IMPALA-5571: Fix authorization tests Issue: With the fix for IMPALA-5549 the catalog cache of an impalad may end up with stale authorization metadata in the presence of GRANT/REVOKE statements that modify multiple privileges.
Fix: Revert the behavior of GRANT/REVOKE privilege DDL statements. Change-Id: Icad893a10fdeb7a721264e69413014603dec6339 Reviewed-on: http://gerrit.cloudera.org:8080/7299 Reviewed-by: Dimitris Tsirogiannis <[email protected]> Tested-by: Impala Public Jenkins Project: http://git-wip-us.apache.org/repos/asf/incubator-impala/repo Commit: http://git-wip-us.apache.org/repos/asf/incubator-impala/commit/8a77fff9 Tree: http://git-wip-us.apache.org/repos/asf/incubator-impala/tree/8a77fff9 Diff: http://git-wip-us.apache.org/repos/asf/incubator-impala/diff/8a77fff9 Branch: refs/heads/master Commit: 8a77fff9a8175a6d0939d195ac622ed099988a37 Parents: 4a3ef9c Author: Dimitris Tsirogiannis <[email protected]> Authored: Mon Jun 26 15:16:48 2017 -0700 Committer: Impala Public Jenkins <[email protected]> Committed: Tue Jun 27 07:39:44 2017 +0000 ---------------------------------------------------------------------- .../java/org/apache/impala/service/CatalogOpExecutor.java | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/incubator-impala/blob/8a77fff9/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java ---------------------------------------------------------------------- diff --git a/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java b/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java index 6716338..675ced5 100644 --- a/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java +++ b/fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java @@ -2906,7 +2906,11 @@ public class CatalogOpExecutor { updatedPrivs.add(catalogObject); } - if (!updatedPrivs.isEmpty()) { + // TODO: Currently we only support sending back 1 catalog object in a "direct DDL" + // response. If multiple privileges have been updated, just send back the + // catalog version so subscribers can wait for the statestore heartbeat that + // contains all updates (see IMPALA-5571). + if (updatedPrivs.size() == 1) { // If this is a REVOKE statement with hasGrantOpt, only the GRANT OPTION is revoked // from the privilege. if (grantRevokePrivParams.isIs_grant() || @@ -2915,6 +2919,8 @@ public class CatalogOpExecutor { } else { resp.result.setRemoved_catalog_objects(updatedPrivs); } + resp.result.setVersion(updatedPrivs.get(0).getCatalog_version()); + } else if (updatedPrivs.size() > 1) { resp.result.setVersion( updatedPrivs.get(updatedPrivs.size() - 1).getCatalog_version()); }
