[
https://issues.apache.org/jira/browse/IMPALA-14954?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097720#comment-18097720
]
ASF subversion and git services commented on IMPALA-14954:
----------------------------------------------------------
Commit b38852802b493b69159b1c0230e992f3e7237b28 in impala's branch
refs/heads/master from Fang-Yu Rao
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=b38852802 ]
IMPALA-14954: Support ADMIN OPTION clause for GRANT/REVOKE ROLE
This patch adds the support of WITH ADMIN OPTION clause for the GRANT
ROLE statement, and the support of ADMIN OPTION FOR clause for the
REVOKE ROLE statement. Specifically, to allow a principal
<principal_name> to grant/revoke a role <role_name> to/from another
principal, an administrator could execute the following, where
<principal_type> could be GROUP or USER.
GRANT ROLE <role_name> TO <principal_type> <principal_name> WITH
ADMIN OPTION
Similarly, to revoke the ADMIN OPTION of the role <role_name> from the
principal <principal_name> without revoking the role <role_name>, an
administrator could execute the following. The syntax is the same as
what Apache Hive supports as in HIVE-6252.
REVOKE ADMIN OPTION FOR <role_name> FROM <principal_type>
<principal_name>
This patch also adds the column of 'grant_option' to the result
of the SHOW ROLE GRANT GROUP/USER statements. Note that we do not add
the columns of 'grant_time' and 'grantor' because of the issue reported
in RANGER-5612.
Testing:
- Added and revised some end-to-end tests to verify the functionality
of the added clauses.
- Revised ToSqlTest#testGrantRevokeRoleStmt() to include the newly
supported clauses.
Generated-by: The changes to sql-parser.cup were by Cursor AI
(gemini-3.1-pro).
Change-Id: I8e7c9ba091bc15271c7a3ef34ca06a38630d5bb6
Reviewed-on: http://gerrit.cloudera.org:8080/24337
Tested-by: Impala Public Jenkins <[email protected]>
Reviewed-by: Fang-Yu Rao <[email protected]>
> Support the ADMIN OPTION clause for granting and revoking roles
> ---------------------------------------------------------------
>
> Key: IMPALA-14954
> URL: https://issues.apache.org/jira/browse/IMPALA-14954
> Project: IMPALA
> Issue Type: Task
> Reporter: Fang-Yu Rao
> Assignee: Fang-Yu Rao
> Priority: Major
> Fix For: Impala 5.0.0
>
>
> Apache Hive supports the {{WITH ADMIN OPTION}} clause for the GRANT ROLE
> statement as shown at
> [https://hive.apache.org/docs/latest/language/sql-standard-based-hive-authorization/#:~:text=GRANT%20role_name%20%5B%2C%20role_name%5D%20...%0ATO%20principal_specification%20%5B%2C%20principal_specification%5D%20...%20%0A%5B%20WITH%20ADMIN%20OPTION%20%5D%3B.]
>
> This allows users/groups assigned a role with "{{{}WITH ADMIN OPTION{}}}" to
> grant/revoke the same role to/from other users/groups, and hence could
> decentralize the role management. We should do this too in Apache Impala.
>
> I briefly verified that to delegate the role management of a role to a
> grantee, it suffices to add the following after
> [https://github.com/apache/impala/blob/a44f72d/fe/src/main/java/org/apache/impala/authorization/ranger/RangerCatalogdAuthorizationManager.java#L566]
> when constructing the corresponding {{{}GrantRevokeRoleRequest{}}}.
> {code:java}
> request.setGrantOption(true);
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
