sentry_policy_service.thrift 9.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260
  1. #!/usr/local/bin/thrift -java
  2. /**
  3. * Licensed to the Apache Software Foundation (ASF) under one
  4. * or more contributor license agreements. See the NOTICE file
  5. * distributed with this work for additional information
  6. * regarding copyright ownership. The ASF licenses this file
  7. * to you under the Apache License, Version 2.0 (the
  8. * "License"); you may not use this file except in compliance
  9. * with the License. You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS,
  15. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. */
  19. #
  20. # Thrift Service that the MetaStore is built on
  21. #
  22. # include "share/fb303/if/fb303.thrift"
  23. include "sentry_common_service.thrift"
  24. namespace java org.apache.sentry.provider.db.service.thrift
  25. namespace php sentry.provider.db.service.thrift
  26. namespace cpp Apache.Sentry.Provider.Db.Service.Thrift
  27. enum TSentryGrantOption {
  28. TRUE = 1,
  29. FALSE = 0,
  30. # UNSET is used for revoke privilege, the component like 'hive'
  31. # didn't support getting grant option, so use UNSET is stand
  32. # for revoke both privileges with grant option and without grant
  33. # option.
  34. UNSET = -1
  35. }
  36. # Represents a Privilege in transport from the client to the server
  37. struct TSentryPrivilege {
  38. 1: required string privilegeScope, # Valid values are SERVER, DATABASE, TABLE, COLUMN, URI
  39. 3: required string serverName,
  40. 4: optional string dbName = "",
  41. 5: optional string tableName = "",
  42. 6: optional string URI = "",
  43. 7: required string action = "",
  44. 8: optional i64 createTime, # Set on server side
  45. 9: optional TSentryGrantOption grantOption = TSentryGrantOption.FALSE
  46. 10: optional string columnName = "",
  47. }
  48. # TODO can this be deleted? it's not adding value to TAlterSentryRoleAddGroupsRequest
  49. struct TSentryGroup {
  50. 1: required string groupName
  51. }
  52. # CREATE ROLE r1
  53. struct TCreateSentryRoleRequest {
  54. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  55. 2: required string requestorUserName, # user on whose behalf the request is issued
  56. 3: required string roleName, # TSentryRole is not required for this request
  57. }
  58. struct TCreateSentryRoleResponse {
  59. 1: required sentry_common_service.TSentryResponseStatus status
  60. }
  61. # DROP ROLE r1
  62. struct TDropSentryRoleRequest {
  63. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  64. 2: required string requestorUserName, # user on whose behalf the request is issued
  65. 3: required string roleName # role to drop
  66. }
  67. struct TDropSentryRoleResponse {
  68. 1: required sentry_common_service.TSentryResponseStatus status
  69. }
  70. # GRANT ROLE r1 TO GROUP g1
  71. struct TAlterSentryRoleAddGroupsRequest {
  72. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  73. 2: required string requestorUserName, # user on whose behalf the request is issued
  74. 3: required string roleName,
  75. 5: required set<TSentryGroup> groups
  76. }
  77. struct TAlterSentryRoleAddGroupsResponse {
  78. 1: required sentry_common_service.TSentryResponseStatus status
  79. }
  80. # REVOLE ROLE r1 FROM GROUP g1
  81. struct TAlterSentryRoleDeleteGroupsRequest {
  82. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  83. 2: required string requestorUserName, # user on whose behalf the request is issued
  84. 3: required string roleName,
  85. 5: required set<TSentryGroup> groups
  86. }
  87. struct TAlterSentryRoleDeleteGroupsResponse {
  88. 1: required sentry_common_service.TSentryResponseStatus status
  89. }
  90. # GRANT ... ON ... TO ROLE ...
  91. struct TAlterSentryRoleGrantPrivilegeRequest {
  92. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  93. 2: required string requestorUserName, # user on whose behalf the request is issued
  94. 3: required string roleName,
  95. 5: optional TSentryPrivilege privilege,
  96. 6: optional set<TSentryPrivilege> privileges
  97. }
  98. struct TAlterSentryRoleGrantPrivilegeResponse {
  99. 1: required sentry_common_service.TSentryResponseStatus status
  100. 2: optional TSentryPrivilege privilege
  101. 3: optional set<TSentryPrivilege> privileges
  102. }
  103. # REVOKE ... ON ... FROM ROLE ...
  104. struct TAlterSentryRoleRevokePrivilegeRequest {
  105. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  106. 2: required string requestorUserName, # user on whose behalf the request is issued
  107. 3: required string roleName,
  108. 5: optional TSentryPrivilege privilege,
  109. 6: optional set<TSentryPrivilege> privileges
  110. }
  111. struct TAlterSentryRoleRevokePrivilegeResponse {
  112. 1: required sentry_common_service.TSentryResponseStatus status
  113. }
  114. # SHOW ROLE GRANT
  115. struct TListSentryRolesRequest {
  116. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  117. 2: required string requestorUserName, # user on whose behalf the request is issued
  118. 3: optional string groupName # for this group, or all roles for all groups if null
  119. }
  120. # used only for TListSentryRolesResponse
  121. struct TSentryRole {
  122. 1: required string roleName,
  123. 2: required set<TSentryGroup> groups,
  124. 3: required string grantorPrincipal #Deprecated
  125. }
  126. struct TListSentryRolesResponse {
  127. 1: required sentry_common_service.TSentryResponseStatus status
  128. 2: optional set<TSentryRole> roles
  129. }
  130. struct TSentryAuthorizable {
  131. 1: required string server,
  132. 2: optional string uri,
  133. 3: optional string db,
  134. 4: optional string table,
  135. 5: optional string column,
  136. }
  137. # SHOW GRANT
  138. struct TListSentryPrivilegesRequest {
  139. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  140. 2: required string requestorUserName, # user on whose behalf the request is issued
  141. 4: required string roleName, # get privileges assigned for this role
  142. 5: optional TSentryAuthorizable authorizableHierarchy # get privileges assigned for this role
  143. }
  144. struct TListSentryPrivilegesResponse {
  145. 1: required sentry_common_service.TSentryResponseStatus status
  146. 2: optional set<TSentryPrivilege> privileges
  147. }
  148. # Drop privilege
  149. struct TDropPrivilegesRequest {
  150. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  151. 2: required string requestorUserName, # user on whose behalf the request is issued
  152. 3: required TSentryAuthorizable authorizable
  153. }
  154. struct TDropPrivilegesResponse {
  155. 1: required sentry_common_service.TSentryResponseStatus status
  156. }
  157. struct TRenamePrivilegesRequest {
  158. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  159. 2: required string requestorUserName, # user on whose behalf the request is issued
  160. 3: required TSentryAuthorizable oldAuthorizable
  161. 4: required TSentryAuthorizable newAuthorizable
  162. }
  163. struct TRenamePrivilegesResponse {
  164. 1: required sentry_common_service.TSentryResponseStatus status
  165. }
  166. # This API was created specifically for ProviderBackend.getPrivileges
  167. # and is not mean for general purpose privilege retrieval.
  168. # This request/response pair are created specifically so we can
  169. # efficiently obtain the specific privilges for a user query
  170. struct TSentryActiveRoleSet {
  171. 1: required bool all,
  172. 2: required set<string> roles,
  173. }
  174. struct TListSentryPrivilegesForProviderRequest {
  175. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  176. 2: required set<string> groups,
  177. 3: required TSentryActiveRoleSet roleSet,
  178. 4: optional TSentryAuthorizable authorizableHierarchy,
  179. }
  180. struct TListSentryPrivilegesForProviderResponse {
  181. 1: required sentry_common_service.TSentryResponseStatus status
  182. 2: required set<string> privileges
  183. }
  184. # List role:set<privileges> for the given authorizable
  185. # Optionally use the set of groups to filter the roles
  186. struct TSentryPrivilegeMap {
  187. 1: required map<string, set<TSentryPrivilege>> privilegeMap
  188. }
  189. struct TListSentryPrivilegesByAuthRequest {
  190. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  191. 2: required string requestorUserName, # user on whose behalf the request is issued
  192. 3: required set<TSentryAuthorizable> authorizableSet,
  193. 4: optional set<string> groups,
  194. 5: optional TSentryActiveRoleSet roleSet
  195. }
  196. struct TListSentryPrivilegesByAuthResponse {
  197. 1: required sentry_common_service.TSentryResponseStatus status,
  198. 2: optional map<TSentryAuthorizable, TSentryPrivilegeMap> privilegesMapByAuth # will not be set in case of an error
  199. }
  200. # Obtain a config value from the Sentry service
  201. struct TSentryConfigValueRequest {
  202. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  203. 2: required string propertyName, # Config attribute to obtain
  204. 3: optional string defaultValue # Value if propertyName not found
  205. }
  206. struct TSentryConfigValueResponse {
  207. 1: required sentry_common_service.TSentryResponseStatus status
  208. 2: optional string value
  209. }
  210. service SentryPolicyService
  211. {
  212. TCreateSentryRoleResponse create_sentry_role(1:TCreateSentryRoleRequest request)
  213. TDropSentryRoleResponse drop_sentry_role(1:TDropSentryRoleRequest request)
  214. TAlterSentryRoleGrantPrivilegeResponse alter_sentry_role_grant_privilege(1:TAlterSentryRoleGrantPrivilegeRequest request)
  215. TAlterSentryRoleRevokePrivilegeResponse alter_sentry_role_revoke_privilege(1:TAlterSentryRoleRevokePrivilegeRequest request)
  216. TAlterSentryRoleAddGroupsResponse alter_sentry_role_add_groups(1:TAlterSentryRoleAddGroupsRequest request)
  217. TAlterSentryRoleDeleteGroupsResponse alter_sentry_role_delete_groups(1:TAlterSentryRoleDeleteGroupsRequest request)
  218. TListSentryRolesResponse list_sentry_roles_by_group(1:TListSentryRolesRequest request)
  219. TListSentryPrivilegesResponse list_sentry_privileges_by_role(1:TListSentryPrivilegesRequest request)
  220. # For use with ProviderBackend.getPrivileges only
  221. TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(1:TListSentryPrivilegesForProviderRequest request)
  222. TDropPrivilegesResponse drop_sentry_privilege(1:TDropPrivilegesRequest request);
  223. TRenamePrivilegesResponse rename_sentry_privilege(1:TRenamePrivilegesRequest request);
  224. TListSentryPrivilegesByAuthResponse list_sentry_privileges_by_authorizable(1:TListSentryPrivilegesByAuthRequest request);
  225. TSentryConfigValueResponse get_sentry_config_value(1:TSentryConfigValueRequest request)
  226. }