Browse Source

[libsentry] Rebasing Thrift for its new impersonation field

Romain Rigaux 11 years ago
parent
commit
71ed68511f

+ 1 - 1
apps/security/src/security/templates/hive.mako

@@ -91,7 +91,7 @@ ${ layout.menubar(section='hive') }
 
     <em class="muted" data-bind="text: moment(timestamp()).fromNow()"></em> <span class="muted" data-bind="text: privilegeScope"></span>
     <!-- ko if: grantOption -->
-      <i class="fa fa-unlock-alt muted" title="${ _('With grant option') }"></i>
+      <i class="fa fa-unlock muted" title="${ _('With grant option') }"></i>
     <!-- /ko -->
     <br/>
     server=<span data-bind="text: serverName"></span>

+ 23 - 11
desktop/libs/libsentry/gen-py/sentry_policy_service/ttypes.py

@@ -2506,6 +2506,7 @@ class TListSentryPrivilegesByAuthRequest(object):
   """
   Attributes:
    - protocol_version
+   - requestorUserName
    - authorizableSet
    - groups
    - roleSet
@@ -2514,13 +2515,15 @@ class TListSentryPrivilegesByAuthRequest(object):
   thrift_spec = (
     None, # 0
     (1, TType.I32, 'protocol_version', None, 1, ), # 1
-    (2, TType.SET, 'authorizableSet', (TType.STRUCT,(TSentryAuthorizable, TSentryAuthorizable.thrift_spec)), None, ), # 2
-    (3, TType.SET, 'groups', (TType.STRING,None), None, ), # 3
-    (4, TType.STRUCT, 'roleSet', (TSentryActiveRoleSet, TSentryActiveRoleSet.thrift_spec), None, ), # 4
+    (2, TType.STRING, 'requestorUserName', None, None, ), # 2
+    (3, TType.SET, 'authorizableSet', (TType.STRUCT,(TSentryAuthorizable, TSentryAuthorizable.thrift_spec)), None, ), # 3
+    (4, TType.SET, 'groups', (TType.STRING,None), None, ), # 4
+    (5, TType.STRUCT, 'roleSet', (TSentryActiveRoleSet, TSentryActiveRoleSet.thrift_spec), None, ), # 5
   )
 
-  def __init__(self, protocol_version=thrift_spec[1][4], authorizableSet=None, groups=None, roleSet=None,):
+  def __init__(self, protocol_version=thrift_spec[1][4], requestorUserName=None, authorizableSet=None, groups=None, roleSet=None,):
     self.protocol_version = protocol_version
+    self.requestorUserName = requestorUserName
     self.authorizableSet = authorizableSet
     self.groups = groups
     self.roleSet = roleSet
@@ -2540,6 +2543,11 @@ class TListSentryPrivilegesByAuthRequest(object):
         else:
           iprot.skip(ftype)
       elif fid == 2:
+        if ftype == TType.STRING:
+          self.requestorUserName = iprot.readString();
+        else:
+          iprot.skip(ftype)
+      elif fid == 3:
         if ftype == TType.SET:
           self.authorizableSet = set()
           (_etype75, _size72) = iprot.readSetBegin()
@@ -2550,7 +2558,7 @@ class TListSentryPrivilegesByAuthRequest(object):
           iprot.readSetEnd()
         else:
           iprot.skip(ftype)
-      elif fid == 3:
+      elif fid == 4:
         if ftype == TType.SET:
           self.groups = set()
           (_etype81, _size78) = iprot.readSetBegin()
@@ -2560,7 +2568,7 @@ class TListSentryPrivilegesByAuthRequest(object):
           iprot.readSetEnd()
         else:
           iprot.skip(ftype)
-      elif fid == 4:
+      elif fid == 5:
         if ftype == TType.STRUCT:
           self.roleSet = TSentryActiveRoleSet()
           self.roleSet.read(iprot)
@@ -2580,22 +2588,26 @@ class TListSentryPrivilegesByAuthRequest(object):
       oprot.writeFieldBegin('protocol_version', TType.I32, 1)
       oprot.writeI32(self.protocol_version)
       oprot.writeFieldEnd()
+    if self.requestorUserName is not None:
+      oprot.writeFieldBegin('requestorUserName', TType.STRING, 2)
+      oprot.writeString(self.requestorUserName)
+      oprot.writeFieldEnd()
     if self.authorizableSet is not None:
-      oprot.writeFieldBegin('authorizableSet', TType.SET, 2)
+      oprot.writeFieldBegin('authorizableSet', TType.SET, 3)
       oprot.writeSetBegin(TType.STRUCT, len(self.authorizableSet))
       for iter84 in self.authorizableSet:
         iter84.write(oprot)
       oprot.writeSetEnd()
       oprot.writeFieldEnd()
     if self.groups is not None:
-      oprot.writeFieldBegin('groups', TType.SET, 3)
+      oprot.writeFieldBegin('groups', TType.SET, 4)
       oprot.writeSetBegin(TType.STRING, len(self.groups))
       for iter85 in self.groups:
         oprot.writeString(iter85)
       oprot.writeSetEnd()
       oprot.writeFieldEnd()
     if self.roleSet is not None:
-      oprot.writeFieldBegin('roleSet', TType.STRUCT, 4)
+      oprot.writeFieldBegin('roleSet', TType.STRUCT, 5)
       self.roleSet.write(oprot)
       oprot.writeFieldEnd()
     oprot.writeFieldStop()
@@ -2604,6 +2616,8 @@ class TListSentryPrivilegesByAuthRequest(object):
   def validate(self):
     if self.protocol_version is None:
       raise TProtocol.TProtocolException(message='Required field protocol_version is unset!')
+    if self.requestorUserName is None:
+      raise TProtocol.TProtocolException(message='Required field requestorUserName is unset!')
     if self.authorizableSet is None:
       raise TProtocol.TProtocolException(message='Required field authorizableSet is unset!')
     return
@@ -2693,8 +2707,6 @@ class TListSentryPrivilegesByAuthResponse(object):
   def validate(self):
     if self.status is None:
       raise TProtocol.TProtocolException(message='Required field status is unset!')
-    if self.privilegesMapByAuth is None:
-      raise TProtocol.TProtocolException(message='Required field privilegesMapByAuth is unset!')
     return
 
 

+ 1 - 2
desktop/libs/libsentry/src/libsentry/client.py

@@ -174,7 +174,6 @@ class SentryClient(object):
     if roleSet is not None:
       roleSet = TSentryActiveRoleSet(**roleSet)    
 
-    # Missing requestorUserName=self.username
-    request = TListSentryPrivilegesByAuthRequest(authorizableSet=authorizableSet, groups=groups, roleSet=roleSet)
+    request = TListSentryPrivilegesByAuthRequest(requestorUserName=self.username, authorizableSet=authorizableSet, groups=groups, roleSet=roleSet)
     return self.client.list_sentry_privileges_by_authorizable(request)
 

+ 5 - 4
desktop/libs/libsentry/thrift/sentry_policy_service.thrift

@@ -206,13 +206,14 @@ struct TSentryPrivilegeMap {
 }
 struct TListSentryPrivilegesByAuthRequest {
 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
-2: required set<TSentryAuthorizable> authorizableSet,
-3: optional set<string> groups,
-4: optional TSentryActiveRoleSet roleSet
+2: required string requestorUserName, # user on whose behalf the request is issued
+3: required set<TSentryAuthorizable> authorizableSet,
+4: optional set<string> groups,
+5: optional TSentryActiveRoleSet roleSet
 }
 struct TListSentryPrivilegesByAuthResponse {
 1: required sentry_common_service.TSentryResponseStatus status,
-2: required map<TSentryAuthorizable, TSentryPrivilegeMap> privilegesMapByAuth
+2: optional map<TSentryAuthorizable, TSentryPrivilegeMap> privilegesMapByAuth # will not be set in case of an error
 }
 
 service SentryPolicyService