[SENTRY-2129] User based privilege

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.1.0
• Component/s: Sentry
• Labels: roadmap
• Assignee: Unassigned
• Reporter: Na Li
• Created: 25/Jan/18 20:12
• Updated: 14/Jun/19 18:41

Description

It’s standard in traditional database security to allow both groups and users to be assigned to roles. And hive supports to grant role to user.

So the following command should be supported in sentry:

GRANT role_name TO USER user

The feature implemented in SENTRY-711 is not complete. We complete this feature 

 
The current user-based privilege missed some items:
 

• Sentry policy has two service API: SentryPolicyService and SentryGenericPolicyService. The current implementation does not support user-based privilege for SentryGenericPolicyService
• Fix bug. SENTRY-2091: User-based Privilege is broken by SENTRY-769. The patch is available for review.
• Name Node need change to generate ACL using user privilege.
  • The full snapshot update only contains authorization to roles mapping and role to group mapping. Need to add role to user mapping in SentryStore.retrieveFullRoleImageCore
  • The delta updates are taken from table SENTRY_PERM_CHANGE, which does not distinguish group based permission or user based permission. No change is needed
  • The user changes to a role is not included when sending delta update from Sentry to NN. Need to add AddUsers and DropUsers in TRoleChanges. 
  • Sentry only create ACL for group with ACL type as AclEntryType.GROUP. Need to add code to create ACL with type as AclEntryType.USER

• • • SentryINodeAttributesProvider.checkPermission -> FSPermissionChecker.checkPermission -> SentryINodeAttributesProvider.getAclFeature -> SentryAuthorizationInfo.getAclEntries -> SentryPermissions.constructAclEntry
• SentryStore.grantOptionCheck() has to be changed to find user level privilege. 

Issue Links

• relates to: SENTRY-711 Implement grant user to role

Sub-Tasks

• Create design document for user based privilege: Open
• Get user to role mapping when retrieving full snapshot from DB: Open
• User-based Privilege is broken by SENTRY-769: Patch Available
• Add user to role mapping in thrift response for permission updates: Open
• Create user related ACL at Name Node: Open
• Support User level privileges for Sentry HA: Open
• Support assigning role to user at SentryGenericPolicyService Interface: Open
• Find user level privilege in SentryStore.grantOptionCheck(): Open
• Update sentry plugin for grant user to role: Open