Release Notes - Sentry - Version 1.4.0

** Sub-task
    * [SENTRY-97] - Create service configuration properties
    * [SENTRY-129] - Implement Hive Sentry Authz DDL Task Factory
    * [SENTRY-134] - Use BoneCP, add unique constraint to GROUP_NAME, and expose jdo/datanucleus properties
    * [SENTRY-137] - Validate privilege scope in sentry service
    * [SENTRY-138] - Use server timestamp for createTime for role, privilege and group
    * [SENTRY-142] - Create database backed ProviderBackend
    * [SENTRY-143] - Merge db_policy_store branch into master
    * [SENTRY-153] - Add Hive e2e test with grant/revoke statements
    * [SENTRY-156] - Support local privilege validation APIs
    * [SENTRY-160] - Class to table mapping in package.jdo is incorrect
    * [SENTRY-364] - Bump up hive and hadoop versions from SNAPSHOT to released bits
    * [SENTRY-365] - Create release branch for 1.4.0
    * [SENTRY-369] - Update changelog.txt, notice.txt, etc... for 1.4.0 release


** Bug
    * [SENTRY-118] - cast udf should be added to sentry udf whitelist for hive
    * [SENTRY-131] - bin/sentry script doesn't find config-tool.sh under some circumstances
    * [SENTRY-133] - Alter table create partition if not exists - results in error
    * [SENTRY-161] - Sentry master branch is trying to download Hadoop tarball from nonexisting URL
    * [SENTRY-162] - Cleanup DB store privilege metadata on Hive DDL statements
    * [SENTRY-166] - Sentry does not accept URIs with an equals sign (=) in path. Fails with llegalArgumentException: Invalid key value
    * [SENTRY-169] - JAAS login options not compatible with IBM JDK  
    * [SENTRY-172] - config-tool.sh is missing from master branch
    * [SENTRY-174] - Sentry should not package hadoop, hive and other jars
    * [SENTRY-175] - sentry script throws error for the dbstore service invocation
    * [SENTRY-176] - Not able to read policy files on HDFS (Regression)
    * [SENTRY-177] - Sentry Policy Service does not treat role names as case insensitive
    * [SENTRY-178] - Poor performance for Sentry Policy Service as #of privileges is scaled up
    * [SENTRY-181] - Add a test case for duplicate privileges
    * [SENTRY-182] - Granting ALL privileges to table does not seem to do the right thing when using the SimpleDbPolicyProvider
    * [SENTRY-183] - Sentry Policy Service goes into an unusable state when granting privileges. Subsequent access fail with a DataNucleusException: "Iteration request failed: SELECT ..."
    * [SENTRY-186] - e2e tests for solr document-level security
    * [SENTRY-187] - Use invariants rather than default for specification of update index level authorization
    * [SENTRY-188] - Reduce the logging level during per-db policy loading
    * [SENTRY-190] - Support for getting set of roles from ProviderBackend
    * [SENTRY-191] - Sentry Policy Service should not require passing the RPC requestor's user/group information
    * [SENTRY-192] - Convert solr doc-level e2e test to be based on roles rather than groups
    * [SENTRY-194] - Sentry script should note use Hive script by default for service and tool execution
    * [SENTRY-195] - Sentry schema tool can't process comments inside statement
    * [SENTRY-200] - Remove sentry-provider dependencies on hive 
    * [SENTRY-201] - TestDatabaseProvider tests fail after Sentry schema tool was added.
    * [SENTRY-202] - Sentry end to end tests which use ClusterDFS will need to explicitly add the policy file to HDFS
    * [SENTRY-203] - Column name mismatch causes DataNucleus to throw exceptions
    * [SENTRY-204] - Test cases extending SentryServiceIntegrationBase are failing
    * [SENTRY-205] - Sentry throws Exception when trying to revoke Table level privileges
    * [SENTRY-206] - Sentry distribution should include a template config file for the service
    * [SENTRY-207] - Sentry script should return non-zero exist status in error conditions
    * [SENTRY-209] - Empty list returned when calling listPrivilegesByRoleName
    * [SENTRY-210] - Exception Thrown When Trying to grantRoleToGroup
    * [SENTRY-212] - Restrict access to hive config property hive.sentry.active.role.set which is set by Sentry Hive binding
    * [SENTRY-213] - Sentry schema tool doesn't handle sentry.javax.jdo.* properties
    * [SENTRY-214] - Sentry Service does not allow the same Privilege to be associated to multiple Roles
    * [SENTRY-217] - Add Insert and URI tests for Sentry DB provider
    * [SENTRY-218] - Use defaults for user, password and driver in SchemaTool 
    * [SENTRY-219] - Sentry Cache Backend Provider initialization does not work as expected
    * [SENTRY-220] - Trivial fix to SentrySchemaTool to set default driver
    * [SENTRY-221] - Privilege scope is case sensitive
    * [SENTRY-222] - Privileges are sometimes granted to the wrong roles
    * [SENTRY-224] - Provider resource should not be required for DB provider backend
    * [SENTRY-229] - SentrySchemaTool initSchema does not work with postgres 8.1and oracle
    * [SENTRY-231] - Fix JDK 6 build
    * [SENTRY-235] - Change tests in TestSentryServerWithoutKerberos to use new Sentry service APIs
    * [SENTRY-236] - Sentry PolicyFile provider incorrectly logs error messages when reading policy file
    * [SENTRY-237] - Support log4j configuration for Sentry service
    * [SENTRY-238] - Denied Show roles and show role grant throw thrift exception
    * [SENTRY-239] - Setup in TestDatabaseProvider is flaky
    * [SENTRY-241] - Sentry GrantRevokeTask should fire the sentry failure look
    * [SENTRY-243] - The operation type needs to be set in the grant/revoke task context for the failure hook
    * [SENTRY-244] - Sentry deprecated properties do not work
    * [SENTRY-245] - Fix failing db provider tests
    * [SENTRY-246] - Load command does not seem to work with filter push down
    * [SENTRY-247] - Go back to using filter push down once the bugs are fixed
    * [SENTRY-248] - The sentry-provider-cache dependency is not correctly set
    * [SENTRY-249] - "Use default" should be allowed for all the users even when using filter push down
    * [SENTRY-250] - Create external table fails with filter push down
    * [SENTRY-251] - PolicyProviderForTest.addPrivilege breaks in some cases
    * [SENTRY-252] - Per db policy files based tests should be updated for dbprovider usage
    * [SENTRY-253] - Creating external table seems to be failing when using provider db.
    * [SENTRY-254] - Privilege name in provider db has a limit of length 128 which might be very low for long uris.
    * [SENTRY-255] - Revoke on Server privilege fails
    * [SENTRY-256] - Fix TestDbEndToEnd.testEndToEnd1
    * [SENTRY-257] - Upgrade master to use version 1.4.0-incubating-SNAPSHOT
    * [SENTRY-259] - Implement Hive metastore plugin
    * [SENTRY-260] - Add support to use DB2  as database for sentry metastore
    * [SENTRY-262] - Updating patch for SENTRY-178
    * [SENTRY-263] - Remove usage of getHostString() from AbstractTestWithStaticConfiguration
    * [SENTRY-266] - Implement _HOST substitution in principal
    * [SENTRY-268] - Allow only granted roles to be set in "SET ROLE <roleName>"
    * [SENTRY-269] - Add a test case for Denied Alter table, should fire SentryOnFailureHook
    * [SENTRY-271] - Test TestSentryServiceIntegration is flaky
    * [SENTRY-272] - Test TestSentryStoreToAuthorizable.testUri is failing on comparing URI string
    * [SENTRY-273] - org.apache.sentry.tests.e2e.dbprovider.TestDbUriPermissions is failing
    * [SENTRY-274] - MySQL init scripts contains invalid comments
    * [SENTRY-275] - Fix compilation error in SentryService
    * [SENTRY-276] - SentryService tests are currently timing out
    * [SENTRY-277] - Add Pig+HCat test for Metastore auth plugin
    * [SENTRY-278] -  TestSearchModelAuthorizables.testTooManyKV and  TestDBModelAuthorizables.testTooManyKV fail
    * [SENTRY-279] - Revert back using lowercase for uri label
    * [SENTRY-280] - Sentry-202 missing changes
    * [SENTRY-281] - Revoking a parent privilege should revoke all child privileges
    * [SENTRY-282] - Select on DB should give privileges to query tables within it.
    * [SENTRY-283] - Secure connection from HS2 to Sentry service fails
    * [SENTRY-284] - Create test for creating external partition
    * [SENTRY-285] - privilege->action=all is not same as privilege
    * [SENTRY-288] - Dissable MetastoreBinding for test cases that do not require it
    * [SENTRY-289] - Kerberos based connection from HS2 and Metastore to Sentry service fails
    * [SENTRY-290] - Handle null pointer in SentryPolicyProcessor
    * [SENTRY-294] - The Sentry service client should execute UGI privilege action by default
    * [SENTRY-297] - Increase privilege_name to 4000 in mysql to be consistent with other dbs
    * [SENTRY-299] - Partial Revoke Fails under certain conditions
    * [SENTRY-300] - HiveAuthzBinding checks for Hive server2 config which is not available when using Sentry with Hive meta store server
    * [SENTRY-301] - Sentry plugin fails access service from secure Hive Metastore 
    * [SENTRY-302] - Partial revoke on Table fails if both ALL and a SELECT/INSERT grant exists
    * [SENTRY-304] - Limit on index key in MYSQL (innoDB ) is 767 bytes
    * [SENTRY-305] - SHOW CURRENT ROLES shouldn't require admin privileges
    * [SENTRY-306] - Fix grant all on table in db based provider
    * [SENTRY-307] - Unqualified URIs should be reconstructed in a standard way
    * [SENTRY-309] - Metastore binding should use fully qualified URI for validating alter table operations
    * [SENTRY-310] - Make Hive operation to required privileges more granular
    * [SENTRY-311] - Metastore plugin needs to be changed to updated privilege model
    * [SENTRY-312] - Add 'decimal' and 'date' to default UDF whitelist
    * [SENTRY-313] - Fix some uri failing tests
    * [SENTRY-314] - Metastore plugin should verify the storage descriptor before referencing
    * [SENTRY-315] - SHOW CURRENT ROLE fails if the one of the groups doesn't have any roles granted
    * [SENTRY-317] - Fix TestDbOperations.testLoad test
    * [SENTRY-319] - group names should be case sensitive.
    * [SENTRY-321] - SentryMetastorePostEventListener should use sentry config to create SentryClient
    * [SENTRY-332] - A role may got empty privilege, although the role have some privileges
    * [SENTRY-336] - Fix test failures on real cluster
    * [SENTRY-337] - When the parameter sentry.metastore.service.users isn't set or set empty, starting metastore will throw java.lang.NullPointerException
    * [SENTRY-363] - CTAS from view is requiring select on underlying table


** Improvement
    * [SENTRY-106] - Make solr testing work against apache 4.7 version
    * [SENTRY-193] - Add schematool for creating Sentry store schema from the SQL scripts
    * [SENTRY-211] - Do the user: group lookup in the Sentry db policy server
    * [SENTRY-258] - Increase field PRIVILEGE_NAME to 4000 characters to enable long URIs
    * [SENTRY-293] - Create a new mvn cluster test profile for provider db tests
    * [SENTRY-303] - Allow users to grant/revoke SELECT/INSERT to ALL tables in a Database
    * [SENTRY-333] - Add conf directory to sentry distribution
    * [SENTRY-361] - Sentry server should use sentry-site.xml in conf directory by default

** New Feature
    * [SENTRY-3] - Create a diagnostics tool for configuration validation
    * [SENTRY-37] - Implement a DB backed policy store
    * [SENTRY-115] - Give bindings the ability to access the group mappings
    * [SENTRY-157] - Support filter pushdown in DB Store client to reduce data transfer from DB Store service
    * [SENTRY-158] - Hive bindings should enable MR level ACLs for session user
    * [SENTRY-165] - Implement createShowRolesTask() in SentryHiveAuthorizationTaskFactoryImpl
    * [SENTRY-184] - Add Sentry service APIs to query roles and privileges
    * [SENTRY-199] - Create tool that will convert policy file into into DB store
    * [SENTRY-215] - SHOW GRANT ROLE xxx ON [SERVER, DATABASE, TABLE, URI] xxx
    * [SENTRY-216] - Support SHOW CURRENT ROLES


** Task
    * [SENTRY-159] - Convert AbstractSolrSentryTestBase to use MiniSolrCloudCluster rather than Lucene test hierarchy
    * [SENTRY-164] - Missing implementation for  HiveAuthorizationTaskFactory: createShowRolesTask()
    * [SENTRY-230] - e2e test for doc level security to cover failure scenarios around Index level auth
    * [SENTRY-356] - Apache Sentry 1.4.0 Release


** Test
    * [SENTRY-223] - Add a test for updates with doc-level security
    * [SENTRY-233] - Disable hdfs blockcache during solr e2e tests
    * [SENTRY-261] - Improve test coverage for grant/revoke statements in Hive e2e tests
    * [SENTRY-287] - Add test case for giving select privieleges on a table in a non default database
    * [SENTRY-291] - Remove duplicate testSameGrantTwice