sentry_generic_policy_service.thrift 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279
  1. #!/usr/local/bin/thrift -java
  2. /**
  3. * Licensed to the Apache Software Foundation (ASF) under one
  4. * or more contributor license agreements. See the NOTICE file
  5. * distributed with this work for additional information
  6. * regarding copyright ownership. The ASF licenses this file
  7. * to you under the Apache License, Version 2.0 (the
  8. * "License"); you may not use this file except in compliance
  9. * with the License. You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS,
  15. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. */
  19. #
  20. # Thrift Service that the MetaStore is built on
  21. #
  22. # include "share/fb303/if/fb303.thrift"
  23. include "sentry_common_service.thrift"
  24. include "sentry_policy_service.thrift"
  25. namespace java org.apache.sentry.provider.db.generic.service.thrift
  26. namespace php sentry.provider.db.service.db.generic.serivce.thrift
  27. namespace cpp Apache.Sentry.Provider.Db.Generic.Service.Thrift
  28. typedef sentry_common_service.TSentryResponseStatus TSentryResponseStatus
  29. # Represents a new generic model privilege for solr or other component in transport
  30. # from the client to the server
  31. enum TSentryGrantOption {
  32. TRUE = 1,
  33. FALSE = 0,
  34. UNSET = -1
  35. }
  36. # Represents a authorizable resource in the privilege
  37. # like DATABASE=db1 in the hive, COLLECTION=collection1 in the solr
  38. struct TAuthorizable {
  39. 1: required string type,
  40. 2: required string name
  41. }
  42. struct TSentryPrivilege {
  43. 1: required string component,
  44. 2: required string serviceName,
  45. 3: required list<TAuthorizable> authorizables,
  46. 4: required string action,
  47. 5: optional i64 createTime, # Set on server side
  48. 6: optional string grantorPrincipal, # Set on server side
  49. 7: optional TSentryGrantOption grantOption = sentry_policy_service.TSentryGrantOption.FALSE
  50. }
  51. # CREATE ROLE r1
  52. struct TCreateSentryRoleRequest {
  53. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  54. 2: required string requestorUserName, # user on whose behalf the request is issued
  55. 3: required string roleName,
  56. 4: required string component # The request is issued to which component
  57. }
  58. struct TCreateSentryRoleResponse {
  59. 1: required TSentryResponseStatus status
  60. }
  61. # DROP ROLE r1
  62. struct TDropSentryRoleRequest {
  63. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  64. 2: required string requestorUserName, # user on whose behalf the request is issued
  65. 3: required string roleName,
  66. 4: required string component # The request is issued to which component
  67. }
  68. struct TDropSentryRoleResponse {
  69. 1: required TSentryResponseStatus status
  70. }
  71. # GRANT ROLE r1 TO GROUP g1
  72. struct TAlterSentryRoleAddGroupsRequest {
  73. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  74. 2: required string requestorUserName, # user on whose behalf the request is issued
  75. 3: required string roleName,
  76. 4: required string component, # The request is issued to which component
  77. 5: required set<string> groups
  78. }
  79. struct TAlterSentryRoleAddGroupsResponse {
  80. 1: required TSentryResponseStatus status
  81. }
  82. # REVOLE ROLE r1 FROM GROUP g1
  83. struct TAlterSentryRoleDeleteGroupsRequest {
  84. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  85. 2: required string requestorUserName, # user on whose behalf the request is issued
  86. 3: required string roleName,
  87. 4: required string component, # The request is issued to which component
  88. 5: required set<string> groups
  89. }
  90. struct TAlterSentryRoleDeleteGroupsResponse {
  91. 1: required TSentryResponseStatus status
  92. }
  93. # GRANT ... ON ... TO ROLE ...
  94. struct TAlterSentryRoleGrantPrivilegeRequest {
  95. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  96. 2: required string requestorUserName, # user on whose behalf the request is issued
  97. 3: required string roleName,
  98. 4: required string component, # The request is issued to which component
  99. 5: required TSentryPrivilege privilege
  100. }
  101. struct TAlterSentryRoleGrantPrivilegeResponse {
  102. 1: required TSentryResponseStatus status
  103. }
  104. # REVOKE ... ON ... FROM ROLE ...
  105. struct TAlterSentryRoleRevokePrivilegeRequest {
  106. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  107. 2: required string requestorUserName, # user on whose behalf the request is issued
  108. 3: required string roleName,
  109. 4: required string component, # The request is issued to which component
  110. 5: required TSentryPrivilege privilege
  111. }
  112. struct TAlterSentryRoleRevokePrivilegeResponse {
  113. 1: required TSentryResponseStatus status
  114. }
  115. # SHOW ROLE GRANT
  116. struct TListSentryRolesRequest {
  117. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  118. 2: required string requestorUserName, # user on whose behalf the request is issued
  119. 3: optional string groupName, # for this group, or all roles for all groups if null
  120. 4: required string component # The request is issued to which component
  121. }
  122. # used only for TListSentryRolesResponse
  123. struct TSentryRole {
  124. 1: required string roleName,
  125. 2: required set<string> groups
  126. }
  127. struct TListSentryRolesResponse {
  128. 1: required TSentryResponseStatus status
  129. 2: optional set<TSentryRole> roles
  130. }
  131. # SHOW GRANT
  132. struct TListSentryPrivilegesRequest {
  133. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  134. 2: required string requestorUserName, # user on whose behalf the request is issued
  135. 3: required string roleName, # get privileges assigned for this role
  136. 4: required string component, # The request is issued to which component
  137. 5: required string serviceName, # The privilege belongs to which service
  138. 6: optional list<TAuthorizable> authorizables # get privileges assigned for this authorizable hierarchys
  139. }
  140. struct TListSentryPrivilegesResponse {
  141. 1: required TSentryResponseStatus status
  142. 2: optional set<TSentryPrivilege> privileges
  143. }
  144. # Drop privilege
  145. struct TDropPrivilegesRequest {
  146. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  147. 2: required string requestorUserName, # user on whose behalf the request is issued
  148. 3: required TSentryPrivilege privilege
  149. 4: required string component, # The request is issued to which component
  150. }
  151. struct TDropPrivilegesResponse {
  152. 1: required TSentryResponseStatus status
  153. }
  154. # Rename privilege
  155. struct TRenamePrivilegesRequest {
  156. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  157. 2: required string requestorUserName, # user on whose behalf the request is issued
  158. 3: required string component, # The request is issued to which component
  159. 4: required string serviceName, # The privilege belongs to which service
  160. 5: required list<TAuthorizable> oldAuthorizables, # get old privileges assigned for this authorizable hierarchys
  161. 6: required list<TAuthorizable> newAuthorizables # change to new authorizable hierarchys
  162. }
  163. struct TRenamePrivilegesResponse {
  164. 1: required TSentryResponseStatus status
  165. }
  166. # This API was created specifically for ProviderBackend.getPrivileges
  167. # and is not mean for general purpose privilege retrieval.
  168. # This request/response pair are created specifically so we can
  169. # efficiently obtain the specific privilges for a user query
  170. struct TSentryActiveRoleSet {
  171. 1: required bool all,
  172. 2: required set<string> roles,
  173. }
  174. struct TListSentryPrivilegesForProviderRequest {
  175. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  176. 2: required string component, # The request is issued to which component
  177. 3: required string serviceName, # The privilege belongs to which service
  178. 4: required set<string> groups,
  179. 5: required TSentryActiveRoleSet roleSet,
  180. 6: optional list<TAuthorizable> authorizables # authorizable hierarchys
  181. }
  182. struct TListSentryPrivilegesForProviderResponse {
  183. 1: required TSentryResponseStatus status
  184. 2: required set<string> privileges
  185. }
  186. # Map of role:set<privileges> for the given authorizable
  187. # Optionally use the set of groups to filter the roles
  188. struct TSentryPrivilegeMap {
  189. 1: required map<string, set<TSentryPrivilege>> privilegeMap
  190. }
  191. struct TListSentryPrivilegesByAuthRequest {
  192. 1: required i32 protocol_version = sentry_common_service.TSENTRY_SERVICE_V2,
  193. # User on whose behalf the request is issued
  194. 2: required string requestorUserName,
  195. # The request is issued to which component
  196. 3: required string component,
  197. # The privilege belongs to which service
  198. 4: required string serviceName,
  199. # The authorizable hierarchys, it is represented as a string. e.g
  200. # resourceType1=resourceName1->resourceType2=resourceName2->resourceType3=resourceName3
  201. 5: required set<string> authorizablesSet,
  202. # The requested groups. For admin, the requested groups can be empty, if so it is
  203. # treated as a wildcard query. Otherwise, it is a query on this specifc groups.
  204. # For non-admin user, the requested groups must be the groups they are part of.
  205. 6: optional set<string> groups,
  206. # The active role set.
  207. 7: optional TSentryActiveRoleSet roleSet
  208. }
  209. struct TListSentryPrivilegesByAuthResponse {
  210. 1: required sentry_common_service.TSentryResponseStatus status,
  211. # Will not be set in case of an error. Otherwise it will be a
  212. # <Authorizables, <Role, Set<Privileges>>> mapping. For non-admin
  213. # requestor, the roles are intersection of active roles and granted roles.
  214. # For admin requestor, the roles are filtered based on the active roles
  215. # and requested group from TListSentryPrivilegesByAuthRequest.
  216. # The authorizable hierarchys is represented as a string in the form
  217. # of the request.
  218. 2: optional map<string, TSentryPrivilegeMap> privilegesMapByAuth
  219. }
  220. service SentryGenericPolicyService
  221. {
  222. TCreateSentryRoleResponse create_sentry_role(1:TCreateSentryRoleRequest request)
  223. TDropSentryRoleResponse drop_sentry_role(1:TDropSentryRoleRequest request)
  224. TAlterSentryRoleGrantPrivilegeResponse alter_sentry_role_grant_privilege(1:TAlterSentryRoleGrantPrivilegeRequest request)
  225. TAlterSentryRoleRevokePrivilegeResponse alter_sentry_role_revoke_privilege(1:TAlterSentryRoleRevokePrivilegeRequest request)
  226. TAlterSentryRoleAddGroupsResponse alter_sentry_role_add_groups(1:TAlterSentryRoleAddGroupsRequest request)
  227. TAlterSentryRoleDeleteGroupsResponse alter_sentry_role_delete_groups(1:TAlterSentryRoleDeleteGroupsRequest request)
  228. TListSentryRolesResponse list_sentry_roles_by_group(1:TListSentryRolesRequest request)
  229. TListSentryPrivilegesResponse list_sentry_privileges_by_role(1:TListSentryPrivilegesRequest request)
  230. TListSentryPrivilegesForProviderResponse list_sentry_privileges_for_provider(1:TListSentryPrivilegesForProviderRequest request)
  231. TListSentryPrivilegesByAuthResponse list_sentry_privileges_by_authorizable(1:TListSentryPrivilegesByAuthRequest request);
  232. TDropPrivilegesResponse drop_sentry_privilege(1:TDropPrivilegesRequest request);
  233. TRenamePrivilegesResponse rename_sentry_privilege(1:TRenamePrivilegesRequest request);
  234. }