Fang-Yu Rao has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24337 )
Change subject: IMPALA-14954: Support ADMIN OPTION clause for GRANT/REVOKE ROLE ...................................................................... IMPALA-14954: Support ADMIN OPTION clause for GRANT/REVOKE ROLE This patch adds the support of WITH ADMIN OPTION clause for the GRANT ROLE statement, and the support of ADMIN OPTION FOR clause for the REVOKE ROLE statement. Specifically, to allow a principal <principal_name> to grant/revoke a role <role_name> to/from another principal, an administrator could execute the following, where <principal_type> could be GROUP or USER. GRANT ROLE <role_name> TO <principal_type> <principal_name> WITH ADMIN OPTION Similarly, to revoke the ADMIN OPTION of the role <role_name> from the principal <principal_name> without revoking the role <role_name>, an administrator could execute the following. The syntax is the same as what Apache Hive supports as in HIVE-6252. REVOKE ADMIN OPTION FOR <role_name> FROM <principal_type> <principal_name> This patch also adds the column of 'grant_option' to the result of the SHOW ROLE GRANT GROUP/USER statements. Note that we do not add the columns of 'grant_time' and 'grantor' because of the issue reported in RANGER-5612. Testing: - Added and revised some end-to-end tests to verify the functionality of the added clauses. - Revised ToSqlTest#testGrantRevokeRoleStmt() to include the newly supported clauses. Generated-by: The changes to sql-parser.cup were by Cursor AI (gemini-3.1-pro). Change-Id: I8e7c9ba091bc15271c7a3ef34ca06a38630d5bb6 Reviewed-on: http://gerrit.cloudera.org:8080/24337 Tested-by: Impala Public Jenkins <[email protected]> Reviewed-by: Fang-Yu Rao <[email protected]> --- M be/src/service/client-request-state.cc M be/src/service/frontend.cc M be/src/service/frontend.h M common/thrift/Frontend.thrift M common/thrift/JniCatalog.thrift M fe/src/main/cup/sql-parser.cup M fe/src/main/java/org/apache/impala/analysis/AnalysisContext.java M fe/src/main/java/org/apache/impala/analysis/GrantRevokeRoleStmt.java A fe/src/main/java/org/apache/impala/analysis/ShowRolesPrincipalStmt.java M fe/src/main/java/org/apache/impala/analysis/ShowRolesStmt.java M fe/src/main/java/org/apache/impala/authorization/AuthorizationManager.java M fe/src/main/java/org/apache/impala/authorization/NoopAuthorizationFactory.java M fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java M fe/src/main/java/org/apache/impala/authorization/ranger/RangerImpaladAuthorizationManager.java M fe/src/main/java/org/apache/impala/service/CatalogOpExecutor.java M fe/src/main/java/org/apache/impala/service/Frontend.java M fe/src/main/java/org/apache/impala/service/JniFrontend.java M fe/src/main/java/org/apache/impala/util/CatalogOpUtil.java M fe/src/test/java/org/apache/impala/analysis/ToSqlTest.java M fe/src/test/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManagerTest.java M fe/src/test/java/org/apache/impala/util/CatalogOpUtilTest.java M testdata/workloads/functional-query/queries/QueryTest/grant_revoke.test A testdata/workloads/functional-query/queries/QueryTest/grant_revoke_admin_option.test M tests/authorization/test_ranger.py 24 files changed, 688 insertions(+), 120 deletions(-) Approvals: Impala Public Jenkins: Verified Fang-Yu Rao: Looks good to me, approved -- To view, visit http://gerrit.cloudera.org:8080/24337 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: I8e7c9ba091bc15271c7a3ef34ca06a38630d5bb6 Gerrit-Change-Number: 24337 Gerrit-PatchSet: 14 Gerrit-Owner: Fang-Yu Rao <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Csaba Ringhofer <[email protected]> Gerrit-Reviewer: Fang-Yu Rao <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]> Gerrit-Reviewer: Joe McDonnell <[email protected]> Gerrit-Reviewer: Michael Smith <[email protected]> Gerrit-Reviewer: Quanlong Huang <[email protected]> Gerrit-Reviewer: Yida Wu <[email protected]>
