sentry_policy_service.thrift 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214
  1. #!/usr/local/bin/thrift -java
  2. /**
  3. * Licensed to the Apache Software Foundation (ASF) under one
  4. * or more contributor license agreements. See the NOTICE file
  5. * distributed with this work for additional information
  6. * regarding copyright ownership. The ASF licenses this file
  7. * to you under the Apache License, Version 2.0 (the
  8. * "License"); you may not use this file except in compliance
  9. * with the License. You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS,
  15. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. */
  19. #
  20. # Thrift Service that the MetaStore is built on
  21. #
  22. # include "share/fb303/if/fb303.thrift"
  23. include "sentry_common_service.thrift"
  24. namespace java org.apache.sentry.provider.db.service.thrift
  25. namespace php sentry.provider.db.service.thrift
  26. namespace cpp Apache.Sentry.Provider.Db.Service.Thrift
  27. # Represents a Privilege in transport from the client to the server
  28. struct TSentryPrivilege {
  29. 1: required string privilegeScope, # Valid values are SERVER, DATABASE, TABLE
  30. 2: optional string privilegeName, # Generated on server side
  31. 3: required string serverName,
  32. 4: optional string dbName,
  33. 5: optional string tableName,
  34. 6: optional string URI,
  35. 7: required string action,
  36. 8: optional i64 createTime, # Set on server side
  37. 9: optional string grantorPrincipal # Set on server side
  38. }
  39. # TODO can this be deleted? it's not adding value to TAlterSentryRoleAddGroupsRequest
  40. struct TSentryGroup {
  41. 1: required string groupName
  42. }
  43. # CREATE ROLE r1
  44. struct TCreateSentryRoleRequest {
  45. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  46. 2: required string requestorUserName, # user on whose behalf the request is issued
  47. 3: required string roleName, # TSentryRole is not required for this request
  48. }
  49. struct TCreateSentryRoleResponse {
  50. 1: required sentry_common_service.TSentryResponseStatus status
  51. }
  52. # DROP ROLE r1
  53. struct TDropSentryRoleRequest {
  54. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  55. 2: required string requestorUserName, # user on whose behalf the request is issued
  56. 3: required string roleName # role to drop
  57. }
  58. struct TDropSentryRoleResponse {
  59. 1: required sentry_common_service.TSentryResponseStatus status
  60. }
  61. # GRANT ROLE r1 TO GROUP g1
  62. struct TAlterSentryRoleAddGroupsRequest {
  63. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  64. 2: required string requestorUserName, # user on whose behalf the request is issued
  65. 3: required string roleName,
  66. 5: required set<TSentryGroup> groups
  67. }
  68. struct TAlterSentryRoleAddGroupsResponse {
  69. 1: required sentry_common_service.TSentryResponseStatus status
  70. }
  71. # REVOLE ROLE r1 FROM GROUP g1
  72. struct TAlterSentryRoleDeleteGroupsRequest {
  73. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  74. 2: required string requestorUserName, # user on whose behalf the request is issued
  75. 3: required string roleName,
  76. 5: required set<TSentryGroup> groups
  77. }
  78. struct TAlterSentryRoleDeleteGroupsResponse {
  79. 1: required sentry_common_service.TSentryResponseStatus status
  80. }
  81. # GRANT ... ON ... TO ROLE ...
  82. struct TAlterSentryRoleGrantPrivilegeRequest {
  83. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  84. 2: required string requestorUserName, # user on whose behalf the request is issued
  85. 3: required string roleName,
  86. 5: required TSentryPrivilege privilege
  87. }
  88. struct TAlterSentryRoleGrantPrivilegeResponse {
  89. 1: required sentry_common_service.TSentryResponseStatus status
  90. }
  91. # REVOKE ... ON ... FROM ROLE ...
  92. struct TAlterSentryRoleRevokePrivilegeRequest {
  93. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  94. 2: required string requestorUserName, # user on whose behalf the request is issued
  95. 3: required string roleName,
  96. 5: required TSentryPrivilege privilege
  97. }
  98. struct TAlterSentryRoleRevokePrivilegeResponse {
  99. 1: required sentry_common_service.TSentryResponseStatus status
  100. }
  101. # SHOW ROLE GRANT
  102. struct TListSentryRolesRequest {
  103. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  104. 2: required string requestorUserName, # user on whose behalf the request is issued
  105. 3: optional string groupName # for this group, or all roles for all groups if null
  106. }
  107. # used only for TListSentryRolesResponse
  108. struct TSentryRole {
  109. 1: required string roleName,
  110. 2: required set<TSentryGroup> groups,
  111. 3: required string grantorPrincipal
  112. }
  113. struct TListSentryRolesResponse {
  114. 1: required sentry_common_service.TSentryResponseStatus status
  115. 2: optional set<TSentryRole> roles
  116. }
  117. struct TSentryAuthorizable {
  118. 1: required string server,
  119. 2: optional string uri,
  120. 3: optional string db,
  121. 4: optional string table,
  122. }
  123. # SHOW GRANT
  124. struct TListSentryPrivilegesRequest {
  125. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  126. 2: required string requestorUserName, # user on whose behalf the request is issued
  127. 4: required string roleName, # get privileges assigned for this role
  128. 5: optional TSentryAuthorizable authorizableHierarchy # get privileges assigned for this role
  129. }
  130. struct TListSentryPrivilegesResponse {
  131. 1: required sentry_common_service.TSentryResponseStatus status
  132. 2: optional set<TSentryPrivilege> privileges
  133. }
  134. # Drop privilege
  135. struct TDropPrivilegesRequest {
  136. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  137. 2: required string requestorUserName, # user on whose behalf the request is issued
  138. 3: required TSentryAuthorizable authorizable
  139. }
  140. struct TDropPrivilegesResponse {
  141. 1: required sentry_common_service.TSentryResponseStatus status
  142. }
  143. struct TRenamePrivilegesRequest {
  144. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  145. 2: required string requestorUserName, # user on whose behalf the request is issued
  146. 3: required TSentryAuthorizable oldAuthorizable
  147. 4: required TSentryAuthorizable newAuthorizable
  148. }
  149. struct TRenamePrivilegesResponse {
  150. 1: required sentry_common_service.TSentryResponseStatus status
  151. }
  152. # This API was created specifically for ProviderBackend.getPrivileges
  153. # and is not mean for general purpose privilege retrieval.
  154. # This request/response pair are created specifically so we can
  155. # efficiently obtain the specific privilges for a user query
  156. struct TSentryActiveRoleSet {
  157. 1: required bool all,
  158. 2: required set<string> roles,
  159. }
  160. struct TListSentryPrivilegesForProviderRequest {
  161. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V1,
  162. 2: required set<string> groups,
  163. 3: required TSentryActiveRoleSet roleSet,
  164. 4: optional TSentryAuthorizable authorizableHierarchy,
  165. }
  166. struct TListSentryPrivilegesForProviderResponse {
  167. 1: required sentry_common_service.TSentryResponseStatus status
  168. 2: required set<string> privileges
  169. }
  170. service SentryPolicyService
  171. {
  172. TCreateSentryRoleResponse create_sentry_role(1:TCreateSentryRoleRequest request)
  173. TDropSentryRoleResponse drop_sentry_role(1:TDropSentryRoleRequest request)
  174. TAlterSentryRoleGrantPrivilegeResponse alter_sentry_role_grant_privilege(1:TAlterSentryRoleGrantPrivilegeRequest request)
  175. TAlterSentryRoleRevokePrivilegeResponse alter_sentry_role_revoke_privilege(1:TAlterSentryRoleRevokePrivilegeRequest request)
  176. TAlterSentryRoleAddGroupsResponse alter_sentry_role_add_groups(1:TAlterSentryRoleAddGroupsRequest request)
  177. TAlterSentryRoleDeleteGroupsResponse alter_sentry_role_delete_groups(1:TAlterSentryRoleDeleteGroupsRequest request)
  178. TListSentryRolesResponse list_sentry_roles_by_group(1:TListSentryRolesRequest request)
  179. TListSentryPrivilegesResponse list_sentry_privileges_by_role(1:TListSentryPrivilegesRequest request)
  180. # For use with ProviderBackend.getPrivileges only
  181. TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(1:TListSentryPrivilegesForProviderRequest request)
  182. TDropPrivilegesResponse drop_sentry_privilege(1:TDropPrivilegesRequest request);
  183. TRenamePrivilegesResponse rename_sentry_privilege(1:TRenamePrivilegesRequest request);
  184. }