com.facebook.presto.hive.security.ranger

Class RangerBasedAccessControl

java.lang.Object

com.facebook.presto.hive.security.ranger.RangerBasedAccessControl

All Implemented Interfaces:

com.facebook.presto.spi.connector.ConnectorAccessControl

public class RangerBasedAccessControl
extends Object
implements com.facebook.presto.spi.connector.ConnectorAccessControl

Connector access control which uses existing Ranger policies for authorizations

Constructor Summary

Constructors

Constructor and Description
RangerBasedAccessControl(RangerBasedAccessControlConfig config, com.facebook.airlift.http.client.HttpClient httpClient)

Method Summary

Modifier and Type	Method and Description
void	checkCanAddColumn(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName) Check if identity is allowed to add columns to the specified table in this catalog.
void	checkCanCreateSchema(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, String schemaName) Check if identity is allowed to create the specified schema in this catalog.
void	checkCanCreateTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName) Check if identity is allowed to create the specified table in this catalog.
void	checkCanCreateView(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName viewName) Check if identity is allowed to create the specified view in this catalog.
void	checkCanCreateViewWithSelectFromColumns(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName, Set<String> columnNames) Check if identity is allowed to create a view that selects from the specified columns in a relation.
void	checkCanDeleteFromTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName) Check if identity is allowed to delete from the specified table in this catalog.
void	checkCanDropColumn(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName) Check if identity is allowed to drop columns from the specified table in this catalog.
void	checkCanDropSchema(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, String schemaName) Check if identity is allowed to drop the specified schema in this catalog.
void	checkCanDropTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName) Check if identity is allowed to drop the specified table in this catalog.
void	checkCanDropView(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName viewName) Check if identity is allowed to drop the specified view in this catalog.
void	checkCanInsertIntoTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName) Check if identity is allowed to insert into the specified table in this catalog.
void	checkCanRenameColumn(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName) Check if identity is allowed to rename a column in the specified table in this catalog.
void	checkCanRenameTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName, com.facebook.presto.spi.SchemaTableName newTableName) Check if identity is allowed to rename the specified table in this catalog.
void	checkCanSelectFromColumns(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, com.facebook.presto.spi.SchemaTableName tableName, Set<com.facebook.presto.common.Subfield> columnOrSubfieldNames) Check if identity is allowed to select from the specified columns in a relation.
void	checkCanSetCatalogSessionProperty(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, String propertyName) Check if identity is allowed to set the specified property in this catalog.
void	checkCanShowSchemas(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context) Check if identity is allowed to execute SHOW SCHEMAS in a catalog.
void	checkCanShowTablesMetadata(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, String schemaName) Check if identity is allowed to show metadata of tables by executing SHOW TABLES, SHOW GRANTS etc.
Set<String>	filterSchemas(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, Set<String> schemaNames) Filter the list of schemas to those visible to the identity.
Set<com.facebook.presto.spi.SchemaTableName>	filterTables(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle, com.facebook.presto.spi.security.ConnectorIdentity identity, com.facebook.presto.spi.security.AccessControlContext context, Set<com.facebook.presto.spi.SchemaTableName> tableNames) Filter the list of tables and views to those visible to the identity.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface com.facebook.presto.spi.connector.ConnectorAccessControl

checkCanCreateRole, checkCanDropRole, checkCanGrantRoles, checkCanGrantTablePrivilege, checkCanRenameSchema, checkCanRevokeRoles, checkCanRevokeTablePrivilege, checkCanSetRole, checkCanShowCurrentRoles, checkCanShowRoleGrants, checkCanShowRoles, checkCanTruncateTable

Constructor Detail

RangerBasedAccessControl

@Inject
public RangerBasedAccessControl(RangerBasedAccessControlConfig config,
                                        com.facebook.airlift.http.client.HttpClient httpClient)

Method Detail

checkCanCreateSchema

public void checkCanCreateSchema(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                 com.facebook.presto.spi.security.ConnectorIdentity identity,
                                 com.facebook.presto.spi.security.AccessControlContext context,
                                 String schemaName)

Check if identity is allowed to create the specified schema in this catalog.

Specified by:

checkCanCreateSchema in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanDropSchema

public void checkCanDropSchema(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                               com.facebook.presto.spi.security.ConnectorIdentity identity,
                               com.facebook.presto.spi.security.AccessControlContext context,
                               String schemaName)

Check if identity is allowed to drop the specified schema in this catalog.

Specified by:

checkCanDropSchema in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanShowSchemas

public void checkCanShowSchemas(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                com.facebook.presto.spi.security.ConnectorIdentity identity,
                                com.facebook.presto.spi.security.AccessControlContext context)

Check if identity is allowed to execute SHOW SCHEMAS in a catalog.

NOTE: This method is only present to give users an error message when listing is not allowed. The filterSchemas(com.facebook.presto.spi.connector.ConnectorTransactionHandle, com.facebook.presto.spi.security.ConnectorIdentity, com.facebook.presto.spi.security.AccessControlContext, java.util.Set<java.lang.String>) method must handle filter all results for unauthorized users, since there are multiple way to list schemas.

Specified by:

checkCanShowSchemas in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

filterSchemas

public Set<String> filterSchemas(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                 com.facebook.presto.spi.security.ConnectorIdentity identity,
                                 com.facebook.presto.spi.security.AccessControlContext context,
                                 Set<String> schemaNames)

Filter the list of schemas to those visible to the identity.

Specified by:

filterSchemas in interface com.facebook.presto.spi.connector.ConnectorAccessControl

checkCanCreateTable

public void checkCanCreateTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                com.facebook.presto.spi.security.ConnectorIdentity identity,
                                com.facebook.presto.spi.security.AccessControlContext context,
                                com.facebook.presto.spi.SchemaTableName tableName)

Check if identity is allowed to create the specified table in this catalog.

Specified by:

checkCanCreateTable in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

filterTables

public Set<com.facebook.presto.spi.SchemaTableName> filterTables(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                                                 com.facebook.presto.spi.security.ConnectorIdentity identity,
                                                                 com.facebook.presto.spi.security.AccessControlContext context,
                                                                 Set<com.facebook.presto.spi.SchemaTableName> tableNames)

Filter the list of tables and views to those visible to the identity.

Specified by:

filterTables in interface com.facebook.presto.spi.connector.ConnectorAccessControl

checkCanAddColumn

public void checkCanAddColumn(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                              com.facebook.presto.spi.security.ConnectorIdentity identity,
                              com.facebook.presto.spi.security.AccessControlContext context,
                              com.facebook.presto.spi.SchemaTableName tableName)

Check if identity is allowed to add columns to the specified table in this catalog.

Specified by:

checkCanAddColumn in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanDropColumn

public void checkCanDropColumn(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                               com.facebook.presto.spi.security.ConnectorIdentity identity,
                               com.facebook.presto.spi.security.AccessControlContext context,
                               com.facebook.presto.spi.SchemaTableName tableName)

Check if identity is allowed to drop columns from the specified table in this catalog.

Specified by:

checkCanDropColumn in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanRenameColumn

public void checkCanRenameColumn(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                 com.facebook.presto.spi.security.ConnectorIdentity identity,
                                 com.facebook.presto.spi.security.AccessControlContext context,
                                 com.facebook.presto.spi.SchemaTableName tableName)

Check if identity is allowed to rename a column in the specified table in this catalog.

Specified by:

checkCanRenameColumn in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanSelectFromColumns

public void checkCanSelectFromColumns(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                      com.facebook.presto.spi.security.ConnectorIdentity identity,
                                      com.facebook.presto.spi.security.AccessControlContext context,
                                      com.facebook.presto.spi.SchemaTableName tableName,
                                      Set<com.facebook.presto.common.Subfield> columnOrSubfieldNames)

Check if identity is allowed to select from the specified columns in a relation. The column set can be empty.

Specified by:

checkCanSelectFromColumns in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanDropTable

public void checkCanDropTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                              com.facebook.presto.spi.security.ConnectorIdentity identity,
                              com.facebook.presto.spi.security.AccessControlContext context,
                              com.facebook.presto.spi.SchemaTableName tableName)

Check if identity is allowed to drop the specified table in this catalog.

Specified by:

checkCanDropTable in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanRenameTable

public void checkCanRenameTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                com.facebook.presto.spi.security.ConnectorIdentity identity,
                                com.facebook.presto.spi.security.AccessControlContext context,
                                com.facebook.presto.spi.SchemaTableName tableName,
                                com.facebook.presto.spi.SchemaTableName newTableName)

Check if identity is allowed to rename the specified table in this catalog.

Specified by:

checkCanRenameTable in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanShowTablesMetadata

public void checkCanShowTablesMetadata(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                       com.facebook.presto.spi.security.ConnectorIdentity identity,
                                       com.facebook.presto.spi.security.AccessControlContext context,
                                       String schemaName)

Check if identity is allowed to show metadata of tables by executing SHOW TABLES, SHOW GRANTS etc. in a catalog.

NOTE: This method is only present to give users an error message when listing is not allowed. The filterTables(com.facebook.presto.spi.connector.ConnectorTransactionHandle, com.facebook.presto.spi.security.ConnectorIdentity, com.facebook.presto.spi.security.AccessControlContext, java.util.Set<com.facebook.presto.spi.SchemaTableName>) method must filter all results for unauthorized users, since there are multiple ways to list tables.

Specified by:

checkCanShowTablesMetadata in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanInsertIntoTable

public void checkCanInsertIntoTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                    com.facebook.presto.spi.security.ConnectorIdentity identity,
                                    com.facebook.presto.spi.security.AccessControlContext context,
                                    com.facebook.presto.spi.SchemaTableName tableName)

Check if identity is allowed to insert into the specified table in this catalog.

Specified by:

checkCanInsertIntoTable in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanDeleteFromTable

public void checkCanDeleteFromTable(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                    com.facebook.presto.spi.security.ConnectorIdentity identity,
                                    com.facebook.presto.spi.security.AccessControlContext context,
                                    com.facebook.presto.spi.SchemaTableName tableName)

Check if identity is allowed to delete from the specified table in this catalog.

Specified by:

checkCanDeleteFromTable in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanCreateView

public void checkCanCreateView(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                               com.facebook.presto.spi.security.ConnectorIdentity identity,
                               com.facebook.presto.spi.security.AccessControlContext context,
                               com.facebook.presto.spi.SchemaTableName viewName)

Check if identity is allowed to create the specified view in this catalog.

Specified by:

checkCanCreateView in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanDropView

public void checkCanDropView(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                             com.facebook.presto.spi.security.ConnectorIdentity identity,
                             com.facebook.presto.spi.security.AccessControlContext context,
                             com.facebook.presto.spi.SchemaTableName viewName)

Check if identity is allowed to drop the specified view in this catalog.

Specified by:

checkCanDropView in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanCreateViewWithSelectFromColumns

public void checkCanCreateViewWithSelectFromColumns(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                                    com.facebook.presto.spi.security.ConnectorIdentity identity,
                                                    com.facebook.presto.spi.security.AccessControlContext context,
                                                    com.facebook.presto.spi.SchemaTableName tableName,
                                                    Set<String> columnNames)

Check if identity is allowed to create a view that selects from the specified columns in a relation.

Specified by:

checkCanCreateViewWithSelectFromColumns in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed

checkCanSetCatalogSessionProperty

public void checkCanSetCatalogSessionProperty(com.facebook.presto.spi.connector.ConnectorTransactionHandle transactionHandle,
                                              com.facebook.presto.spi.security.ConnectorIdentity identity,
                                              com.facebook.presto.spi.security.AccessControlContext context,
                                              String propertyName)

Check if identity is allowed to set the specified property in this catalog.

Specified by:

checkCanSetCatalogSessionProperty in interface com.facebook.presto.spi.connector.ConnectorAccessControl

Throws:

com.facebook.presto.spi.security.AccessDeniedException - if not allowed