[SENTRY-390] Extend Thrift API to support column-level privilege

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.5.0
• Assignee: Dapeng Sun
• Reporter: Dapeng Sun
• Created: 14/Aug/14 06:44
• Updated: 18/Nov/14 08:51
• Resolved: 18/Nov/14 08:51

Description

The jira include:

1. SENTRY Thrift API changed :
   • We change the field TSentryPrivilege privilege to set<TSentryPrivilege> privileges in TAlterSentryRoleGrantPrivilegeRequest and TAlterSentryRoleRevokePrivilegeRequest, The reason is the HIVE GRANT may like Grant SELECT (tb1.col1, tb2.col2) on TABLE table1 to role roleName, it contains two privileges (col1 and col2) for SENTRY, to reduce the request API calls, we make it change.
   • Another way to Implement it, maybe add a column list to TSentryPrivilege, but it will bring more problems, we know SentryStore has many convert methods between TSentryPrivilege and MSentryPrivilege, and query an unique MSentryPrivilege use TSentryPrivilege as query condition, so we should make them one-to-one correspondence.
2. Change SentryStore after Thrift API changed
3. Change SentryPolicyStoreProcessor and SentryPolicyServiceClient after Thrift API changed, include the grant/revoke methods about column privilege
4. Change Auditlog after Thrift API changed

Issue Links

• depends upon: SENTRY-391 Extend sentrystore query for column level privilege
• Is contained by: SENTRY-74 Add column-level privileges for Hive/Impala
• is depended upon by: SENTRY-393 Grant/Revoke and Show Grant info support for column level privilege
• links to: Review board