How to use

withGrantOption

method

in

org.apache.sentry.provider.db.generic.service.persistent.PrivilegeObject$Builder

.setAction(mPrivilege.getAction())
.setAuthorizables(mPrivilege.getAuthorizables())
.withGrantOption(mPrivilege.getGrantOption())
.build());

Set<PrivilegeObject> getPrivilegesByProvider(String component,
                       String service, Set<MSentryRole> roles,
                       List<? extends Authorizable> authorizables, PersistenceManager pm) {
 Set<PrivilegeObject> privileges = Sets.newHashSet();
 if (roles == null || roles.isEmpty()) {
  return privileges;
 }
 MSentryGMPrivilege parentPrivilege = new MSentryGMPrivilege(component, service, authorizables, null, null);
 Set<MSentryGMPrivilege> privilegeGraph = Sets.newHashSet();
 privilegeGraph.addAll(populateIncludePrivileges(roles, parentPrivilege, pm));
 for (MSentryGMPrivilege mPrivilege : privilegeGraph) {
  privileges.add(new Builder()
               .setComponent(mPrivilege.getComponentName())
               .setService(mPrivilege.getServiceName())
               .setAction(mPrivilege.getAction())
               .setAuthorizables(mPrivilege.getAuthorizables())
               .withGrantOption(mPrivilege.getGrantOption())
               .build());
 }
 return privileges;
}

public Set<PrivilegeObject> getPrivilegesByProvider(String component,
  String service, Set<MSentryRole> roles,
  List<? extends Authorizable> authorizables, PersistenceManager pm) {
 Set<PrivilegeObject> privileges = Sets.newHashSet();
 if (roles == null || roles.isEmpty()) {
  return privileges;
 }
 MSentryGMPrivilege parentPrivilege = new MSentryGMPrivilege(component, service, authorizables, null, null);
 Set<MSentryGMPrivilege> privilegeGraph = Sets.newHashSet();
 privilegeGraph.addAll(populateIncludePrivileges(roles, parentPrivilege, pm));
 for (MSentryGMPrivilege mPrivilege : privilegeGraph) {
  privileges.add(new Builder()
               .setComponent(mPrivilege.getComponentName())
               .setService(mPrivilege.getServiceName())
               .setAction(mPrivilege.getAction())
               .setAuthorizables(mPrivilege.getAuthorizables())
               .withGrantOption(mPrivilege.getGrantOption())
               .build());
 }
 return privileges;
}

.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(true)
.build();
.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(false).build();

.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(true)
.build();
.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(false).build();

.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(true)
.build();
.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(false)
.build();
  .setService(SERVICE)
  .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
  .withGrantOption(null)
  .build();

.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(true)
.build();

.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(true)
.build();
.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(false)
.build();
  .setService(SERVICE)
  .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
  .withGrantOption(null)
  .build();

.setService(SERVICE)
.setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
.withGrantOption(true)
.build();

.setService(SERVICE)
.setAuthorizables(Collections.singletonList(new Collection(COLLECTION_NAME)))
.withGrantOption(null)
.build();
.setService(SERVICE)
.setAuthorizables(Collections.singletonList(new Collection(COLLECTION_NAME)))
.withGrantOption(true)
.build();
.setService(SERVICE)
.setAuthorizables(Collections.singletonList(new Collection(COLLECTION_NAME)))
.withGrantOption(false)
.build();

.setService(SERVICE)
.setAuthorizables(Collections.singletonList(new Collection(COLLECTION_NAME)))
.withGrantOption(null)
.build();
.setService(SERVICE)
.setAuthorizables(Collections.singletonList(new Collection(COLLECTION_NAME)))
.withGrantOption(true)
.build();
.setService(SERVICE)
.setAuthorizables(Collections.singletonList(new Collection(COLLECTION_NAME)))
.withGrantOption(false)
.build();

.setAction(mPrivilege.getAction())
.setAuthorizables(mPrivilege.getAuthorizables())
.withGrantOption(mPrivilege.getGrantOption())
.build());

@Test
public void testGrantWithGrantOption() throws Exception {
 addGroupsToUser(GRANT_OPTION_USER, GRANT_OPTION_GROUP);
 addGroupsToUser(NO_GRANT_OPTION_USER, NO_GRANT_OPTION_GROUP);
 writePolicyFile();
 String roleName1 = "r1";
 String grantor = "g1";
 sentryStore.createRole(SEARCH, roleName1, grantor);
 /**
  * grant query privilege to role r1 with grant option
  */
 PrivilegeObject queryPrivilege = new Builder()
   .setComponent(SEARCH)
   .setAction(SolrConstants.QUERY)
   .setService(SERVICE)
   .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
   .withGrantOption(true)
   .build();
 sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege,ADMIN_USER);
 sentryStore.alterRoleAddGroups(SEARCH, roleName1,
   Sets.newHashSet(GRANT_OPTION_GROUP), grantor);
 /**
  * the user with grant option grant query privilege to rolr r2
  */
 String roleName2 = "r2";
 sentryStore.createRole(SEARCH, roleName2, grantor);
 sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, queryPrivilege, GRANT_OPTION_USER);
 assertEquals(Sets.newHashSet(queryPrivilege),
   sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2)));
}

@Test
public void testGrantWithGrantOption() throws Exception {
 addGroupsToUser(GRANT_OPTION_USER, GRANT_OPTION_GROUP);
 addGroupsToUser(NO_GRANT_OPTION_USER, NO_GRANT_OPTION_GROUP);
 writePolicyFile();
 String roleName1 = "r1";
 String grantor = "g1";
 sentryStore.createRole(SEARCH, roleName1, grantor);
 /**
  * grant query privilege to role r1 with grant option
  */
 PrivilegeObject queryPrivilege = new Builder()
   .setComponent(SEARCH)
   .setAction(SearchConstants.QUERY)
   .setService(SERVICE)
   .setAuthorizables(Arrays.asList(new Collection(COLLECTION_NAME)))
   .withGrantOption(true)
   .build();
 sentryStore.alterRoleGrantPrivilege(SEARCH, roleName1, queryPrivilege,ADMIN_USER);
 sentryStore.alterRoleAddGroups(SEARCH, roleName1,
   Sets.newHashSet(GRANT_OPTION_GROUP), grantor);
 /**
  * the user with grant option grant query privilege to rolr r2
  */
 String roleName2 = "r2";
 sentryStore.createRole(SEARCH, roleName2, grantor);
 sentryStore.alterRoleGrantPrivilege(SEARCH, roleName2, queryPrivilege, GRANT_OPTION_USER);
 assertEquals(Sets.newHashSet(queryPrivilege),
   sentryStore.getPrivilegesByRole(SEARCH, Sets.newHashSet(roleName2)));
}

private PrivilegeObject toPrivilegeObject(TSentryPrivilege tSentryPrivilege) {
 Boolean grantOption;
 if (tSentryPrivilege.getGrantOption().equals(TSentryGrantOption.TRUE)) {
  grantOption = true;
 } else if (tSentryPrivilege.getGrantOption().equals(TSentryGrantOption.FALSE)) {
  grantOption = false;
 } else {
  grantOption = null;
 }
 return new Builder().setComponent(tSentryPrivilege.getComponent())
                      .setService(tSentryPrivilege.getServiceName())
                      .setAuthorizables(toAuthorizables(tSentryPrivilege.getAuthorizables()))
                      .setAction(tSentryPrivilege.getAction())
                      .withGrantOption(grantOption)
                      .build();
}

private PrivilegeObject toPrivilegeObject(TSentryPrivilege tSentryPrivilege) {
 Boolean grantOption;
 if (tSentryPrivilege.getGrantOption().equals(TSentryGrantOption.TRUE)) {
  grantOption = true;
 } else if (tSentryPrivilege.getGrantOption().equals(TSentryGrantOption.FALSE)) {
  grantOption = false;
 } else {
  grantOption = null;
 }
 return new Builder().setComponent(tSentryPrivilege.getComponent())
                      .setService(tSentryPrivilege.getServiceName())
                      .setAuthorizables(toAuthorizables(tSentryPrivilege.getAuthorizables()))
                      .setAction(tSentryPrivilege.getAction())
                      .withGrantOption(grantOption)
                      .build();
}