瀏覽代碼

[security] Adding API to list priviledges of an object

Romain Rigaux 11 年之前
父節點
當前提交
a07d9ed0ca
共有 2 個文件被更改,包括 45 次插入18 次删除
  1. 24 15
      desktop/libs/libsentry/src/libsentry/api.py
  2. 21 3
      desktop/libs/libsentry/src/libsentry/client.py

+ 24 - 15
desktop/libs/libsentry/src/libsentry/api.py

@@ -113,20 +113,29 @@ class SentryApi(object):
     response = self.client.list_sentry_privileges_by_role(roleName, authorizableHierarchy)
     
     if response.status.value == 0:
-      priviliges = []
-      for privilige in response.privileges:
-        priviliges.append({
-          'scope': privilige.privilegeScope,
-          'name': privilige.privilegeName,
-          'server': privilige.serverName,
-          'database': privilige.dbName,
-          'table': privilige.tableName,
-          'URI': privilige.URI,
-          'action': privilige.action,
-          'timestamp': privilige.createTime,
-          'grantor': privilige.grantorPrincipal
-        })
-      return priviliges
+      return [self._massage_priviledges(privilige) for privilige in response.privileges]
     else:
       raise SentryException(response)
-    
+    
+    
+  def list_sentry_privileges_for_provider(self, groups, roleSet=None, authorizableHierarchy=None):
+    response = self.client.list_sentry_privileges_for_provider(groups, roleSet, authorizableHierarchy)
+    
+    if response.status.value == 0:
+      return  [self._massage_priviledges(privilige) for privilige in response.privileges]
+    else:
+      raise SentryException(response)
+    
+    
+  def _massage_priviledges(self, privilige):
+    return {
+        'scope': privilige.privilegeScope,
+        'name': privilige.privilegeName,
+        'server': privilige.serverName,
+        'database': privilige.dbName,
+        'table': privilige.tableName,
+        'URI': privilige.URI,
+        'action': privilige.action,
+        'timestamp': privilige.createTime,
+        'grantor': privilige.grantorPrincipal
+    }     

+ 21 - 3
desktop/libs/libsentry/src/libsentry/client.py

@@ -22,12 +22,12 @@ from desktop.lib import thrift_util
 from sentry_policy_service import SentryPolicyService
 from sentry_policy_service.ttypes import TListSentryRolesRequest, TListSentryPrivilegesRequest, TSentryAuthorizable, TCreateSentryRoleRequest, \
     TDropSentryRoleRequest, TAlterSentryRoleGrantPrivilegeRequest, TSentryPrivilege, TAlterSentryRoleGrantPrivilegeResponse, \
-    TAlterSentryRoleRevokePrivilegeRequest, TAlterSentryRoleAddGroupsRequest, TSentryGroup, TAlterSentryRoleDeleteGroupsRequest
+    TAlterSentryRoleRevokePrivilegeRequest, TAlterSentryRoleAddGroupsRequest, TSentryGroup, TAlterSentryRoleDeleteGroupsRequest, \
+    TListSentryPrivilegesForProviderRequest, TSentryActiveRoleSet, TSentryAuthorizable
 
 
 LOG = logging.getLogger(__name__)
 
-# TODO: kerberos
 
 """
 struct TSentryPrivilege {
@@ -55,7 +55,7 @@ class SentryClient(object):
   def __init__(self, host, port, username):
     self.username = username
 
-    self.client = thrift_util.get_client(
+    self.client = thrift_util.get_client( # TODO: kerberos
         SentryPolicyService.Client,
         host,
         port,
@@ -111,3 +111,21 @@ class SentryClient(object):
     return self.client.list_sentry_privileges_by_role(request)
 
 
+  def list_sentry_privileges_for_provider(self, groups, roleSet=None, authorizableHierarchy=None):
+    """
+    struct TSentryActiveRoleSet {
+      1: required bool all,
+      2: required set<string> roles,
+    }
+    
+    struct TListSentryPrivilegesForProviderResponse {
+      1: required sentry_common_service.TSentryResponseStatus status
+      2: required set<string> privileges
+    }
+    """
+    if roleSet is not None:        
+      roleSet = TSentryActiveRoleSet(**roleSet)
+    if authorizableHierarchy is not None:
+      authorizableHierarchy = TSentryAuthorizable(**authorizableHierarchy) 
+    request = TListSentryPrivilegesForProviderRequest(groups=groups, roleSet=roleSet, authorizableHierarchy=authorizableHierarchy)
+    return self.client.list_sentry_roles_by_group(request)