[IMPALA-7074] Update OWNER privilege on CREATE, DROP, and ALTER SET OWNER

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Impala 3.1.0
• Component/s: Frontend
• Labels: security
• Epic Color: ghx-label-6
• Assignee: Adam Holley
• Reporter: Fredy Wijaya
• Created: 25/May/18 16:01
• Updated: 25/Sep/18 03:48
• Resolved: 14/Sep/18 15:08

Description

When objects are created and owner privilege is enabled in sentry, we should create an owner privilege in the catalog without waiting for the next sentry poll to get the owner privilege. This should also be done for DROP DB/Table, and ALTER DB/Table set owner. These privileges should mirror the privileges that are created in Sentry. As with other GRANT operations, the results of the "SHOW GRANT ROLE" statements will have a create date of NULL for privileges that have not been refreshed from Sentry.

For this Jira, we're adding code to the various catalog operations to create or remove privileges as necessary. Because catalogd does not have the server_name set, we opted to pass the server_name as part of the catalog operations so the catalog is able to create the privileges.

Additionally, because we want to ensure consistency with the sentry, we grab the SentryOwnerPrivilegeType from sentry instead of reading from the local config file.

This change requires a new series of tests that will execute both with and without data refreshed from Sentry privilege database.

Issue Links

• is duplicated by: IMPALA-7339 Drop table/database should remove owner privileges
• is duplicated by: IMPALA-7341 ALTER TABLE/DB SET OWNER should update user privileges
• is duplicated by: IMPALA-7537 REVOKE GRANT OPTION regression