sentry-commits mailing list archives

Repository: incubator-sentry
Updated Branches:
  refs/heads/master cda611aee -> 488f88061


SENTRY-1047: Use existing validators in SentryShellSolr (Gregory Chanan, reviewed by Lenni
Kuff)


Project: http://git-wip-us.apache.org/repos/asf/incubator-sentry/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-sentry/commit/488f8806
Tree: http://git-wip-us.apache.org/repos/asf/incubator-sentry/tree/488f8806
Diff: http://git-wip-us.apache.org/repos/asf/incubator-sentry/diff/488f8806

Branch: refs/heads/master
Commit: 488f8806180c22d4a3cfd7be926e147f16e7bc58
Parents: cda611a
Author: Gregory Chanan <gchanan@cloudera.com>
Authored: Tue Feb 2 17:39:46 2016 -0800
Committer: Gregory Chanan <gchanan@cloudera.com>
Committed: Wed Feb 3 12:44:39 2016 -0800

----------------------------------------------------------------------
 .../tools/SolrTSentryPrivilegeConvertor.java    | 30 +++++++++-----------
 1 file changed, 13 insertions(+), 17 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/incubator-sentry/blob/488f8806/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/generic/tools/SolrTSentryPrivilegeConvertor.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/generic/tools/SolrTSentryPrivilegeConvertor.java
b/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/generic/tools/SolrTSentryPrivilegeConvertor.java
index e2b01a4..e2dfdf1 100644
--- a/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/generic/tools/SolrTSentryPrivilegeConvertor.java
+++ b/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/generic/tools/SolrTSentryPrivilegeConvertor.java
@@ -22,15 +22,18 @@ import com.google.common.collect.Lists;
 
 import org.apache.sentry.core.model.search.Collection;
 import org.apache.sentry.core.model.search.SearchModelAuthorizable;
-import org.apache.sentry.core.model.search.SearchModelAuthorizable.AuthorizableType;
 import org.apache.sentry.policy.common.PolicyConstants;
+import org.apache.sentry.policy.common.PrivilegeValidator;
+import org.apache.sentry.policy.common.PrivilegeValidatorContext;
 import org.apache.sentry.policy.search.SearchModelAuthorizables;
+import org.apache.sentry.policy.search.SimpleSearchPolicyEngine;
 import org.apache.sentry.policy.common.KeyValue;
 import org.apache.sentry.provider.common.PolicyFileConstants;
 import org.apache.sentry.provider.db.generic.service.thrift.TAuthorizable;
 import org.apache.sentry.provider.db.generic.service.thrift.TSentryGrantOption;
 import org.apache.sentry.provider.db.generic.service.thrift.TSentryPrivilege;
 import org.apache.sentry.provider.db.generic.tools.command.TSentryPrivilegeConvertor;
+import org.apache.shiro.config.ConfigurationException;
 
 import java.util.Iterator;
 import java.util.LinkedList;
@@ -46,6 +49,7 @@ public  class SolrTSentryPrivilegeConvertor implements TSentryPrivilegeConvertor
   }
 
   public TSentryPrivilege fromString(String privilegeStr) throws Exception {
+    validatePrivilegeHierarchy(privilegeStr);
     TSentryPrivilege tSentryPrivilege = new TSentryPrivilege();
     List<TAuthorizable> authorizables = new LinkedList<TAuthorizable>();
     for (String authorizable : PolicyConstants.AUTHORIZABLE_SPLITTER.split(privilegeStr))
{
@@ -76,7 +80,6 @@ public  class SolrTSentryPrivilegeConvertor implements TSentryPrivilegeConvertor
     tSentryPrivilege.setComponent(component);
     tSentryPrivilege.setServiceName(service);
     tSentryPrivilege.setAuthorizables(authorizables);
-    validatePrivilegeHierarchy(tSentryPrivilege);
     return tSentryPrivilege;
   }
 
@@ -111,22 +114,15 @@ public  class SolrTSentryPrivilegeConvertor implements TSentryPrivilegeConvertor
     return PolicyConstants.AUTHORIZABLE_JOINER.join(privileges);
   }
 
-  private static void validatePrivilegeHierarchy(TSentryPrivilege tSentryPrivilege) throws
Exception {
-    boolean foundCollection = false;
-    Iterator<TAuthorizable> it = tSentryPrivilege.getAuthorizablesIterator();
-    if (it != null) {
-      while (it.hasNext()) {
-        TAuthorizable authorizable = it.next();
-        if (AuthorizableType.Collection.name().equals(authorizable.getType())) {
-          foundCollection = true;
-          break;
-        }
+  private static void validatePrivilegeHierarchy(String privilegeStr) throws Exception {
+    List<PrivilegeValidator> validators = SimpleSearchPolicyEngine.createPrivilegeValidators();
+    PrivilegeValidatorContext context = new PrivilegeValidatorContext(null, privilegeStr);
+    for (PrivilegeValidator validator : validators) {
+      try {
+        validator.validate(context);
+      } catch (ConfigurationException e) {
+        throw new IllegalArgumentException(e);
       }
     }
-
-    if (!foundCollection) {
-      String msg = "Missing collection object in privilege";
-      throw new IllegalArgumentException(msg);
-    }
   }
 }