[SENTRY-2372] SentryStore should not implement grantOptionCheck

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.2.0
• Component/s: Sentry, sentrystore
• Assignee: Sergio Peña
• Reporter: Sergio Peña
• Created: 29/Aug/18 16:26
• Updated: 27/Oct/18 15:01
• Resolved: 27/Oct/18 15:01

Description

During functional testing it was found that SentryStore implementation contains logic that enforces sentry rights and depends on cluster-specific context. Specifically grantOptionCheck needs to be able to resolve hadoop user's groups and sentry admin groups configured on the cluster. 

There are two problems with this:

1. Some backends use SentryStore in a multi-tenant way and does have the context that SentryStore expects when it is used in cluster.
2. Security enforcement logic shouldn't be in SentryStore if it is to be trusted. Since the backends Sentry API may be stateless the caller has to pass request context to such implementation backend together with the explicit SentryStore arguments. If the context (e.g. groups) is passed with the request the checks become unenforceable since caller controls variables on both sides of the comparison.

The recommendation is to remove grantOptionCheck and SentryStore and to implement equivalent logic in SentryPolicyStoreProcessor.

Issue Links

• links to: Review Board