client2.py 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189
  1. #!/usr/bin/env python
  2. # Licensed to Cloudera, Inc. under one
  3. # or more contributor license agreements. See the NOTICE file
  4. # distributed with this work for additional information
  5. # regarding copyright ownership. Cloudera, Inc. licenses this file
  6. # to you under the Apache License, Version 2.0 (the
  7. # "License"); you may not use this file except in compliance
  8. # with the License. You may obtain a copy of the License at
  9. #
  10. # http://www.apache.org/licenses/LICENSE-2.0
  11. #
  12. # Unless required by applicable law or agreed to in writing, software
  13. # distributed under the License is distributed on an "AS IS" BASIS,
  14. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  15. # See the License for the specific language governing permissions and
  16. # limitations under the License.
  17. import logging
  18. from desktop.lib import thrift_util
  19. from sentry_generic_policy_service import SentryGenericPolicyService
  20. from sentry_generic_policy_service.ttypes import TListSentryRolesRequest, TListSentryPrivilegesRequest, TAuthorizable, TCreateSentryRoleRequest, \
  21. TDropSentryRoleRequest, TAlterSentryRoleGrantPrivilegeRequest, TSentryPrivilege, TAlterSentryRoleGrantPrivilegeResponse, \
  22. TAlterSentryRoleRevokePrivilegeRequest, TAlterSentryRoleAddGroupsRequest, TAlterSentryRoleDeleteGroupsRequest, \
  23. TListSentryPrivilegesForProviderRequest, TSentryActiveRoleSet, TDropPrivilegesRequest, TRenamePrivilegesRequest
  24. from libsentry.sentry_site import get_sentry_server_authentication,\
  25. get_sentry_server_principal
  26. LOG = logging.getLogger(__name__)
  27. """
  28. struct TAuthorizable {
  29. 1: required string type,
  30. 2: required string name
  31. }
  32. struct TSentryPrivilege {
  33. 1: required string component,
  34. 2: required string serviceName,
  35. 3: required list<TAuthorizable> authorizables,
  36. 4: required string action,
  37. 5: optional i64 createTime, # Set on server side
  38. 6: optional string grantorPrincipal, # Set on server side
  39. 7: optional TSentryGrantOption grantOption = sentry_policy_service.TSentryGrantOption.FALSE
  40. }
  41. """
  42. class SentryClient(object):
  43. SENTRY_MECHANISMS = {'KERBEROS': 'GSSAPI', 'NOSASL': 'NOSASL', 'NONE': 'NONE'}
  44. def __init__(self, host, port, username, component='hive'):
  45. self.username = username
  46. self.host = host
  47. self.port = port
  48. self.security = self._get_security()
  49. self.component = component
  50. self.client = thrift_util.get_client(
  51. SentryGenericPolicyService.Client,
  52. host,
  53. port,
  54. service_name="SentryGenericPolicyService",
  55. username=self.username,
  56. timeout_seconds=30,
  57. multiple=True,
  58. kerberos_principal=self.security['kerberos_principal_short_name'],
  59. use_sasl=self.security['use_sasl'],
  60. mechanism=self.security['mechanism']
  61. )
  62. def __str__(self):
  63. return ', '.join(map(str, [self.host, self.port, self.component, self.username, self.security]))
  64. def _get_security(self):
  65. principal = get_sentry_server_principal()
  66. if principal:
  67. kerberos_principal_short_name = principal.split('/', 1)[0]
  68. else:
  69. kerberos_principal_short_name = None
  70. use_sasl = get_sentry_server_authentication() == 'KERBEROS'
  71. mechanism = SentryClient.SENTRY_MECHANISMS[get_sentry_server_authentication()]
  72. return {
  73. 'kerberos_principal_short_name': kerberos_principal_short_name,
  74. 'use_sasl': use_sasl,
  75. 'mechanism': mechanism
  76. }
  77. def create_sentry_role(self, roleName):
  78. request = TCreateSentryRoleRequest(requestorUserName=self.username, component=self.component, roleName=roleName)
  79. return self.client.create_sentry_role(request)
  80. def drop_sentry_role(self, roleName):
  81. request = TDropSentryRoleRequest(requestorUserName=self.username, component=self.component, roleName=roleName)
  82. return self.client.drop_sentry_role(request)
  83. def alter_sentry_role_grant_privilege(self, roleName, tSentryPrivilege, tSentryPrivileges):
  84. if tSentryPrivilege is not None:
  85. tSentryPrivilege = TSentryPrivilege(**tSentryPrivilege)
  86. if tSentryPrivileges is not None:
  87. tSentryPrivileges = [TSentryPrivilege(**tSentryPrivilege) for tSentryPrivilege in tSentryPrivileges]
  88. request = TAlterSentryRoleGrantPrivilegeRequest(requestorUserName=self.username, component=self.component, roleName=roleName, privilege=tSentryPrivilege, privileges=tSentryPrivileges)
  89. return self.client.alter_sentry_role_grant_privilege(request)
  90. def alter_sentry_role_revoke_privilege(self, roleName, tSentryPrivilege, tSentryPrivileges):
  91. if tSentryPrivilege is not None:
  92. tSentryPrivilege = TSentryPrivilege(**tSentryPrivilege)
  93. if tSentryPrivileges is not None:
  94. tSentryPrivileges = [TSentryPrivilege(**tSentryPrivilege) for tSentryPrivilege in tSentryPrivileges]
  95. request = TAlterSentryRoleRevokePrivilegeRequest(requestorUserName=self.username, component=self.component, roleName=roleName, privilege=tSentryPrivilege, privileges=tSentryPrivileges)
  96. return self.client.alter_sentry_role_revoke_privilege(request)
  97. def alter_sentry_role_add_groups(self, roleName, groups):
  98. request = TAlterSentryRoleAddGroupsRequest(requestorUserName=self.username, component=self.component, roleName=roleName, groups=groups)
  99. return self.client.alter_sentry_role_add_groups(request)
  100. def alter_sentry_role_delete_groups(self, roleName, groups):
  101. request = TAlterSentryRoleDeleteGroupsRequest(requestorUserName=self.username, component=self.component, roleName=roleName, groups=groups)
  102. return self.client.alter_sentry_role_delete_groups(request)
  103. def list_sentry_roles_by_group(self, groupName=None):
  104. request = TListSentryRolesRequest(requestorUserName=self.username, component=self.component, groupName=groupName)
  105. return self.client.list_sentry_roles_by_group(request)
  106. def list_sentry_privileges_by_role(self, roleName, authorizableHierarchy=None):
  107. if authorizableHierarchy is not None:
  108. authorizableHierarchy = TAuthorizable(**authorizableHierarchy)
  109. request = TListSentryPrivilegesRequest(requestorUserName=self.username, component=self.component, roleName=roleName, authorizableHierarchy=authorizableHierarchy)
  110. return self.client.list_sentry_privileges_by_role(request)
  111. def drop_sentry_privilege(self, authorizable):
  112. authorizable = TAuthorizable(**authorizable)
  113. request = TDropPrivilegesRequest(requestorUserName=self.username, component=self.component, authorizable=authorizable)
  114. return self.client.drop_sentry_privilege(request)
  115. def rename_sentry_privilege(self, oldAuthorizable, newAuthorizable):
  116. oldAuthorizable = TAuthorizable(**oldAuthorizable)
  117. newAuthorizable = TAuthorizable(**newAuthorizable)
  118. request = TRenamePrivilegesRequest(requestorUserName=self.username, component=self.component, oldAuthorizable=oldAuthorizable, newAuthorizable=newAuthorizable)
  119. return self.client.rename_sentry_privilege(request)
  120. def list_sentry_privileges_for_provider(self, groups, roleSet=None, authorizableHierarchy=None):
  121. """
  122. struct TSentryActiveRoleSet {
  123. 1: required bool all,
  124. 2: required set<string> roles,
  125. }
  126. struct TListSentryPrivilegesForProviderResponse {
  127. 1: required sentry_common_service.TSentryResponseStatus status
  128. 2: required set<string> privileges
  129. }
  130. """
  131. if roleSet is not None:
  132. roleSet = TSentryActiveRoleSet(**roleSet)
  133. if authorizableHierarchy is not None:
  134. authorizableHierarchy = TAuthorizable(**authorizableHierarchy)
  135. request = TListSentryPrivilegesForProviderRequest(component=self.component, groups=groups, roleSet=roleSet, authorizableHierarchy=authorizableHierarchy)
  136. return self.client.list_sentry_privileges_for_provider(request)
  137. def list_sentry_privileges_by_authorizable(self, authorizableSet, groups=None, roleSet=None):
  138. authorizableSet = [TAuthorizable(**authorizable) for authorizable in authorizableSet]
  139. if roleSet is not None:
  140. roleSet = TSentryActiveRoleSet(**roleSet)
  141. request = TListSentryPrivilegesByAuthRequest(requestorUserName=self.username, component=self.component, authorizableSet=authorizableSet, groups=groups, roleSet=roleSet)
  142. return self.client.list_sentry_privileges_by_authorizable(request)