ACCESS-214: Rename Access package to Sentry
Includes refactored commits of following patches :-
ACCESS-219. Fix end to end test failures for Hive binding
ACCESS-220:A badly formatted db level policy file shouldn't impact access to rest of the databases
ACCESS-217. Support for URIs in per DB policy file
ACCESS-208: Add interface for on failure hooks
diff --git a/README.md b/README.md
index afb133a..7152e9b 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-access
+Sentry
======
-Access Server
\ No newline at end of file
+Sentry Authorization
diff --git a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestHiveAuthzConf.java b/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestHiveAuthzConf.java
deleted file mode 100644
index e17822e..0000000
--- a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestHiveAuthzConf.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.apache.access.binding.hive;
-
-import org.apache.access.binding.hive.conf.HiveAuthzConf;
-import org.apache.access.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
-
-import com.google.common.io.Resources;
-
-public class TestHiveAuthzConf {
- private HiveAuthzConf authzConf;
-
- @Before
- public void setUp() {
- authzConf = new HiveAuthzConf(Resources.getResource("access-site.xml"));
- }
-
- @Test
- public void testConfig() {
- Assert.assertEquals("org.apache.access.provider.file.fooProvider",
- authzConf.get(AuthzConfVars.AUTHZ_PROVIDER.getVar()));
- }
-
- @Test
- public void testConfigOverload() {
- authzConf.set(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE.getVar(), "fooFile");
- Assert.assertEquals("fooFile",
- authzConf.get(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE.getVar()));
- }
-}
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPerDBConfiguration.java b/access-tests/src/test/java/org/apache/access/tests/e2e/TestPerDBConfiguration.java
deleted file mode 100644
index 17ab997..0000000
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPerDBConfiguration.java
+++ /dev/null
@@ -1,166 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.apache.access.tests.e2e;
-
-import static org.junit.Assert.assertTrue;
-
-import java.io.File;
-import java.io.FileOutputStream;
-import java.sql.Connection;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.sql.Statement;
-
-import junit.framework.Assert;
-
-import org.junit.After;
-import org.junit.Test;
-
-import com.google.common.base.Charsets;
-import com.google.common.base.Joiner;
-import com.google.common.io.Files;
-import com.google.common.io.Resources;
-
-/**
- * Test privileges per database policy files
- */
-public class TestPerDBConfiguration extends AbstractTestWithStaticLocalFS {
- private static final String MULTI_TYPE_DATA_FILE_NAME = "emp.dat";
- private static final String DB2_POLICY_FILE = "db2-policy-file.ini";
-
- private Context context;
-
- @After
- public void teardown() throws Exception {
- if (context != null) {
- context.close();
- }
- }
-
- @Test
- public void testPerDB() throws Exception {
- context = createContext();
- File policyFile = context.getPolicyFile();
- File db2PolicyFile = new File(policyFile.getParent(), DB2_POLICY_FILE);
- File dataDir = context.getDataDir();
- //copy data file to test dir
- File dataFile = new File(dataDir, MULTI_TYPE_DATA_FILE_NAME);
- FileOutputStream to = new FileOutputStream(dataFile);
- Resources.copy(Resources.getResource(MULTI_TYPE_DATA_FILE_NAME), to);
- to.close();
- //delete existing policy file; create new policy file
- assertTrue("Could not delete " + policyFile, context.deletePolicyFile());
- assertTrue("Could not delete " + db2PolicyFile,!db2PolicyFile.exists() || db2PolicyFile.delete());
-
- String[] policyFileContents = {
- // groups : role -> group
- "[groups]",
- "admin = all_server",
- "user_group1 = select_tbl1",
- "user_group2 = select_tbl2",
- // roles: privileges -> role
- "[roles]",
- "all_server = server=server1",
- "select_tbl1 = server=server1->db=db1->table=tbl1->action=select",
- // users: users -> groups
- "[users]",
- "hive = admin",
- "user_1 = user_group1",
- "user_2 = user_group2",
- "[databases]",
- "db2 = " + db2PolicyFile.getPath(),
- };
- context.makeNewPolicy(policyFileContents);
-
- String[] db2PolicyFileContents = {
- "[groups]",
- "user_group2 = select_tbl2",
- "[roles]",
- "select_tbl2 = server=server1->db=db2->table=tbl2->action=select"
- };
- Files.write(Joiner.on("\n").join(db2PolicyFileContents), db2PolicyFile, Charsets.UTF_8);
-
- // setup db objects needed by the test
- Connection connection = context.createConnection("hive", "hive");
- Statement statement = context.createStatement(connection);
-
- statement.execute("DROP DATABASE IF EXISTS db1 CASCADE");
- statement.execute("DROP DATABASE IF EXISTS db2 CASCADE");
- statement.execute("CREATE DATABASE db1");
- statement.execute("USE db1");
- statement.execute("CREATE TABLE tbl1(B INT, A STRING) " +
- " row format delimited fields terminated by '|' stored as textfile");
- statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl1");
- statement.execute("DROP DATABASE IF EXISTS db2 CASCADE");
- statement.execute("CREATE DATABASE db2");
- statement.execute("USE db2");
- statement.execute("CREATE TABLE tbl2(B INT, A STRING) " +
- " row format delimited fields terminated by '|' stored as textfile");
- statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl2");
- statement.close();
- connection.close();
-
- // test execution
- connection = context.createConnection("user_1", "password");
- statement = context.createStatement(connection);
- statement.execute("USE db1");
- // test user1 can execute query on tbl1
- verifyCount(statement, "SELECT COUNT(*) FROM tbl1");
-
- // user1 cannot query db2.tbl2
- context.assertAuthzException(statement, "USE db2");
- context.assertAuthzException(statement, "SELECT COUNT(*) FROM db2.tbl2");
- statement.close();
- connection.close();
-
- // test per-db file for db2
-
- connection = context.createConnection("user_2", "password");
- statement = context.createStatement(connection);
- statement.execute("USE db2");
- // test user2 can execute query on tbl2
- verifyCount(statement, "SELECT COUNT(*) FROM tbl2");
-
- // user2 cannot query db1.tbl1
- context.assertAuthzException(statement, "SELECT COUNT(*) FROM db1.tbl1");
- context.assertAuthzException(statement, "USE db1");
-
- statement.close();
- connection.close();
-
- //test cleanup
- connection = context.createConnection("hive", "hive");
- statement = context.createStatement(connection);
- statement.execute("DROP DATABASE db1 CASCADE");
- statement.execute("DROP DATABASE db2 CASCADE");
- statement.close();
- connection.close();
- }
- private void verifyCount(Statement statement, String query) throws SQLException {
- ResultSet resultSet = statement.executeQuery(query);
- int count = 0;
- int countRows = 0;
-
- while (resultSet.next()) {
- count = resultSet.getInt(1);
- countRows++;
- }
- assertTrue("Incorrect row count", countRows == 1);
- assertTrue("Incorrect result", count == 12);
- }
-}
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 37bc597..0378382 100644
--- a/pom.xml
+++ b/pom.xml
@@ -23,7 +23,7 @@
<version>4.4.0-SNAPSHOT</version>
</parent>
- <artifactId>access</artifactId>
+ <artifactId>sentry</artifactId>
<version>1.1.0-SNAPSHOT</version>
<description>Access component</description>
<name>Access</name>
@@ -65,11 +65,25 @@
<guava.version>11.0.2</guava.version>
<shiro.version>1.2.1</shiro.version>
<slf4j.version>1.6.1</slf4j.version>
+ <derby.version>10.4.2.0</derby.version>
+ <libthrift.version>0.9.0-cdh4-1</libthrift.version>
</properties>
<dependencyManagement>
<dependencies>
<dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derby</artifactId>
+ <version>${derby.version}</version>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libthrift</artifactId>
+ <version>${libthrift.version}</version>
+ <scope>provided</scope>
+ </dependency>
+ <dependency>
<groupId>org.apache.hive</groupId>
<artifactId>hive-common</artifactId>
<version>${hive.version}</version>
@@ -142,7 +156,7 @@
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-core</artifactId>
+ <artifactId>sentry-core</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
@@ -219,30 +233,30 @@
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-binding-hive</artifactId>
+ <artifactId>sentry-binding-hive</artifactId>
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-provider-file</artifactId>
+ <artifactId>sentry-provider-file</artifactId>
<version>${project.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-dist</artifactId>
+ <artifactId>sentry-dist</artifactId>
<version>${project.version}</version>
</dependency>
</dependencies>
</dependencyManagement>
<modules>
- <module>access-core</module>
- <module>access-binding</module>
- <module>access-provider</module>
- <module>access-tests</module>
- <module>access-dist</module>
+ <module>sentry-core</module>
+ <module>sentry-binding</module>
+ <module>sentry-provider</module>
+ <module>sentry-tests</module>
+ <module>sentry-dist</module>
</modules>
<build>
diff --git a/access-binding/pom.xml b/sentry-binding/pom.xml
similarity index 91%
rename from access-binding/pom.xml
rename to sentry-binding/pom.xml
index 6a1779a..d771d36 100644
--- a/access-binding/pom.xml
+++ b/sentry-binding/pom.xml
@@ -20,17 +20,17 @@
<parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access</artifactId>
+ <artifactId>sentry</artifactId>
<version>1.1.0-SNAPSHOT</version>
</parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-binding</artifactId>
+ <artifactId>sentry-binding</artifactId>
<name>Access Bindings</name>
<packaging>pom</packaging>
<modules>
- <module>access-binding-hive</module>
+ <module>sentry-binding-hive</module>
</modules>
</project>
diff --git a/access-binding/access-binding-hive/pom.xml b/sentry-binding/sentry-binding-hive/pom.xml
similarity index 77%
rename from access-binding/access-binding-hive/pom.xml
rename to sentry-binding/sentry-binding-hive/pom.xml
index 5874799..03a68c1 100644
--- a/access-binding/access-binding-hive/pom.xml
+++ b/sentry-binding/sentry-binding-hive/pom.xml
@@ -21,15 +21,31 @@
<parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-binding</artifactId>
+ <artifactId>sentry-binding</artifactId>
<version>1.1.0-SNAPSHOT</version>
</parent>
- <artifactId>access-binding-hive</artifactId>
+ <artifactId>sentry-binding-hive</artifactId>
<name>Access Binding for Hive</name>
<dependencies>
<dependency>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libthrift</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derby</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libthrift</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derby</artifactId>
+ </dependency>
+ <dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<scope>test</scope>
@@ -48,11 +64,11 @@
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-core</artifactId>
+ <artifactId>sentry-core</artifactId>
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-provider-file</artifactId>
+ <artifactId>sentry-provider-file</artifactId>
<scope>test</scope>
</dependency>
<dependency>
diff --git a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingSessionHook.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingSessionHook.java
new file mode 100644
index 0000000..fefe18f
--- /dev/null
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingSessionHook.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.access.binding.hive;
+
+import org.apache.hive.service.cli.HiveSQLException;
+import org.apache.hive.service.cli.session.HiveSessionHookContext;
+
+/**
+ * The session hook wrapper for backward compatibility
+ */
+public class HiveAuthzBindingSessionHook
+ implements org.apache.hive.service.cli.session.HiveSessionHook {
+
+ private org.apache.sentry.binding.hive.HiveAuthzBindingSessionHook underlyingHook;
+ public HiveAuthzBindingSessionHook() {
+ underlyingHook = new org.apache.sentry.binding.hive.HiveAuthzBindingSessionHook();
+ }
+ @Override
+ public void run(HiveSessionHookContext sessionHookContext) throws HiveSQLException {
+ underlyingHook.run(sessionHookContext);
+ }
+
+}
diff --git a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingHook.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java
similarity index 86%
rename from access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingHook.java
rename to sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java
index 681f3aa..89c7c65 100644
--- a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingHook.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingHook.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive;
+package org.apache.sentry.binding.hive;
import static org.apache.hadoop.hive.metastore.MetaStoreUtils.DEFAULT_DATABASE_NAME;
@@ -29,19 +29,6 @@
import java.util.List;
import java.util.Set;
-import org.apache.access.binding.hive.authz.HiveAuthzBinding;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivileges;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivileges.HiveOperationScope;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivileges.HiveOperationType;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivilegesMap;
-import org.apache.access.binding.hive.conf.HiveAuthzConf;
-import org.apache.access.core.AccessURI;
-import org.apache.access.core.Action;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Authorizable.AuthorizableType;
-import org.apache.access.core.Database;
-import org.apache.access.core.Subject;
-import org.apache.access.core.Table;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.conf.HiveConf.ConfVars;
import org.apache.hadoop.hive.ql.HiveDriverFilterHook;
@@ -51,6 +38,7 @@
import org.apache.hadoop.hive.ql.exec.Task;
import org.apache.hadoop.hive.ql.hooks.Entity;
import org.apache.hadoop.hive.ql.hooks.Entity.Type;
+import org.apache.hadoop.hive.ql.hooks.Hook;
import org.apache.hadoop.hive.ql.hooks.ReadEntity;
import org.apache.hadoop.hive.ql.hooks.WriteEntity;
import org.apache.hadoop.hive.ql.metadata.AuthorizationException;
@@ -64,6 +52,20 @@
import org.apache.hadoop.hive.ql.parse.SemanticException;
import org.apache.hadoop.hive.ql.plan.HiveOperation;
import org.apache.hadoop.hive.ql.session.SessionState;
+import org.apache.sentry.binding.hive.authz.HiveAuthzBinding;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivileges;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivilegesMap;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivileges.HiveOperationScope;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivileges.HiveOperationType;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Action;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Subject;
+import org.apache.sentry.core.Table;
+import org.apache.hadoop.hive.common.JavaUtils;
+import org.apache.sentry.core.Authorizable.AuthorizableType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -84,6 +86,7 @@
public HiveAuthzBindingHook() throws Exception {
SessionState session = SessionState.get();
+ boolean depreicatedConfigFile = false;
if(session == null) {
throw new IllegalStateException("Session has not been started");
}
@@ -91,16 +94,26 @@
if(hiveConf == null) {
throw new IllegalStateException("Session HiveConf is null");
}
- String hiveAuthzConf = hiveConf.get(HiveAuthzConf.HIVE_ACCESS_CONF_URL);
+ String hiveAuthzConf = hiveConf.get(HiveAuthzConf.HIVE_SENTRY_CONF_URL);
if(hiveAuthzConf == null || (hiveAuthzConf = hiveAuthzConf.trim()).isEmpty()) {
- throw new IllegalArgumentException("Configuration key " + HiveAuthzConf.HIVE_ACCESS_CONF_URL
+ hiveAuthzConf = hiveConf.get(HiveAuthzConf.HIVE_ACCESS_CONF_URL);
+ depreicatedConfigFile = true;
+ }
+
+ if(hiveAuthzConf == null || (hiveAuthzConf = hiveAuthzConf.trim()).isEmpty()) {
+ throw new IllegalArgumentException("Configuration key " + HiveAuthzConf.HIVE_SENTRY_CONF_URL
+ " value '" + hiveAuthzConf + "' is invalid.");
}
try {
authzConf = new HiveAuthzConf(new URL(hiveAuthzConf));
} catch (MalformedURLException e) {
- throw new IllegalArgumentException("Configuration key " + HiveAuthzConf.HIVE_ACCESS_CONF_URL
- + " specifies a malformed URL '" + hiveAuthzConf + "'", e);
+ if (depreicatedConfigFile) {
+ throw new IllegalArgumentException("Configuration key " + HiveAuthzConf.HIVE_ACCESS_CONF_URL
+ + " specifies a malformed URL '" + hiveAuthzConf + "'", e);
+ } else {
+ throw new IllegalArgumentException("Configuration key " + HiveAuthzConf.HIVE_SENTRY_CONF_URL
+ + " specifies a malformed URL '" + hiveAuthzConf + "'", e);
+ }
}
hiveAuthzBinding = new HiveAuthzBinding(hiveConf, authzConf);
}
@@ -270,11 +283,27 @@
try {
authorizeWithHiveBindings(context, stmtAuthObject, stmtOperation);
} catch (AuthorizationException e) {
+ executeOnFailureHooks(context, e);
throw new SemanticException("No valid privileges", e);
}
hiveAuthzBinding.set(context.getConf());
}
+ private void executeOnFailureHooks(HiveSemanticAnalyzerHookContext context,
+ AuthorizationException e) {
+ SentryOnFailureHookContext hookCtx = new SentryOnFailureHookContextImpl(
+ context.getCommand(), context.getInputs(), context.getOutputs(),
+ currDB, currTab, udfURI, partitionURI, context.getUserName(),
+ context.getIpAddress(), e);
+ try {
+ for (Hook aofh : getHooks(HiveAuthzConf.AuthzConfVars.AUTHZ_ONFAILURE_HOOKS)) {
+ ((SentryOnFailureHook)aofh).run(hookCtx);
+ }
+ } catch (Exception ex) {
+ LOG.error("Error executing hook:", ex);
+ }
+ }
+
/**
* Convert the input/output entities into authorizables. generate
* authorizables for cases like Database and metadata operations where the
@@ -626,4 +655,57 @@
return false;
}
}
+
+ /**
+ * Returns a set of hooks specified in a configuration variable.
+ *
+ * See getHooks(HiveAuthzConf.AuthzConfVars hookConfVar, Class<T> clazz)
+ * @param hookConfVar
+ * @return
+ * @throws Exception
+ */
+ private List<Hook> getHooks(HiveAuthzConf.AuthzConfVars hookConfVar) throws Exception {
+ return getHooks(hookConfVar, Hook.class);
+ }
+
+ /**
+ * Returns the hooks specified in a configuration variable. The hooks are returned in a list in
+ * the order they were specified in the configuration variable.
+ *
+ * @param hookConfVar The configuration variable specifying a comma separated list of the hook
+ * class names.
+ * @param clazz The super type of the hooks.
+ * @return A list of the hooks cast as the type specified in clazz, in the order
+ * they are listed in the value of hookConfVar
+ * @throws Exception
+ */
+ private <T extends Hook> List<T> getHooks(HiveAuthzConf.AuthzConfVars hookConfVar, Class<T> clazz)
+ throws Exception {
+
+ List<T> hooks = new ArrayList<T>();
+ String csHooks = authzConf.get(hookConfVar.getVar(), "");
+ if (csHooks == null) {
+ return hooks;
+ }
+
+ csHooks = csHooks.trim();
+ if (csHooks.equals("")) {
+ return hooks;
+ }
+
+ String[] hookClasses = csHooks.split(",");
+
+ for (String hookClass : hookClasses) {
+ try {
+ T hook =
+ (T) Class.forName(hookClass.trim(), true, JavaUtils.getClassLoader()).newInstance();
+ hooks.add(hook);
+ } catch (ClassNotFoundException e) {
+ LOG.error(hookConfVar.getVar() + " Class not found:" + e.getMessage());
+ throw e;
+ }
+ }
+
+ return hooks;
+ }
}
diff --git a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingPreExecHook.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingPreExecHook.java
similarity index 89%
rename from access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingPreExecHook.java
rename to sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingPreExecHook.java
index 6e07818..28812c5 100644
--- a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingPreExecHook.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingPreExecHook.java
@@ -14,20 +14,20 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive;
+package org.apache.sentry.binding.hive;
import java.util.ArrayList;
import java.util.List;
-import org.apache.access.binding.hive.authz.HiveAuthzBinding;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivileges.HiveExtendedOperation;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivilegesMap;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Subject;
import org.apache.hadoop.hive.ql.QueryPlan;
import org.apache.hadoop.hive.ql.hooks.ExecuteWithHookContext;
import org.apache.hadoop.hive.ql.hooks.HookContext;
import org.apache.hadoop.hive.ql.plan.HiveOperation;
+import org.apache.sentry.binding.hive.authz.HiveAuthzBinding;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivilegesMap;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivileges.HiveExtendedOperation;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Subject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingSessionHook.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingSessionHook.java
similarity index 81%
rename from access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingSessionHook.java
rename to sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingSessionHook.java
index be334dd..f584b9b 100644
--- a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/HiveAuthzBindingSessionHook.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/HiveAuthzBindingSessionHook.java
@@ -14,23 +14,23 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive;
+package org.apache.sentry.binding.hive;
-import org.apache.access.binding.hive.conf.HiveAuthzConf;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.conf.HiveConf.ConfVars;
import org.apache.hive.service.cli.HiveSQLException;
import org.apache.hive.service.cli.session.HiveSessionHookContext;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
public class HiveAuthzBindingSessionHook
implements org.apache.hive.service.cli.session.HiveSessionHook {
public static final String SEMANTIC_HOOK =
- "org.apache.access.binding.hive.HiveAuthzBindingHook";
+ "org.apache.sentry.binding.hive.HiveAuthzBindingHook";
public static final String PRE_EXEC_HOOK =
- "org.apache.access.binding.hive.HiveAuthzBindingPreExecHook";
+ "org.apache.sentry.binding.hive.HiveAuthzBindingPreExecHook";
public static final String FILTER_HOOK =
- "org.apache.access.binding.hive.HiveAuthzBindingHook";
+ "org.apache.sentry.binding.hive.HiveAuthzBindingHook";
public static final String SCRATCH_DIR_PERMISSIONS = "700";
public static final String ACCESS_RESTRICT_LIST =
ConfVars.SEMANTIC_ANALYZER_HOOK.varname + "," +
@@ -48,11 +48,13 @@
ConfVars.HIVESTATSDBCONNECTIONSTRING.varname + "," +
ConfVars.SCRATCHDIRPERMISSION.varname + "," +
HiveAuthzConf.HIVE_ACCESS_CONF_URL + "," +
- HiveAuthzConf.HIVE_ACCESS_SUBJECT_NAME;
+ HiveAuthzConf.HIVE_SENTRY_CONF_URL + "," +
+ HiveAuthzConf.HIVE_ACCESS_SUBJECT_NAME + "," +
+ HiveAuthzConf.HIVE_SENTRY_SUBJECT_NAME;
/**
- * The session hook for access authorization that sets the required session level configuration
- * 1. Setup the access hooks -
+ * The session hook for sentry authorization that sets the required session level configuration
+ * 1. Setup the sentry hooks -
* semantic, exec and filter hooks
* 2. Set additional config properties required for auth
* set HIVE_EXTENDED_ENITITY_CAPTURE = true
@@ -62,7 +64,7 @@
*/
@Override
public void run(HiveSessionHookContext sessionHookContext) throws HiveSQLException {
- // Add access hooks to the session configuration
+ // Add sentry hooks to the session configuration
HiveConf sessionConf = sessionHookContext.getSessionConf();
appendConfVar(sessionConf, ConfVars.SEMANTIC_ANALYZER_HOOK, SEMANTIC_HOOK);
@@ -76,18 +78,19 @@
// set user name
sessionConf.set(HiveAuthzConf.HIVE_ACCESS_SUBJECT_NAME, sessionHookContext.getSessionUser());
+ sessionConf.set(HiveAuthzConf.HIVE_SENTRY_SUBJECT_NAME, sessionHookContext.getSessionUser());
// setup restrict list
sessionConf.addToRestrictList(ACCESS_RESTRICT_LIST);
}
- // Setup given access hooks
- private void appendConfVar(HiveConf sessionConf, ConfVars confVar, String accessConfVal) {
+ // Setup given sentry hooks
+ private void appendConfVar(HiveConf sessionConf, ConfVars confVar, String sentryConfVal) {
String currentValue = sessionConf.getVar(confVar);
if ((currentValue == null) || currentValue.isEmpty()) {
- currentValue = accessConfVal;
+ currentValue = sentryConfVal;
} else {
- currentValue = accessConfVal + "," + currentValue;
+ currentValue = sentryConfVal + "," + currentValue;
}
sessionConf.setVar(confVar, currentValue);
}
diff --git a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHook.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHook.java
new file mode 100644
index 0000000..45a2925
--- /dev/null
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHook.java
@@ -0,0 +1,38 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.sentry.binding.hive;
+
+import org.apache.hadoop.hive.ql.hooks.Hook;
+
+/**
+ *
+ * SentryOnFailureHook allows Sentry to be extended
+ * with custom logic to be executed upon authorization failure.
+ *
+ */
+public interface SentryOnFailureHook extends Hook {
+
+ /**
+ *
+ * @param context
+ * The hook context passed to each hook.
+ * @throws Exception
+ */
+ void run(SentryOnFailureHookContext context) throws Exception;
+}
diff --git a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHookContext.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHookContext.java
new file mode 100644
index 0000000..3b179e6
--- /dev/null
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHookContext.java
@@ -0,0 +1,89 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.sentry.binding.hive;
+
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Table;
+import org.apache.hadoop.hive.ql.exec.Task;
+import org.apache.hadoop.hive.ql.hooks.ReadEntity;
+import org.apache.hadoop.hive.ql.hooks.WriteEntity;
+import org.apache.hadoop.hive.ql.metadata.AuthorizationException;
+
+import java.io.Serializable;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * Context information provided by Access to implementations
+ * of AccessOnFailureHook
+ */
+public interface SentryOnFailureHookContext {
+
+ /**
+ * @return the command attempted by user
+ */
+ public String getCommand();
+
+ /**
+ * @return the set of read entities
+ */
+ public Set<ReadEntity> getInputs();
+
+ /**
+ * @return the set of write entities
+ */
+ public Set<WriteEntity> getOutputs();
+
+ /**
+ * @return the user name
+ */
+ public String getUserName();
+
+ /**
+ * @return the ip address
+ */
+ public String getIpAddress();
+
+ /**
+ * @return the database object
+ */
+ public Database getDatabase();
+
+ /**
+ * @return the table object
+ */
+ public Table getTable();
+
+ /**
+ * @return the udf URI
+ */
+ public AccessURI getUdfURI();
+
+ /**
+ * @return the partition URI
+ */
+ public AccessURI getPartitionURI();
+
+ /**
+ * @return the authorization failure exception
+ */
+ public AuthorizationException getException();
+
+}
diff --git a/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHookContextImpl.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHookContextImpl.java
new file mode 100644
index 0000000..c1d31ce
--- /dev/null
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/SentryOnFailureHookContextImpl.java
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.sentry.binding.hive;
+
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Table;
+import org.apache.hadoop.hive.ql.exec.Task;
+import org.apache.hadoop.hive.ql.hooks.ReadEntity;
+import org.apache.hadoop.hive.ql.hooks.WriteEntity;
+import org.apache.hadoop.hive.ql.metadata.AuthorizationException;
+
+import java.io.Serializable;
+import java.util.List;
+import java.util.Set;
+
+public class SentryOnFailureHookContextImpl implements SentryOnFailureHookContext {
+
+ private final String command;
+ private final Set<ReadEntity> inputs;
+ private final Set<WriteEntity> outputs;
+ private final String userName;
+ private final String ipAddress;
+ private final Database database;
+ private final Table table;
+ private final AccessURI udfURI;
+ private final AccessURI partitionURI;
+ private final AuthorizationException authException;
+
+ public SentryOnFailureHookContextImpl(String command,
+ Set<ReadEntity> inputs, Set<WriteEntity> outputs, Database db,
+ Table tab, AccessURI udfURI, AccessURI partitionURI,
+ String userName, String ipAddress, AuthorizationException e) {
+ this.command = command;
+ this.inputs = inputs;
+ this.outputs = outputs;
+ this.userName = userName;
+ this.ipAddress = ipAddress;
+ this.database = db;
+ this.table = tab;
+ this.udfURI = udfURI;
+ this.partitionURI = partitionURI;
+ this.authException = e;
+ }
+
+ @Override
+ public String getCommand() {
+ return command;
+ }
+
+ @Override
+ public Set<ReadEntity> getInputs() {
+ return inputs;
+ }
+
+ @Override
+ public Set<WriteEntity> getOutputs() {
+ return outputs;
+ }
+
+ @Override
+ public String getUserName() {
+ return userName;
+ }
+
+ @Override
+ public String getIpAddress() {
+ return ipAddress;
+ }
+
+ @Override
+ public Database getDatabase() {
+ return database;
+ }
+
+ @Override
+ public Table getTable() {
+ return table;
+ }
+
+ @Override
+ public AccessURI getUdfURI() {
+ return udfURI;
+ }
+
+ @Override
+ public AccessURI getPartitionURI() {
+ return partitionURI;
+ }
+
+ @Override
+ public AuthorizationException getException() {
+ return authException;
+ }
+}
diff --git a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzBinding.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzBinding.java
similarity index 94%
rename from access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzBinding.java
rename to sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzBinding.java
index 441d790..5190ba6 100644
--- a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzBinding.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzBinding.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive.authz;
+package org.apache.sentry.binding.hive.authz;
import java.lang.reflect.Constructor;
import java.util.EnumSet;
@@ -23,15 +23,6 @@
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicInteger;
-import org.apache.access.binding.hive.conf.HiveAuthzConf;
-import org.apache.access.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
-import org.apache.access.core.Action;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Authorizable.AuthorizableType;
-import org.apache.access.core.AuthorizationProvider;
-import org.apache.access.core.NoAuthorizationProvider;
-import org.apache.access.core.Server;
-import org.apache.access.core.Subject;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.CommonConfigurationKeys;
import org.apache.hadoop.hive.conf.HiveConf;
@@ -39,6 +30,15 @@
import org.apache.hadoop.hive.ql.metadata.AuthorizationException;
import org.apache.hadoop.hive.ql.plan.HiveOperation;
import org.apache.hadoop.hive.ql.session.SessionState;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
+import org.apache.sentry.core.Action;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.AuthorizationProvider;
+import org.apache.sentry.core.NoAuthorizationProvider;
+import org.apache.sentry.core.Server;
+import org.apache.sentry.core.Subject;
+import org.apache.sentry.core.Authorizable.AuthorizableType;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzPrivileges.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivileges.java
similarity index 96%
rename from access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzPrivileges.java
rename to sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivileges.java
index fbfcb31..2c480ef 100644
--- a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzPrivileges.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivileges.java
@@ -14,14 +14,14 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive.authz;
+package org.apache.sentry.binding.hive.authz;
import java.util.EnumSet;
import java.util.HashMap;
import java.util.Map;
-import org.apache.access.core.Action;
-import org.apache.access.core.Authorizable.AuthorizableType;
+import org.apache.sentry.core.Action;
+import org.apache.sentry.core.Authorizable.AuthorizableType;
/**
* Hive objects with required access privileges mapped to auth provider privileges
diff --git a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzPrivilegesMap.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivilegesMap.java
similarity index 96%
rename from access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzPrivilegesMap.java
rename to sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivilegesMap.java
index f6d3d16..7b6c598 100644
--- a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/authz/HiveAuthzPrivilegesMap.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/authz/HiveAuthzPrivilegesMap.java
@@ -14,18 +14,18 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive.authz;
+package org.apache.sentry.binding.hive.authz;
import java.util.EnumSet;
import java.util.HashMap;
import java.util.Map;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivileges.HiveExtendedOperation;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivileges.HiveOperationScope;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivileges.HiveOperationType;
-import org.apache.access.core.Action;
-import org.apache.access.core.Authorizable.AuthorizableType;
import org.apache.hadoop.hive.ql.plan.HiveOperation;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivileges.HiveExtendedOperation;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivileges.HiveOperationScope;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivileges.HiveOperationType;
+import org.apache.sentry.core.Action;
+import org.apache.sentry.core.Authorizable.AuthorizableType;
public class HiveAuthzPrivilegesMap {
private static final Map <HiveOperation, HiveAuthzPrivileges> hiveAuthzStmtPrivMap =
diff --git a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/conf/HiveAuthzConf.java b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/conf/HiveAuthzConf.java
similarity index 60%
rename from access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/conf/HiveAuthzConf.java
rename to sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/conf/HiveAuthzConf.java
index 59650bf..bfd58fa 100644
--- a/access-binding/access-binding-hive/src/main/java/org/apache/access/binding/hive/conf/HiveAuthzConf.java
+++ b/sentry-binding/sentry-binding-hive/src/main/java/org/apache/sentry/binding/hive/conf/HiveAuthzConf.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive.conf;
+package org.apache.sentry.binding.hive.conf;
import java.net.URL;
import java.util.HashMap;
@@ -22,6 +22,7 @@
import java.util.Map.Entry;
import org.apache.hadoop.conf.Configuration;
+import org.mortbay.log.Log;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -29,23 +30,37 @@
public class HiveAuthzConf extends Configuration {
/**
- * Configuration key used in hive-site.xml to point at access-site.xml
+ * Configuration key used in hive-site.xml to point at sentry-site.xml
*/
public static final String HIVE_ACCESS_CONF_URL = "hive.access.conf.url";
+ public static final String HIVE_SENTRY_CONF_URL = "hive.sentry.conf.url";
public static final String HIVE_ACCESS_SUBJECT_NAME = "hive.access.subject.name";
+ public static final String HIVE_SENTRY_SUBJECT_NAME = "hive.sentry.subject.name";
/**
* Config setting definitions
*/
public static enum AuthzConfVars {
- AUTHZ_PROVIDER("hive.access.provider",
- "org.apache.access.provider.file.ResourceAuthorizationProvider"),
- AUTHZ_PROVIDER_RESOURCE("hive.access.provider.resource", ""),
- AUTHZ_SERVER_NAME("hive.access.server", "HS2"),
- AUTHZ_RESTRICT_DEFAULT_DB("hive.access.restrict.defaultDB", "false"),
- ACCESS_TESTING_MODE("hive.access.testing.mode", "false"),
- AUTHZ_UDF_WHITELIST("hive.access.udf.whitelist", HIVE_UDF_WHITE_LIST),
- AUTHZ_ALLOW_HIVE_IMPERSONATION("hive.access.allow.hive.impersonation", "false"),
+ AUTHZ_PROVIDER("hive.sentry.provider",
+ "org.apache.sentry.provider.file.ResourceAuthorizationProvider"),
+ AUTHZ_PROVIDER_RESOURCE("hive.sentry.provider.resource", ""),
+ AUTHZ_SERVER_NAME("hive.sentry.server", "HS2"),
+ AUTHZ_RESTRICT_DEFAULT_DB("hive.sentry.restrict.defaultDB", "false"),
+ ACCESS_TESTING_MODE("hive.sentry.testing.mode", "false"),
+ AUTHZ_UDF_WHITELIST("hive.sentry.udf.whitelist", HIVE_UDF_WHITE_LIST),
+ AUTHZ_ALLOW_HIVE_IMPERSONATION("hive.sentry.allow.hive.impersonation", "false"),
+ AUTHZ_ONFAILURE_HOOKS("hive.sentry.failure.hooks", ""),
+
+ AUTHZ_PROVIDER_DEPRECATED("hive.access.provider",
+ "org.apache.sentry.provider.file.ResourceAuthorizationProvider"),
+ AUTHZ_PROVIDER_RESOURCE_DEPRECATED("hive.access.provider.resource", ""),
+ AUTHZ_SERVER_NAME_DEPRECATED("hive.access.server", "HS2"),
+ AUTHZ_RESTRICT_DEFAULT_DB_DEPRECATED("hive.access.restrict.defaultDB", "false"),
+ ACCESS_TESTING_MODE_DEPRECATED("hive.access.testing.mode", "false"),
+ AUTHZ_UDF_WHITELIST_DEPRECATED("hive.access.udf.whitelist", HIVE_UDF_WHITE_LIST),
+ AUTHZ_ALLOW_HIVE_IMPERSONATION_DEPRECATED("hive.access.allow.hive.impersonation", "false"),
+ AUTHZ_ONFAILURE_HOOKS_DEPRECATED("hive.access.failure.hooks", ""),
+
;
private final String varName;
@@ -93,10 +108,23 @@
"variance,weekofyear,when,xpath,xpath_boolean,xpath_double,xpath_float,xpath_int,xpath_long," +
"xpath_number,xpath_short,xpath_string,year";
+ private static final Map<String, AuthzConfVars> deprecatedConfigs =
+ new HashMap<String, AuthzConfVars>();
+ static {
+ deprecatedConfigs.put(AuthzConfVars.AUTHZ_PROVIDER_DEPRECATED.getVar(), AuthzConfVars.AUTHZ_PROVIDER);
+ deprecatedConfigs.put(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE_DEPRECATED.getVar(), AuthzConfVars.AUTHZ_PROVIDER_RESOURCE);
+ deprecatedConfigs.put(AuthzConfVars.AUTHZ_SERVER_NAME_DEPRECATED.getVar(), AuthzConfVars.AUTHZ_SERVER_NAME);
+ deprecatedConfigs.put(AuthzConfVars.AUTHZ_RESTRICT_DEFAULT_DB_DEPRECATED.getVar(), AuthzConfVars.AUTHZ_RESTRICT_DEFAULT_DB);
+ deprecatedConfigs.put(AuthzConfVars.ACCESS_TESTING_MODE_DEPRECATED.getVar(), AuthzConfVars.ACCESS_TESTING_MODE);
+ deprecatedConfigs.put(AuthzConfVars.AUTHZ_UDF_WHITELIST_DEPRECATED.getVar(), AuthzConfVars.AUTHZ_UDF_WHITELIST);
+ deprecatedConfigs.put(AuthzConfVars.AUTHZ_ALLOW_HIVE_IMPERSONATION_DEPRECATED.getVar(), AuthzConfVars.AUTHZ_ALLOW_HIVE_IMPERSONATION);
+ deprecatedConfigs.put(AuthzConfVars.AUTHZ_ONFAILURE_HOOKS_DEPRECATED.getVar(), AuthzConfVars.AUTHZ_ONFAILURE_HOOKS);
+ };
+
@SuppressWarnings("unused")
private static final Logger LOG = LoggerFactory
.getLogger(HiveAuthzConf.class);
- public static final String AUTHZ_SITE_FILE = "access-site.xml";
+ public static final String AUTHZ_SITE_FILE = "sentry-site.xml";
public HiveAuthzConf(URL hiveAuthzSiteURL) {
super(false);
@@ -134,8 +162,17 @@
public String get(String varName) {
String retVal = super.get(varName);
if (retVal == null) {
- retVal = AuthzConfVars.getDefault(varName);
+ // check if the deprecated value is set here
+ if (deprecatedConfigs.containsKey(varName)) {
+ retVal = super.get(deprecatedConfigs.get(varName).getVar());
+ }
+ if (retVal == null) {
+ retVal = AuthzConfVars.getDefault(varName);
+ } else {
+ Log.info("Using the deprecated config setting " + deprecatedConfigs.get(varName).getVar() +
+ " instead of " + varName);
+ }
}
return retVal;
}
-}
\ No newline at end of file
+}
diff --git a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/MockUserToGroupMapping.java b/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/MockUserToGroupMapping.java
similarity index 91%
rename from access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/MockUserToGroupMapping.java
rename to sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/MockUserToGroupMapping.java
index e46e7a5..881712b 100644
--- a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/MockUserToGroupMapping.java
+++ b/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/MockUserToGroupMapping.java
@@ -15,11 +15,11 @@
* limitations under the License.
*/
-package org.apache.access.binding.hive;
+package org.apache.sentry.binding.hive;
import java.util.List;
-import org.apache.access.provider.file.GroupMappingService;
+import org.apache.sentry.provider.file.GroupMappingService;
import com.google.common.collect.Lists;
diff --git a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestHiveAuthzBindings.java b/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestHiveAuthzBindings.java
similarity index 94%
rename from access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestHiveAuthzBindings.java
rename to sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestHiveAuthzBindings.java
index c3f254b..20d4e8f 100644
--- a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestHiveAuthzBindings.java
+++ b/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestHiveAuthzBindings.java
@@ -14,31 +14,31 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive;
+package org.apache.sentry.binding.hive;
import java.io.File;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
-import org.apache.access.binding.hive.authz.HiveAuthzBinding;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivileges;
-import org.apache.access.binding.hive.authz.HiveAuthzPrivilegesMap;
-import org.apache.access.binding.hive.conf.HiveAuthzConf;
-import org.apache.access.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
-import org.apache.access.core.AccessConstants;
-import org.apache.access.core.AccessURI;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Database;
-import org.apache.access.core.Server;
-import org.apache.access.core.Subject;
-import org.apache.access.core.Table;
-import org.apache.access.provider.file.PolicyFiles;
import org.apache.commons.io.FileUtils;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.conf.HiveConf.ConfVars;
import org.apache.hadoop.hive.ql.metadata.AuthorizationException;
import org.apache.hadoop.hive.ql.plan.HiveOperation;
+import org.apache.sentry.binding.hive.authz.HiveAuthzBinding;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivileges;
+import org.apache.sentry.binding.hive.authz.HiveAuthzPrivilegesMap;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
+import org.apache.sentry.core.AccessConstants;
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Server;
+import org.apache.sentry.core.Subject;
+import org.apache.sentry.core.Table;
+import org.apache.sentry.provider.file.PolicyFiles;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
@@ -103,7 +103,7 @@
// create auth configuration
authzConf.set(AuthzConfVars.AUTHZ_PROVIDER.getVar(),
- "org.apache.access.provider.file.LocalGroupResourceAuthorizationProvider");
+ "org.apache.sentry.provider.file.LocalGroupResourceAuthorizationProvider");
authzConf.set(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE.getVar(),
new File(baseDir, RESOURCE_PATH).getPath());
authzConf.set(AuthzConfVars.AUTHZ_SERVER_NAME.getVar(), SERVER1);
diff --git a/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestHiveAuthzConf.java b/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestHiveAuthzConf.java
new file mode 100644
index 0000000..de59546
--- /dev/null
+++ b/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestHiveAuthzConf.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.sentry.binding.hive;
+
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+import com.google.common.io.Resources;
+
+public class TestHiveAuthzConf {
+ private HiveAuthzConf authzConf;
+ private HiveAuthzConf authzDepConf;
+
+ @Before
+ public void setUp() {
+ authzConf = new HiveAuthzConf(Resources.getResource("sentry-site.xml"));
+ authzDepConf = new HiveAuthzConf(Resources.getResource("access-site.xml"));
+ }
+
+ @Test
+ public void testConfig() {
+ Assert.assertEquals("org.apache.sentry.provider.file.fooProvider",
+ authzDepConf.get(AuthzConfVars.AUTHZ_PROVIDER_DEPRECATED.getVar()));
+ Assert.assertEquals("org.apache.sentry.provider.file.fooProvider",
+ authzConf.get(AuthzConfVars.AUTHZ_PROVIDER.getVar()));
+ }
+
+ @Test
+ public void testConfigOverload() {
+ authzConf.set(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE.getVar(), "fooFile");
+ Assert.assertEquals("fooFile",
+ authzConf.get(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE.getVar()));
+ authzDepConf.set(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE_DEPRECATED.getVar(), "fooFile");
+ Assert.assertEquals("fooFile",
+ authzDepConf.get(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE_DEPRECATED.getVar()));
+ }
+
+ /**
+ * Check the deprecated properties from the config files that doesn't explicitly set it
+ */
+ @Test
+ public void testDeprecatedConfig() {
+ Assert.assertEquals("classpath:test-authz-provider.ini",
+ authzConf.get(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE_DEPRECATED.getVar()));
+ }
+}
diff --git a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestURI.java b/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestURI.java
similarity index 95%
rename from access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestURI.java
rename to sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestURI.java
index 91c803f..1853559 100644
--- a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/TestURI.java
+++ b/sentry-binding/sentry-binding-hive/src/test/java/org/apache/sentry/binding/hive/TestURI.java
@@ -14,12 +14,13 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.binding.hive;
+package org.apache.sentry.binding.hive;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.conf.HiveConf.ConfVars;
import org.apache.hadoop.hive.ql.parse.SemanticException;
import org.apache.hadoop.hive.ql.session.SessionState;
+import org.apache.sentry.binding.hive.HiveAuthzBindingHook;
import org.junit.Assert;
import org.junit.BeforeClass;
import org.junit.Test;
diff --git a/access-binding/access-binding-hive/src/test/resources/access-site.xml b/sentry-binding/sentry-binding-hive/src/test/resources/access-site.xml
similarity index 94%
rename from access-binding/access-binding-hive/src/test/resources/access-site.xml
rename to sentry-binding/sentry-binding-hive/src/test/resources/access-site.xml
index 6a5ddff..1936c21 100644
--- a/access-binding/access-binding-hive/src/test/resources/access-site.xml
+++ b/sentry-binding/sentry-binding-hive/src/test/resources/access-site.xml
@@ -20,7 +20,7 @@
<configuration>
<property>
<name>hive.access.provider</name>
- <value>org.apache.access.provider.file.fooProvider</value>
+ <value>org.apache.sentry.provider.file.fooProvider</value>
</property>
<property>
<name>hive.access.provider.resource</name>
diff --git a/access-binding/access-binding-hive/src/test/resources/log4j.properties b/sentry-binding/sentry-binding-hive/src/test/resources/log4j.properties
similarity index 100%
rename from access-binding/access-binding-hive/src/test/resources/log4j.properties
rename to sentry-binding/sentry-binding-hive/src/test/resources/log4j.properties
diff --git a/access-binding/access-binding-hive/src/test/resources/access-site.xml b/sentry-binding/sentry-binding-hive/src/test/resources/sentry-site.xml
similarity index 84%
copy from access-binding/access-binding-hive/src/test/resources/access-site.xml
copy to sentry-binding/sentry-binding-hive/src/test/resources/sentry-site.xml
index 6a5ddff..beef40d 100644
--- a/access-binding/access-binding-hive/src/test/resources/access-site.xml
+++ b/sentry-binding/sentry-binding-hive/src/test/resources/sentry-site.xml
@@ -19,16 +19,16 @@
<configuration>
<property>
- <name>hive.access.provider</name>
- <value>org.apache.access.provider.file.fooProvider</value>
+ <name>hive.sentry.provider</name>
+ <value>org.apache.sentry.provider.file.fooProvider</value>
</property>
<property>
- <name>hive.access.provider.resource</name>
+ <name>hive.sentry.provider.resource</name>
<value>classpath:test-authz-provider.ini</value>
</property>
<property>
- <name>hive.access.server</name>
+ <name>hive.sentry.server</name>
<value>myHS2</value>
</property>
</configuration>
-
+
diff --git a/access-binding/access-binding-hive/src/test/resources/test-authz-provider.ini b/sentry-binding/sentry-binding-hive/src/test/resources/test-authz-provider.ini
similarity index 100%
rename from access-binding/access-binding-hive/src/test/resources/test-authz-provider.ini
rename to sentry-binding/sentry-binding-hive/src/test/resources/test-authz-provider.ini
diff --git a/access-core/pom.xml b/sentry-core/pom.xml
similarity index 94%
rename from access-core/pom.xml
rename to sentry-core/pom.xml
index 5ceaf16..5466009 100644
--- a/access-core/pom.xml
+++ b/sentry-core/pom.xml
@@ -20,12 +20,12 @@
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access</artifactId>
+ <artifactId>sentry</artifactId>
<version>1.1.0-SNAPSHOT</version>
</parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-core</artifactId>
+ <artifactId>sentry-core</artifactId>
<name>Access core</name>
<dependencies>
diff --git a/access-core/src/main/java/org/apache/access/core/AccessConstants.java b/sentry-core/src/main/java/org/apache/sentry/core/AccessConstants.java
similarity index 96%
rename from access-core/src/main/java/org/apache/access/core/AccessConstants.java
rename to sentry-core/src/main/java/org/apache/sentry/core/AccessConstants.java
index 38a2ba0..7551a1d 100644
--- a/access-core/src/main/java/org/apache/access/core/AccessConstants.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/AccessConstants.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public class AccessConstants {
diff --git a/access-core/src/main/java/org/apache/access/core/AccessURI.java b/sentry-core/src/main/java/org/apache/sentry/core/AccessURI.java
similarity index 97%
rename from access-core/src/main/java/org/apache/access/core/AccessURI.java
rename to sentry-core/src/main/java/org/apache/sentry/core/AccessURI.java
index 42c18eb..e6d817e 100644
--- a/access-core/src/main/java/org/apache/access/core/AccessURI.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/AccessURI.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public class AccessURI implements Authorizable {
/**
diff --git a/access-core/src/main/java/org/apache/access/core/Action.java b/sentry-core/src/main/java/org/apache/sentry/core/Action.java
similarity index 96%
rename from access-core/src/main/java/org/apache/access/core/Action.java
rename to sentry-core/src/main/java/org/apache/sentry/core/Action.java
index 3a847c9..94e1984 100644
--- a/access-core/src/main/java/org/apache/access/core/Action.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/Action.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public enum Action {
diff --git a/access-core/src/main/java/org/apache/access/core/Authorizable.java b/sentry-core/src/main/java/org/apache/sentry/core/Authorizable.java
similarity index 96%
rename from access-core/src/main/java/org/apache/access/core/Authorizable.java
rename to sentry-core/src/main/java/org/apache/sentry/core/Authorizable.java
index 73df183..2849a9f 100644
--- a/access-core/src/main/java/org/apache/access/core/Authorizable.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/Authorizable.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public interface Authorizable {
diff --git a/access-core/src/main/java/org/apache/access/core/AuthorizationProvider.java b/sentry-core/src/main/java/org/apache/sentry/core/AuthorizationProvider.java
similarity index 97%
rename from access-core/src/main/java/org/apache/access/core/AuthorizationProvider.java
rename to sentry-core/src/main/java/org/apache/sentry/core/AuthorizationProvider.java
index b5ac574..c026fce 100644
--- a/access-core/src/main/java/org/apache/access/core/AuthorizationProvider.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/AuthorizationProvider.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
import java.util.EnumSet;
import java.util.List;
diff --git a/access-core/src/main/java/org/apache/access/core/Database.java b/sentry-core/src/main/java/org/apache/sentry/core/Database.java
similarity index 97%
rename from access-core/src/main/java/org/apache/access/core/Database.java
rename to sentry-core/src/main/java/org/apache/sentry/core/Database.java
index 2f3c038..169057d 100644
--- a/access-core/src/main/java/org/apache/access/core/Database.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/Database.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public class Database implements Authorizable {
diff --git a/access-core/src/main/java/org/apache/access/core/NoAuthorizationProvider.java b/sentry-core/src/main/java/org/apache/sentry/core/NoAuthorizationProvider.java
similarity index 97%
rename from access-core/src/main/java/org/apache/access/core/NoAuthorizationProvider.java
rename to sentry-core/src/main/java/org/apache/sentry/core/NoAuthorizationProvider.java
index 1e448b7..a0a6201 100644
--- a/access-core/src/main/java/org/apache/access/core/NoAuthorizationProvider.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/NoAuthorizationProvider.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
import java.util.EnumSet;
import java.util.List;
diff --git a/access-core/src/main/java/org/apache/access/core/Server.java b/sentry-core/src/main/java/org/apache/sentry/core/Server.java
similarity index 97%
rename from access-core/src/main/java/org/apache/access/core/Server.java
rename to sentry-core/src/main/java/org/apache/sentry/core/Server.java
index 0c95666..caed9a9 100644
--- a/access-core/src/main/java/org/apache/access/core/Server.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/Server.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public class Server implements Authorizable {
diff --git a/access-core/src/main/java/org/apache/access/core/ServerResource.java b/sentry-core/src/main/java/org/apache/sentry/core/ServerResource.java
similarity index 95%
rename from access-core/src/main/java/org/apache/access/core/ServerResource.java
rename to sentry-core/src/main/java/org/apache/sentry/core/ServerResource.java
index bdbdd57..91334dc 100644
--- a/access-core/src/main/java/org/apache/access/core/ServerResource.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/ServerResource.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public enum ServerResource {
UDFS();
diff --git a/access-core/src/main/java/org/apache/access/core/Subject.java b/sentry-core/src/main/java/org/apache/sentry/core/Subject.java
similarity index 96%
rename from access-core/src/main/java/org/apache/access/core/Subject.java
rename to sentry-core/src/main/java/org/apache/sentry/core/Subject.java
index 111895e..fa5cd6e 100644
--- a/access-core/src/main/java/org/apache/access/core/Subject.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/Subject.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public class Subject {
diff --git a/access-core/src/main/java/org/apache/access/core/Table.java b/sentry-core/src/main/java/org/apache/sentry/core/Table.java
similarity index 97%
rename from access-core/src/main/java/org/apache/access/core/Table.java
rename to sentry-core/src/main/java/org/apache/sentry/core/Table.java
index 47cc724..9053d9a 100644
--- a/access-core/src/main/java/org/apache/access/core/Table.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/Table.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public class Table implements TableOrView {
diff --git a/access-core/src/main/java/org/apache/access/core/TableOrView.java b/sentry-core/src/main/java/org/apache/sentry/core/TableOrView.java
similarity index 95%
rename from access-core/src/main/java/org/apache/access/core/TableOrView.java
rename to sentry-core/src/main/java/org/apache/sentry/core/TableOrView.java
index 1cbb2e0..d6f8837 100644
--- a/access-core/src/main/java/org/apache/access/core/TableOrView.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/TableOrView.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public interface TableOrView extends Authorizable {
diff --git a/access-core/src/main/java/org/apache/access/core/View.java b/sentry-core/src/main/java/org/apache/sentry/core/View.java
similarity index 97%
rename from access-core/src/main/java/org/apache/access/core/View.java
rename to sentry-core/src/main/java/org/apache/sentry/core/View.java
index bed52ed..471a09c 100644
--- a/access-core/src/main/java/org/apache/access/core/View.java
+++ b/sentry-core/src/main/java/org/apache/sentry/core/View.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.core;
+package org.apache.sentry.core;
public class View implements TableOrView {
diff --git a/access-core/src/test/java/org/apache/access/core/TestURI.java b/sentry-core/src/test/java/org/apache/sentry/core/TestURI.java
similarity index 94%
rename from access-core/src/test/java/org/apache/access/core/TestURI.java
rename to sentry-core/src/test/java/org/apache/sentry/core/TestURI.java
index 6cb7689..5507285 100644
--- a/access-core/src/test/java/org/apache/access/core/TestURI.java
+++ b/sentry-core/src/test/java/org/apache/sentry/core/TestURI.java
@@ -1,4 +1,4 @@
-package org.apache.access.core;
+package org.apache.sentry.core;
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
@@ -17,6 +17,7 @@
*/
+import org.apache.sentry.core.AccessURI;
import org.junit.Test;
public class TestURI {
diff --git a/access-dist/pom.xml b/sentry-dist/pom.xml
similarity index 88%
rename from access-dist/pom.xml
rename to sentry-dist/pom.xml
index d37ab2d..30a3494 100644
--- a/access-dist/pom.xml
+++ b/sentry-dist/pom.xml
@@ -19,24 +19,24 @@
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access</artifactId>
+ <artifactId>sentry</artifactId>
<version>1.1.0-SNAPSHOT</version>
</parent>
- <artifactId>access-dist</artifactId>
+ <artifactId>sentry-dist</artifactId>
<name>Access Distribution</name>
<description>Access distribution</description>
<dependencies>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-core</artifactId>
+ <artifactId>sentry-core</artifactId>
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-binding-hive</artifactId>
+ <artifactId>sentry-binding-hive</artifactId>
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-provider-file</artifactId>
+ <artifactId>sentry-provider-file</artifactId>
</dependency>
</dependencies>
<build>
@@ -53,7 +53,7 @@
</goals>
<inherited>false</inherited>
<configuration>
- <finalName>access-${project.version}</finalName>
+ <finalName>sentry-${project.version}</finalName>
<descriptors>
<descriptor>src/main/assembly/src.xml</descriptor>
</descriptors>
diff --git a/access-dist/src/main/assembly/src.xml b/sentry-dist/src/main/assembly/src.xml
similarity index 80%
rename from access-dist/src/main/assembly/src.xml
rename to sentry-dist/src/main/assembly/src.xml
index 1964f40..05ea8f7 100644
--- a/access-dist/src/main/assembly/src.xml
+++ b/sentry-dist/src/main/assembly/src.xml
@@ -28,7 +28,7 @@
<format>tar.gz</format>
</formats>
- <baseDirectory>access-${project.version}</baseDirectory>
+ <baseDirectory>sentry-${project.version}</baseDirectory>
<moduleSets>
@@ -36,13 +36,13 @@
<useAllReactorProjects>true</useAllReactorProjects>
<includes>
- <include>com.cloudera.cdh:access-binding</include>
- <include>com.cloudera.cdh:access-binding-hive</include>
- <include>com.cloudera.cdh:access-core</include>
- <include>com.cloudera.cdh:access-provider</include>
- <include>com.cloudera.cdh:access-provider-file</include>
- <include>com.cloudera.cdh:access-tests</include>
- <include>com.cloudera.cdh:access-dist</include>
+ <include>com.cloudera.cdh:sentry-binding</include>
+ <include>com.cloudera.cdh:sentry-binding-hive</include>
+ <include>com.cloudera.cdh:sentry-core</include>
+ <include>com.cloudera.cdh:sentry-provider</include>
+ <include>com.cloudera.cdh:sentry-provider-file</include>
+ <include>com.cloudera.cdh:sentry-tests</include>
+ <include>com.cloudera.cdh:sentry-dist</include>
</includes>
<binaries>
@@ -85,11 +85,11 @@
<directory>../</directory>
<excludes>
- <exclude>access-binding/**</exclude>
- <exclude>access-core/**</exclude>
- <exclude>access-dist/**</exclude>
- <exclude>access-provider/**</exclude>
- <exclude>access-test/**</exclude>
+ <exclude>sentry-binding/**</exclude>
+ <exclude>sentry-core/**</exclude>
+ <exclude>sentry-dist/**</exclude>
+ <exclude>sentry-provider/**</exclude>
+ <exclude>sentry-test/**</exclude>
<exclude>**/target/**</exclude>
<exclude>**/.classpath</exclude>
<exclude>**/.project</exclude>
diff --git a/access-provider/pom.xml b/sentry-provider/pom.xml
similarity index 91%
rename from access-provider/pom.xml
rename to sentry-provider/pom.xml
index 6f42075..f9f9915 100644
--- a/access-provider/pom.xml
+++ b/sentry-provider/pom.xml
@@ -20,17 +20,17 @@
<parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access</artifactId>
+ <artifactId>sentry</artifactId>
<version>1.1.0-SNAPSHOT</version>
</parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-provider</artifactId>
+ <artifactId>sentry-provider</artifactId>
<name>Access Providers</name>
<packaging>pom</packaging>
<modules>
- <module>access-provider-file</module>
+ <module>sentry-provider-file</module>
</modules>
</project>
diff --git a/access-provider/access-provider-file/pom.xml b/sentry-provider/sentry-provider-file/pom.xml
similarity index 94%
rename from access-provider/access-provider-file/pom.xml
rename to sentry-provider/sentry-provider-file/pom.xml
index 289a6e5..fdee8cc 100644
--- a/access-provider/access-provider-file/pom.xml
+++ b/sentry-provider/sentry-provider-file/pom.xml
@@ -20,12 +20,12 @@
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-provider</artifactId>
+ <artifactId>sentry-provider</artifactId>
<version>1.1.0-SNAPSHOT</version>
</parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-provider-file</artifactId>
+ <artifactId>sentry-provider-file</artifactId>
<name>Access Provider File</name>
<dependencies>
@@ -67,7 +67,7 @@
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-core</artifactId>
+ <artifactId>sentry-core</artifactId>
</dependency>
</dependencies>
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/AbstractRoleValidator.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/AbstractRoleValidator.java
similarity index 88%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/AbstractRoleValidator.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/AbstractRoleValidator.java
index 28fdfff..35889e4 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/AbstractRoleValidator.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/AbstractRoleValidator.java
@@ -14,14 +14,14 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
-import static org.apache.access.provider.file.PolicyFileConstants.AUTHORIZABLE_SPLITTER;
-import static org.apache.access.provider.file.PolicyFileConstants.PRIVILEGE_PREFIX;
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_SPLITTER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.PRIVILEGE_PREFIX;
import java.util.List;
-import org.apache.access.core.Authorizable;
+import org.apache.sentry.core.Authorizable;
import org.apache.shiro.config.ConfigurationException;
import com.google.common.annotations.VisibleForTesting;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/Authorizables.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/Authorizables.java
similarity index 82%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/Authorizables.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/Authorizables.java
index bb7cffc..4062473 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/Authorizables.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/Authorizables.java
@@ -14,15 +14,15 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
-import org.apache.access.core.AccessURI;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Authorizable.AuthorizableType;
-import org.apache.access.core.Database;
-import org.apache.access.core.Server;
-import org.apache.access.core.Table;
-import org.apache.access.core.View;
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Server;
+import org.apache.sentry.core.Table;
+import org.apache.sentry.core.View;
+import org.apache.sentry.core.Authorizable.AuthorizableType;
public class Authorizables {
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/DatabaseMustMatch.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/DatabaseMustMatch.java
similarity index 92%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/DatabaseMustMatch.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/DatabaseMustMatch.java
index ea1c0a7..ef6486b 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/DatabaseMustMatch.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/DatabaseMustMatch.java
@@ -14,10 +14,10 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Database;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
import org.apache.shiro.config.ConfigurationException;
public class DatabaseMustMatch extends AbstractRoleValidator {
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/DatabaseRequiredInRole.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/DatabaseRequiredInRole.java
similarity index 62%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/DatabaseRequiredInRole.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/DatabaseRequiredInRole.java
index 7a3c42a..fd0f2c1 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/DatabaseRequiredInRole.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/DatabaseRequiredInRole.java
@@ -14,12 +14,13 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import javax.annotation.Nullable;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Database;
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
import org.apache.shiro.config.ConfigurationException;
public class DatabaseRequiredInRole extends AbstractRoleValidator {
@@ -33,16 +34,34 @@
Iterable<Authorizable> authorizables = parseRole(role);
/*
* Each permission in a non-global file must have a database
- * object.
+ * object except for URIs.
+ *
+ * We allow URIs to be specified in the per DB policy file for
+ * ease of mangeability. URIs will contain to remain server scope
+ * objects.
*/
boolean foundDatabaseInAuthorizables = false;
+ boolean foundURIInAuthorizables = false;
+ boolean allowURIInAuthorizables = false;
+
+ if ("true".equalsIgnoreCase(
+ System.getProperty(SimplePolicyEngine.ACCESS_ALLOW_URI_PER_DB_POLICYFILE))) {
+ allowURIInAuthorizables = true;
+ }
+
for(Authorizable authorizable : authorizables) {
if(authorizable instanceof Database) {
foundDatabaseInAuthorizables = true;
- break;
+ }
+ if (authorizable instanceof AccessURI) {
+ if (foundDatabaseInAuthorizables) {
+ String msg = "URI object is specified at DB scope in " + role;
+ throw new ConfigurationException(msg);
+ }
+ foundURIInAuthorizables = true;
}
}
- if(!foundDatabaseInAuthorizables) {
+ if(!foundDatabaseInAuthorizables && !(foundURIInAuthorizables && allowURIInAuthorizables)) {
String msg = "Missing database object in " + role;
throw new ConfigurationException(msg);
}
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/GroupMappingService.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/GroupMappingService.java
similarity index 95%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/GroupMappingService.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/GroupMappingService.java
index ebfdf30..6af2edf 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/GroupMappingService.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/GroupMappingService.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.util.List;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/HadoopGroupMappingService.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupMappingService.java
similarity index 96%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/HadoopGroupMappingService.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupMappingService.java
index 9e22730..1bbb125 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/HadoopGroupMappingService.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupMappingService.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.IOException;
import java.util.Collections;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/HadoopGroupResourceAuthorizationProvider.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupResourceAuthorizationProvider.java
similarity index 96%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/HadoopGroupResourceAuthorizationProvider.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupResourceAuthorizationProvider.java
index ac2b199..f99ae8c 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/HadoopGroupResourceAuthorizationProvider.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/HadoopGroupResourceAuthorizationProvider.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.IOException;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/KeyValue.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/KeyValue.java
similarity index 93%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/KeyValue.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/KeyValue.java
index 2921eb7..622736a 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/KeyValue.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/KeyValue.java
@@ -16,9 +16,9 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.access.provider.file;
-import static org.apache.access.provider.file.PolicyFileConstants.KV_JOINER;
-import static org.apache.access.provider.file.PolicyFileConstants.KV_SPLITTER;
+package org.apache.sentry.provider.file;
+import static org.apache.sentry.provider.file.PolicyFileConstants.KV_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.KV_SPLITTER;
import java.util.List;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/LocalGroupMappingService.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupMappingService.java
similarity index 98%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/LocalGroupMappingService.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupMappingService.java
index 2c876ea..fa3e804 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/LocalGroupMappingService.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupMappingService.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.IOException;
import java.util.Collections;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/LocalGroupResourceAuthorizationProvider.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupResourceAuthorizationProvider.java
similarity index 96%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/LocalGroupResourceAuthorizationProvider.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupResourceAuthorizationProvider.java
index 5df64d1..ef595c8 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/LocalGroupResourceAuthorizationProvider.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/LocalGroupResourceAuthorizationProvider.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.IOException;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyEngine.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyEngine.java
similarity index 94%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyEngine.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyEngine.java
index cbee32b..954e1d5 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyEngine.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyEngine.java
@@ -15,11 +15,11 @@
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.util.List;
-import org.apache.access.core.Authorizable;
+import org.apache.sentry.core.Authorizable;
import com.google.common.collect.ImmutableSetMultimap;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFile.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFile.java
similarity index 96%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFile.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFile.java
index c52c703..fafe79b 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFile.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFile.java
@@ -15,11 +15,11 @@
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
-import static org.apache.access.provider.file.PolicyFileConstants.DATABASES;
-import static org.apache.access.provider.file.PolicyFileConstants.GROUPS;
-import static org.apache.access.provider.file.PolicyFileConstants.ROLES;
+import static org.apache.sentry.provider.file.PolicyFileConstants.DATABASES;
+import static org.apache.sentry.provider.file.PolicyFileConstants.GROUPS;
+import static org.apache.sentry.provider.file.PolicyFileConstants.ROLES;
import java.io.File;
import java.io.IOException;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFileConstants.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFileConstants.java
similarity index 97%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFileConstants.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFileConstants.java
index 0f80b0a..d28cde2 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFileConstants.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFileConstants.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import com.google.common.base.Joiner;
import com.google.common.base.Splitter;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFiles.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFiles.java
similarity index 98%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFiles.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFiles.java
index 652a0e0..ff4c984 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/PolicyFiles.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/PolicyFiles.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.File;
import java.io.FileNotFoundException;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ResourceAuthorizationProvider.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ResourceAuthorizationProvider.java
similarity index 89%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ResourceAuthorizationProvider.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ResourceAuthorizationProvider.java
index 5aece44..60282e6 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ResourceAuthorizationProvider.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ResourceAuthorizationProvider.java
@@ -14,24 +14,24 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
-import static org.apache.access.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
-import static org.apache.access.provider.file.PolicyFileConstants.KV_JOINER;
-import static org.apache.access.provider.file.PolicyFileConstants.PRIVILEGE_NAME;
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.KV_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.PRIVILEGE_NAME;
import java.util.ArrayList;
import java.util.EnumSet;
import java.util.List;
-import org.apache.access.core.Action;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.AuthorizationProvider;
-import org.apache.access.core.Database;
-import org.apache.access.core.Server;
-import org.apache.access.core.ServerResource;
-import org.apache.access.core.Subject;
-import org.apache.access.core.Table;
+import org.apache.sentry.core.Action;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.AuthorizationProvider;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Server;
+import org.apache.sentry.core.ServerResource;
+import org.apache.sentry.core.Subject;
+import org.apache.sentry.core.Table;
import org.apache.shiro.authz.Permission;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/RoleValidator.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/RoleValidator.java
similarity index 95%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/RoleValidator.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/RoleValidator.java
index 02ea02f..323a18a 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/RoleValidator.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/RoleValidator.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import javax.annotation.Nullable;
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/Roles.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/Roles.java
similarity index 78%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/Roles.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/Roles.java
index 71ccdcd..556be01 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/Roles.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/Roles.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import javax.annotation.Nullable;
@@ -24,6 +24,7 @@
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSet;
import com.google.common.collect.ImmutableSetMultimap;
+import com.google.common.io.Resources;
public class Roles {
private static final Logger LOGGER = LoggerFactory
@@ -41,14 +42,27 @@
this.globalRoles = globalRoles;
this.perDatabaseRoles = perDatabaseRoles;
}
- public ImmutableSet<String> getRoles(@Nullable String database, String group) {
+ public ImmutableSet<String> getRoles(@Nullable String database, String group, Boolean isURI) {
ImmutableSet.Builder<String> resultBuilder = ImmutableSet.builder();
+ String allowURIPerDbFile =
+ System.getProperty(SimplePolicyEngine.ACCESS_ALLOW_URI_PER_DB_POLICYFILE);
+ Boolean consultPerDbRolesForURI = isURI && ("true".equalsIgnoreCase(allowURIPerDbFile));
+
if(database != null) {
ImmutableSetMultimap<String, String> dbPolicies = perDatabaseRoles.get(database);
if(dbPolicies != null && dbPolicies.containsKey(group)) {
resultBuilder.addAll(dbPolicies.get(group));
}
}
+ if (consultPerDbRolesForURI) {
+ for(String db:perDatabaseRoles.keySet()) {
+ ImmutableSetMultimap<String, String> dbPolicies = perDatabaseRoles.get(db);
+ if(dbPolicies != null && dbPolicies.containsKey(group)) {
+ resultBuilder.addAll(dbPolicies.get(group));
+ }
+ }
+ }
+
if(globalRoles.containsKey(group)) {
resultBuilder.addAll(globalRoles.get(group));
}
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ServerNameMustMatch.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ServerNameMustMatch.java
similarity index 92%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ServerNameMustMatch.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ServerNameMustMatch.java
index 020c07b..1d2a8c6 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ServerNameMustMatch.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ServerNameMustMatch.java
@@ -14,12 +14,12 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import javax.annotation.Nullable;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Server;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Server;
import org.apache.shiro.config.ConfigurationException;
public class ServerNameMustMatch extends AbstractRoleValidator {
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ServersAllIsInvalid.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ServersAllIsInvalid.java
similarity index 91%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ServersAllIsInvalid.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ServersAllIsInvalid.java
index c13fbb7..8ee1c43 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/ServersAllIsInvalid.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/ServersAllIsInvalid.java
@@ -14,12 +14,12 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import javax.annotation.Nullable;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Server;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Server;
import org.apache.shiro.config.ConfigurationException;
public class ServersAllIsInvalid extends AbstractRoleValidator {
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/SimplePolicyEngine.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/SimplePolicyEngine.java
similarity index 91%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/SimplePolicyEngine.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/SimplePolicyEngine.java
index 21f6d9c..868736c 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/SimplePolicyEngine.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/SimplePolicyEngine.java
@@ -14,9 +14,13 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
-import static org.apache.access.provider.file.PolicyFileConstants.*;
+import static org.apache.sentry.provider.file.PolicyFileConstants.DATABASES;
+import static org.apache.sentry.provider.file.PolicyFileConstants.GROUPS;
+import static org.apache.sentry.provider.file.PolicyFileConstants.ROLES;
+import static org.apache.sentry.provider.file.PolicyFileConstants.ROLE_SPLITTER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.USERS;
import java.io.FileNotFoundException;
import java.io.IOException;
@@ -29,11 +33,12 @@
import javax.annotation.Nullable;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Database;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.FileSystem;
import org.apache.hadoop.fs.Path;
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
import org.apache.shiro.config.ConfigurationException;
import org.apache.shiro.config.Ini;
import org.apache.shiro.util.PermissionUtils;
@@ -63,6 +68,7 @@
private final String serverName;
private final List<Path> perDbResources = Lists.newArrayList();
private final AtomicReference<Roles> rolesReference;
+ public final static String ACCESS_ALLOW_URI_PER_DB_POLICYFILE = "sentry.allow.uri.db.policyfile";
public SimplePolicyEngine(String resourcePath, String serverName) throws IOException {
this(new Configuration(), new Path(resourcePath), serverName);
@@ -118,11 +124,11 @@
if(perDbIni.containsKey(DATABASES)) {
throw new ConfigurationException("Per-db policy files cannot contain " + DATABASES + " section");
}
- perDatabaseRoles.put(database, parseIni(database, perDbIni));
+ ImmutableSetMultimap<String, String> currentDbRoles = parseIni(database, perDbIni);
+ perDatabaseRoles.put(database, currentDbRoles);
perDbResources.add(perDbPolicy);
} catch (Exception e) {
LOGGER.error("Error processing key " + entry.getKey() + ", skipping " + entry.getValue(), e);
- throw e;
}
}
}
@@ -239,17 +245,22 @@
public ImmutableSetMultimap<String, String> getPermissions(List<Authorizable> authorizables, List<String> groups) {
Roles roles = rolesReference.get();
String database = null;
+ Boolean isURI = false;
for(Authorizable authorizable : authorizables) {
if(authorizable instanceof Database) {
database = authorizable.getName();
}
+ if (authorizable instanceof AccessURI) {
+ isURI = true;
+ }
}
+
if(LOGGER.isDebugEnabled()) {
LOGGER.debug("Getting permissions for {} via {}", groups, database);
}
ImmutableSetMultimap.Builder<String, String> resultBuilder = ImmutableSetMultimap.builder();
for(String group : groups) {
- resultBuilder.putAll(group, roles.getRoles(database, group));
+ resultBuilder.putAll(group, roles.getRoles(database, group, isURI));
}
ImmutableSetMultimap<String, String> result = resultBuilder.build();
if(LOGGER.isDebugEnabled()) {
@@ -257,4 +268,4 @@
}
return result;
}
-}
\ No newline at end of file
+}
diff --git a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/WildcardPermission.java b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/WildcardPermission.java
similarity index 95%
rename from access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/WildcardPermission.java
rename to sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/WildcardPermission.java
index 20ba719..e989d82 100644
--- a/access-provider/access-provider-file/src/main/java/org/apache/access/provider/file/WildcardPermission.java
+++ b/sentry-provider/sentry-provider-file/src/main/java/org/apache/sentry/provider/file/WildcardPermission.java
@@ -19,19 +19,19 @@
// copied from apache shiro
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
-import static org.apache.access.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
-import static org.apache.access.provider.file.PolicyFileConstants.AUTHORIZABLE_SPLITTER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_SPLITTER;
import java.io.Serializable;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.List;
-import org.apache.access.core.AccessConstants;
-import org.apache.access.core.Authorizable.AuthorizableType;
import org.apache.commons.lang.text.StrSubstitutor;
+import org.apache.sentry.core.AccessConstants;
+import org.apache.sentry.core.Authorizable.AuthorizableType;
import org.apache.shiro.authz.Permission;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/AbstractTestSimplePolicyEngine.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/AbstractTestSimplePolicyEngine.java
similarity index 96%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/AbstractTestSimplePolicyEngine.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/AbstractTestSimplePolicyEngine.java
index 8bb101f..bfa2d68 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/AbstractTestSimplePolicyEngine.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/AbstractTestSimplePolicyEngine.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.File;
import java.io.IOException;
@@ -24,9 +24,10 @@
import junit.framework.Assert;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Database;
import org.apache.commons.io.FileUtils;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.provider.file.PolicyEngine;
import org.junit.After;
import org.junit.AfterClass;
import org.junit.Before;
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/MockGroupMappingServiceProvider.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/MockGroupMappingServiceProvider.java
similarity index 93%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/MockGroupMappingServiceProvider.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/MockGroupMappingServiceProvider.java
index be04259..74956fc 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/MockGroupMappingServiceProvider.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/MockGroupMappingServiceProvider.java
@@ -14,11 +14,12 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.util.Collection;
import java.util.List;
+import org.apache.sentry.provider.file.GroupMappingService;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestAuthorizables.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestAuthorizables.java
similarity index 89%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestAuthorizables.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestAuthorizables.java
index 853b20f..f81b574 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestAuthorizables.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestAuthorizables.java
@@ -16,15 +16,16 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import static junit.framework.Assert.assertEquals;
import static junit.framework.Assert.assertNull;
-import org.apache.access.core.AccessURI;
-import org.apache.access.core.Database;
-import org.apache.access.core.Server;
-import org.apache.access.core.Table;
-import org.apache.access.core.View;
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Server;
+import org.apache.sentry.core.Table;
+import org.apache.sentry.core.View;
+import org.apache.sentry.provider.file.Authorizables;
import org.junit.Test;
public class TestAuthorizables {
diff --git a/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestDatabaseRequiredInRole.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestDatabaseRequiredInRole.java
new file mode 100644
index 0000000..fc35043
--- /dev/null
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestDatabaseRequiredInRole.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sentry.provider.file;
+
+import junit.framework.Assert;
+
+import org.apache.shiro.config.ConfigurationException;
+import org.junit.Test;
+
+public class TestDatabaseRequiredInRole {
+
+ @Test
+ public void testURIInPerDbPolicyFile() throws Exception {
+ DatabaseRequiredInRole dbRequiredInRole = new DatabaseRequiredInRole();
+ System.setProperty("sentry.allow.uri.db.policyfile", "true");
+ dbRequiredInRole.validate("db1",
+ "server=server1->URI=file:///user/hive/warehouse/tab1");
+ System.setProperty("sentry.allow.uri.db.policyfile", "false");
+ }
+
+ @Test
+ public void testURIWithDBInPerDbPolicyFile() throws Exception {
+ DatabaseRequiredInRole dbRequiredInRole = new DatabaseRequiredInRole();
+ try {
+ dbRequiredInRole.validate("db1",
+ "server=server1->db=db1->URI=file:///user/hive/warehouse/tab1");
+ Assert.fail("Expected ConfigurationException");
+ } catch (ConfigurationException e) {
+ ;
+ }
+ }
+}
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestKeyValue.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestKeyValue.java
similarity index 93%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestKeyValue.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestKeyValue.java
index 3f419bc..1fd64f1 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestKeyValue.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestKeyValue.java
@@ -16,11 +16,12 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import static junit.framework.Assert.assertEquals;
import static junit.framework.Assert.assertFalse;
-import static org.apache.access.provider.file.PolicyFileConstants.KV_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.KV_JOINER;
+import org.apache.sentry.provider.file.KeyValue;
import org.junit.Test;
public class TestKeyValue {
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestLocalGroupMapping.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestLocalGroupMapping.java
similarity index 93%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestLocalGroupMapping.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestLocalGroupMapping.java
index 939a0c1..f1d8192 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestLocalGroupMapping.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestLocalGroupMapping.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.File;
import java.io.IOException;
@@ -23,6 +23,8 @@
import org.apache.commons.io.FileUtils;
import org.apache.hadoop.fs.Path;
+import org.apache.sentry.provider.file.LocalGroupMappingService;
+import org.apache.sentry.provider.file.PolicyFiles;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestPolicyParsingNegative.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestPolicyParsingNegative.java
similarity index 72%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestPolicyParsingNegative.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestPolicyParsingNegative.java
index 3e9fe0f..7285806 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestPolicyParsingNegative.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestPolicyParsingNegative.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.File;
import java.io.IOException;
@@ -22,10 +22,13 @@
import junit.framework.Assert;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Database;
-import org.apache.access.core.Server;
import org.apache.commons.io.FileUtils;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Server;
+import org.apache.sentry.provider.file.PolicyEngine;
+import org.apache.sentry.provider.file.PolicyFile;
+import org.apache.sentry.provider.file.SimplePolicyEngine;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
@@ -105,7 +108,7 @@
Arrays.asList(new Authorizable[] {
new Server("server1")
}), Lists.newArrayList("admin")).get("admin");
- Assert.assertTrue(permissions.toString(), permissions.isEmpty());
+ Assert.assertEquals(permissions.toString(), "[server=server1]");
// test to ensure [databases] fails parsing of per-db file
// by removing the user mapping from the per-db policy file
policyFile.removeGroupsFromUser("admin1", "admin")
@@ -115,7 +118,7 @@
Arrays.asList(new Authorizable[] {
new Server("server1")
}), Lists.newArrayList("admin")).get("admin");
- Assert.assertTrue(permissions.toString(), permissions.isEmpty());
+ Assert.assertEquals(permissions.toString(), "[server=server1]");
}
@Test
public void testDatabaseRequiredInRole() throws Exception {
@@ -177,4 +180,61 @@
Assert.assertTrue(permissions.toString(), permissions.isEmpty());
}
+ /**
+ * Create policy file with multiple per db files.
+ * Verify that a file with bad format is the only one that's ignored
+ * @throws Exception
+ */
+ @Test
+ public void testMultiDbWithErrors() throws Exception {
+ File db1PolicyFile = new File(baseDir, "db1.ini");
+ File db2PolicyFile = new File(baseDir, "db2.ini");
+
+ // global policy file
+ append("[databases]", globalPolicyFile);
+ append("db1 = " + db1PolicyFile.getPath(), globalPolicyFile);
+ append("db2 = " + db2PolicyFile.getPath(), globalPolicyFile);
+ append("[groups]", globalPolicyFile);
+ append("db3_group = db3_rule", globalPolicyFile);
+ append("[roles]", globalPolicyFile);
+ append("db3_rule = server=server1->db=db3->table=sales->action=select", globalPolicyFile);
+
+ //db1 policy file with badly formatted rule
+ append("[groups]", db1PolicyFile);
+ append("db1_group = bad_rule", db1PolicyFile);
+ append("[roles]", db1PolicyFile);
+ append("bad_rule = server=server1->db=customers->=purchases->action=", db1PolicyFile);
+
+ //db2 policy file with proper rule
+ append("[groups]", db2PolicyFile);
+ append("db2_group = db2_rule", db2PolicyFile);
+ append("[roles]", db2PolicyFile);
+ append("db2_rule = server=server1->db=db2->table=purchases->action=select", db2PolicyFile);
+
+ PolicyEngine policy = new SimplePolicyEngine(globalPolicyFile.getPath(), "server1");
+
+ // verify that the db1 rule is empty
+ ImmutableSet<String> permissions = policy.getPermissions(
+ Arrays.asList(new Authorizable[] {
+ new Server("server1"),
+ new Database("db1")
+ }), Lists.newArrayList("db1_group")).get("db1_group");
+ Assert.assertTrue(permissions.toString(), permissions.isEmpty());
+
+ permissions = policy.getPermissions(
+ Arrays.asList(new Authorizable[] {
+ new Server("server1"),
+ new Database("db2")
+ }), Lists.newArrayList("db2_group")).get("db2_group");
+ Assert.assertEquals(permissions.toString(), 1, permissions.size());
+
+ permissions = policy.getPermissions(
+ Arrays.asList(new Authorizable[] {
+ new Server("server1"),
+ new Database("db2")
+ }), Lists.newArrayList("db2_group")).get("db2_group");
+ Assert.assertEquals(permissions.toString(), 1, permissions.size());
+
+ }
+
}
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestResourceAuthorizationProviderGeneralCases.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestResourceAuthorizationProviderGeneralCases.java
similarity index 93%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestResourceAuthorizationProviderGeneralCases.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestResourceAuthorizationProviderGeneralCases.java
index 27a94ad..a8a946d 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestResourceAuthorizationProviderGeneralCases.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestResourceAuthorizationProviderGeneralCases.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.File;
import java.io.IOException;
@@ -24,14 +24,18 @@
import junit.framework.Assert;
-import org.apache.access.core.AccessConstants;
-import org.apache.access.core.Action;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.Database;
-import org.apache.access.core.Server;
-import org.apache.access.core.Subject;
-import org.apache.access.core.Table;
import org.apache.commons.io.FileUtils;
+import org.apache.sentry.core.AccessConstants;
+import org.apache.sentry.core.Action;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.Database;
+import org.apache.sentry.core.Server;
+import org.apache.sentry.core.Subject;
+import org.apache.sentry.core.Table;
+import org.apache.sentry.provider.file.HadoopGroupResourceAuthorizationProvider;
+import org.apache.sentry.provider.file.PolicyFiles;
+import org.apache.sentry.provider.file.ResourceAuthorizationProvider;
+import org.apache.sentry.provider.file.SimplePolicyEngine;
import org.junit.After;
import org.junit.Test;
import org.slf4j.Logger;
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestResourceAuthorizationProviderSpecialCases.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestResourceAuthorizationProviderSpecialCases.java
similarity index 91%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestResourceAuthorizationProviderSpecialCases.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestResourceAuthorizationProviderSpecialCases.java
index 7dd7cd8..14e2ff5 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestResourceAuthorizationProviderSpecialCases.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestResourceAuthorizationProviderSpecialCases.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.File;
import java.io.IOException;
@@ -23,13 +23,15 @@
import junit.framework.Assert;
-import org.apache.access.core.AccessURI;
-import org.apache.access.core.Action;
-import org.apache.access.core.Authorizable;
-import org.apache.access.core.AuthorizationProvider;
-import org.apache.access.core.Server;
-import org.apache.access.core.Subject;
import org.apache.commons.io.FileUtils;
+import org.apache.sentry.core.AccessURI;
+import org.apache.sentry.core.Action;
+import org.apache.sentry.core.Authorizable;
+import org.apache.sentry.core.AuthorizationProvider;
+import org.apache.sentry.core.Server;
+import org.apache.sentry.core.Subject;
+import org.apache.sentry.provider.file.LocalGroupResourceAuthorizationProvider;
+import org.apache.sentry.provider.file.PolicyFile;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestSimplePolicyEngineDFS.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestSimplePolicyEngineDFS.java
similarity index 93%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestSimplePolicyEngineDFS.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestSimplePolicyEngineDFS.java
index ef0f109..92e3b03 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestSimplePolicyEngineDFS.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestSimplePolicyEngineDFS.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.File;
import java.io.IOException;
@@ -25,6 +25,8 @@
import org.apache.hadoop.fs.FileSystem;
import org.apache.hadoop.fs.Path;
import org.apache.hadoop.hdfs.MiniDFSCluster;
+import org.apache.sentry.provider.file.PolicyFiles;
+import org.apache.sentry.provider.file.SimplePolicyEngine;
import org.junit.AfterClass;
import org.junit.BeforeClass;
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestSimplePolicyEngineLocalFS.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestSimplePolicyEngineLocalFS.java
similarity index 90%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestSimplePolicyEngineLocalFS.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestSimplePolicyEngineLocalFS.java
index 3093e4a..73cd673 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestSimplePolicyEngineLocalFS.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestSimplePolicyEngineLocalFS.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import java.io.File;
import java.io.IOException;
@@ -22,6 +22,8 @@
import junit.framework.Assert;
import org.apache.commons.io.FileUtils;
+import org.apache.sentry.provider.file.PolicyFiles;
+import org.apache.sentry.provider.file.SimplePolicyEngine;
public class TestSimplePolicyEngineLocalFS extends AbstractTestSimplePolicyEngine {
diff --git a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestWildcardPermission.java b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestWildcardPermission.java
similarity index 96%
rename from access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestWildcardPermission.java
rename to sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestWildcardPermission.java
index 2b230c6..77c3838 100644
--- a/access-provider/access-provider-file/src/test/java/org/apache/access/provider/file/TestWildcardPermission.java
+++ b/sentry-provider/sentry-provider-file/src/test/java/org/apache/sentry/provider/file/TestWildcardPermission.java
@@ -16,15 +16,17 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.access.provider.file;
+package org.apache.sentry.provider.file;
import static junit.framework.Assert.assertEquals;
import static junit.framework.Assert.assertFalse;
import static junit.framework.Assert.assertTrue;
-import static org.apache.access.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
-import static org.apache.access.provider.file.PolicyFileConstants.KV_JOINER;
-import static org.apache.access.provider.file.PolicyFileConstants.KV_SEPARATOR;
+import static org.apache.sentry.provider.file.PolicyFileConstants.AUTHORIZABLE_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.KV_JOINER;
+import static org.apache.sentry.provider.file.PolicyFileConstants.KV_SEPARATOR;
-import org.apache.access.core.AccessConstants;
+import org.apache.sentry.core.AccessConstants;
+import org.apache.sentry.provider.file.KeyValue;
+import org.apache.sentry.provider.file.WildcardPermission;
import org.apache.shiro.authz.Permission;
import org.junit.Test;
diff --git a/access-provider/access-provider-file/src/test/resources/log4j.properties b/sentry-provider/sentry-provider-file/src/test/resources/log4j.properties
similarity index 100%
rename from access-provider/access-provider-file/src/test/resources/log4j.properties
rename to sentry-provider/sentry-provider-file/src/test/resources/log4j.properties
diff --git a/access-provider/access-provider-file/src/test/resources/test-authz-provider-local-group-mapping.ini b/sentry-provider/sentry-provider-file/src/test/resources/test-authz-provider-local-group-mapping.ini
similarity index 100%
rename from access-provider/access-provider-file/src/test/resources/test-authz-provider-local-group-mapping.ini
rename to sentry-provider/sentry-provider-file/src/test/resources/test-authz-provider-local-group-mapping.ini
diff --git a/access-provider/access-provider-file/src/test/resources/test-authz-provider-other-group.ini b/sentry-provider/sentry-provider-file/src/test/resources/test-authz-provider-other-group.ini
similarity index 100%
rename from access-provider/access-provider-file/src/test/resources/test-authz-provider-other-group.ini
rename to sentry-provider/sentry-provider-file/src/test/resources/test-authz-provider-other-group.ini
diff --git a/access-provider/access-provider-file/src/test/resources/test-authz-provider.ini b/sentry-provider/sentry-provider-file/src/test/resources/test-authz-provider.ini
similarity index 100%
rename from access-provider/access-provider-file/src/test/resources/test-authz-provider.ini
rename to sentry-provider/sentry-provider-file/src/test/resources/test-authz-provider.ini
diff --git a/access-tests/pom.xml b/sentry-tests/pom.xml
similarity index 92%
rename from access-tests/pom.xml
rename to sentry-tests/pom.xml
index 5ce26d5..22e6cde 100644
--- a/access-tests/pom.xml
+++ b/sentry-tests/pom.xml
@@ -19,20 +19,36 @@
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access</artifactId>
+ <artifactId>sentry</artifactId>
<version>1.1.0-SNAPSHOT</version>
</parent>
- <artifactId>access-tests</artifactId>
+ <artifactId>sentry-tests</artifactId>
<name>Access Tests</name>
- <description>end to end tests for access project</description>
+ <description>end to end tests for sentry project</description>
<properties>
<hadoop-dist></hadoop-dist>
<hive-dist>${hadoop-dist}</hive-dist>
</properties>
<dependencies>
<dependency>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libthrift</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derby</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libthrift</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.derby</groupId>
+ <artifactId>derby</artifactId>
+ </dependency>
+ <dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-core</artifactId>
+ <artifactId>sentry-core</artifactId>
</dependency>
<dependency>
<groupId>org.apache.hive</groupId>
@@ -179,7 +195,7 @@
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-binding-hive</artifactId>
+ <artifactId>sentry-binding-hive</artifactId>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
@@ -188,7 +204,7 @@
</dependency>
<dependency>
<groupId>com.cloudera.cdh</groupId>
- <artifactId>access-provider-file</artifactId>
+ <artifactId>sentry-provider-file</artifactId>
</dependency>
<dependency>
<groupId>org.apache.hadoop</groupId>
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithHiveServer.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithHiveServer.java
similarity index 94%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithHiveServer.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithHiveServer.java
index 880e5ec..d4060d3 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithHiveServer.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithHiveServer.java
@@ -14,18 +14,18 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import java.io.File;
import java.util.Map;
import junit.framework.Assert;
-import org.apache.access.tests.e2e.hiveserver.HiveServer;
-import org.apache.access.tests.e2e.hiveserver.HiveServerFactory;
import org.apache.commons.io.FileUtils;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.FileSystem;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServer;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServerFactory;
import org.junit.After;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticConfiguration.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticConfiguration.java
similarity index 96%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticConfiguration.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticConfiguration.java
index b0600ec..40232c8 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticConfiguration.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticConfiguration.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import java.io.File;
import java.sql.Connection;
@@ -24,10 +24,10 @@
import junit.framework.Assert;
-import org.apache.access.tests.e2e.hiveserver.HiveServer;
-import org.apache.access.tests.e2e.hiveserver.HiveServerFactory;
import org.apache.commons.io.FileUtils;
import org.apache.hadoop.fs.FileSystem;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServer;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServerFactory;
import org.junit.AfterClass;
import org.junit.BeforeClass;
import org.slf4j.Logger;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticDFS.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticDFS.java
similarity index 95%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticDFS.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticDFS.java
index d0fb2f0..ab30fa5 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticDFS.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticDFS.java
@@ -14,17 +14,17 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import java.io.File;
import java.io.IOException;
import junit.framework.Assert;
-import org.apache.access.tests.e2e.hiveserver.HiveServerFactory;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.Path;
import org.apache.hadoop.hdfs.MiniDFSCluster;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServerFactory;
import org.junit.AfterClass;
import org.junit.Before;
import org.junit.BeforeClass;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticLocalFS.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticLocalFS.java
similarity index 93%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticLocalFS.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticLocalFS.java
index f449247..c29c16c 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/AbstractTestWithStaticLocalFS.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/AbstractTestWithStaticLocalFS.java
@@ -14,11 +14,11 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
-import org.apache.access.tests.e2e.hiveserver.HiveServerFactory;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.FileSystem;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServerFactory;
import org.junit.BeforeClass;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/Context.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/Context.java
similarity index 98%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/Context.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/Context.java
index e7d9d9d..687b154 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/Context.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/Context.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
@@ -34,8 +34,8 @@
import junit.framework.Assert;
-import org.apache.access.tests.e2e.hiveserver.HiveServer;
import org.apache.hadoop.fs.FileSystem;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServer;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
diff --git a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/MockUserToGroupMapping.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/DummySentryOnFailureHook.java
similarity index 68%
copy from access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/MockUserToGroupMapping.java
copy to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/DummySentryOnFailureHook.java
index e46e7a5..87d1b01 100644
--- a/access-binding/access-binding-hive/src/test/java/org/apache/access/binding/hive/MockUserToGroupMapping.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/DummySentryOnFailureHook.java
@@ -15,20 +15,18 @@
* limitations under the License.
*/
-package org.apache.access.binding.hive;
+package org.apache.sentry.tests.e2e;
-import java.util.List;
+import org.apache.sentry.binding.hive.SentryOnFailureHook;
+import org.apache.sentry.binding.hive.SentryOnFailureHookContext;
-import org.apache.access.provider.file.GroupMappingService;
+public class DummySentryOnFailureHook implements SentryOnFailureHook {
-import com.google.common.collect.Lists;
+ static boolean invoked = false;
-public class MockUserToGroupMapping implements GroupMappingService {
-
- // User to group 1-to-1 map
@Override
- public List<String> getGroups(String user) {
- return Lists.newArrayList(user);
+ public void run(SentryOnFailureHookContext failureHookContext)
+ throws Exception {
+ invoked = true;
}
-
}
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/PolicyFileEditor.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/PolicyFileEditor.java
similarity index 97%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/PolicyFileEditor.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/PolicyFileEditor.java
index 8207cde..69bf2ad 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/PolicyFileEditor.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/PolicyFileEditor.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestCrossDbOps.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestCrossDbOps.java
similarity index 98%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestCrossDbOps.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestCrossDbOps.java
index 5d585fc..c619bb0 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestCrossDbOps.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestCrossDbOps.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
@@ -32,7 +32,7 @@
import junit.framework.Assert;
-import org.apache.access.provider.file.PolicyFile;
+import org.apache.sentry.provider.file.PolicyFile;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
@@ -242,7 +242,7 @@
ResultSet res = conn.getMetaData().getSchemas();
ResultSetMetaData resMeta = res.getMetaData();
assertEquals(2, resMeta.getColumnCount());
- assertEquals("TABLE_SCHEMA", resMeta.getColumnName(1));
+ assertEquals("TABLE_SCHEM", resMeta.getColumnName(1));
assertEquals("TABLE_CATALOG", resMeta.getColumnName(2));
result.add("db1");
@@ -310,7 +310,7 @@
res = conn.getMetaData().getSchemas();
resMeta = res.getMetaData();
assertEquals(2, resMeta.getColumnCount());
- assertEquals("TABLE_SCHEMA", resMeta.getColumnName(1));
+ assertEquals("TABLE_SCHEM", resMeta.getColumnName(1));
assertEquals("TABLE_CATALOG", resMeta.getColumnName(2));
result.add("db2");
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestEndToEnd.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestEndToEnd.java
similarity index 98%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestEndToEnd.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestEndToEnd.java
index 878424f..a643e17 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestEndToEnd.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestEndToEnd.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import java.io.File;
import java.io.FileOutputStream;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestExportImportPrivileges.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestExportImportPrivileges.java
similarity index 98%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestExportImportPrivileges.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestExportImportPrivileges.java
index 3bc3227..dba478e 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestExportImportPrivileges.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestExportImportPrivileges.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertTrue;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestMetadataObjectRetrieval.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMetadataObjectRetrieval.java
similarity index 99%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestMetadataObjectRetrieval.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMetadataObjectRetrieval.java
index a604d47..ffc79c5 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestMetadataObjectRetrieval.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMetadataObjectRetrieval.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
@@ -26,7 +26,7 @@
import java.sql.ResultSet;
import java.sql.Statement;
-import org.apache.access.provider.file.PolicyFile;
+import org.apache.sentry.provider.file.PolicyFile;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestMetadataPermissions.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMetadataPermissions.java
similarity index 98%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestMetadataPermissions.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMetadataPermissions.java
index 7b90b74..6036eaa 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestMetadataPermissions.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMetadataPermissions.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import java.sql.Connection;
import java.sql.SQLException;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestMovingToProduction.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMovingToProduction.java
similarity index 99%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestMovingToProduction.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMovingToProduction.java
index 90890d8..dba6d9f 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestMovingToProduction.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestMovingToProduction.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
diff --git a/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPerDBConfiguration.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPerDBConfiguration.java
new file mode 100644
index 0000000..e265f3d
--- /dev/null
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPerDBConfiguration.java
@@ -0,0 +1,423 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.sentry.tests.e2e;
+
+import static org.junit.Assert.assertTrue;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.sql.Connection;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+
+import org.apache.sentry.provider.file.SimplePolicyEngine;
+import org.junit.After;
+import org.junit.Test;
+
+import com.google.common.base.Charsets;
+import com.google.common.base.Joiner;
+import com.google.common.io.Files;
+import com.google.common.io.Resources;
+
+/**
+ * Test privileges per database policy files
+ */
+public class TestPerDBConfiguration extends AbstractTestWithStaticLocalFS {
+ private static final String MULTI_TYPE_DATA_FILE_NAME = "emp.dat";
+ private static final String DB2_POLICY_FILE = "db2-policy-file.ini";
+
+ private Context context;
+
+ @After
+ public void teardown() throws Exception {
+ if (context != null) {
+ context.close();
+ }
+ }
+
+ @Test
+ public void testPerDB() throws Exception {
+ context = createContext();
+ File policyFile = context.getPolicyFile();
+ File db2PolicyFile = new File(policyFile.getParent(), DB2_POLICY_FILE);
+ File dataDir = context.getDataDir();
+ //copy data file to test dir
+ File dataFile = new File(dataDir, MULTI_TYPE_DATA_FILE_NAME);
+ FileOutputStream to = new FileOutputStream(dataFile);
+ Resources.copy(Resources.getResource(MULTI_TYPE_DATA_FILE_NAME), to);
+ to.close();
+ //delete existing policy file; create new policy file
+ assertTrue("Could not delete " + policyFile, context.deletePolicyFile());
+ assertTrue("Could not delete " + db2PolicyFile,!db2PolicyFile.exists() || db2PolicyFile.delete());
+
+ String[] policyFileContents = {
+ // groups : role -> group
+ "[groups]",
+ "admin = all_server",
+ "user_group1 = select_tbl1",
+ "user_group2 = select_tbl2",
+ // roles: privileges -> role
+ "[roles]",
+ "all_server = server=server1",
+ "select_tbl1 = server=server1->db=db1->table=tbl1->action=select",
+ // users: users -> groups
+ "[users]",
+ "hive = admin",
+ "user_1 = user_group1",
+ "user_2 = user_group2",
+ "[databases]",
+ "db2 = " + db2PolicyFile.getPath(),
+ };
+ context.makeNewPolicy(policyFileContents);
+
+ String[] db2PolicyFileContents = {
+ "[groups]",
+ "user_group2 = select_tbl2",
+ "[roles]",
+ "select_tbl2 = server=server1->db=db2->table=tbl2->action=select"
+ };
+ Files.write(Joiner.on("\n").join(db2PolicyFileContents), db2PolicyFile, Charsets.UTF_8);
+
+ // setup db objects needed by the test
+ Connection connection = context.createConnection("hive", "hive");
+ Statement statement = context.createStatement(connection);
+
+ statement.execute("DROP DATABASE IF EXISTS db1 CASCADE");
+ statement.execute("DROP DATABASE IF EXISTS db2 CASCADE");
+ statement.execute("CREATE DATABASE db1");
+ statement.execute("USE db1");
+ statement.execute("CREATE TABLE tbl1(B INT, A STRING) " +
+ " row format delimited fields terminated by '|' stored as textfile");
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl1");
+ statement.execute("DROP DATABASE IF EXISTS db2 CASCADE");
+ statement.execute("CREATE DATABASE db2");
+ statement.execute("USE db2");
+ statement.execute("CREATE TABLE tbl2(B INT, A STRING) " +
+ " row format delimited fields terminated by '|' stored as textfile");
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl2");
+ statement.close();
+ connection.close();
+
+ // test execution
+ connection = context.createConnection("user_1", "password");
+ statement = context.createStatement(connection);
+ statement.execute("USE db1");
+ // test user1 can execute query on tbl1
+ verifyCount(statement, "SELECT COUNT(*) FROM tbl1");
+
+ // user1 cannot query db2.tbl2
+ context.assertAuthzException(statement, "USE db2");
+ context.assertAuthzException(statement, "SELECT COUNT(*) FROM db2.tbl2");
+ statement.close();
+ connection.close();
+
+ // test per-db file for db2
+
+ connection = context.createConnection("user_2", "password");
+ statement = context.createStatement(connection);
+ statement.execute("USE db2");
+ // test user2 can execute query on tbl2
+ verifyCount(statement, "SELECT COUNT(*) FROM tbl2");
+
+ // user2 cannot query db1.tbl1
+ context.assertAuthzException(statement, "SELECT COUNT(*) FROM db1.tbl1");
+ context.assertAuthzException(statement, "USE db1");
+
+ statement.close();
+ connection.close();
+
+ //test cleanup
+ connection = context.createConnection("hive", "hive");
+ statement = context.createStatement(connection);
+ statement.execute("DROP DATABASE db1 CASCADE");
+ statement.execute("DROP DATABASE db2 CASCADE");
+ statement.close();
+ connection.close();
+ }
+
+ /**
+ * Multiple DB files with some containing badly formatted rules
+ * The privileges should work for good files
+ * No access for bad formatted ones
+ * @throws Exception
+ */
+ @Test
+ public void testMultiPerDBwithErrors() throws Exception {
+ String DB3_POLICY_FILE = "db3-policy-file.ini";
+ String DB4_POLICY_FILE = "db4-policy-file.ini";
+
+ context = createContext();
+ File policyFile = context.getPolicyFile();
+ File db2PolicyFile = new File(policyFile.getParent(), DB2_POLICY_FILE);
+ File db3PolicyFile = new File(policyFile.getParent(), DB3_POLICY_FILE);
+ File db4PolicyFile = new File(policyFile.getParent(), DB4_POLICY_FILE);
+ File dataDir = context.getDataDir();
+ //copy data file to test dir
+ File dataFile = new File(dataDir, MULTI_TYPE_DATA_FILE_NAME);
+ FileOutputStream to = new FileOutputStream(dataFile);
+ Resources.copy(Resources.getResource(MULTI_TYPE_DATA_FILE_NAME), to);
+ to.close();
+ //delete existing policy file; create new policy file
+ assertTrue("Could not delete " + policyFile, context.deletePolicyFile());
+ assertTrue("Could not delete " + db2PolicyFile,!db2PolicyFile.exists() || db2PolicyFile.delete());
+
+ String[] policyFileContents = {
+ // groups : role -> group
+ "[groups]",
+ "admin = all_server",
+ "user_group1 = select_tbl1",
+ "user_group2 = select_tbl2",
+ // roles: privileges -> role
+ "[roles]",
+ "all_server = server=server1",
+ "select_tbl1 = server=server1->db=db1->table=tbl1->action=select",
+ // users: users -> groups
+ "[users]",
+ "hive = admin",
+ "user_1 = user_group1",
+ "user_2 = user_group2",
+ "user_3 = user_group3",
+ "user_4 = user_group4",
+ "[databases]",
+ "db2 = " + db2PolicyFile.getPath(),
+ "db3 = " + db3PolicyFile.getPath(),
+ "db4 = " + db4PolicyFile.getPath(),
+ };
+ context.makeNewPolicy(policyFileContents);
+
+ String[] db2PolicyFileContents = {
+ "[groups]",
+ "user_group2 = select_tbl2",
+ "[roles]",
+ "select_tbl2 = server=server1->db=db2->table=tbl2->action=select"
+ };
+ String[] db3PolicyFileContents = {
+ "[groups]",
+ "user_group3 = select_tbl3_BAD",
+ "[roles]",
+ "select_tbl3_BAD = server=server1->db=db3------>table->action=select"
+ };
+ String[] db4PolicyFileContents = {
+ "[groups]",
+ "user_group4 = select_tbl4",
+ "[roles]",
+ "select_tbl4 = server=server1->db=db4->table=tbl4->action=select"
+ };
+
+ Files.write(Joiner.on("\n").join(db2PolicyFileContents), db2PolicyFile, Charsets.UTF_8);
+ Files.write(Joiner.on("\n").join(db3PolicyFileContents), db3PolicyFile, Charsets.UTF_8);
+ Files.write(Joiner.on("\n").join(db4PolicyFileContents), db4PolicyFile, Charsets.UTF_8);
+
+ // setup db objects needed by the test
+ Connection connection = context.createConnection("hive", "hive");
+ Statement statement = context.createStatement(connection);
+
+ statement.execute("DROP DATABASE IF EXISTS db1 CASCADE");
+ statement.execute("CREATE DATABASE db1");
+ statement.execute("USE db1");
+ statement.execute("CREATE TABLE tbl1(B INT, A STRING) " +
+ " row format delimited fields terminated by '|' stored as textfile");
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl1");
+
+ statement.execute("DROP DATABASE IF EXISTS db2 CASCADE");
+ statement.execute("CREATE DATABASE db2");
+ statement.execute("USE db2");
+ statement.execute("CREATE TABLE tbl2(B INT, A STRING) " +
+ " row format delimited fields terminated by '|' stored as textfile");
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl2");
+
+ statement.execute("DROP DATABASE IF EXISTS db3 CASCADE");
+ statement.execute("CREATE DATABASE db3");
+ statement.execute("USE db3");
+ statement.execute("CREATE TABLE tbl3(B INT, A STRING) " +
+ " row format delimited fields terminated by '|' stored as textfile");
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl3");
+
+ statement.execute("DROP DATABASE IF EXISTS db4 CASCADE");
+ statement.execute("CREATE DATABASE db4");
+ statement.execute("USE db4");
+ statement.execute("CREATE TABLE tbl4(B INT, A STRING) " +
+ " row format delimited fields terminated by '|' stored as textfile");
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl4");
+
+ statement.close();
+ connection.close();
+
+ // test execution
+ connection = context.createConnection("user_1", "password");
+ statement = context.createStatement(connection);
+ statement.execute("USE db1");
+ // test user1 can execute query on tbl1
+ verifyCount(statement, "SELECT COUNT(*) FROM tbl1");
+ connection.close();
+
+ connection = context.createConnection("user_2", "password");
+ statement = context.createStatement(connection);
+ statement.execute("USE db2");
+ // test user1 can execute query on tbl1
+ verifyCount(statement, "SELECT COUNT(*) FROM tbl2");
+ connection.close();
+
+ // verify no access to db3 due to badly formatted rule in db3 policy file
+ connection = context.createConnection("user_3", "password");
+ statement = context.createStatement(connection);
+ context.assertAuthzException(statement, "USE db3");
+ // test user1 can execute query on tbl1
+ context.assertAuthzException(statement, "SELECT COUNT(*) FROM db3.tbl3");
+ connection.close();
+
+ connection = context.createConnection("user_4", "password");
+ statement = context.createStatement(connection);
+ statement.execute("USE db4");
+ // test user1 can execute query on tbl1
+ verifyCount(statement, "SELECT COUNT(*) FROM tbl4");
+ connection.close();
+
+ //test cleanup
+ connection = context.createConnection("hive", "hive");
+ statement = context.createStatement(connection);
+ statement.execute("DROP DATABASE db1 CASCADE");
+ statement.execute("DROP DATABASE db2 CASCADE");
+ statement.execute("DROP DATABASE db3 CASCADE");
+ statement.execute("DROP DATABASE db4 CASCADE");
+ statement.close();
+ connection.close();
+ }
+
+ @Test
+ public void testPerDBPolicyFileWithURI() throws Exception {
+ context = createContext();
+ File policyFile = context.getPolicyFile();
+ File db2PolicyFile = new File(policyFile.getParent(), DB2_POLICY_FILE);
+ File dataDir = context.getDataDir();
+ //copy data file to test dir
+ File dataFile = new File(dataDir, MULTI_TYPE_DATA_FILE_NAME);
+ FileOutputStream to = new FileOutputStream(dataFile);
+ Resources.copy(Resources.getResource(MULTI_TYPE_DATA_FILE_NAME), to);
+ to.close();
+ //delete existing policy file; create new policy file
+ assertTrue("Could not delete " + policyFile, context.deletePolicyFile());
+ assertTrue("Could not delete " + db2PolicyFile,!db2PolicyFile.exists() || db2PolicyFile.delete());
+
+ String[] policyFileContents = {
+ // groups : role -> group
+ "[groups]",
+ "admin = all_server",
+ "user_group1 = select_tbl1",
+ "user_group2 = select_tbl2",
+ // roles: privileges -> role
+ "[roles]",
+ "all_server = server=server1",
+ "select_tbl1 = server=server1->db=db1->table=tbl1->action=select",
+ // users: users -> groups
+ "[users]",
+ "hive = admin",
+ "user_1 = user_group1",
+ "user_2 = user_group2",
+ "[databases]",
+ "db2 = " + db2PolicyFile.getPath(),
+ };
+ context.makeNewPolicy(policyFileContents);
+
+ String[] db2PolicyFileContents = {
+ "[groups]",
+ "user_group2 = select_tbl2, data_read, insert_tbl2",
+ "[roles]",
+ "select_tbl2 = server=server1->db=db2->table=tbl2->action=select",
+ "insert_tbl2 = server=server1->db=db2->table=tbl2->action=insert",
+ "data_read = server=server1->URI=file://" + dataFile
+ };
+ Files.write(Joiner.on("\n").join(db2PolicyFileContents), db2PolicyFile, Charsets.UTF_8);
+ // ugly hack: needs to go away once this becomes a config property. Note that this property
+ // will not be set with external HS and this test will fail. Hope is this fix will go away
+ // by then.
+ System.setProperty(SimplePolicyEngine.ACCESS_ALLOW_URI_PER_DB_POLICYFILE, "true");
+ // setup db objects needed by the test
+ Connection connection = context.createConnection("hive", "hive");
+ Statement statement = context.createStatement(connection);
+
+ statement.execute("DROP DATABASE IF EXISTS db1 CASCADE");
+ statement.execute("DROP DATABASE IF EXISTS db2 CASCADE");
+ statement.execute("CREATE DATABASE db1");
+ statement.execute("USE db1");
+ statement.execute("CREATE TABLE tbl1(B INT, A STRING) " +
+ " row format delimited fields terminated by '|' stored as textfile");
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl1");
+ statement.execute("DROP DATABASE IF EXISTS db2 CASCADE");
+ statement.execute("CREATE DATABASE db2");
+ statement.execute("USE db2");
+ statement.execute("CREATE TABLE tbl2(B INT, A STRING) " +
+ " row format delimited fields terminated by '|' stored as textfile");
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl2");
+ statement.close();
+ connection.close();
+
+ // test execution
+ connection = context.createConnection("user_1", "password");
+ statement = context.createStatement(connection);
+ statement.execute("USE db1");
+ // test user1 can execute query on tbl1
+ verifyCount(statement, "SELECT COUNT(*) FROM tbl1");
+
+ // user1 cannot query db2.tbl2
+ context.assertAuthzException(statement, "USE db2");
+ context.assertAuthzException(statement, "SELECT COUNT(*) FROM db2.tbl2");
+ statement.close();
+ connection.close();
+
+ // test per-db file for db2
+ connection = context.createConnection("user_2", "password");
+ statement = context.createStatement(connection);
+ statement.execute("USE db2");
+ // test user2 can execute query on tbl2
+ verifyCount(statement, "SELECT COUNT(*) FROM tbl2");
+
+ // verify user2 can execute LOAD
+ statement.execute("LOAD DATA LOCAL INPATH '" + dataFile.getPath() + "' INTO TABLE tbl2");
+
+ // user2 cannot query db1.tbl1
+ context.assertAuthzException(statement, "SELECT COUNT(*) FROM db1.tbl1");
+ context.assertAuthzException(statement, "USE db1");
+
+ statement.close();
+ connection.close();
+
+ //test cleanup
+ connection = context.createConnection("hive", "hive");
+ statement = context.createStatement(connection);
+ statement.execute("DROP DATABASE db1 CASCADE");
+ statement.execute("DROP DATABASE db2 CASCADE");
+ statement.close();
+ connection.close();
+ System.setProperty(SimplePolicyEngine.ACCESS_ALLOW_URI_PER_DB_POLICYFILE, "false");
+ }
+
+ private void verifyCount(Statement statement, String query) throws SQLException {
+ ResultSet resultSet = statement.executeQuery(query);
+ int count = 0;
+ int countRows = 0;
+
+ while (resultSet.next()) {
+ count = resultSet.getInt(1);
+ countRows++;
+ }
+ assertTrue("Incorrect row count", countRows == 1);
+ assertTrue("Incorrect result", count == 12);
+ }
+}
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPerDatabasePolicyFile.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPerDatabasePolicyFile.java
similarity index 97%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestPerDatabasePolicyFile.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPerDatabasePolicyFile.java
index f2ec906..8c0fb71 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPerDatabasePolicyFile.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPerDatabasePolicyFile.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertTrue;
@@ -24,7 +24,7 @@
import java.sql.Connection;
import java.sql.Statement;
-import org.apache.access.provider.file.PolicyFile;
+import org.apache.sentry.provider.file.PolicyFile;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegeAtTransform.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegeAtTransform.java
similarity index 97%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegeAtTransform.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegeAtTransform.java
index 4d71a5f..53f295d 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegeAtTransform.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegeAtTransform.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertTrue;
@@ -24,7 +24,7 @@
import java.sql.Connection;
import java.sql.Statement;
-import org.apache.access.provider.file.PolicyFile;
+import org.apache.sentry.provider.file.PolicyFile;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtDatabaseScope.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtDatabaseScope.java
similarity index 99%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtDatabaseScope.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtDatabaseScope.java
index fdf1544..a046c8f 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtDatabaseScope.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtDatabaseScope.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
@@ -31,7 +31,7 @@
import junit.framework.Assert;
-import org.apache.access.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf.AuthzConfVars;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtFunctionScope.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtFunctionScope.java
similarity index 99%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtFunctionScope.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtFunctionScope.java
index f8324b6..90d6214 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtFunctionScope.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtFunctionScope.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertFalse;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtTableScope.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtTableScope.java
similarity index 99%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtTableScope.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtTableScope.java
index dcaa8fe..3da96a0 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestPrivilegesAtTableScope.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestPrivilegesAtTableScope.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.*;
import static org.junit.Assert.assertEquals;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestRuntimeMetadataRetrieval.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestRuntimeMetadataRetrieval.java
similarity index 99%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestRuntimeMetadataRetrieval.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestRuntimeMetadataRetrieval.java
index 3a90656..27871a1 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestRuntimeMetadataRetrieval.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestRuntimeMetadataRetrieval.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import java.io.File;
import java.io.FileOutputStream;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestSandboxOps.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestSandboxOps.java
similarity index 99%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestSandboxOps.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestSandboxOps.java
index 1bec36d..2996eab 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestSandboxOps.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestSandboxOps.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertTrue;
@@ -26,8 +26,8 @@
import java.sql.ResultSet;
import java.sql.Statement;
-import org.apache.access.provider.file.PolicyFile;
import org.apache.hadoop.fs.Path;
+import org.apache.sentry.provider.file.PolicyFile;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
diff --git a/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestSentryOnFailureHookLoading.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestSentryOnFailureHookLoading.java
new file mode 100644
index 0000000..139d43f
--- /dev/null
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestSentryOnFailureHookLoading.java
@@ -0,0 +1,133 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.sentry.tests.e2e;
+
+import com.google.common.io.Resources;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServerFactory;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.sql.Connection;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.util.HashMap;
+import java.util.Map;
+import junit.framework.Assert;
+
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertFalse;
+
+public class TestSentryOnFailureHookLoading extends AbstractTestWithHiveServer {
+
+ private Context context;
+ Map<String, String > testProperties;
+ private static final String SINGLE_TYPE_DATA_FILE_NAME = "kv1.dat";
+
+ @Before
+ public void setup() throws Exception {
+ testProperties = new HashMap<String, String>();
+ testProperties.put(HiveAuthzConf.AuthzConfVars.AUTHZ_ONFAILURE_HOOKS.getVar(),
+ DummySentryOnFailureHook.class.getName());
+ }
+
+ @After
+ public void teardown() throws Exception {
+ if (context != null) {
+ context.close();
+ }
+ }
+
+ /* Admin creates database DB_2
+ * USER_1 tries to drop DB_2, but it has permissions for DB_1.
+ */
+ @Test
+ public void testOnFailureHookLoading() throws Exception {
+
+ // Do not run this test if run with external HiveServer2
+ // This test checks for a static member, which will not
+ // be set if HiveServer2 and the test run in different JVMs
+ String hiveServer2Type = System.getProperty(
+ HiveServerFactory.HIVESERVER2_TYPE);
+ if (hiveServer2Type != null &&
+ HiveServerFactory.HiveServer2Type.valueOf(hiveServer2Type.trim()) !=
+ HiveServerFactory.HiveServer2Type.InternalHiveServer2) {
+ return;
+ }
+
+ context = createContext(testProperties);
+
+ File policyFile = context.getPolicyFile();
+ File dataDir = context.getDataDir();
+ //copy data file to test dir
+ File dataFile = new File(dataDir, SINGLE_TYPE_DATA_FILE_NAME);
+ FileOutputStream to = new FileOutputStream(dataFile);
+ Resources.copy(Resources.getResource(SINGLE_TYPE_DATA_FILE_NAME), to);
+ to.close();
+ //delete existing policy file; create new policy file
+ assertTrue("Could not delete " + policyFile, context.deletePolicyFile());
+ // groups : role -> group
+ context.append("[groups]");
+ context.append("admin = all_server");
+ context.append("user_group1 = all_db1, load_data");
+ // roles: privileges -> role
+ context.append("[roles]");
+ context.append("all_server = server=server1");
+ context.append("all_db1 = server=server1->db=DB_1");
+ // users: users -> groups
+ context.append("[users]");
+ context.append("hive = admin");
+ context.append("user_1 = user_group1");
+ // setup db objects needed by the test
+ Connection connection = context.createConnection("hive", "hive");
+ Statement statement = context.createStatement(connection);
+ statement.execute("DROP DATABASE IF EXISTS DB_1 CASCADE");
+ statement.execute("DROP DATABASE IF EXISTS DB_2 CASCADE");
+ statement.execute("CREATE DATABASE DB_1");
+ statement.execute("CREATE DATABASE DB_2");
+ statement.close();
+ connection.close();
+
+ // test execution
+ connection = context.createConnection("user_1", "password");
+ statement = context.createStatement(connection);
+
+ //negative test case: user can't drop another user's database
+ assertFalse(DummySentryOnFailureHook.invoked);
+ try {
+ statement.execute("DROP DATABASE DB_2 CASCADE");
+ Assert.fail("Expected SQL exception");
+ } catch (SQLException e) {
+ assertTrue(DummySentryOnFailureHook.invoked);
+ }
+
+ statement.close();
+ connection.close();
+
+ //test cleanup
+ connection = context.createConnection("hive", "hive");
+ statement = context.createStatement(connection);
+ statement.execute("DROP DATABASE DB_1 CASCADE");
+ statement.execute("DROP DATABASE DB_2 CASCADE");
+ statement.close();
+ connection.close();
+ context.close();
+ }
+}
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestServerConfiguration.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestServerConfiguration.java
similarity index 96%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestServerConfiguration.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestServerConfiguration.java
index 971244a..aaad396 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestServerConfiguration.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestServerConfiguration.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNotNull;
@@ -29,12 +29,12 @@
import java.sql.Statement;
import java.util.Map;
-import org.apache.access.binding.hive.HiveAuthzBindingSessionHook;
-import org.apache.access.binding.hive.conf.HiveAuthzConf;
-import org.apache.access.provider.file.PolicyFile;
-import org.apache.access.tests.e2e.hiveserver.HiveServerFactory;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.conf.HiveConf.ConfVars;
+import org.apache.sentry.binding.hive.HiveAuthzBindingSessionHook;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
+import org.apache.sentry.provider.file.PolicyFile;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServerFactory;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestUriPermissions.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestUriPermissions.java
similarity index 98%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestUriPermissions.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestUriPermissions.java
index 6c08617..cd6eb14 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestUriPermissions.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestUriPermissions.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import java.sql.Connection;
import java.sql.ResultSet;
@@ -22,7 +22,7 @@
import junit.framework.Assert;
-import org.apache.access.tests.e2e.hiveserver.HiveServerFactory;
+import org.apache.sentry.tests.e2e.hiveserver.HiveServerFactory;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/TestUserManagement.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestUserManagement.java
similarity index 99%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/TestUserManagement.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestUserManagement.java
index 8f82b97..fba3878 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/TestUserManagement.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/TestUserManagement.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e;
+package org.apache.sentry.tests.e2e;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/AbstractHiveServer.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/AbstractHiveServer.java
similarity index 97%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/AbstractHiveServer.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/AbstractHiveServer.java
index ae53d7f..0c2fbc3 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/AbstractHiveServer.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/AbstractHiveServer.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e.hiveserver;
+package org.apache.sentry.tests.e2e.hiveserver;
import java.sql.Connection;
import java.sql.DriverManager;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/EmbeddedHiveServer.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/EmbeddedHiveServer.java
similarity index 96%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/EmbeddedHiveServer.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/EmbeddedHiveServer.java
index 9052f00..48c112c 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/EmbeddedHiveServer.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/EmbeddedHiveServer.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e.hiveserver;
+package org.apache.sentry.tests.e2e.hiveserver;
import org.apache.hadoop.hive.metastore.HiveMetaStore;
import org.fest.reflect.core.Reflection;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/ExternalHiveServer.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/ExternalHiveServer.java
similarity index 94%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/ExternalHiveServer.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/ExternalHiveServer.java
index 28b82dc..6065002 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/ExternalHiveServer.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/ExternalHiveServer.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e.hiveserver;
+package org.apache.sentry.tests.e2e.hiveserver;
import java.io.BufferedReader;
import java.io.File;
@@ -107,13 +107,13 @@
String clazzPath = Preconditions.checkNotNull(System.getProperty("java.class.path"), "java.class.path");
String sep = Preconditions.checkNotNull(System.getProperty("path.separator"), "path.separator");
for(String item : Splitter.on(sep).omitEmptyStrings().trimResults().split(clazzPath)) {
- if(item.endsWith("/access-tests/target/classes") ||
- item.endsWith("/access-tests/target/test-classes")) {
+ if(item.endsWith("/sentry-tests/target/classes") ||
+ item.endsWith("/sentry-tests/target/test-classes")) {
result.add(item);
} else {
File clazzPathItem = new File(item);
String fileName = clazzPathItem.getName();
- if(clazzPathItem.isFile() && fileName.startsWith("access-") && fileName.endsWith(".jar")) {
+ if(clazzPathItem.isFile() && fileName.startsWith("sentry-") && fileName.endsWith(".jar")) {
result.add(item);
}
}
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/HiveServer.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/HiveServer.java
similarity index 95%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/HiveServer.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/HiveServer.java
index 58e161e..ce4b3e8 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/HiveServer.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/HiveServer.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e.hiveserver;
+package org.apache.sentry.tests.e2e.hiveserver;
public interface HiveServer {
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/HiveServerFactory.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/HiveServerFactory.java
similarity index 92%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/HiveServerFactory.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/HiveServerFactory.java
index 873176c..5292eaa 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/HiveServerFactory.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/HiveServerFactory.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e.hiveserver;
+package org.apache.sentry.tests.e2e.hiveserver;
import java.io.File;
import java.io.FileOutputStream;
@@ -24,12 +24,13 @@
import java.net.URL;
import java.util.Map;
-import org.apache.access.binding.hive.conf.HiveAuthzConf;
-import org.apache.access.provider.file.LocalGroupResourceAuthorizationProvider;
+import com.google.common.annotations.VisibleForTesting;
import org.apache.hadoop.fs.FileSystem;
import org.apache.hadoop.hdfs.DistributedFileSystem;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.conf.HiveConf.ConfVars;
+import org.apache.sentry.binding.hive.conf.HiveAuthzConf;
+import org.apache.sentry.provider.file.LocalGroupResourceAuthorizationProvider;
import org.fest.reflect.core.Reflection;
import org.junit.Assert;
import org.slf4j.Logger;
@@ -42,8 +43,8 @@
.getLogger(HiveServerFactory.class);
private static final String HIVE_DRIVER_NAME = "org.apache.hive.jdbc.HiveDriver";
private static final String DERBY_DRIVER_NAME = "org.apache.derby.jdbc.EmbeddedDriver";
- public static final String HIVESERVER2_TYPE = "access.e2etest.hiveServer2Type";
- public static final String KEEP_BASEDIR = "access.e2etest.keepBaseDir";
+ public static final String HIVESERVER2_TYPE = "sentry.e2etest.hiveServer2Type";
+ public static final String KEEP_BASEDIR = "sentry.e2etest.keepBaseDir";
public static final String METASTORE_CONNECTION_URL = HiveConf.ConfVars.METASTORECONNECTURLKEY.varname;
public static final String WAREHOUSE_DIR = HiveConf.ConfVars.METASTOREWAREHOUSE.varname;
public static final String AUTHZ_PROVIDER = HiveAuthzConf.AuthzConfVars.AUTHZ_PROVIDER.getVar();
@@ -148,7 +149,7 @@
.in(HiveConf.class)
.set(null);
HiveConf hiveConf = new HiveConf();
- HiveAuthzConf authzConf = new HiveAuthzConf(Resources.getResource("access-site.xml"));
+ HiveAuthzConf authzConf = new HiveAuthzConf(Resources.getResource("sentry-site.xml"));
for(Map.Entry<String, String> entry : properties.entrySet()) {
LOGGER.info(entry.getKey() + " => " + entry.getValue());
hiveConf.set(entry.getKey(), entry.getValue());
@@ -161,8 +162,10 @@
out.close();
// points hive-site.xml at access-site.xml
hiveConf.set(HiveAuthzConf.HIVE_ACCESS_CONF_URL, accessSite.toURI().toURL().toExternalForm());
- hiveConf.set(HiveConf.ConfVars.HIVE_SERVER2_SESSION_HOOK.varname,
- "org.apache.access.binding.hive.HiveAuthzBindingSessionHook");
+ if(!properties.containsKey(HiveConf.ConfVars.HIVE_SERVER2_SESSION_HOOK.varname)) {
+ hiveConf.set(HiveConf.ConfVars.HIVE_SERVER2_SESSION_HOOK.varname,
+ "org.apache.sentry.binding.hive.HiveAuthzBindingSessionHook");
+ }
out = new FileOutputStream(hiveSite);
hiveConf.writeXml(out);
out.close();
@@ -196,7 +199,8 @@
return port;
}
- private static enum HiveServer2Type {
+ @VisibleForTesting
+ public static enum HiveServer2Type {
EmbeddedHiveServer2, // Embedded HS2, directly executed by JDBC, without thrift
InternalHiveServer2, // Start a thrift HS2 in the same process
ExternalHiveServer2, // start a remote thrift HS2
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/InternalHiveServer.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/InternalHiveServer.java
similarity index 97%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/InternalHiveServer.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/InternalHiveServer.java
index 50739c7..7e0fed7 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/InternalHiveServer.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/InternalHiveServer.java
@@ -15,7 +15,7 @@
* limitations under the License.
*/
-package org.apache.access.tests.e2e.hiveserver;
+package org.apache.sentry.tests.e2e.hiveserver;
import java.io.IOException;
import org.apache.hadoop.hive.conf.HiveConf;
diff --git a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/UnmanagedHiveServer.java b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/UnmanagedHiveServer.java
similarity index 95%
rename from access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/UnmanagedHiveServer.java
rename to sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/UnmanagedHiveServer.java
index 7691e29..288d2f7 100644
--- a/access-tests/src/test/java/org/apache/access/tests/e2e/hiveserver/UnmanagedHiveServer.java
+++ b/sentry-tests/src/test/java/org/apache/sentry/tests/e2e/hiveserver/UnmanagedHiveServer.java
@@ -14,7 +14,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.access.tests.e2e.hiveserver;
+package org.apache.sentry.tests.e2e.hiveserver;
import org.apache.hadoop.hive.conf.HiveConf;
diff --git a/access-tests/src/test/resources/access-site.xml b/sentry-tests/src/test/resources/access-site.xml
similarity index 100%
rename from access-tests/src/test/resources/access-site.xml
rename to sentry-tests/src/test/resources/access-site.xml
diff --git a/access-tests/src/test/resources/emp.dat b/sentry-tests/src/test/resources/emp.dat
similarity index 100%
rename from access-tests/src/test/resources/emp.dat
rename to sentry-tests/src/test/resources/emp.dat
diff --git a/access-tests/src/test/resources/hive-site.xml b/sentry-tests/src/test/resources/hive-site.xml
similarity index 100%
rename from access-tests/src/test/resources/hive-site.xml
rename to sentry-tests/src/test/resources/hive-site.xml
diff --git a/access-tests/src/test/resources/kv1.dat b/sentry-tests/src/test/resources/kv1.dat
similarity index 100%
rename from access-tests/src/test/resources/kv1.dat
rename to sentry-tests/src/test/resources/kv1.dat
diff --git a/access-tests/src/test/resources/log4j.properties b/sentry-tests/src/test/resources/log4j.properties
similarity index 100%
rename from access-tests/src/test/resources/log4j.properties
rename to sentry-tests/src/test/resources/log4j.properties
diff --git a/access-binding/access-binding-hive/src/test/resources/access-site.xml b/sentry-tests/src/test/resources/sentry-site.xml
similarity index 80%
copy from access-binding/access-binding-hive/src/test/resources/access-site.xml
copy to sentry-tests/src/test/resources/sentry-site.xml
index 6a5ddff..de0c9cf 100644
--- a/access-binding/access-binding-hive/src/test/resources/access-site.xml
+++ b/sentry-tests/src/test/resources/sentry-site.xml
@@ -19,16 +19,15 @@
<configuration>
<property>
- <name>hive.access.provider</name>
- <value>org.apache.access.provider.file.fooProvider</value>
+ <name>hive.sentry.provider</name>
+ <value>invalid</value>
</property>
<property>
- <name>hive.access.provider.resource</name>
- <value>classpath:test-authz-provider.ini</value>
+ <name>hive.sentry.provider.resource</name>
+ <value>invalid</value>
</property>
<property>
- <name>hive.access.server</name>
+ <name>hive.sentry.server</name>
<value>myHS2</value>
</property>
</configuration>
-
diff --git a/access-tests/src/test/resources/test-authz-provider.ini b/sentry-tests/src/test/resources/test-authz-provider.ini
similarity index 100%
rename from access-tests/src/test/resources/test-authz-provider.ini
rename to sentry-tests/src/test/resources/test-authz-provider.ini
