#!/usr/local/bin/thrift -java /** * Licensed to the Apache Software Foundation (ASF) under one * or more contributor license agreements. See the NOTICE file * distributed with this work for additional information * regarding copyright ownership. The ASF licenses this file * to you under the Apache License, Version 2.0 (the * "License"); you may not use this file except in compliance * with the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ # # Thrift Service that the MetaStore is built on # # include "share/fb303/if/fb303.thrift" include "sentry_common_service.thrift" include "sentry_policy_service.thrift" namespace java org.apache.sentry.provider.db.generic.service.thrift namespace php sentry.provider.db.service.db.generic.serivce.thrift namespace cpp Apache.Sentry.Provider.Db.Generic.Service.Thrift typedef sentry_common_service.TSentryResponseStatus TSentryResponseStatus # Represents a new generic model privilege for solr or other component in transport # from the client to the server enum TSentryGrantOption { TRUE = 1, FALSE = 0, UNSET = -1 } # Represents a authorizable resource in the privilege # like DATABASE=db1 in the hive, COLLECTION=collection1 in the solr struct TAuthorizable { 1: required string type, 2: required string name } struct TSentryPrivilege { 1: required string component, 2: required string serviceName, 3: required list authorizables, 4: required string action, 5: optional i64 createTime, # Set on server side 6: optional string grantorPrincipal, # Set on server side 7: optional TSentryGrantOption grantOption = sentry_policy_service.TSentryGrantOption.FALSE } # CREATE ROLE r1 struct TCreateSentryRoleRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required string roleName, 4: required string component # The request is issued to which component } struct TCreateSentryRoleResponse { 1: required TSentryResponseStatus status } # DROP ROLE r1 struct TDropSentryRoleRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required string roleName, 4: required string component # The request is issued to which component } struct TDropSentryRoleResponse { 1: required TSentryResponseStatus status } # GRANT ROLE r1 TO GROUP g1 struct TAlterSentryRoleAddGroupsRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required string roleName, 4: required string component, # The request is issued to which component 5: required set groups } struct TAlterSentryRoleAddGroupsResponse { 1: required TSentryResponseStatus status } # REVOLE ROLE r1 FROM GROUP g1 struct TAlterSentryRoleDeleteGroupsRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required string roleName, 4: required string component, # The request is issued to which component 5: required set groups } struct TAlterSentryRoleDeleteGroupsResponse { 1: required TSentryResponseStatus status } # GRANT ... ON ... TO ROLE ... struct TAlterSentryRoleGrantPrivilegeRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required string roleName, 4: required string component, # The request is issued to which component 5: required TSentryPrivilege privilege } struct TAlterSentryRoleGrantPrivilegeResponse { 1: required TSentryResponseStatus status } # REVOKE ... ON ... FROM ROLE ... struct TAlterSentryRoleRevokePrivilegeRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required string roleName, 4: required string component, # The request is issued to which component 5: required TSentryPrivilege privilege } struct TAlterSentryRoleRevokePrivilegeResponse { 1: required TSentryResponseStatus status } # SHOW ROLE GRANT struct TListSentryRolesRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: optional string groupName, # for this group, or all roles for all groups if null 4: required string component # The request is issued to which component } # used only for TListSentryRolesResponse struct TSentryRole { 1: required string roleName, 2: required set groups } struct TListSentryRolesResponse { 1: required TSentryResponseStatus status 2: optional set roles } # SHOW GRANT struct TListSentryPrivilegesRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required string roleName, # get privileges assigned for this role 4: required string component, # The request is issued to which component 5: required string serviceName, # The privilege belongs to which service 6: optional list authorizables # get privileges assigned for this authorizable hierarchys } struct TListSentryPrivilegesResponse { 1: required TSentryResponseStatus status 2: optional set privileges } # Drop privilege struct TDropPrivilegesRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required TSentryPrivilege privilege 4: required string component, # The request is issued to which component } struct TDropPrivilegesResponse { 1: required TSentryResponseStatus status } # Rename privilege struct TRenamePrivilegesRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string requestorUserName, # user on whose behalf the request is issued 3: required string component, # The request is issued to which component 4: required string serviceName, # The privilege belongs to which service 5: required list oldAuthorizables, # get old privileges assigned for this authorizable hierarchys 6: required list newAuthorizables # change to new authorizable hierarchys } struct TRenamePrivilegesResponse { 1: required TSentryResponseStatus status } # This API was created specifically for ProviderBackend.getPrivileges # and is not mean for general purpose privilege retrieval. # This request/response pair are created specifically so we can # efficiently obtain the specific privilges for a user query struct TSentryActiveRoleSet { 1: required bool all, 2: required set roles, } struct TListSentryPrivilegesForProviderRequest { 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2, 2: required string component, # The request is issued to which component 3: required string serviceName, # The privilege belongs to which service 4: required set groups, 5: required TSentryActiveRoleSet roleSet, 6: optional list authorizables # authorizable hierarchys } struct TListSentryPrivilegesForProviderResponse { 1: required TSentryResponseStatus status 2: required set privileges } service SentryGenericPolicyService { TCreateSentryRoleResponse create_sentry_role(1:TCreateSentryRoleRequest request) TDropSentryRoleResponse drop_sentry_role(1:TDropSentryRoleRequest request) TAlterSentryRoleGrantPrivilegeResponse alter_sentry_role_grant_privilege(1:TAlterSentryRoleGrantPrivilegeRequest request) TAlterSentryRoleRevokePrivilegeResponse alter_sentry_role_revoke_privilege(1:TAlterSentryRoleRevokePrivilegeRequest request) TAlterSentryRoleAddGroupsResponse alter_sentry_role_add_groups(1:TAlterSentryRoleAddGroupsRequest request) TAlterSentryRoleDeleteGroupsResponse alter_sentry_role_delete_groups(1:TAlterSentryRoleDeleteGroupsRequest request) TListSentryRolesResponse list_sentry_roles_by_group(1:TListSentryRolesRequest request) TListSentryPrivilegesResponse list_sentry_privileges_by_role(1:TListSentryPrivilegesRequest request) TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(1:TListSentryPrivilegesForProviderRequest request) TDropPrivilegesResponse drop_sentry_privilege(1:TDropPrivilegesRequest request); TRenamePrivilegesResponse rename_sentry_privilege(1:TRenamePrivilegesRequest request); }