自定义Hive权限控制(4)扩展Hive以实现自定义权限控制

??public static enum ConfVars {	KUXUNUSER("hive.kuxun.username",""), //用户名	KUXUNPASSWORD("hive.kuxun.password",""),//密码	KUXUN_HIVESERVER_URL("hive.kuxun.hiveserver.url",""), //权限认证数据库地址	KUXUN_HIVESERVER_USER("hive.kuxun.hiveserver.username",""),//权限认证数据库用户名	KUXUN_HIVESERVER_PASSWORD("hive.kuxun.hiveserver.password",""),//权限认证数据库密码	KUXUN_RESERVE_A("hive.kuxun.resrver.a",""),//保留	KUXUN_RESERVE_B("hive.kuxun.resrver.b",""),//保留	KUXUN_RESERVE_C("hive.kuxun.resrver.c",""),//保留	KUXUN_RESERVE_D("hive.kuxun.resrver.d",""),//保留????????.......}

private String username ="";private String password ="";

this.username = HiveConf.getVar(conf, HiveConf.ConfVars.KUXUNUSER);this.password = HiveConf.getVar(conf, HiveConf.ConfVars.KUXUNPASSWORD);

private void doAuthorizationExtend(BaseSemanticAnalyzer sem) throws HiveException, AuthorizationException {	//获取用户权限信息	UserAuthDataMode ua ;	try{	ua = new UserAuthDataMode(this.username,this.password,this.conf);	ua.run();	}catch(Exception e){	throw new AuthorizationException(e.getMessage());	}	if(ua.isSuperUser()){	LOG.error("current user is super user,do not check authorization.");	return ;	}	LOG.warn("current user is ["+this.username+"]. start check authorization.......");????LOG.warn("current user["+this.username+"] execute command ["+this.userCommand+"].");?	HashSet inputs = sem.getInputs();	SessionState ss = SessionState.get();	HiveOperation op = ss.getHiveOperation();	if (op != null) {}//不处理这种方式，hiveserver并不提供写入操作	LOG.debug("---------auth KUXUN--------------");	if (inputs != null && inputs.size() > 0) {	if (inputs.size() > ua.getMaxMapCount()){	String errorMsg = "The max partition numbers which you can handler in one job is ["+ua.getMaxMapCount()+"],but current is ["+inputs.size()+"]. Pemission denied.";	Exception ex = new Exception(errorMsg);	throw new AuthorizationException(errorMsg,ex);	}	for (ReadEntity read : inputs) {	if (read.getPartition() != null) {	Table tbl = read.getTable();	String tblName = tbl.getTableName();	LOG.debug("-----dbName.tableName---------"+tbl.getDbName()+"."+tblName);	String tblFullName = tbl.getDbName()+"."+tblName;	//如果当前表所在db不在用户权限db中 ,同时表不在用户权限table中，则抛出异常	if(ua.getDbNameList().indexOf(tbl.getDbName()) partValueList = part.getValues();	List partList = tbl.getPartitionKeys();	int partSize = partList.size();	for (int i=0;i tsoTopMap = parseCtx	.getTopToTable();?	for (Map.Entry> topOpMap : querySem	.getParseContext().getTopOps().entrySet()) {	Operator topOp = topOpMap	.getValue();	if (topOp instanceof TableScanOperator	&& tsoTopMap.containsKey(topOp)) {	TableScanOperator tableScanOp = (TableScanOperator) topOp;	Table tbl = tsoTopMap.get(tableScanOp);	String dbName = tbl.getDbName();	String tblName = tbl.getTableName();	List neededColumnIds = tableScanOp	.getNeededColumnIDs();	List columns = tbl.getCols();	List cols = new ArrayList();	if (neededColumnIds != null){	LOG.debug("-------neededColumnIds-----"+neededColumnIds.size());	}else{	LOG.debug("-------neededColumnIds-----null");	}	if (neededColumnIds != null	&& neededColumnIds.size() > 0) {	for (int i = 0; i < neededColumnIds.size(); i++) {	cols.add(columns.get(neededColumnIds.get(i))	.getName());	}	} else {	for (int i = 0; i < columns.size(); i++) {	cols.add(columns.get(i).getName());	}	}	//判断非分区表，是否存在于权限对象中	String fullTableName = dbName +"."+tblName;	if(ua.getDbNameList().indexOf(tbl.getDbName()) authColList = ua.getExcludeColumnList().get(fullTableName);	for(String col:cols){	if(authColList.indexOf(col) !=-1){	throw new AuthorizationException("table ["+fullTableName+"] column ["+col+"] Pemission denied.");	}	LOG.debug("--------col------------"+dbName+"."+tblName+":"+col);	}	}	//判断是否有必须包含的列，但是在使用中没有使用的	if(ua.getIncludeColumnList().containsKey(fullTableName)){	List authColList = ua.getIncludeColumnList().get(fullTableName);	for(String authCol:authColList){	if(cols.indexOf(authCol) == -1 ){	throw new AuthorizationException("table ["+fullTableName+"] must contain??column ["+authCol+"]. Pemission denied.");	}	}	}?	}	}	}	}}

public int compile(String command, boolean resetTaskIds){??????try{????	??doAuthorizationExtend(sem);??????}catch (AuthorizationException authExp){????	??errorMessage ="FAILED:Kuxun Authorization failed:" + authExp.getMessage()??????????+ " Please contact anyoneking@163.com for your information." ;????	??console.printError("Kuxun Authorization failed:" + authExp.getMessage()??????????????????+ "Please contact anyoneking@163.com for your information.");??????????????return 403;??????}}请注意：errorMessage在获取异常后，必须要进行赋值，否则通过hive client访问的时候，出现异常的时候不会给出异常提示，只会给出NUll。

??hive.kuxun.username??test???hive.kuxun.password??test?????hive.kuxun.hiveserver.url??jdbc:mysql://localhost:3306/hiveserver??hiveserver jdbc connection url???hive.kuxun.hiveserver.username??test??username to use against hiveserver database???hive.kuxun.hiveserver.password??test??password to use against hiveserver database