大数据平台权限设计分享-Hive库表权限
权限目标
可通过界面管理用户访问hive库表权限，权限设计模型如下图
权限模型-思维导图.png
-
用户拥有hive库表权限列表
image.png
-
新增hive库权限
image.png
-新增hive表权限
image.png
-修改hive库表权限
-删除hive库表权限
实现思路
在hive中执行sql之前，对sql语句进行解析，获取当前操作的类型，如select,drop,update等，当前操作的库表，当前操作的用户，调用权限校验服务，通过后在进行后续语句执行。
修改hive-site.xml配置文件
<!--权限校验 -->
<property>
<name>hive.server2.authentication</name>
<value>CUSTOM</value>
</property>
<property>
<name>hive.server2.custom.authentication.class</name>
<value>org.apache.hive.permissions.check.BeelineCustomerAuth</value>
</property>
<property>
<name>hive.semantic.analyzer.hook</name>
<value>org.apache.hive.permissions.check.MyAuthorityHook</value>
</property>
<property>
<name>permissions.cluster.type</name>
<value>SPARK</value>
</property>
<property>
<name>permissions.check.url</name>
<value>http://192.168.94.1:8120/legend-permissions-spring/app/acl/permission/api/check</value>
</property>
MyAuthorityHook类如下：
package org.apache.hive.permissions.check;
import org.apache.common.permissions.model.CheckPermissionModel;
import org.apache.common.permissions.model.ClusterType;
import org.apache.common.permissions.model.RequestType;
import org.apache.common.permissions.model.Result;
import org.apache.common.permissions.utils.HttpTools;
import org.apache.common.permissions.utils.JacksonTools;
import org.apache.hadoop.hdfs.server.namenode.permissions.check.PermissionsConstants;
import org.apache.hadoop.hive.metastore.api.Database;
import org.apache.hadoop.hive.ql.metadata.Table;
import org.apache.hadoop.hive.ql.parse.ASTNode;
import org.apache.hadoop.hive.ql.parse.AbstractSemanticAnalyzerHook;
import org.apache.hadoop.hive.ql.parse.HiveSemanticAnalyzerHookContext;
import org.apache.hadoop.hive.ql.parse.SemanticException;
import org.apache.hadoop.hive.ql.session.SessionState;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.util.*;
public class MyAuthorityHook extends AbstractSemanticAnalyzerHook {
public final Logger log = LoggerFactory.getLogger(MyAuthorityHook.class);
private final static String SUPER_USER_NAME = "hadoop";
/**
* 表示失败
*/
public final static String ZORE = "0";
@Override
public ASTNode preAnalyze(HiveSemanticAnalyzerHookContext context, ASTNode ast) throws SemanticException {
try {
Properties properties = context.getHive().getConf().getAllProperties();
String checkUrl = properties.getProperty(PermissionsConstants.PERMISSIONS_CHECK_URL);
String clusertType = properties.getProperty(PermissionsConstants.CLUSTER_TYPE);
String command = context.getCommand();
String sessionUserName = "";
if (SessionState.get() != null && SessionState.get().getAuthenticator() != null) {
sessionUserName = SessionState.get().getAuthenticator().getUserName();
}
if (SUPER_USER_NAME.equals(sessionUserName)) {
throw new SemanticException("permissions error , not allow hadoop user op...");
}
CheckPermissionModel checkPermissionModel = new CheckPermissionModel();
checkPermissionModel.setCommand(command);
checkPermissionModel.setUserName(sessionUserName);
checkPermissionModel.setClusterType(ClusterType.valueOf(clusertType));
checkPermissionModel.setRequestType(RequestType.HIVE_REQUEST);
Database databaseCurrent = context.getHive().getDatabaseCurrent();
String databaseCurrentName = databaseCurrent.getName();
checkPermissionModel.setDatabaseCurrentName(databaseCurrentName);
Map<String, Map<String, Table>> tempTables = SessionState.get().getTempTables();
Set<String> strings = tempTables.keySet();
log.info("---------------");
log.info("------sessionUserName---------" + sessionUserName);
log.info("---command----" + command);
log.info("------databaseCurrentName---------" + databaseCurrentName);
List<String> tempViews = new ArrayList<String>();
for (String key : strings) {
Map<String, Table> stringTableMap = tempTables.get(key);
Set<String> strings1 = stringTableMap.keySet();
for (String str : strings1) {
Table table = stringTableMap.get(str);
String tableName = table.getTableName();
String dbName = table.getDbName();
log.info("------tableName---------" + tableName + " ---dbName--" + dbName);
tempViews.add(dbName.toLowerCase() + "." + tableName.toLowerCase());
}
}
checkPermissionModel.setTempViews(tempViews);
log.info("---------------");
String post = HttpTools.sendPost(checkUrl, JacksonTools.obj2json(checkPermissionModel));
Result result = JacksonTools.json2pojo(post, Result.class);
String status = result.getStatus();
if (status.equals(ZORE)) {
throw new SemanticException("validate permissions has error...");
}
Object obj = result.getObj();
CheckPermissionModel model = JacksonTools.json2pojo(JacksonTools.obj2json(obj), CheckPermissionModel.class);
boolean validateFlag = model.isValidateFlag();
if (!validateFlag) {
throw new SemanticException("user: " + model.getUserName() + " has not permissions..." + " error message :" + model.getMsg() + " excute command : " + model.getCommand());
}
if (validateFlag) {
return ast;
}
} catch (Exception e) {
e.printStackTrace();
}
return null;
}
}
BeelineCustomerAuth类如下：
package org.apache.hive.permissions.check;
import org.apache.hive.service.auth.PasswdAuthenticationProvider;
import javax.security.sasl.AuthenticationException;
public class BeelineCustomerAuth implements PasswdAuthenticationProvider {
private final static String SUPER_USER_NAME = "hadoop";
@Override
public void Authenticate(String userName, String password) throws AuthenticationException {
if (userName == null || userName == "") {
throw new AuthenticationException("user is null,please use -n name way");
}
if (!SUPER_USER_NAME.equals(userName)) {
return;
}
throw new AuthenticationException("permissions error , not allow hadoop user op...");
}
}
为兼容spark sql语法，这里对sql语句的解析，使用了spark组件对sql的解析模块涉及类ResolvedLogicPlan，MySqlParse，OperateTypeEnum，ResolvedOperate，Table几个类,可参见spark sql解析源码
package cn.com.legend.permissions.sql
import java.util.ArrayList
import org.antlr.v4.runtime.tree.xpath.XPath
import org.apache.logging.log4j.{LogManager, Logger}
import org.apache.spark.sql.catalyst.parser.SqlBaseParser._
import scala.collection.JavaConversions.collectionAsScalaIterable
/**
* 解析sql中的操作类型，及操作对象
**/
class ResolvedLogicPlan {
protected var logger: Logger = LogManager.getLogger(getClass)
def parseSql(sql: String): ArrayList[ResolvedOperate] = {
val mySqlParse = new MySqlParse();
mySqlParse.parse(sql) { parser =>
parser.statement() match {
//USE db
case statement: UseContext =>
val dbName = statement.identifier().getText
logger.info("this is a UseContext statement,database is " + dbName);
otherOperate();
case statement: ShowTableContext =>
logger.info("this is a ShowTableContext statement");
otherOperate();
case statement: CacheTableContext =>
logger.info("this is a CacheTableContext statement");
otherOperate();
case statement: UncacheTableContext =>
logger.info("this is a UncacheTableContext statement");
otherOperate();
case statement: ClearCacheContext =>
logger.info("this is a ClearCacheContext statement");
otherOperate();
case statement: ExplainContext =>
logger.info("this is a ExplainContext statement");
otherOperate();
case statement: RefreshResourceContext =>
logger.info("this is a RefreshResourceContext statement");
otherOperate();
case statement: RefreshTableContext =>
logger.info("this is a RefreshTableContext statement");
otherOperate();
case statement: CreateTempViewUsingContext =>
logger.info("this is a CreateTempViewUsingContext statement");
var dbName = "";
if (statement.tableIdentifier().db != null) {
dbName = statement.tableIdentifier().db.getText;
}
val tableName = statement.tableIdentifier().table.getText;
writeOperate(dbName,tableName);
case statement: SetConfigurationContext =>
logger.info("this is a SetConfigurationContext statement");
otherOperate();
case statement: ResetConfigurationContext =>
logger.info("this is a ResetConfigurationContext statement");
otherOperate();
case statement: ShowTblPropertiesContext =>
logger.info("this is a ShowTblPropertiesContext statement");
otherOperate();
case statement: DescribeFunctionContext =>
logger.info("this is a DescribeFunctionContext statement");
otherOperate();
case statement: DescribeTableContext =>
logger.info("this is a DescribeTableContext statement");
otherOperate();
case statement: ShowFunctionsContext =>
logger.info("this is a ShowFunctionsContext statement");
otherOperate();
case statement: ShowColumnsContext =>
logger.info("this is a ShowColumnsContext statement");
otherOperate();
case statement: ShowCreateTableContext =>
logger.info("this is a ShowCreateTableContext statement");
otherOperate();
case statement: ShowDatabasesContext =>
logger.info("this is a ShowDatabasesContext statement");
otherOperate();
case statement: ShowPartitionsContext =>
logger.info("this is a ShowPartitionsContext statement");
otherOperate();
case statement: ShowTablesContext =>
logger.info("this is a ShowTablesContext statement");
otherOperate();
case statement: AnalyzeContext =>
logger.info("this is a AnalyzeContext statement");
otherOperate();
case statement: DescribeDatabaseContext =>
logger.info("this is a DescribeDatabaseContext statement");
otherOperate();
case statement: SetDatabasePropertiesContext =>
logger.info("this is a SetDatabasePropertiesContext statement");
adminOperate();
case statement: DropDatabaseContext =>
val dbName = statement.identifier().getText
logger.info("this is a DropDatabaseContext statement,db is " + dbName);
adminOperate();
case statement: CreateDatabaseContext =>
val dbName = statement.identifier().getText
logger.info("this is a CreateDatabaseContext statement,db is " + dbName);
adminOperate();
case statement: CreateFunctionContext =>
logger.info("this is a CreateFunctionContext statement");
adminOperate();
case statement: DropFunctionContext =>
logger.info("this is a DropFunctionContext statement");
adminOperate();
case statement: CreateHiveTableContext =>
logger.info("this is a CreateHiveTableContext statement");
var dbName = "";
if (statement.createTableHeader().tableIdentifier().db != null) {
dbName = statement.createTableHeader().tableIdentifier().db.getText;
}
val tableName = statement.createTableHeader().tableIdentifier().table.getText;
createOperate(dbName, tableName);
case statement: CreateTableLikeContext =>
logger.info("this is a CreateTableLikeContext statement");
var dbName = "";
if (statement.target.db != null) {
dbName = statement.target.db.getText
}
val tableName = statement.target.table.getText;
createOperate(dbName, tableName);
case statement: CreateViewContext =>
logger.info("this is a CreateViewContext statement");
otherOperate();
case statement: CreateTableContext =>
logger.info("this is a CreateTableContext statement");
var dbName = "";
if (statement.createTableHeader().tableIdentifier().db != null) {
dbName = statement.createTableHeader().tableIdentifier().db.getText;
}
val tableName = statement.createTableHeader().tableIdentifier().table.getText;
createOperate(dbName, tableName);
case statement: DropTableContext =>
logger.info("this is a DropTableContext statement");
var dbName = "";
if (statement.tableIdentifier().db != null) {
dbName = statement.tableIdentifier().db.getText;
}
val tableName = statement.tableIdentifier().table.getText;
dropOperate(dbName, tableName);
case statement: DropTablePartitionsContext =>
logger.info("this is a DropTablePartitionsContext statement");
var dbName = "";
if (statement.tableIdentifier().db != null) {
dbName = statement.tableIdentifier().db.getText;
}
val tableName = statement.tableIdentifier().table.getText;
alterOperate(dbName, tableName);
case statement: TruncateTableContext =>
logger.info("this is a TruncateTableContext statement");
var dbName = "";
if (statement.tableIdentifier().db != null) {
dbName = statement.tableIdentifier().db.getText;
}
val tableName = statement.tableIdentifier().table.getText;
alterOperate(dbName, tableName);
case statement: AddTableColumnsContext =>
logger.info("this is a AddTableColumnsContext statement");
var dbName = "";
if (statement.tableIdentifier().db != null) {
dbName = statement.tableIdentifier().db.getText;
}
val tableName = statement.tableIdentifier().table.getText;
alterOperate(dbName, tableName);
case statement: AddTablePartitionContext =>
logger.info("this is a AddTablePartitionContext statement");
var dbName = "";
if (statement.tableIdentifier().db != null) {
dbName = statement.tableIdentifier().db.getText;
}
val tableName = statement.tableIdentifier().table.getText;
alterOperate(dbName, tableName);
case statement: AlterViewQueryContext =>
logger.info("this is a AlterViewQueryContext statement");
var dbName = "";
if (statement.tableIdentifier().db != null) {
dbName = statement.tableIdentifier().db.getText;
}
val tableName = statement.tableIdentifier().table.getText;
alterOperate(dbName, tableName);
case statement: ChangeColumnContext =>
logger.info("this is a ChangeColumnContext statement");
var dbName = "";
if (statement.tableIdentifier().db != null) {
dbName = statement.tableIdentifier().db.getText;
}
val tableName = statement.tableIdentifier().table.getText;
alterOperate(dbName, tableName);
case statement: RenameTableContext =>
logger.info("this is a RenameTableContext statement");
var dbName = "";
if (statement.from.db != null) {
dbName = statement.from.db.getText;
}
val tableName = statement.from.table.getText;
alterOperate(dbName, tableName);
case statement: RenameTablePartitionContext =>
logger.info("this is a RenameTablePartitionContext statement");
var dbName = "";
if (statement.tableIdentifier.db != null) {
dbName = statement.tableIdentifier.db.getText;
}
val tableName = statement.tableIdentifier.table.getText;
alterOperate(dbName, tableName);
case statement: UnsetTablePropertiesContext =>
logger.info("this is a UnsetTablePropertiesContext statement");
var dbName = "";
if (statement.tableIdentifier.db != null) {
dbName = statement.tableIdentifier.db.getText;
}
val tableName = statement.tableIdentifier.table.getText;
alterOperate(dbName, tableName);
case statement: SetTableLocationContext =>
logger.info("this is a SetTableLocationContext statement");
var dbName = "";
if (statement.tableIdentifier.db != null) {
dbName = statement.tableIdentifier.db.getText;
}
val tableName = statement.tableIdentifier.table.getText;
alterOperate(dbName, tableName);
case statement: SetTablePropertiesContext =>
logger.info("this is a SetTableLocationContext statement");
var dbName = "";
if (statement.tableIdentifier.db != null) {
dbName = statement.tableIdentifier.db.getText;
}
val tableName = statement.tableIdentifier.table.getText;
alterOperate(dbName, tableName);
case statement: SetTableSerDeContext =>
logger.info("this is a SetTableSerDeContext statement");
var dbName = "";
if (statement.tableIdentifier.db != null) {
dbName = statement.tableIdentifier.db.getText;
}
val tableName = statement.tableIdentifier.table.getText;
alterOperate(dbName, tableName);
case statement: RepairTableContext =>
logger.info("this is a RepairTableContext statement");
var dbName = "";
if (statement.tableIdentifier.db != null) {
dbName = statement.tableIdentifier.db.getText;
}
val tableName = statement.tableIdentifier.table.getText;
alterOperate(dbName, tableName);
case statement: RecoverPartitionsContext =>
logger.info("this is a RecoverPartitionsContext statement");
var dbName = "";
if (statement.tableIdentifier.db != null) {
dbName = statement.tableIdentifier.db.getText;
}
val tableName = statement.tableIdentifier.table.getText;
alterOperate(dbName, tableName);
case statement: LoadDataContext =>
logger.info("this is a LoadDataContext statement");
var dbName = "";
if (statement.tableIdentifier.db != null) {
dbName = statement.tableIdentifier.db.getText;
}
val tableName = statement.tableIdentifier.table.getText;
writeOperate(dbName, tableName);
case statement: StatementDefaultContext =>
logger.info("this is a StatementDefaultContext statement")
val resolvedOperates: ArrayList[ResolvedOperate] = new ArrayList[ResolvedOperate]();
statement.children.foreach { tree =>
//xpath表示定义的规则,SqlBaseParser.ruleNames
val xpath = "//fromClause//tableIdentifier"
XPath.findAll(tree, xpath, parser).foreach { x =>
val text = x.getText;
var dbName = "";
var tableName = "";
if (text.contains(".")) {
val textArr = text.split("\\.");
dbName = textArr.apply(0);
tableName = textArr.apply(1);
} else {
tableName = text;
}
val resolvedOperate = new ResolvedOperate();
resolvedOperate.setDbName(dbName);
resolvedOperate.setTableName(tableName);
resolvedOperate.setOperateType(OperateTypeEnum.SELECT);
resolvedOperates.add(resolvedOperate);
}
val insertXpath = "//insertInto//tableIdentifier"
XPath.findAll(tree, insertXpath, parser).foreach { x =>
val text = x.getText;
var dbName = "";
var tableName = "";
if (text.contains(".")) {
val textArr = text.split("\\.");
dbName = textArr.apply(0);
tableName = textArr.apply(1);
} else {
tableName = text;
}
val resolvedOperate = new ResolvedOperate();
resolvedOperate.setDbName(dbName);
resolvedOperate.setTableName(tableName);
resolvedOperate.setOperateType(OperateTypeEnum.WRITE);
resolvedOperates.add(resolvedOperate);
}
}
resolvedOperates;
case _ =>
println("other statement");
null;
}
}
}
private def otherOperate(): ArrayList[ResolvedOperate] = {
val resolvedOperates: ArrayList[ResolvedOperate] = new ArrayList[ResolvedOperate]();
val resolvedOperate = new ResolvedOperate();
resolvedOperate.setOperateType(OperateTypeEnum.OTHER);
resolvedOperates.add(resolvedOperate);
resolvedOperates;
}
private def adminOperate(): ArrayList[ResolvedOperate] = {
val resolvedOperates: ArrayList[ResolvedOperate] = new ArrayList[ResolvedOperate]();
val resolvedOperate = new ResolvedOperate();
resolvedOperate.setOperateType(OperateTypeEnum.ADMIN);
resolvedOperates.add(resolvedOperate);
resolvedOperates;
}
private def createOperate(dbName: String, tableName: String): ArrayList[ResolvedOperate] = {
val resolvedOperates: ArrayList[ResolvedOperate] = new ArrayList[ResolvedOperate]();
val resolvedOperate = new ResolvedOperate();
resolvedOperate.setDbName(dbName);
resolvedOperate.setTableName(tableName);
resolvedOperate.setOperateType(OperateTypeEnum.CREATE);
resolvedOperates.add(resolvedOperate);
resolvedOperates;
}
private def dropOperate(dbName: String, tableName: String): ArrayList[ResolvedOperate] = {
val resolvedOperates: ArrayList[ResolvedOperate] = new ArrayList[ResolvedOperate]();
val resolvedOperate = new ResolvedOperate();
resolvedOperate.setDbName(dbName);
resolvedOperate.setTableName(tableName);
resolvedOperate.setOperateType(OperateTypeEnum.DROP);
resolvedOperates.add(resolvedOperate);
resolvedOperates;
}
private def alterOperate(dbName: String, tableName: String): ArrayList[ResolvedOperate] = {
val resolvedOperates: ArrayList[ResolvedOperate] = new ArrayList[ResolvedOperate]();
val resolvedOperate = new ResolvedOperate();
resolvedOperate.setDbName(dbName);
resolvedOperate.setTableName(tableName);
resolvedOperate.setOperateType(OperateTypeEnum.ALTER);
resolvedOperates.add(resolvedOperate);
resolvedOperates;
}
private def writeOperate(dbName: String, tableName: String): ArrayList[ResolvedOperate] = {
val resolvedOperates: ArrayList[ResolvedOperate] = new ArrayList[ResolvedOperate]();
val resolvedOperate = new ResolvedOperate();
resolvedOperate.setDbName(dbName);
resolvedOperate.setTableName(tableName);
resolvedOperate.setOperateType(OperateTypeEnum.WRITE);
resolvedOperates.add(resolvedOperate);
resolvedOperates;
}
}
package cn.com.legend.permissions.sql
import org.antlr.v4.runtime.atn.PredictionMode
import org.antlr.v4.runtime.misc.ParseCancellationException
import org.antlr.v4.runtime.{ANTLRInputStream, CommonTokenStream, IntStream}
import org.apache.spark.sql.AnalysisException
import org.apache.spark.sql.catalyst.parser._
import org.apache.spark.sql.catalyst.plans.logical.LogicalPlan
import org.apache.spark.sql.catalyst.trees.Origin
class MySqlParse {
class ANTLRNoCaseStringStream(input: String) extends ANTLRInputStream(input) {
override def LA(i: Int): Int = {
val la = super.LA(i)
if (la == 0 || la == IntStream.EOF) la
else Character.toUpperCase(la)
}
}
def parsePlan(sqlText: String): LogicalPlan = parse(sqlText) { parser =>
val astBuilder = new AstBuilder();
astBuilder.visitSingleStatement(parser.singleStatement()) match {
case plan: LogicalPlan => plan
case _ =>
val position = Origin(None, None)
throw new ParseException(Option(sqlText), "Unsupported SQL statement", position, position)
}
}
def parse[T](command: String)(toResult: SqlBaseParser => T): T = {
val lexer = new SqlBaseLexer(new ANTLRNoCaseStringStream(command))
lexer.removeErrorListeners()
lexer.addErrorListener(ParseErrorListener)
val tokenStream = new CommonTokenStream(lexer)
val parser = new SqlBaseParser(tokenStream)
parser.addParseListener(PostProcessor)
parser.removeErrorListeners()
parser.addErrorListener(ParseErrorListener)
try {
try {
// first, try parsing with potentially faster SLL mode
parser.getInterpreter.setPredictionMode(PredictionMode.SLL)
toResult(parser)
}
catch {
case e: ParseCancellationException =>
e.printStackTrace();
// if we fail, parse with LL mode
tokenStream.reset() // rewind input stream
parser.reset()
// Try Again.
parser.getInterpreter.setPredictionMode(PredictionMode.LL)
toResult(parser)
}
}
catch {
case e: ParseException if e.command.isDefined =>
throw e
case e: ParseException =>
throw e.withCommand(command)
case e: AnalysisException =>
val position = Origin(e.line, e.startPosition)
throw new ParseException(Option(command), e.message, position, position)
}
}
}
package cn.com.legend.permissions.sql
object OperateTypeEnum extends Enumeration {
type OperateTypeEnum = Value
val ADMIN, CREATE, DROP, ALTER, SELECT, WRITE, OTHER = Value
}
package cn.com.legend.permissions.sql
import java.util.ArrayList
import OperateTypeEnum.OperateTypeEnum
class ResolvedOperate {
/**
* 操作类型
**/
private var operateType: OperateTypeEnum = OperateTypeEnum.OTHER;
private var dbName: String = null;
private var tableName: String = null;
private var oprateTables: ArrayList[Table] = new ArrayList[Table]();
def getOperateType(): OperateTypeEnum = {
operateType
}
def setOperateType(newOperateType: OperateTypeEnum) = {
operateType = newOperateType;
}
def getOprateTables(): ArrayList[Table] = {
oprateTables
}
def setOprateTables(newOprateTables: ArrayList[Table]) = {
oprateTables = newOprateTables;
}
def getDbName(): String = {
dbName
}
def setDbName(newDbName: String) = {
dbName = newDbName;
}
def getTableName(): String = {
tableName
}
def setTableName(newTableName: String) = {
tableName = newTableName;
}
}
package cn.com.legend.permissions.sql
class Table(val dbName: String, val tableName: String) {
}
上述类使用方式如下代码，传入sql语句，可解析出sql，操作类型，操作库表
ResolvedLogicPlan resolvedLogicPlan = new ResolvedLogicPlan();
ArrayList<ResolvedOperate> resolvedOperates = resolvedLogicPlan.parseSql(command);
权限校验服务，核心代码如下:
private CheckPermissionModel checkHiveSparkDbOrTablePermissions(CheckPermissionModel checkPermissionModel) {
try {
log.info("---requet params----");
log.info(JsonTools.toJsonStr(checkPermissionModel));
log.info("---requet params----");
String userName = checkPermissionModel.getUserName();
checkPermissionModel.setUserName(userName);
//判断执行用户是否是超级管理员
if (SUPER_USER.equals(userName)) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
//解析sql，返回操作类型
String command = checkPermissionModel.getCommand();
//spark sql默认不支持 insert overwrite local directory '/home/wyp/wyp' select * from wyp 类型语法
if (command.toLowerCase().contains("insert") && command.toLowerCase().contains("directory")) {
int selectIndex = command.indexOf("select");
command = command.substring(selectIndex - 1, command.length());
}
ResolvedLogicPlan resolvedLogicPlan = new ResolvedLogicPlan();
ArrayList<ResolvedOperate> resolvedOperates = resolvedLogicPlan.parseSql(command);
//校验权限
CheckPermissionModel rCheckPermissionModel = validatePermission(checkPermissionModel, resolvedOperates);
return rCheckPermissionModel;
} catch (Exception e) {
log.error(e.getMessage());
}
checkPermissionModel.setValidateFlag(false);
return checkPermissionModel;
}
/**
* 校验权限
*/
private CheckPermissionModel validatePermission(CheckPermissionModel checkPermissionModel, ArrayList<ResolvedOperate> resolvedOperates) {
String userName = checkPermissionModel.getUserName();
for (ResolvedOperate resolvedOperate : resolvedOperates) {
Enumeration.Value operateType = resolvedOperate.getOperateType();
//查看是否是admin操作
if (OperateTypeEnum.ADMIN().equals(operateType)) {
checkPermissionModel.setValidateFlag(false);
checkPermissionModel.setMsg("[user " + userName + " has not admin permissions]");
return checkPermissionModel;
}
//查看是否是other操作,other是默认权限，所有用户都拥有
if (OperateTypeEnum.OTHER().equals(operateType)) {
continue;
}
//判断命令是否包含关键字temporary
String command = checkPermissionModel.getCommand();
if (command.toLowerCase().contains("temporary")) {
continue;
}
CheckPermissionModel validateCheckPermissionModel = validateOperatePermission(checkPermissionModel, resolvedOperate, operateType.toString());
if (validateCheckPermissionModel.isValidateFlag()) {
continue;
}
return validateCheckPermissionModel;
}
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
/**
* 校验权限
*/
private CheckPermissionModel validateOperatePermission(CheckPermissionModel checkPermissionModel, ResolvedOperate resolvedOperate, String operateType) {
String userName = checkPermissionModel.getUserName();
String dbName = resolvedOperate.getDbName();
if (!StringTools.hasText(dbName)) {
dbName = checkPermissionModel.getDatabaseCurrentName();
}
ClusterType clusterType = checkPermissionModel.getClusterType();
List<HivePermission> hivePermissions = null;
String key = RedisTools.generateRedisKet(clusterType, userName);
if (enable) {
hivePermissions = (List<HivePermission>) redisDao.get(key);
}
if (CollectionUtils.isEmpty(hivePermissions)) {
hivePermissions = hivePermissionsDao.findByUserNameAndClusterType(userName, clusterType.getValue());
if (CollectionUtils.isEmpty(hivePermissions)) {
checkPermissionModel.setValidateFlag(false);
String msg = "[user " + userName + " has not " + operateType.toString() + " permissions]";
checkPermissionModel.setMsg(msg);
return checkPermissionModel;
}
if (enable) {
redisDao.put(key, hivePermissions);
}
}
//校验表所在库拥有权限
HivePermission dbPermission = hivePermissions.stream().filter(x -> Constant.DB_TYPE.equals(x.getPermissionType())).findFirst().get();
if (dbPermission != null) {
if (dbPermission.isHasAll()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
CheckPermissionModel sitchCaseDbValidateCheck = sitchCaseDbValidate(checkPermissionModel, operateType, dbPermission);
if (sitchCaseDbValidateCheck != null) {
return sitchCaseDbValidateCheck;
}
}
//校验表所拥有权限
String tableName = resolvedOperate.getTableName();
//判断是否是临时表
List<String> tempViews = checkPermissionModel.getTempViews();
if (!CollectionUtils.isEmpty(tempViews)) {
RequestType requestType = checkPermissionModel.getRequestType();
String dbTable = "";
if (RequestType.HIVE_REQUEST.equals(requestType)) {
dbTable = dbName + "." + tableName;
}
if (RequestType.SPARK_REQUEST.equals(requestType)) {
dbTable = tableName;
}
if (tempViews.contains(dbTable.toLowerCase())) {
checkPermissionModel.setValidateFlag(true);
log.info(dbName + "." + tableName + " is tempView,user has all permission");
return checkPermissionModel;
}
}
final String filterDbName = dbName;
HivePermission tbPermission = hivePermissions.stream().filter(x ->
x.getPermissionType().equals(Constant.TABLE_TYPE) && tableName.equals(x.getTbName()) && filterDbName.equals(x.getDbName())
).findFirst().get();
if (tbPermission == null) {
checkPermissionModel.setValidateFlag(false);
String msg = "[user " + userName + " has not " + operateType + " dbName: " + dbName + " tableName: " + tableName + " permissions,or " + dbName + "." + tableName + " is not exist]";
checkPermissionModel.setMsg(msg);
return checkPermissionModel;
}
CheckPermissionModel sitchCaseTableValidateCheck = sitchCaseTableValidate(checkPermissionModel, operateType, tbPermission);
if (sitchCaseTableValidateCheck != null) {
boolean validateFlag = sitchCaseTableValidateCheck.isValidateFlag();
if (!validateFlag) {
String msg = "[user " + userName + " has not " + operateType + " dbName: " + dbName + " tableName: " + tableName + " permissions]";
sitchCaseTableValidateCheck.setMsg(msg);
}
return sitchCaseTableValidateCheck;
}
checkPermissionModel.setValidateFlag(false);
String msg = "[user " + userName + " has not " + operateType.toString() + " permissions]";
checkPermissionModel.setMsg(msg);
return checkPermissionModel;
}
private CheckPermissionModel sitchCaseTableValidate(CheckPermissionModel checkPermissionModel, String operateType, HivePermission tbPermission) {
switch (operateType) {
case "ALTER":
if (tbPermission.isHasAlter()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
case "CREATE":
if (tbPermission.isHasCreate()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
case "DROP":
if (tbPermission.isHasDrop()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
case "SELECT":
if (tbPermission.isHasSelect()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
case "WRITE":
if (tbPermission.isHasWrite()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
default:
log.error("switch: not case,operateType: " + operateType.toString());
}
return null;
}
private CheckPermissionModel sitchCaseDbValidate(CheckPermissionModel checkPermissionModel, String operateType, HivePermission dbPermission) {
switch (operateType) {
case "ALTER":
if (dbPermission.isHasAlter()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
case "CREATE":
if (dbPermission.isHasCreate()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
case "DROP":
if (dbPermission.isHasDrop()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
case "SELECT":
if (dbPermission.isHasSelect()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
case "WRITE":
if (dbPermission.isHasWrite()) {
checkPermissionModel.setValidateFlag(true);
return checkPermissionModel;
}
break;
default:
log.error("switch: not case,operateType: " + operateType.toString());
}
return null;
}
15人点赞
299
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
