基于sql标准权限验证 修改添加自己的权限验证

由于sql 的权限认证可能不能满足自己的需求，修改来满足自己需求

添加自己的FACTORY

package com.bfd.dw.plugin.hive.security;import org.apache.hadoop.hive.conf.HiveConf;import org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider;import org.apache.hadoop.hive.ql.security.authorization.plugin.*;import org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.SQLStdHiveAccessControllerWrapper;/** * Created by wenting on 11/3/16. */public class BFDSQLStdHiveAuthorizerFactory implements HiveAuthorizerFactory {    @Override    public HiveAuthorizer createHiveAuthorizer(HiveMetastoreClientFactory metastoreClientFactory,                                               HiveConf conf, HiveAuthenticationProvider authenticator, HiveAuthzSessionContext ctx) throws HiveAuthzPluginException {        SQLStdHiveAccessControllerWrapper privilegeManager =                new SQLStdHiveAccessControllerWrapper(metastoreClientFactory, conf, authenticator, ctx);        return new HiveAuthorizerImpl(                privilegeManager,                new BFDSQLStdHiveAuthorizationValidator(metastoreClientFactory, conf, authenticator,                        privilegeManager, ctx) //需要创建自己的Validator        );    }}

实现BFDSQLStdHiveAuthorizationValidator

package com.bfd.dw.plugin.hive.security;import java.util.ArrayList;import java.util.Collection;import java.util.List;import org.apache.commons.logging.Log;import org.apache.commons.logging.LogFactory;import org.apache.hadoop.fs.Path;import org.apache.hadoop.hive.conf.HiveConf;import org.apache.hadoop.hive.conf.HiveConf.ConfVars;import org.apache.hadoop.hive.metastore.IMetaStoreClient;import org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizationValidator;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzContext;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzSessionContext;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzSessionContext.CLIENT_TYPE;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveMetastoreClientFactory;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveOperationType;import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal;import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal.HivePrincipalType;import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject;import org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.*;import org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.Operation2Privilege.IOType;/** * Created by wenting on 11/3/16. */public class BFDSQLStdHiveAuthorizationValidator implements HiveAuthorizationValidator {    private final HiveMetastoreClientFactory metastoreClientFactory;    private final HiveConf conf;    private final HiveAuthenticationProvider authenticator;    private final SQLStdHiveAccessControllerWrapper privController;    private final HiveAuthzSessionContext ctx;    public static final Log LOG = LogFactory.getLog(SQLStdHiveAuthorizationValidator.class);    public BFDSQLStdHiveAuthorizationValidator(HiveMetastoreClientFactory metastoreClientFactory,                                            HiveConf conf, HiveAuthenticationProvider authenticator,                                            SQLStdHiveAccessControllerWrapper privilegeManager, HiveAuthzSessionContext ctx)            throws HiveAuthzPluginException {        this.metastoreClientFactory = metastoreClientFactory;        this.conf = conf;        this.authenticator = authenticator;        this.privController = privilegeManager;        this.ctx = SQLAuthorizationUtils.applyTestSettings(ctx, conf);        assertHiveCliAuthDisabled(conf);    }    private void assertHiveCliAuthDisabled(HiveConf conf) throws HiveAuthzPluginException {        if (ctx.getClientType() == CLIENT_TYPE.HIVECLI                && conf.getBoolVar(ConfVars.HIVE_AUTHORIZATION_ENABLED)) {            throw new HiveAuthzPluginException(                    "SQL standards based authorization should not be enabled from hive cli"                            + "Instead the use of storage based authorization in hive metastore is reccomended. Set "                            + ConfVars.HIVE_AUTHORIZATION_ENABLED.varname + "=false to disable authz within cli");        }    }    @Override    public void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> inputHObjs,                                List<HivePrivilegeObject> outputHObjs, HiveAuthzContext context)            throws HiveAuthzPluginException, HiveAccessControlException {        if (LOG.isDebugEnabled()) {            String msg = "Checking privileges for operation " + hiveOpType + " by user "                    + authenticator.getUserName() + " on " + " input objects " + inputHObjs                    + " and output objects " + outputHObjs + ". Context Info: " + context;            LOG.debug(msg);        }        String userName = authenticator.getUserName();        IMetaStoreClient metastoreClient = metastoreClientFactory.getHiveMetastoreClient();        // check privileges on input and output objects        List<String> deniedMessages = new ArrayList<String>();        checkPrivileges(hiveOpType, inputHObjs, metastoreClient, userName, IOType.INPUT, deniedMessages);        checkPrivileges(hiveOpType, outputHObjs, metastoreClient, userName, IOType.OUTPUT, deniedMessages);        SQLAuthorizationUtils.assertNoDeniedPermissions(new HivePrincipal(userName,                HivePrincipalType.USER), hiveOpType, deniedMessages);    }    private void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> hiveObjects,                                 IMetaStoreClient metastoreClient, String userName, IOType ioType, List<String> deniedMessages)            throws HiveAuthzPluginException, HiveAccessControlException {        if (hiveObjects == null) {            return;        }        // Compare required privileges and available privileges for each hive object        for (HivePrivilegeObject hiveObj : hiveObjects) {            RequiredPrivileges requiredPrivs = Operation2Privilege.getRequiredPrivs(hiveOpType, hiveObj,                    ioType);            if(requiredPrivs.getRequiredPrivilegeSet().isEmpty()){                // no privileges required, so don't need to check this object privileges                continue;            }            // find available privileges            RequiredPrivileges availPrivs = new RequiredPrivileges(); //start with an empty priv set;            switch (hiveObj.getType()) {                case LOCAL_URI:// URI的处理逻辑                case DFS_URI:                    availPrivs = SQLAuthorizationUtils.getPrivilegesFromFS(new Path(hiveObj.getObjectName()),                            conf, userName);                    if (privController.isUserAdmin()) {                        availPrivs.addPrivilege(SQLPrivTypeGrant.ADMIN_PRIV);                    }                    break;                case PARTITION:                    // sql std authorization is managing privileges at the table/view levels                    // only                    // ignore partitions                    continue;                case COMMAND_PARAMS:                    continue;                case FUNCTION: //function 的处理逻辑修改                    // operations that have objects of type COMMAND_PARAMS, FUNCTION are authorized                    // solely on the type                    availPrivs.addPrivilege(SQLPrivTypeGrant.ADMIN_PRIV);                    /*if (privController.isUserAdmin()) {                        availPrivs.addPrivilege(SQLPrivTypeGrant.ADMIN_PRIV);                    }*/                    break;                default:                    availPrivs = SQLAuthorizationUtils.getPrivilegesFromMetaStore(metastoreClient, userName,                            hiveObj, privController.getCurrentRoleNames(), privController.isUserAdmin());            }            // Verify that there are no missing privileges            Collection<SQLPrivTypeGrant> missingPriv = requiredPrivs.findMissingPrivs(availPrivs);            SQLAuthorizationUtils.addMissingPrivMsg(missingPriv, hiveObj, deniedMessages);        }    }    public List<HivePrivilegeObject> filterListCmdObjects(List<HivePrivilegeObject> listObjs, HiveAuthzContext context) {        if(LOG.isDebugEnabled()) {            String msg = "Obtained following objects in  filterListCmdObjects " + listObjs + " for user " + this.authenticator.getUserName() + ". Context Info: " + context;            LOG.debug(msg);        }        return listObjs;    }}

修改SQLAuthorizationUtils.java

package com.bfd.dw.plugin.hive.security;import java.util.ArrayList;import java.util.Arrays;import java.util.Collection;import java.util.Collections;import java.util.HashMap;import java.util.HashSet;import java.util.List;import java.util.ListIterator;import java.util.Locale;import java.util.Map;import java.util.Set;import org.apache.commons.logging.Log;import org.apache.commons.logging.LogFactory;import org.apache.hadoop.fs.FileStatus;import org.apache.hadoop.fs.FileSystem;import org.apache.hadoop.fs.Path;import org.apache.hadoop.fs.permission.FsAction;import org.apache.hadoop.hive.common.FileUtils;import org.apache.hadoop.hive.conf.HiveConf;import org.apache.hadoop.hive.conf.HiveConf.ConfVars;import org.apache.hadoop.hive.metastore.IMetaStoreClient;import org.apache.hadoop.hive.metastore.MetaStoreUtils;import org.apache.hadoop.hive.metastore.api.Database;import org.apache.hadoop.hive.metastore.api.HiveObjectPrivilege;import org.apache.hadoop.hive.metastore.api.HiveObjectRef;import org.apache.hadoop.hive.metastore.api.HiveObjectType;import org.apache.hadoop.hive.metastore.api.MetaException;import org.apache.hadoop.hive.metastore.api.PrincipalPrivilegeSet;import org.apache.hadoop.hive.metastore.api.PrincipalType;import org.apache.hadoop.hive.metastore.api.PrivilegeBag;import org.apache.hadoop.hive.metastore.api.PrivilegeGrantInfo;import org.apache.hadoop.hive.metastore.api.Table;import org.apache.hadoop.hive.ql.metadata.HiveException;import org.apache.hadoop.hive.ql.security.authorization.AuthorizationUtils;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzSessionContext;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzSessionContext.CLIENT_TYPE;import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveOperationType;import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrincipal;import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilege;import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject;import org.apache.hadoop.hive.ql.security.authorization.plugin.HivePrivilegeObject.HivePrivilegeObjectType;import org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.RequiredPrivileges;import org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.SQLPrivTypeGrant;import org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.SQLPrivilegeType;import org.apache.thrift.TException;public class SQLAuthorizationUtils {    private static final String[] SUPPORTED_PRIVS = { "INSERT", "UPDATE", "DELETE", "SELECT" };    private static final Set<String> SUPPORTED_PRIVS_SET = new HashSet<String>(            Arrays.asList(SUPPORTED_PRIVS));    public static final Log LOG = LogFactory.getLog(SQLAuthorizationUtils.class);    /**     * Create thrift privileges bag     *     * @param hivePrincipals     * @param hivePrivileges     * @param hivePrivObject     * @param grantorPrincipal     * @param grantOption     * @return     * @throws HiveAuthzPluginException     */    static PrivilegeBag getThriftPrivilegesBag(List<HivePrincipal> hivePrincipals,                                               List<HivePrivilege> hivePrivileges, HivePrivilegeObject hivePrivObject,                                               HivePrincipal grantorPrincipal, boolean grantOption) throws HiveAuthzPluginException {        HiveObjectRef privObj = getThriftHiveObjectRef(hivePrivObject);        PrivilegeBag privBag = new PrivilegeBag();        for (HivePrivilege privilege : hivePrivileges) {            if (privilege.getColumns() != null && privilege.getColumns().size() > 0) {                throw new HiveAuthzPluginException("Privileges on columns not supported currently"                        + " in sql standard authorization mode");            }            if (!SUPPORTED_PRIVS_SET.contains(privilege.getName().toUpperCase(Locale.US))) {                throw new HiveAuthzPluginException("Privilege: " + privilege.getName()                        + " is not supported in sql standard authorization mode");            }            PrivilegeGrantInfo grantInfo = getThriftPrivilegeGrantInfo(privilege, grantorPrincipal,                    grantOption, 0 /*real grant time added by metastore*/);            for (HivePrincipal principal : hivePrincipals) {                HiveObjectPrivilege objPriv = new HiveObjectPrivilege(privObj, principal.getName(),                        AuthorizationUtils.getThriftPrincipalType(principal.getType()), grantInfo);                privBag.addToPrivileges(objPriv);            }        }        return privBag;    }    static PrivilegeGrantInfo getThriftPrivilegeGrantInfo(HivePrivilege privilege,                                                          HivePrincipal grantorPrincipal, boolean grantOption, int grantTime)            throws HiveAuthzPluginException {        try {            return AuthorizationUtils.getThriftPrivilegeGrantInfo(privilege, grantorPrincipal,                    grantOption, grantTime);        } catch (HiveException e) {            throw new HiveAuthzPluginException(e);        }    }    /**     * Create a thrift privilege object from the plugin interface privilege object     *     * @param privObj     * @return     * @throws HiveAuthzPluginException     */    static HiveObjectRef getThriftHiveObjectRef(HivePrivilegeObject privObj)            throws HiveAuthzPluginException {        try {            return AuthorizationUtils.getThriftHiveObjectRef(privObj);        } catch (HiveException e) {            throw new HiveAuthzPluginException(e);        }    }    static HivePrivilegeObjectType getPluginObjType(HiveObjectType objectType)            throws HiveAuthzPluginException {        switch (objectType) {            case DATABASE:                return HivePrivilegeObjectType.DATABASE;            case TABLE:                return HivePrivilegeObjectType.TABLE_OR_VIEW;            case COLUMN:            case GLOBAL:            case PARTITION:                throw new HiveAuthzPluginException("Unsupported object type " + objectType);            default:                throw new AssertionError("Unexpected object type " + objectType);        }    }    /**     * Check if the privileges are acceptable for SQL Standard authorization implementation     * @param hivePrivileges     * @throws HiveAuthzPluginException     */    public static void validatePrivileges(List<HivePrivilege> hivePrivileges) throws HiveAuthzPluginException {        for (HivePrivilege hivePrivilege : hivePrivileges) {            if (hivePrivilege.getColumns() != null && hivePrivilege.getColumns().size() != 0) {                throw new HiveAuthzPluginException(                        "Privilege with columns are not currently supported with sql standard authorization:"                                + hivePrivilege);            }            //try converting to the enum to verify that this is a valid privilege type            SQLPrivilegeType.getRequirePrivilege(hivePrivilege.getName());        }    }    /**     * Get the privileges this user(userName argument) has on the object     * (hivePrivObject argument) If isAdmin is true, adds an admin privilege as     * well.     *     * @param metastoreClient     * @param userName     * @param hivePrivObject     * @param curRoles     *          current active roles for user     * @param isAdmin     *          if user can run as admin user     * @return     * @throws HiveAuthzPluginException     */    static RequiredPrivileges getPrivilegesFromMetaStore(IMetaStoreClient metastoreClient,                                                         String userName, HivePrivilegeObject hivePrivObject, List<String> curRoles, boolean isAdmin)            throws HiveAuthzPluginException {        // get privileges for this user and its role on this object        PrincipalPrivilegeSet thrifPrivs = null;        try {            HiveObjectRef objectRef = AuthorizationUtils.getThriftHiveObjectRef(hivePrivObject);            if (objectRef.getObjectType() == null) {                objectRef.setObjectType(HiveObjectType.GLOBAL);            }            thrifPrivs = metastoreClient.get_privilege_set(                    objectRef, userName, null);        } catch (MetaException e) {            throwGetPrivErr(e, hivePrivObject, userName);        } catch (TException e) {            throwGetPrivErr(e, hivePrivObject, userName);        } catch (HiveException e) {            throwGetPrivErr(e, hivePrivObject, userName);        }        filterPrivsByCurrentRoles(thrifPrivs, curRoles);        // convert to RequiredPrivileges        RequiredPrivileges privs = getRequiredPrivsFromThrift(thrifPrivs);        // add owner privilege if user is owner of the object        if (isOwner(metastoreClient, userName, curRoles, hivePrivObject)) {            privs.addPrivilege(SQLPrivTypeGrant.OWNER_PRIV);        }        if (isAdmin) {            privs.addPrivilege(SQLPrivTypeGrant.ADMIN_PRIV);        }        return privs;    }    /**     * Remove any role privileges that don't belong to the roles in curRoles     * @param thriftPrivs     * @param curRoles     * @return     */    private static void filterPrivsByCurrentRoles(PrincipalPrivilegeSet thriftPrivs,                                                  List<String> curRoles) {        // check if there are privileges to be filtered        if(thriftPrivs == null || thriftPrivs.getRolePrivileges() == null                || thriftPrivs.getRolePrivilegesSize() == 0                ){            // no privileges to filter            return;        }        // add the privs for roles in curRoles to new role-to-priv map        Map<String, List<PrivilegeGrantInfo>> filteredRolePrivs = new HashMap<String, List<PrivilegeGrantInfo>>();        for(String role : curRoles){            List<PrivilegeGrantInfo> privs = thriftPrivs.getRolePrivileges().get(role);            if(privs != null){                filteredRolePrivs.put(role, privs);            }        }        thriftPrivs.setRolePrivileges(filteredRolePrivs);    }    /**     * Check if user is owner of the given object     *     * @param metastoreClient     * @param userName     *          current user     * @param curRoles     *          current roles for userName     * @param hivePrivObject     *          given object     * @return true if user is owner     * @throws HiveAuthzPluginException     */    private static boolean isOwner(IMetaStoreClient metastoreClient, String userName,                                   List<String> curRoles, HivePrivilegeObject hivePrivObject) throws HiveAuthzPluginException {        // for now, check only table & db        switch (hivePrivObject.getType()) {            case TABLE_OR_VIEW: {                Table thriftTableObj = null;                try {                    thriftTableObj = metastoreClient.getTable(hivePrivObject.getDbname(),                            hivePrivObject.getObjectName());                } catch (Exception e) {                    throwGetObjErr(e, hivePrivObject);                }                return userName.equals(thriftTableObj.getOwner());            }            case DATABASE: {                if (MetaStoreUtils.DEFAULT_DATABASE_NAME.equalsIgnoreCase(hivePrivObject.getDbname())) {                    return true;                }                Database db = null;                try {                    db = metastoreClient.getDatabase(hivePrivObject.getDbname());                } catch (Exception e) {                    throwGetObjErr(e, hivePrivObject);                }                // a db owner can be a user or a role                if(db.getOwnerType() == PrincipalType.USER){                    return userName.equals(db.getOwnerName());                } else if(db.getOwnerType() == PrincipalType.ROLE){                    // check if any of the roles of this user is an owner                    return curRoles.contains(db.getOwnerName());                } else {                    // looks like owner is an unsupported type                    LOG.warn("Owner of database " + db.getName() + " is of unsupported type "                            + db.getOwnerType());                    return false;                }            }            case DFS_URI:            case LOCAL_URI:            case PARTITION:            default:                return false;        }    }    private static void throwGetObjErr(Exception e, HivePrivilegeObject hivePrivObject)            throws HiveAuthzPluginException {        String msg = "Error getting object from metastore for " + hivePrivObject;        throw new HiveAuthzPluginException(msg, e);    }    private static void throwGetPrivErr(Exception e, HivePrivilegeObject hivePrivObject,                                        String userName) throws HiveAuthzPluginException {        String msg = "Error getting privileges on " + hivePrivObject + " for " + userName + ": "                + e.getMessage();        throw new HiveAuthzPluginException(msg, e);    }    private static RequiredPrivileges getRequiredPrivsFromThrift(PrincipalPrivilegeSet thrifPrivs)            throws HiveAuthzPluginException {        RequiredPrivileges reqPrivs = new RequiredPrivileges();        // add user privileges        Map<String, List<PrivilegeGrantInfo>> userPrivs = thrifPrivs.getUserPrivileges();        if (userPrivs != null && userPrivs.size() != 1) {            throw new HiveAuthzPluginException("Invalid number of user privilege objects: "                    + userPrivs.size());        }        addRequiredPrivs(reqPrivs, userPrivs);        // add role privileges        Map<String, List<PrivilegeGrantInfo>> rolePrivs = thrifPrivs.getRolePrivileges();        addRequiredPrivs(reqPrivs, rolePrivs);        return reqPrivs;    }    /**     * Add privileges to RequiredPrivileges object reqPrivs from thrift availPrivs     * object     * @param reqPrivs     * @param availPrivs     * @throws HiveAuthzPluginException     */    private static void addRequiredPrivs(RequiredPrivileges reqPrivs,                                         Map<String, List<PrivilegeGrantInfo>> availPrivs) throws HiveAuthzPluginException {        if(availPrivs == null){            return;        }        for (Map.Entry<String, List<PrivilegeGrantInfo>> userPriv : availPrivs.entrySet()) {            List<PrivilegeGrantInfo> userPrivGInfos = userPriv.getValue();            for (PrivilegeGrantInfo userPrivGInfo : userPrivGInfos) {                reqPrivs.addPrivilege(userPrivGInfo.getPrivilege(), userPrivGInfo.isGrantOption());            }        }    }    public static void addMissingPrivMsg(Collection<SQLPrivTypeGrant> missingPrivs,                                         HivePrivilegeObject hivePrivObject, List<String> deniedMessages) {        if (missingPrivs.size() != 0) {            // there are some required privileges missing, create error message            // sort the privileges so that error message is deterministic (for tests)            List<SQLPrivTypeGrant> sortedmissingPrivs = new ArrayList<SQLPrivTypeGrant>(missingPrivs);            Collections.sort(sortedmissingPrivs);            String errMsg = sortedmissingPrivs + " on " + hivePrivObject;            deniedMessages.add(errMsg);        }    }    /**     * Map permissions for this uri to SQL Standard privileges     * @param filePath     * @param conf     * @param userName     * @return     * @throws HiveAuthzPluginException     */    public static RequiredPrivileges getPrivilegesFromFS(Path filePath, HiveConf conf,                                                         String userName) throws HiveAuthzPluginException {        // get the 'available privileges' from file system        RequiredPrivileges availPrivs = new RequiredPrivileges();        // check file system permission        FileSystem fs;        try {            fs = FileSystem.get(filePath.toUri(), conf);//local dfs URL 处理的逻辑 修改            FileStatus fileStatus = FileUtils.getPathOrParentThatExists(fs, filePath);            /*if (FileUtils.isOwnerOfFileHierarchy(fs, fileStatus, userName)) {                availPrivs.addPrivilege(SQLPrivTypeGrant.OWNER_PRIV);            }*/            availPrivs.addPrivilege(SQLPrivTypeGrant.OWNER_PRIV);            availPrivs.addPrivilege(SQLPrivTypeGrant.INSERT_NOGRANT);            availPrivs.addPrivilege(SQLPrivTypeGrant.DELETE_NOGRANT);            availPrivs.addPrivilege(SQLPrivTypeGrant.SELECT_NOGRANT);            /*if (FileUtils.isActionPermittedForFileHierarchy(fs, fileStatus, userName, FsAction.WRITE)) {                availPrivs.addPrivilege(SQLPrivTypeGrant.INSERT_NOGRANT);                availPrivs.addPrivilege(SQLPrivTypeGrant.DELETE_NOGRANT);            }            if (FileUtils.isActionPermittedForFileHierarchy(fs, fileStatus, userName, FsAction.READ)) {                availPrivs.addPrivilege(SQLPrivTypeGrant.SELECT_NOGRANT);            }*/        } catch (Exception e) {            String msg = "Error getting permissions for " + filePath + ": " + e.getMessage();            throw new HiveAuthzPluginException(msg, e);        }        return availPrivs;    }    public static void assertNoDeniedPermissions(HivePrincipal hivePrincipal,                                                 HiveOperationType hiveOpType, List<String> deniedMessages) throws HiveAccessControlException {        if (deniedMessages.size() != 0) {            Collections.sort(deniedMessages);            String errorMessage = "Permission denied: " + hivePrincipal                    + " does not have following privileges for operation " + hiveOpType + " "                    + deniedMessages;            throw new HiveAccessControlException(errorMessage);        }    }    static HiveAuthzPluginException getPluginException(String prefix, Exception e) {        return new HiveAuthzPluginException(prefix + ": " + e.getMessage(), e);    }    /**     * Validate the principal type, and convert role name to lower case     * @param hPrincipal     * @return validated principal     * @throws HiveAuthzPluginException     */    public static HivePrincipal getValidatedPrincipal(HivePrincipal hPrincipal)            throws HiveAuthzPluginException {        if (hPrincipal == null || hPrincipal.getType() == null) {            // null principal            return hPrincipal;        }        switch (hPrincipal.getType()) {            case USER:                return hPrincipal;            case ROLE:                // lower case role names, for case insensitive behavior                return new HivePrincipal(hPrincipal.getName().toLowerCase(), hPrincipal.getType());            default:                throw new HiveAuthzPluginException("Invalid principal type in principal " + hPrincipal);        }    }    /**     * Calls getValidatedPrincipal on each principal in list and updates the list     * @param hivePrincipals     * @return     * @return     * @throws HiveAuthzPluginException     */    public static List<HivePrincipal> getValidatedPrincipals(List<HivePrincipal> hivePrincipals)            throws HiveAuthzPluginException {        ListIterator<HivePrincipal> it = hivePrincipals.listIterator();        while(it.hasNext()){            it.set(getValidatedPrincipal(it.next()));        }        return hivePrincipals;    }    /**     * Change the session context based on configuration to aid in testing of sql     * std auth     *     * @param ctx     * @param conf     * @return     */    static HiveAuthzSessionContext applyTestSettings(HiveAuthzSessionContext ctx, HiveConf conf) {        if (conf.getBoolVar(ConfVars.HIVE_TEST_AUTHORIZATION_SQLSTD_HS2_MODE)                && ctx.getClientType() == CLIENT_TYPE.HIVECLI) {            // create new session ctx object with HS2 as client type            HiveAuthzSessionContext.Builder ctxBuilder = new HiveAuthzSessionContext.Builder(ctx);            ctxBuilder.setClientType(CLIENT_TYPE.HIVESERVER2);            return ctxBuilder.build();        }        return ctx;    }}

红色表示表示为了local_uri 和函数对应的修改，是不是很简单。