[SENTRY-432] Synchronization of HDFS permissions with Sentry permissions

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.5.0
• Labels: sentry-hdfs
• Assignee: Arun Suresh
• Reporter: Arun Suresh
• Created: 12/Sep/14 04:59
• Updated: 29/May/15 01:49
• Resolved: 25/May/15 15:43

Description

An HDFS file or directory that is associated with an Authorizable Object managed by Sentry (Such as a HiveMetaStore table partition, a Solr/Search collection/document or an HBase Table etc.) should have the permissions that reflect those that were granted/revoked via Sentry.

This logic should be enforced by a Sentry Authorization Plugin which would be an implementation of the HDFS AuthorizationProvider as described in HDFS-6826

This is an umbrella JIRA

Issue Links

• is blocked by: HDFS-6826 Plugin interface to enable delegation of HDFS authorization assertions

Sub-Tasks

• Create common in-memory data structures for efficient storage of Path and Permission information: Closed
• Create wrapper classes for the Path and Permission data structures to handle Full/Partial updates: Resolved
• Implement SentryAuthorizationProvider namenode plugin: Resolved
• Add Thrift endpoints to handle updates from HMS as well as request for updates from Sentry Namenode plugin: Resolved
• Create UpdateHandler and Forwarder that stores updates in a log to be sent to Sentry NN plugin: Resolved
• Modify SentryMetastorePostEventHandler to post updates to Sentry on HMS Path changes: Resolved
• Add e2e testcases for Sentry HDFS integration: Resolved