractHiveAuthorizer

getHiveAuthorizationTranslator, getHivePolicyProvider

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

HiveAuthorizerImpl

public HiveAuthorizerImpl(HiveAccessController accessController,
                          HiveAuthorizationValidator authValidator)

Method Detail

grantPrivileges

public void grantPrivileges(List<HivePrincipal> hivePrincipals,
                            List<HivePrivilege> hivePrivileges,
                            HivePrivilegeObject hivePrivObject,
                            HivePrincipal grantorPrincipal,
                            boolean grantOption)
                     throws HiveAuthzPluginException,
                            HiveAccessControlException

Description copied from interface: HiveAuthorizer

Grant privileges for principals on the object

Throws:

HiveAuthzPluginException

HiveAccessControlException

revokePrivileges

public void revokePrivileges(List<HivePrincipal> hivePrincipals,
                             List<HivePrivilege> hivePrivileges,
                             HivePrivilegeObject hivePrivObject,
                             HivePrincipal grantorPrincipal,
                             boolean grantOption)
                      throws HiveAuthzPluginException,
                             HiveAccessControlException

Description copied from interface: HiveAuthorizer

Revoke privileges for principals on the object

Throws:

HiveAuthzPluginException

HiveAccessControlException

createRole

public void createRole(String roleName,
                       HivePrincipal adminGrantor)
                throws HiveAuthzPluginException,
                       HiveAccessControlException

Description copied from interface: HiveAuthorizer

Create role

adminGrantor - - The user in "[ WITH ADMIN ]" clause of "create role"

Throws:

HiveAuthzPluginException

HiveAccessControlException

dropRole

public void dropRole(String roleName)
              throws HiveAuthzPluginException,
                     HiveAccessControlException

Description copied from interface: HiveAuthorizer

Drop role

Throws:

HiveAuthzPluginException

HiveAccessControlException

grantRole

public void grantRole(List<HivePrincipal> hivePrincipals,
                      List<String> roles,
                      boolean grantOption,
                      HivePrincipal grantorPrinc)
               throws HiveAuthzPluginException,
                      HiveAccessControlException

Description copied from interface: HiveAuthorizer

Grant roles in given roles list to principals in given hivePrincipals list

Throws:

HiveAuthzPluginException

HiveAccessControlException

revokeRole

public void revokeRole(List<HivePrincipal> hivePrincipals,
                       List<String> roles,
                       boolean grantOption,
                       HivePrincipal grantorPrinc)
                throws HiveAuthzPluginException,
                       HiveAccessControlException

Description copied from interface: HiveAuthorizer

Revoke roles in given roles list to principals in given hivePrincipals list

Throws:

HiveAuthzPluginException

HiveAccessControlException

checkPrivileges

public void checkPrivileges(HiveOperationType hiveOpType,
                            List<HivePrivilegeObject> inputHObjs,
                            List<HivePrivilegeObject> outputHObjs,
                            HiveAuthzContext context)
                     throws HiveAuthzPluginException,
                            HiveAccessControlException

Description copied from interface: HiveAuthorizer

Check if user has privileges to do this action on these objects

Throws:

HiveAuthzPluginException

HiveAccessControlException

filterListCmdObjects

public List<HivePrivilegeObject> filterListCmdObjects(List<HivePrivilegeObject> listObjs,
                                                      HiveAuthzContext context)
                                               throws HiveAuthzPluginException,
                                                      HiveAccessControlException

Description copied from interface: HiveAuthorizer

Filter out any objects that should not be shown to the user, from the list of tables or databases coming from a 'show tables' or 'show databases' command

Parameters:

listObjs - List of all objects obtained as result of a show command

Returns:

filtered list of objects that will be returned to the user invoking the command

Throws:

HiveAuthzPluginException

HiveAccessControlException

getAllRoles

public List<String> getAllRoles()
                         throws HiveAuthzPluginException,
                                HiveAccessControlException

Returns:

all existing roles

Throws:

HiveAuthzPluginException

HiveAccessControlException

showPrivileges

public List<HivePrivilegeInfo> showPrivileges(HivePrincipal principal,
                                              HivePrivilegeObject privObj)
                                       throws HiveAuthzPluginException,
                                              HiveAccessControlException

Description copied from interface: HiveAuthorizer

Show privileges for given principal on given object

Returns:

Throws:

HiveAuthzPluginException

HiveAccessControlException

getVersion

public HiveAuthorizer.VERSION getVersion()

Returns:

version of HiveAuthorizer interface that is implemented by this instance

setCurrentRole

public void setCurrentRole(String roleName)
                    throws HiveAccessControlException,
                           HiveAuthzPluginException

Description copied from interface: HiveAuthorizer

Set the current role to roleName argument

Throws:

HiveAccessControlException

HiveAuthzPluginException

getCurrentRoleNames

public List<String> getCurrentRoleNames()
                                 throws HiveAuthzPluginException

Returns:

List having names of current roles

Throws:

HiveAuthzPluginException

getPrincipalGrantInfoForRole

public List<HiveRoleGrant> getPrincipalGrantInfoForRole(String roleName)
                                                 throws HiveAuthzPluginException,
                                                        HiveAccessControlException

Description copied from interface: HiveAuthorizer

Get the grant information for principals granted the given role

Returns:

Throws:

HiveAuthzPluginException

HiveAccessControlException

getRoleGrantInfoForPrincipal

public List<HiveRoleGrant> getRoleGrantInfoForPrincipal(HivePrincipal principal)
                                                 throws HiveAuthzPluginException,
                                                        HiveAccessControlException

Description copied from interface: HiveAuthorizer

Get the grant information of roles the given principal belongs to

Returns:

Throws:

HiveAuthzPluginException

HiveAccessControlException

applyAuthorizationConfigPolicy

public void applyAuthorizationConfigPolicy(HiveConf hiveConf)
                                    throws HiveAuthzPluginException

Description copied from interface: HiveAuthorizer

Modify the given HiveConf object to configure authorization related parameters or other parameters related to hive security

Throws:

HiveAuthzPluginException

needTransform

public boolean needTransform()

Description copied from interface: HiveAuthorizer

needTransform() is called once per user in a query. Returning false short-circuits the generation of row/column transforms.

Returns:

applyRowFilterAndColumnMasking

public List<HivePrivilegeObject> applyRowFilterAndColumnMasking(HiveAuthzContext context,
                                                                List<HivePrivilegeObject> privObjs)
                                                         throws SemanticException

Description copied from interface: HiveAuthorizer

applyRowFilterAndColumnMasking is called once for each table in a query. (part 1) It expects a valid filter condition to be returned. Null indicates no filtering is required. Example: table foo(c int) -> "c > 0 && c % 2 = 0" (part 2) It expects a valid expression as used in a select clause. Null is NOT a valid option. If no transformation is needed simply return the column name. Example: column a -> "a" (no transform) Example: column a -> "reverse(a)" (call the reverse function on a) Example: column a -> "5" (replace column a with the constant 5)

Returns:

List please return the list of HivePrivilegeObjects that need to be rewritten.

Throws:

SemanticException