Apache Sentry实战之旅（二）—— Sentry客户端使用

Apache Sentry虽然可以将HDFS、Hive与Impala三个组件的权限认证统一，但是只能按照给组授予角色的方式来进行授权，不能直接授权给组中的用户，显得不太灵活。有时候为了兼容已有大数据平台的授权体系，比如只使用Sentry控制Impala服务的权限，而不控制Hive和HDFS服务的权限，希望通过调用Sentry客户端API的方式将已有的Hive和HDFS服务的权限信息导入到Sentry中，就需要通过调用Sentry API来达到这个目的。Sentry支持通过调用服务方式整合公司特定的数据权限需求，提供了外调接口来动态获得和更改权限信息，使我们可以同步其它大数据平台的组织架构，复用已有的权限模型，实现权限信息的统一。

环境

Impala版本：2.12.0-cdh5.16.1

Sentry版本：1.5.1-cdh5.16.1

JDK版本：jdk1.8.0_212

整合步骤

首先得确认Sentry服务端安装好并已启动，以下是整合步骤及测试用例。整个工程目录如下：

1、加入maven依赖：

<dependency>
    <groupId>org.apache.sentry</groupId>
    <artifactId>sentry-provider-db</artifactId>
    <version>1.5.1-cdh5.16.1</version>
</dependency>

2、Sentry客户端配置文件——sentry-site.xml：

<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="configuration.xsl"?>
<!--
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-->

<!-- WARNING!!! This file is provided for documentation purposes ONLY!              -->
<!-- WARNING!!! You should copy to sentry-site.xml and make modification instead.   -->

<configuration>

    <property>
        <name>sentry.service.client.server.rpc-port</name>
        <value>8038</value>
    </property>

    <property>
        <name>sentry.service.client.server.rpc-addresses</name>
        <value>hadoop21-test1-rgtj5-tj1</value>
    </property>

    <property>
        <name>sentry.service.client.server.rpc-connection-timeout</name>
        <value>200000</value>
    </property>

    <!-- Properties required for setting the DB provider-->
    <property>
        <name>sentry.hive.provider.backend</name>
        <value>org.apache.sentry.provider.db.SimpleDBProviderBackend</value>
    </property>

    <property>
        <name>sentry.service.security.mode</name>
        <value>none</value>
    </property>

</configuration>

3、异常处理类——InternalException：

public class InternalException extends Exception{

    public InternalException(String msg, Throwable cause) {
        super(msg, cause);
    }

    public InternalException(String msg) {
        super(msg);
    }
}

4、配置文件加载类——SentryConfig：

public class SentryConfig {
  // Absolute path to the sentry-site.xml configuration file.
  private final String configFile_;

  // The Sentry configuration. Valid only after calling loadConfig().
  private final Configuration config_;

  public SentryConfig(String configFilePath) {
    configFile_ = configFilePath;
    config_ = new Configuration();
  }

  /**
   * Initializes the Sentry configuration.
   */
  public void loadConfig() {
    if (Strings.isNullOrEmpty(configFile_)) {
      throw new IllegalArgumentException("A valid path to a sentry-site.xml config " +
          "file must be set using --sentry_config to enable authorization.");
    }

    File configFile = new File(configFile_);
    if (!configFile.exists()) {
      String configFilePath = "\"" + configFile_ + "\"";
      throw new RuntimeException("Sentry configuration file does not exist: " +
          configFilePath);
    }

    if (!configFile.canRead()) {
      throw new RuntimeException("Cannot read Sentry configuration file: " +
          configFile_);
    }

    // Load the config.
    try {
      config_.addResource(configFile.toURI().toURL());
    } catch (MalformedURLException e) {
      throw new RuntimeException("Invalid Sentry config file path: " + configFile_, e);
    }
  }

  public Configuration getConfig() { return config_; }
  public String getConfigFile() { return configFile_; }
}

5、测试类——SentryClientTest：

public class SentryClientTest {

    // SentryConfig类需要的sentry配置文件路径视配置文件实际存放路径而定
    private static SentryConfig sentryConfig = new SentryConfig("/test/spring-boot-galaxy/bigdata-galaxy/src/test/scala/com/galaxy/bigdata/sentry/sentry-site-client.xml");

    /**
     * 测试获取已有角色信息
     * @throws InternalException
     */
    @Test
    public void testListRoles() throws InternalException {
        SentryServiceClient client = null;
        try {
            client = new SentryServiceClient();
            // 这里为了测试方便，使用hadoop管理员作为请求用户，来获取所有角色信息
            Set<TSentryRole> roles = client.get().listRoles("hadoop");
            for (TSentryRole role : roles) {
                System.out.println(role);
            }
        } catch (InternalException | SentryUserException e) {
            e.printStackTrace();
        } finally {
            client.close();
        }
    }

    /**
     * 删除已有角色信息
     * @throws InternalException
     */
    @Test
    public void testDropRoleIfExists() throws InternalException {
        SentryServiceClient client = null;
        try {
            client = new SentryServiceClient();
            client.get().dropRoleIfExists("hadoop","admin_role");
        } catch (InternalException | SentryUserException e) {
            e.printStackTrace();
        } finally {
            client.close();
        }
    }


    /**
     * Wrapper around a SentryPolicyServiceClient.
     * TODO: When SENTRY-296 is resolved we can more easily cache connections instead of
     * opening a new connection for each request.
     */
    static class SentryServiceClient implements AutoCloseable {
        private final SentryPolicyServiceClient client_;

        /**
         * Creates and opens a new Sentry Service thrift client.
         */
        public SentryServiceClient() throws InternalException {
            client_ = createClient();
        }

        /**
         * Get the underlying SentryPolicyServiceClient.
         */
        public SentryPolicyServiceClient get() {
            return client_;
        }

        /**
         * Returns this client back to the connection pool. Can be called multiple times.
         */
        public void close() throws InternalException {
            try {
                client_.close();
            } catch (Exception e) {
                throw new InternalException("Error closing client: ", e);
            }
        }

        /**
         * Creates a new client to the SentryService.
         */
        private SentryPolicyServiceClient createClient() throws InternalException {
            SentryPolicyServiceClient client;
            try {
                sentryConfig.loadConfig();
                client = SentryServiceClientFactory.create(sentryConfig.getConfig());
            } catch (Exception e) {
                throw new InternalException("Error creating Sentry Service client: ", e);
            }
            return client;
        }
    }
}

在该类中，定义了静态内部类SentryServiceClient，它的主要职责是创建SentryPolicyServiceClient接口的对象，SentryPolicyServiceClient接口是Sentry与外部系统交互的窗口，它的主要方法定义如下：

可以看到，创建（create）、删除（drop）、查询（list）、授权（grant）和撤销（revoke）这些与权限有关的操作，都定义在该方法中，方法的定义一目了然，顾名就能思义。

6、运行SentryClientTest类，测试服务调用是否正常，相关操作是否成功。

参考资料

1、Impala-2.12.0-cdh5.16.1源码SentryPolicyService.java类中的实现。

2、测试代码地址：https://github.com/Viking-Bird/spring-boot-galaxy/tree/master/bigdata-galaxy/src/test/scala/com/galaxy/bigdata/sentry