Java Code Examples for org.apache.sqoop.security.SecurityError#AUTH_0014

The following examples show how to use org.apache.sqoop.security.SecurityError#AUTH_0014 . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example 1

Source File: SentryAuthorizationValidator.java From incubator-sentry with Apache License 2.0

6 votes

@Override
public void checkPrivileges(MPrincipal principal, List<MPrivilege> privileges) throws SqoopException {
  if (privileges == null || privileges.isEmpty()) {
    return;
  }
  PrincipalDesc principalDesc = new PrincipalDesc(principal.getName(), principal.getType());
  if (principalDesc.getType() != PrincipalType.USER) {
    throw new SqoopException(SecurityError.AUTH_0014,SentrySqoopError.AUTHORIZE_CHECK_NOT_SUPPORT_FOR_PRINCIPAL);
  }
  for (MPrivilege privilege : privileges) {
    if (LOG.isDebugEnabled()) {
      LOG.debug("Going to authorize check on privilege : " + privilege +
          " for principal: " + principal);
    }
    if (!binding.authorize(new Subject(principalDesc.getName()), privilege)) {
      throw new SqoopException(SecurityError.AUTH_0014, "User " + principalDesc.getName() +
          " does not have privileges for : " + privilege.toString());
    }
  }
}

Example 2

Source File: SentryAccessController.java From incubator-sentry with Apache License 2.0

6 votes

@Override
public void grantPrivileges(List<MPrincipal> principals, List<MPrivilege> privileges)
    throws SqoopException {
  for (MPrincipal principal : principals) {
    PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
    if (principalDesc.getType() != PrincipalType.ROLE) {
      throw new SqoopException(SecurityError.AUTH_0014,
          SentrySqoopError.GRANT_REVOKE_PRIVILEGE_NOT_SUPPORT_FOR_PRINCIPAL
              + principalDesc.getType().name());
    }

    for (MPrivilege privilege : privileges) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Going to grant privilege : " + privilege +
            " to principal: " + principal);
      }
      binding.grantPrivilege(getSubject(), principal.getName(), privilege);
    }
  }
}

Example 3

Source File: SentryAccessController.java From incubator-sentry with Apache License 2.0

6 votes

@Override
public void grantRole(List<MPrincipal> principals, List<MRole> roles)
    throws SqoopException {
  for (MPrincipal principal : principals) {
    PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
    if (principalDesc.getType() != PrincipalType.GROUP) {
      throw new SqoopException(SecurityError.AUTH_0014,
          SentrySqoopError.GRANT_REVOKE_ROLE_NOT_SUPPORT_FOR_PRINCIPAL
              + principalDesc.getType().name());
    }
    for (MRole role : roles) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Going to grant role : " + role.getName() +
            " to principal: " + principal);
      }
      binding.grantGroupToRole(getSubject(), principal.getName(), role);
    }
  }
}

Example 4

Source File: SentryAccessController.java From incubator-sentry with Apache License 2.0

6 votes

@Override
public void revokePrivileges(List<MPrincipal> principals, List<MPrivilege> privileges)
    throws SqoopException {
  for (MPrincipal principal : principals) {
    PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
    if (principalDesc.getType() != PrincipalType.ROLE) {
      throw new SqoopException(SecurityError.AUTH_0014,
          SentrySqoopError.GRANT_REVOKE_PRIVILEGE_NOT_SUPPORT_FOR_PRINCIPAL
              + principalDesc.getType().name());
    }

    for (MPrivilege privilege : privileges) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Going to revoke privilege : " + privilege +
            " from principal: " + principal);
      }
      binding.revokePrivilege(getSubject(), principal.getName(), privilege);
    }
  }
}

Example 5

Source File: SentryAccessController.java From incubator-sentry with Apache License 2.0

6 votes

@Override
public void revokeRole(List<MPrincipal> principals, List<MRole> roles)
    throws SqoopException {
  for (MPrincipal principal : principals) {
    PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
    if (principalDesc.getType() != PrincipalType.GROUP) {
      throw new SqoopException(SecurityError.AUTH_0014,
          SentrySqoopError.GRANT_REVOKE_ROLE_NOT_SUPPORT_FOR_PRINCIPAL
              + principalDesc.getType().name());
    }
    for (MRole role : roles) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Going to revoke role : " + role.getName() +
            " from principal: " + principal);
      }
      binding.revokeGroupfromRole(getSubject(), principal.getName(), role);
    }
  }
}

Example 6

Source File: RangerSqoopAuthorizer.java From ranger with Apache License 2.0

5 votes

@Override
public void checkPrivileges(MPrincipal principal, List<MPrivilege> privileges) throws SqoopException {
	if (LOG.isDebugEnabled()) {
		LOG.debug("==> RangerSqoopAuthorizer.checkPrivileges( principal=" + principal + ", privileges="
				+ privileges + ")");
	}

	if (CollectionUtils.isEmpty(privileges)) {
		if (LOG.isDebugEnabled()) {
			LOG.debug("<== RangerSqoopAuthorizer.checkPrivileges() return because privileges is empty.");
		}
		return;
	}

	RangerSqoopPlugin plugin = sqoopPlugin;

	if (plugin != null) {
		for (MPrivilege privilege : privileges) {
			RangerSqoopAccessRequest request = new RangerSqoopAccessRequest(principal, privilege, clientIPAddress);

			RangerAccessResult result = plugin.isAccessAllowed(request);
			if (result != null && !result.getIsAllowed()) {
				throw new SqoopException(SecurityError.AUTH_0014, "principal=" + principal
						+ " does not have privileges for : " + privilege);
			}
		}
	}

	if (LOG.isDebugEnabled()) {
		LOG.debug("<== RangerSqoopAuthorizer.checkPrivileges() success without exception.");
	}
}

Example 7

Source File: SentryAccessController.java From incubator-sentry with Apache License 2.0

5 votes

@Override
public List<MPrincipal> getPrincipalsByRole(MRole role) throws SqoopException {
  /**
   * Sentry does not implement this function yet
   */
  throw new SqoopException(SecurityError.AUTH_0014, SentrySqoopError.NOT_IMPLEMENT_YET);
}

Example 8

Source File: SentryAccessController.java From incubator-sentry with Apache License 2.0

5 votes

@Override
public List<MPrivilege> getPrivilegesByPrincipal(MPrincipal principal,
    MResource resource) throws SqoopException {
  /**
   * Sentry Only supports get privilege by role
   */
  PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
  if (principalDesc.getType() != PrincipalType.ROLE) {
    throw new SqoopException(SecurityError.AUTH_0014,
        SentrySqoopError.SHOW_PRIVILEGE_NOT_SUPPORTED_FOR_PRINCIPAL
            + principalDesc.getType().name());
  }
  return binding.listPrivilegeByRole(getSubject(), principalDesc.getName(), resource);
}

Example 9

Source File: SentryAccessController.java From incubator-sentry with Apache License 2.0

5 votes

@Override
public List<MRole> getRolesByPrincipal(MPrincipal principal) throws SqoopException {
  /**
   * Sentry Only supports get privilege by role
   */
  PrincipalDesc principalDesc = PrincipalDesc.fromStr(principal.getName(), principal.getType());
  if (principalDesc.getType() != PrincipalType.GROUP) {
    throw new SqoopException(SecurityError.AUTH_0014,
        SentrySqoopError.SHOW_GRANT_NOT_SUPPORTED_FOR_PRINCIPAL
            + principalDesc.getType().name());
  }
  return binding.listRolesByGroup(getSubject(), principalDesc.getName());
}