docs/topics/impala_grant.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.
-->
<!DOCTYPE concept PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">
<concept rev="2.0.0" id="grant">

  <title>GRANT Statement (<keyword keyref="impala20"/> or higher only)</title>

  <titlealts audience="PDF">

    <navtitle>GRANT</navtitle>

  </titlealts>

  <prolog>
    <metadata>
      <data name="Category" value="Impala"/>
      <data name="Category" value="DDL"/>
      <data name="Category" value="SQL"/>
      <data name="Category" value="Security"/>
      <data name="Category" value="Sentry"/>
      <data name="Category" value="Roles"/>
      <data name="Category" value="Administrators"/>
      <data name="Category" value="Developers"/>
      <data name="Category" value="Data Analysts"/>
<!-- Consider whether to go deeper into categories like Security for the Sentry-related statements. -->
    </metadata>
  </prolog>

  <conbody>

    <p rev="2.0.0">
      The <codeph>GRANT</codeph> statement grants a privilege on a specified object to a role,
      to a user, or to a group. The statement is also used to grant a role to a group.
    </p>

    <p conref="../shared/impala_common.xml#common/syntax_blurb"/>

    <p>
      The following syntax are supported in Impala through Ranger to manage authorization.
    </p>

    <p><b><codeph>GRANT ROLE TO GROUP</codeph></b></p>
    <p>
      For <codeph>GRANT ROLE TO GROUP</codeph>, only Ranger administrative users can grant roles to a group.
    </p>
    <codeblock>GRANT ROLE <varname>role_name</varname> TO GROUP <varname>group_name</varname></codeblock>

    <p><b><codeph>GRANT privilege ON object TO PRINCIPAL</codeph></b></p>
    <p>
      For GRANT privilege ON object TO principal (a user, a group, or a role), Ranger
      administrative users can use this statement. If the privilege is granted with the clause of
      WITH GRANT OPTION, the grantee (the user, the users belonging to the group, or the users
      belonging to the group granted the role) is able to grant the privilege to other principals.
    </p>
<codeblock>GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
   TO USER <varname>user_name</varname>
GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
   TO GROUP <varname>group_name</varname>
  GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
  TO ROLE <varname>role_name</varname>
  
<ph rev="3.0">privilege ::= ALL | ALTER | CREATE | DROP | INSERT | REFRESH | SELECT | SELECT(<varname>column_name</varname>)</ph>
<ph rev="3.0">object_type ::= SERVER | URI | DATABASE | TABLE</ph></codeblock>

    <p>
      Typically, the <codeph><varname>object_name</varname></codeph> is an identifier. For URIs,
      it is a string literal.
    </p>

    <p conref="../shared/impala_common.xml#common/privileges_blurb"/>

    <p>
      Only administrative users for Ranger can use this statement.
    </p>

    <p>
      Only Ranger administrative users can grant roles to a group.
    </p>

    <p>
      The <codeph>WITH GRANT OPTION</codeph> clause allows members of the specified role to issue
      <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements for those same privileges.
      Hence, if a role has the <codeph>ALL</codeph> privilege on a database and the <codeph>WITH
      GRANT OPTION</codeph> set, users granted that role can execute
      <codeph>GRANT</codeph>/<codeph>REVOKE</codeph> statements only for that database or child
      tables of the database. This means a user could revoke the privileges of the user that
      provided them the <codeph>GRANT OPTION</codeph>.
    </p>

    <p rev="2.3.0 collevelauth">
      The ability to grant or revoke <codeph>SELECT</codeph> privilege on specific columns is
      available in <keyword keyref="impala23_full"/> and higher. See
      <xref
        keyref="sg_hive_sql"/> for details.
    </p>

    <p>
      <b>Usage notes:</b>
    </p>

    <p>
      You can only grant the <codeph>ALL</codeph> privilege to the <codeph>URI</codeph> object.
      Finer-grained privileges mentioned below on a <codeph>URI</codeph> are not supported.
    </p>

    <p conref="../shared/impala_common.xml#common/privileges_objects"/>

    <p conref="../shared/impala_common.xml#common/compatibility_blurb"/>

    <p>
      <ul>
        <li>
          The Impala <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements are available
          in <keyword keyref="impala20_full"/> and later.
        </li>

        <li>
          In general, Impala can make use of any roles and privileges specified by the
          <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements in Hive, when your system
          is configured to use the Ranger service instead of the file-based policy mechanism.
        </li>

        <li conref="../shared/impala_common.xml#common/grant_revoke_single"/>
      </ul>
    </p>

    <p conref="../shared/impala_common.xml#common/cancel_blurb_no"/>

    <p conref="../shared/impala_common.xml#common/permissions_blurb_no"/>

    <p conref="../shared/impala_common.xml#common/kudu_blurb"/>

    <p conref="../shared/impala_common.xml#common/kudu_sentry_limitations"/>

    <p conref="../shared/impala_common.xml#common/related_info"/>

    <p>
      <xref href="impala_authorization.xml#authorization"/>,
      <xref href="impala_revoke.xml#revoke"/>,
      <xref href="impala_create_role.xml#create_role"/>,
      <xref href="impala_drop_role.xml#drop_role"/>, <xref href="impala_show.xml#show"/>
    </p>

  </conbody>

</concept>