// import policy files
public void importPolicy() throws Exception {
final String requestorUserName = "hive";
SimpleFileProviderBackend policyFileBackend;
SentryPolicyServiceClient client;
policyFileBackend = new SimpleFileProviderBackend(getAuthzConf(),
getAuthzConf().get(AuthzConfVars.AUTHZ_PROVIDER_RESOURCE.getVar()));
ProviderBackendContext context = new ProviderBackendContext();
context.setAllowPerDatabase(true);
policyFileBackend.initialize(context);
client = new SentryPolicyServiceClient(getAuthzConf());
Set<String> roles = new HashSet<String>();
for (TSentryRole sentryRole : client.listRoles(requestorUserName)) {
roles.add(sentryRole.getRoleName());
}
Table<String, String, Set<String>> groupRolePrivilegeTable =
policyFileBackend.getGroupRolePrivilegeTable();
for(String groupName : groupRolePrivilegeTable.rowKeySet()) {
for(String roleName : groupRolePrivilegeTable.columnKeySet()) {
if (!roles.contains(roleName)) {
client.createRole(requestorUserName, roleName);
System.out.println(String.format("CREATE ROLE %s;", roleName));
roles.add(roleName);
}
Set<String> privileges = groupRolePrivilegeTable.get(groupName, roleName);
if (privileges == null) {
continue;
}
client.grantRoleToGroup(requestorUserName, groupName, roleName);
System.out.println(String.format("GRANT ROLE %s TO GROUP %s;",
roleName, groupName));
for (String permission : privileges) {
String server = null;
String database = null;
String table = null;
String uri = null;
String action = AccessConstants.ALL;
for (String authorizable : PolicyFileConstants.AUTHORIZABLE_SPLITTER.
trimResults().split(permission)) {
KeyValue kv = new KeyValue(authorizable);
DBModelAuthorizable a = DBModelAuthorizables.from(kv);
if (a == null) {
action = kv.getValue();
continue;
}
switch (a.getAuthzType()) {
case Server:
server = a.getName();
break;
case Db:
database = a.getName();
break;
case Table:
case View:
table = a.getName();
break;
case URI:
uri = a.getName();
break;
default:
break;
}
}
if (uri != null) {
System.out.println(String.format(
"GRANT ALL ON URI %s TO ROLE %s; # server=%s",
uri, roleName, server));
client.grantURIPrivilege(requestorUserName, roleName, server, uri);
} else if (table != null && !AccessConstants.ALL.equals(table)) {
System.out.println(String.format(
"GRANT %s ON TABLE %s TO ROLE %s; # server=%s, database=%s",
"*".equals(action) ? "ALL" : action.toUpperCase(), table,
roleName, server, database));
client.grantTablePrivilege(requestorUserName, roleName, server,
database, table, action);
} else if (database != null && !AccessConstants.ALL.equals(database)) {
System.out.println(String.format(
"GRANT %s ON DATABASE %s TO ROLE %s; # server=%s",
"*".equals(action) ? "ALL" : action.toUpperCase(),
database, roleName, server));
client.grantDatabasePrivilege(requestorUserName, roleName, server,
database, action);
} else if (server != null) {
System.out.println(String.format("GRANT ALL ON SERVER %s TO ROLE %s;",
server, roleName));
client.grantServerPrivilege(requestorUserName, roleName, server);
} else {
System.out.println(String.format("No grant for permission %s",
permission));
}
}