[SENTRY-2091] User-based Privilege is broken by SENTRY-769

• Type: Sub-task
• Status: Patch Available
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.1.0
• Component/s: Sentry
• Assignee: Unassigned
• Reporter: Na Li
• Created: 06/Dec/17 17:13
• Updated: 14/Jun/19 18:50

Description

SENTRY-769 throws exception when a user has no group. This breaks user-based privilege as the exception prevents getting privilege using user-based privilege.

For example, in the following code

Set<String> userPrivileges =
        authProvider.getPolicyEngine().getPrivileges(
            authProvider.getGroupMapping().getGroups(userName), Sets.newHashSet(userName),
            hiveAuthzBinding.getActiveRoleSet(), hiveAuthzBinding.getAuthServer());

when user has no group, the exception causes the processing stops even when user has privilege.

The solution is to catch the exception, and continue the processing.

try {
Set<String> groups = null;
try {
  groups = authProvider.getGroupMapping().getGroups(userName)
} catch (SentryGroupNotFoundException ex) {
  log.debug(...);
  groups = new HashSet<String>();
}

Set<String> userPrivileges =
        authProvider.getPolicyEngine().getPrivileges(
            groups, Sets.newHashSet(userName),
            hiveAuthzBinding.getActiveRoleSet(), hiveAuthzBinding.getAuthServer());

        ...

}

Issue Links

• is duplicated by: SENTRY-2051 Catch SentryGroupNotFoundException in thrift server handler
• is related to: SENTRY-2095 Support User-based privilege at Name Node through HDFS sync
• relates to: SENTRY-711 Implement grant user to role
• links to: Review Link for this case