Răsfoiți Sursa

[libsentry] Add new component field to client

Romain Rigaux 10 ani în urmă
părinte
comite
1edaf8d
1 a modificat fișierele cu 30 adăugiri și 32 ștergeri
  1. 30 32
      desktop/libs/libsentry/src/libsentry/client2.py

+ 30 - 32
desktop/libs/libsentry/src/libsentry/client2.py

@@ -19,8 +19,8 @@ import logging
 
 from desktop.lib import thrift_util
 
-from sentry_policy_service import SentryPolicyService
-from sentry_policy_service.ttypes import TListSentryRolesRequest, TListSentryPrivilegesRequest, TSentryAuthorizable, TCreateSentryRoleRequest, \
+from sentry_generic_policy_service import SentryGenericPolicyService
+from sentry_generic_policy_service.ttypes import TListSentryRolesRequest, TListSentryPrivilegesRequest, TSentryAuthorizable, TCreateSentryRoleRequest, \
     TDropSentryRoleRequest, TAlterSentryRoleGrantPrivilegeRequest, TSentryPrivilege, TAlterSentryRoleGrantPrivilegeResponse, \
     TAlterSentryRoleRevokePrivilegeRequest, TAlterSentryRoleAddGroupsRequest, TSentryGroup, TAlterSentryRoleDeleteGroupsRequest, \
     TListSentryPrivilegesForProviderRequest, TSentryActiveRoleSet, TSentryAuthorizable, TDropPrivilegesRequest, TRenamePrivilegesRequest, \
@@ -34,39 +34,37 @@ LOG = logging.getLogger(__name__)
 
 
 """
-struct TSentryPrivilege {
-1: required string privilegeScope, # Valid values are SERVER, DATABASE, TABLE
-3: required string serverName,
-4: optional string dbName = "",
-5: optional string tableName = "",
-6: optional string URI = "",
-7: required string action = "",
-8: optional i64 createTime, # Set on server side
-9: optional TSentryGrantOption grantOption = TSentryGrantOption.FALSE
+struct TAuthorizable {
+1: required string type,
+2: required string name
 }
 
-struct TSentryAuthorizable {
-1: required string server,
-2: optional string uri,
-3: optional string db,
-4: optional string table,
+struct TSentryPrivilege {
+1: required string component,
+2: required string serviceName,
+3: required list<TAuthorizable> authorizables,
+4: required string action,
+5: optional i64 createTime, # Set on server side
+6: optional string grantorPrincipal, # Set on server side
+7: optional TSentryGrantOption grantOption = sentry_policy_service.TSentryGrantOption.FALSE
 }
 """
 
 class SentryClient(object):
   SENTRY_MECHANISMS = {'KERBEROS': 'GSSAPI', 'NOSASL': 'NOSASL', 'NONE': 'NONE'}
 
-  def __init__(self, host, port, username):
+  def __init__(self, host, port, username, component='hive'):
     self.username = username
     self.host = host
     self.port = port
     self.security = self._get_security()
+    self.component = component
 
     self.client = thrift_util.get_client(
-        SentryPolicyService.Client,
+        SentryGenericPolicyService.Client,
         host,
         port,
-        service_name="SentryPolicyService",
+        service_name="SentryGenericPolicyService",
         username=self.username,
         timeout_seconds=30,
         multiple=True,
@@ -76,7 +74,7 @@ class SentryClient(object):
     )
 
   def __str__(self):
-    return ', '.join(map(str, [self.host, self.port, self.username, self.security]))
+    return ', '.join(map(str, [self.host, self.port, self.component, self.username, self.security]))
 
 
   def _get_security(self):
@@ -96,12 +94,12 @@ class SentryClient(object):
 
 
   def create_sentry_role(self, roleName):
-    request = TCreateSentryRoleRequest(requestorUserName=self.username, roleName=roleName)
+    request = TCreateSentryRoleRequest(requestorUserName=self.username, component=self.component, roleName=roleName)
     return self.client.create_sentry_role(request)
 
 
   def drop_sentry_role(self, roleName):
-    request = TDropSentryRoleRequest(requestorUserName=self.username, roleName=roleName, )
+    request = TDropSentryRoleRequest(requestorUserName=self.username, component=self.component, roleName=roleName)
     return self.client.drop_sentry_role(request)
 
 
@@ -112,7 +110,7 @@ class SentryClient(object):
     if tSentryPrivileges is not None:
       tSentryPrivileges = [TSentryPrivilege(**tSentryPrivilege) for tSentryPrivilege in tSentryPrivileges]
 
-    request = TAlterSentryRoleGrantPrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=tSentryPrivilege, privileges=tSentryPrivileges)
+    request = TAlterSentryRoleGrantPrivilegeRequest(requestorUserName=self.username, component=self.component, roleName=roleName, privilege=tSentryPrivilege, privileges=tSentryPrivileges)
     return self.client.alter_sentry_role_grant_privilege(request)
 
 
@@ -123,44 +121,44 @@ class SentryClient(object):
     if tSentryPrivileges is not None:
       tSentryPrivileges = [TSentryPrivilege(**tSentryPrivilege) for tSentryPrivilege in tSentryPrivileges]
 
-    request = TAlterSentryRoleRevokePrivilegeRequest(requestorUserName=self.username, roleName=roleName, privilege=tSentryPrivilege, privileges=tSentryPrivileges)
+    request = TAlterSentryRoleRevokePrivilegeRequest(requestorUserName=self.username, component=self.component, roleName=roleName, privilege=tSentryPrivilege, privileges=tSentryPrivileges)
     return self.client.alter_sentry_role_revoke_privilege(request)
 
 
   def alter_sentry_role_add_groups(self, roleName, groups):
     groups = [TSentryGroup(name) for name in groups]
-    request = TAlterSentryRoleAddGroupsRequest(requestorUserName=self.username, roleName=roleName, groups=groups)
+    request = TAlterSentryRoleAddGroupsRequest(requestorUserName=self.username, component=self.component, roleName=roleName, groups=groups)
     return self.client.alter_sentry_role_add_groups(request)
 
 
   def alter_sentry_role_delete_groups(self, roleName, groups):
     groups = [TSentryGroup(name) for name in groups]
-    request = TAlterSentryRoleDeleteGroupsRequest(requestorUserName=self.username, roleName=roleName, groups=groups)
+    request = TAlterSentryRoleDeleteGroupsRequest(requestorUserName=self.username, component=self.component, roleName=roleName, groups=groups)
     return self.client.alter_sentry_role_delete_groups(request)
 
 
   def list_sentry_roles_by_group(self, groupName=None):
-    request = TListSentryRolesRequest(requestorUserName=self.username, groupName=groupName)
+    request = TListSentryRolesRequest(requestorUserName=self.username, component=self.component, groupName=groupName)
     return self.client.list_sentry_roles_by_group(request)
 
 
   def list_sentry_privileges_by_role(self, roleName, authorizableHierarchy=None):
     if authorizableHierarchy is not None:
       authorizableHierarchy = TSentryAuthorizable(**authorizableHierarchy)
-    request = TListSentryPrivilegesRequest(requestorUserName=self.username, roleName=roleName, authorizableHierarchy=authorizableHierarchy)
+    request = TListSentryPrivilegesRequest(requestorUserName=self.username, component=self.component, roleName=roleName, authorizableHierarchy=authorizableHierarchy)
     return self.client.list_sentry_privileges_by_role(request)
 
 
   def drop_sentry_privilege(self, authorizable):
     authorizable = TSentryAuthorizable(**authorizable)
-    request = TDropPrivilegesRequest(requestorUserName=self.username, authorizable=authorizable)
+    request = TDropPrivilegesRequest(requestorUserName=self.username, component=self.component, authorizable=authorizable)
     return self.client.drop_sentry_privilege(request)
 
 
   def rename_sentry_privilege(self, oldAuthorizable, newAuthorizable):
     oldAuthorizable = TSentryAuthorizable(**oldAuthorizable)
     newAuthorizable = TSentryAuthorizable(**newAuthorizable)
-    request = TRenamePrivilegesRequest(requestorUserName=self.username, oldAuthorizable=oldAuthorizable, newAuthorizable=newAuthorizable)
+    request = TRenamePrivilegesRequest(requestorUserName=self.username, component=self.component, oldAuthorizable=oldAuthorizable, newAuthorizable=newAuthorizable)
     return self.client.rename_sentry_privilege(request)
 
 
@@ -180,7 +178,7 @@ class SentryClient(object):
       roleSet = TSentryActiveRoleSet(**roleSet)
     if authorizableHierarchy is not None:
       authorizableHierarchy = TSentryAuthorizable(**authorizableHierarchy)
-    request = TListSentryPrivilegesForProviderRequest(groups=groups, roleSet=roleSet, authorizableHierarchy=authorizableHierarchy)
+    request = TListSentryPrivilegesForProviderRequest(component=self.component, groups=groups, roleSet=roleSet, authorizableHierarchy=authorizableHierarchy)
     return self.client.list_sentry_privileges_for_provider(request)
 
 
@@ -189,7 +187,7 @@ class SentryClient(object):
     if roleSet is not None:
       roleSet = TSentryActiveRoleSet(**roleSet)
 
-    request = TListSentryPrivilegesByAuthRequest(requestorUserName=self.username, authorizableSet=authorizableSet, groups=groups, roleSet=roleSet)
+    request = TListSentryPrivilegesByAuthRequest(requestorUserName=self.username, component=self.component, authorizableSet=authorizableSet, groups=groups, roleSet=roleSet)
     return self.client.list_sentry_privileges_by_authorizable(request)