Authorization Design

Definitions

Sentry: Provides a service for managing privileges and propagating those privileges to third-party systems like Hive and HDFS.
Group: Can be associated with multiple users.
Role: Can be associated with multiple groups. e.g. admin, guest.
Privilege: Entity and action pair, can be associated with a role.

HTTP Handler Integration

*Handler: Converts HTTP requests into method calls on *Managers. Converts the method call result into an HTTP response.
*Manager: Performs operations on entities like namespaces and applications.