|
@@ -0,0 +1,231 @@
|
|
|
|
|
+#!/usr/local/bin/thrift -java
|
|
|
|
|
+
|
|
|
|
|
+/**
|
|
|
|
|
+ * Licensed to the Apache Software Foundation (ASF) under one
|
|
|
|
|
+ * or more contributor license agreements. See the NOTICE file
|
|
|
|
|
+ * distributed with this work for additional information
|
|
|
|
|
+ * regarding copyright ownership. The ASF licenses this file
|
|
|
|
|
+ * to you under the Apache License, Version 2.0 (the
|
|
|
|
|
+ * "License"); you may not use this file except in compliance
|
|
|
|
|
+ * with the License. You may obtain a copy of the License at
|
|
|
|
|
+ *
|
|
|
|
|
+ * http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
+ *
|
|
|
|
|
+ * Unless required by applicable law or agreed to in writing, software
|
|
|
|
|
+ * distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
|
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
|
+ * See the License for the specific language governing permissions and
|
|
|
|
|
+ * limitations under the License.
|
|
|
|
|
+ */
|
|
|
|
|
+
|
|
|
|
|
+#
|
|
|
|
|
+# Thrift Service that the MetaStore is built on
|
|
|
|
|
+#
|
|
|
|
|
+
|
|
|
|
|
+include "share/fb303/if/fb303.thrift"
|
|
|
|
|
+include "sentry_common_service.thrift"
|
|
|
|
|
+include "sentry_policy_service.thrift"
|
|
|
|
|
+
|
|
|
|
|
+namespace java org.apache.sentry.provider.db.generic.service.thrift
|
|
|
|
|
+namespace php sentry.provider.db.service.db.generic.serivce.thrift
|
|
|
|
|
+namespace cpp Apache.Sentry.Provider.Db.Generic.Service.Thrift
|
|
|
|
|
+
|
|
|
|
|
+typedef sentry_common_service.TSentryResponseStatus TSentryResponseStatus
|
|
|
|
|
+
|
|
|
|
|
+# Represents a new generic model privilege for solr or other component in transport
|
|
|
|
|
+# from the client to the server
|
|
|
|
|
+enum TSentryGrantOption {
|
|
|
|
|
+ TRUE = 1,
|
|
|
|
|
+ FALSE = 0,
|
|
|
|
|
+ UNSET = -1
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# Represents a authorizable resource in the privilege
|
|
|
|
|
+# like DATABASE=db1 in the hive, COLLECTION=collection1 in the solr
|
|
|
|
|
+struct TAuthorizable {
|
|
|
|
|
+1: required string type,
|
|
|
|
|
+2: required string name
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+struct TSentryPrivilege {
|
|
|
|
|
+1: required string component,
|
|
|
|
|
+2: required string serviceName,
|
|
|
|
|
+3: required list<TAuthorizable> authorizables,
|
|
|
|
|
+4: required string action,
|
|
|
|
|
+5: optional i64 createTime, # Set on server side
|
|
|
|
|
+6: optional string grantorPrincipal, # Set on server side
|
|
|
|
|
+7: optional TSentryGrantOption grantOption = sentry_policy_service.TSentryGrantOption.FALSE
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# CREATE ROLE r1
|
|
|
|
|
+struct TCreateSentryRoleRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required string roleName,
|
|
|
|
|
+4: required string component # The request is issued to which component
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+struct TCreateSentryRoleResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# DROP ROLE r1
|
|
|
|
|
+struct TDropSentryRoleRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required string roleName,
|
|
|
|
|
+4: required string component # The request is issued to which component
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+struct TDropSentryRoleResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# GRANT ROLE r1 TO GROUP g1
|
|
|
|
|
+struct TAlterSentryRoleAddGroupsRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required string roleName,
|
|
|
|
|
+4: required string component, # The request is issued to which component
|
|
|
|
|
+5: required set<string> groups
|
|
|
|
|
+}
|
|
|
|
|
+struct TAlterSentryRoleAddGroupsResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# REVOLE ROLE r1 FROM GROUP g1
|
|
|
|
|
+struct TAlterSentryRoleDeleteGroupsRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required string roleName,
|
|
|
|
|
+4: required string component, # The request is issued to which component
|
|
|
|
|
+5: required set<string> groups
|
|
|
|
|
+}
|
|
|
|
|
+struct TAlterSentryRoleDeleteGroupsResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# GRANT ... ON ... TO ROLE ...
|
|
|
|
|
+struct TAlterSentryRoleGrantPrivilegeRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required string roleName,
|
|
|
|
|
+4: required string component, # The request is issued to which component
|
|
|
|
|
+5: required TSentryPrivilege privilege
|
|
|
|
|
+}
|
|
|
|
|
+struct TAlterSentryRoleGrantPrivilegeResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# REVOKE ... ON ... FROM ROLE ...
|
|
|
|
|
+struct TAlterSentryRoleRevokePrivilegeRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required string roleName,
|
|
|
|
|
+4: required string component, # The request is issued to which component
|
|
|
|
|
+5: required TSentryPrivilege privilege
|
|
|
|
|
+}
|
|
|
|
|
+struct TAlterSentryRoleRevokePrivilegeResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# SHOW ROLE GRANT
|
|
|
|
|
+struct TListSentryRolesRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: optional string groupName, # for this group, or all roles for all groups if null
|
|
|
|
|
+4: required string component # The request is issued to which component
|
|
|
|
|
+}
|
|
|
|
|
+# used only for TListSentryRolesResponse
|
|
|
|
|
+struct TSentryRole {
|
|
|
|
|
+1: required string roleName,
|
|
|
|
|
+2: required set<string> groups
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+struct TListSentryRolesResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+2: optional set<TSentryRole> roles
|
|
|
|
|
+}
|
|
|
|
|
+# SHOW GRANT
|
|
|
|
|
+struct TListSentryPrivilegesRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required string roleName, # get privileges assigned for this role
|
|
|
|
|
+4: required string component, # The request is issued to which component
|
|
|
|
|
+5: required string serviceName, # The privilege belongs to which service
|
|
|
|
|
+6: optional list<TAuthorizable> authorizables # get privileges assigned for this authorizable hierarchys
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+struct TListSentryPrivilegesResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+2: optional set<TSentryPrivilege> privileges
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# Drop privilege
|
|
|
|
|
+struct TDropPrivilegesRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required TSentryPrivilege privilege
|
|
|
|
|
+4: required string component, # The request is issued to which component
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+struct TDropPrivilegesResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# Rename privilege
|
|
|
|
|
+struct TRenamePrivilegesRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string requestorUserName, # user on whose behalf the request is issued
|
|
|
|
|
+3: required string component, # The request is issued to which component
|
|
|
|
|
+4: required string serviceName, # The privilege belongs to which service
|
|
|
|
|
+5: required list<TAuthorizable> oldAuthorizables, # get old privileges assigned for this authorizable hierarchys
|
|
|
|
|
+6: required list<TAuthorizable> newAuthorizables # change to new authorizable hierarchys
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+struct TRenamePrivilegesResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+# This API was created specifically for ProviderBackend.getPrivileges
|
|
|
|
|
+# and is not mean for general purpose privilege retrieval.
|
|
|
|
|
+# This request/response pair are created specifically so we can
|
|
|
|
|
+# efficiently obtain the specific privilges for a user query
|
|
|
|
|
+struct TSentryActiveRoleSet {
|
|
|
|
|
+1: required bool all,
|
|
|
|
|
+2: required set<string> roles,
|
|
|
|
|
+}
|
|
|
|
|
+struct TListSentryPrivilegesForProviderRequest {
|
|
|
|
|
+1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
|
|
|
|
|
+2: required string component, # The request is issued to which component
|
|
|
|
|
+3: required string serviceName, # The privilege belongs to which service
|
|
|
|
|
+4: required set<string> groups,
|
|
|
|
|
+5: required TSentryActiveRoleSet roleSet,
|
|
|
|
|
+6: optional list<TAuthorizable> authorizables # authorizable hierarchys
|
|
|
|
|
+}
|
|
|
|
|
+struct TListSentryPrivilegesForProviderResponse {
|
|
|
|
|
+1: required TSentryResponseStatus status
|
|
|
|
|
+2: required set<string> privileges
|
|
|
|
|
+}
|
|
|
|
|
+
|
|
|
|
|
+service SentryGenericPolicyService
|
|
|
|
|
+{
|
|
|
|
|
+ TCreateSentryRoleResponse create_sentry_role(1:TCreateSentryRoleRequest request)
|
|
|
|
|
+ TDropSentryRoleResponse drop_sentry_role(1:TDropSentryRoleRequest request)
|
|
|
|
|
+
|
|
|
|
|
+ TAlterSentryRoleGrantPrivilegeResponse alter_sentry_role_grant_privilege(1:TAlterSentryRoleGrantPrivilegeRequest request)
|
|
|
|
|
+ TAlterSentryRoleRevokePrivilegeResponse alter_sentry_role_revoke_privilege(1:TAlterSentryRoleRevokePrivilegeRequest request)
|
|
|
|
|
+
|
|
|
|
|
+ TAlterSentryRoleAddGroupsResponse alter_sentry_role_add_groups(1:TAlterSentryRoleAddGroupsRequest request)
|
|
|
|
|
+ TAlterSentryRoleDeleteGroupsResponse alter_sentry_role_delete_groups(1:TAlterSentryRoleDeleteGroupsRequest request)
|
|
|
|
|
+
|
|
|
|
|
+ TListSentryRolesResponse list_sentry_roles_by_group(1:TListSentryRolesRequest request)
|
|
|
|
|
+
|
|
|
|
|
+ TListSentryPrivilegesResponse list_sentry_privileges_by_role(1:TListSentryPrivilegesRequest request)
|
|
|
|
|
+
|
|
|
|
|
+ TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(1:TListSentryPrivilegesForProviderRequest request)
|
|
|
|
|
+
|
|
|
|
|
+ TDropPrivilegesResponse drop_sentry_privilege(1:TDropPrivilegesRequest request);
|
|
|
|
|
+
|
|
|
|
|
+ TRenamePrivilegesResponse rename_sentry_privilege(1:TRenamePrivilegesRequest request);
|
|
|
|
|
+}
|