Hello Quanlong Huang, Abhishek Rawat, Csaba Ringhofer, Impala Public Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/24337
to look at the new patch set (#6).
Change subject: IMPALA-14954: Support ADMIN OPTION clause for GRANT/REVOKE ROLE
......................................................................
IMPALA-14954: Support ADMIN OPTION clause for GRANT/REVOKE ROLE
This patch adds the support of WITH ADMIN OPTION clause for the GRANT
ROLE statement, and the support of ADMIN OPTION FOR clause for the
REVOKE ROLE statement. Specifically, to allow a principal
<principal_name> to grant/revoke a role <role_name> to/from another
principal, an administrator could execute the following, where
<principal_type> could be GROUP or USER.
GRANT ROLE <role_name> TO <principal_type> <principal_name> WITH
ADMIN OPTION
Similarly, to revoke the ADMIN OPTION of the role <role_name> from the
principal <principal_name> without revoking the role <role_name>, an
administrator could execute the following. The syntax is the same as
what Apache Hive supports as in HIVE-6252.
REVOKE ADMIN OPTION FOR <role_name> FROM <principal_type>
<principal_name>
This patch also adds the column of 'grant_option' to the result
of the SHOW ROLE GRANT GROUP/USER statements. Note that we do not add
the columns of 'grant_time' and 'grantor' because of the issue reported
in RANGER-5612.
Testing:
- Added and revised some end-to-end tests to verify the functionality
of the added clauses.
- Revised ToSqlTest#testGrantRevokeRoleStmt() to include the newly
supported clauses.
Generated-by: The changes to sql-parser.cup were by Cursor AI
(gemini-3.1-pro).
Change-Id: I8e7c9ba091bc15271c7a3ef34ca06a38630d5bb6
---
M be/src/service/client-request-state.cc
M be/src/service/frontend.cc
M be/src/service/frontend.h
M common/thrift/Frontend.thrift
M common/thrift/JniCatalog.thrift
M fe/src/main/cup/sql-parser.cup
M fe/src/main/java/org/apache/impala/analysis/AnalysisContext.java
M fe/src/main/java/org/apache/impala/analysis/GrantRevokeRoleStmt.java
A fe/src/main/java/org/apache/impala/analysis/ShowRolesPrincipalStmt.java
M fe/src/main/java/org/apache/impala/analysis/ShowRolesStmt.java
M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java
M fe/src/main/java/org/apache/impala/authorization/NoopAuthorizationFactory.java
M
fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java
M
fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java
M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java
M fe/src/main/java/org/apache/impala/service/Frontend.java
M fe/src/main/java/org/apache/impala/service/JniFrontend.java
M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java
M fe/src/test/java/org/apache/impala/util/CatalogOpUtilTest.java
M testdata/workloads/functional-query/queries/QueryTest/grant_revoke.test
A
testdata/workloads/functional-query/queries/QueryTest/grant_revoke_admin_option.test
M tests/authorization/test_ranger.py
22 files changed, 567 insertions(+), 106 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/37/24337/6
--
To view, visit http://gerrit.cloudera.org:8080/24337
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I8e7c9ba091bc15271c7a3ef34ca06a38630d5bb6
Gerrit-Change-Number: 24337
Gerrit-PatchSet: 6
Gerrit-Owner: Fang-Yu Rao <[email protected]>
Gerrit-Reviewer: Abhishek Rawat <[email protected]>
Gerrit-Reviewer: Csaba Ringhofer <[email protected]>
Gerrit-Reviewer: Fang-Yu Rao <[email protected]>
Gerrit-Reviewer: Impala Public Jenkins <[email protected]>
Gerrit-Reviewer: Quanlong Huang <[email protected]>
