[SENTRY-498] Sentry integration with Hive authorization framework V2

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: hive_plugin_v2
• Fix Version/s: hive_plugin_v2, 1.7.0
• Labels: roadmap
• Assignee: Dapeng Sun
• Reporter: Xiaomeng Huang
• Created: 21/Oct/14 07:34
• Updated: 15/Apr/16 21:37
• Resolved: 26/Nov/15 03:30

Description

Currently Sentry grant/revoke privileges via hook DDLTask, and do authorization via HiveSemanticAnalyzerHook. Now hive has a pluggable authorization framework via exposing some interfaces HiveAccessController and HiveAuthorizationValidator. HiveAccessController is used to grant/revoke roles and privileges. HiveAuthorizationValidator is used to do fine-grained authorization.

Advantages to use this framework to grant/revoke privileges and do authorization:

• This framework is very convenient to use by external authorization system.
• Using this framework will be better accepted by community.
• We don't need to take efforts to add so many hooks.
• Some hooks has limitations. e.g. For column level security, we can't get accessed cloumns from query via HiveSemanticAnalyzerHook, so I extend the readEntity to put accessed columns into it(HIVE-7730). But if we use this framework, we don't need to extend the readEntity, we can just get accessed columns from ColumnAccessInfo directly.

I will not remove the old sentry authorization framework, I will just add a new authorizationV2 via implement Hive authorization framework. If all the e2e tests passed, we can mark the old authorization deprecated.

Issue Links

• contains: SENTRY-924 filterIndexNames should return the whole indexList
• depends upon: HIVE-8611 grant/revoke syntax should support additional objects for authorization plugins
• depends upon: HIVE-8612 Support metadata result filter hooks
• is blocked by: SENTRY-541 Seperate udfuri privilege from anyPrivilege model
• is blocked by: SENTRY-563 The interface listPrivilegesByRoleName may throw thrift exception if Authorizable is empty
• is blocked by: SENTRY-591 create table should have output privilege in DB scope
• is blocked by: SENTRY-594 Alter database should check output privilege instead of input
• links to: RB

Sub-Tasks

• Change Hive version to Apache Hive 0.15 for authorization V2: Resolved
• Add new module for hive plugin v2: Resolved
• Sentry Hive authorizer interfaces for authorization V2: Resolved
• Add SentryHivePrivilegeObject to enhance hive authorization for Server and URI type: Resolved
• Merge Hive_plugin_v2 with master (2015/11/02): Resolved
• Default implementation of SentryAccessController to do grant/revoke role/privlege: Resolved
• Implement taskFactory V2 to handle special privilege for Sentry: Resolved
• Default implementation of SentryAuthorizationValidator to do authorization: Resolved
• Extend SentryPolicyServiceClient to implement grant wrapped privilege info for V2: Resolved
• Add unit tests for DefaultSentryAuthorizationValidator: Resolved
• Support column level security for V2: Resolved
• Execute on failure hooks for V2: Resolved
• Workaround some operations for Authorization V2: Resolved