[HIVE-11179] HIVE should allow custom converting from HivePrivilegeObjectDesc to privilegeObject for different authorizers

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.3.0, 2.0.0
• Labels: Authorization
• Assignee: Dapeng Sun
• Reporter: Dapeng Sun
• Created: 03/Jul/15 05:49
• Updated: 16/Feb/16 23:50
• Resolved: 08/Jul/15 05:01

Description

HIVE should allow custom converting from HivePrivilegeObjectDesc to privilegeObject for different authorizers:

There is a case in Apache Sentry: Sentry support uri and server level privilege, but in hive side, it uses AuthorizationUtils.getHivePrivilegeObject(privSubjectDesc) to do the converting, and the code in getHivePrivilegeObject() only handle the scenes for table and database

privSubjectDesc.getTable() ? HivePrivilegeObjectType.TABLE_OR_VIEW :
        HivePrivilegeObjectType.DATABASE;

A solution is move this method to HiveAuthorizer, so that a custom Authorizer could enhance it.

Issue Links

• is related to: HIVE-12698 Remove exposure to internal privilege and principal classes in HiveAuthorizer