@Override
      public Void invoke() throws AmbariException {
        Long resource = null;
        final List<PrivilegeEntity> requiredEntities = new ArrayList<>();
        for (Map<String, Object> properties: request.getProperties()) {
          Set<Long> resourceIds = getResourceEntities(properties).keySet();
          Long      resourceId  = resourceIds.iterator().next();

          if (resource != null && ! resourceId.equals(resource)) {
            throw new AmbariException("Can't update privileges of multiple resources in one request");
          }
          resource = resourceId;

          PrivilegeEntity entity = toEntity(properties, resourceId);
          requiredEntities.add(entity);
        }
        if (resource == null) {
          // request body is empty, use predicate instead
          resource = getResourceEntityId(predicate);
          // if the predicate does not identify a single resource or the resource is not available for update
          if (resource == null) {
            return null;
          }
        }
        final List<PrivilegeEntity> currentPrivileges = privilegeDAO.findByResourceId(resource);

        for (PrivilegeEntity requiredPrivilege: requiredEntities) {
          boolean isInBothLists = false;
          for (PrivilegeEntity currentPrivilege: currentPrivileges) {
            if (requiredPrivilege.getPermission().getPermissionName().equals(currentPrivilege.getPermission().getPermissionName()) &&
                    requiredPrivilege.getPrincipal().getId().equals(currentPrivilege.getPrincipal().getId())) {
              isInBothLists = true;
              break;
            }
          }
          if (!isInBothLists) {
            if (!checkResourceTypes(requiredPrivilege)) {
              throw new AmbariException("Can't grant " + requiredPrivilege.getPermission().getResourceType().getName() +
                  " permission on a " + requiredPrivilege.getResource().getResourceType().getName() + " resource.");
            }

            privilegeDAO.create(requiredPrivilege);
            requiredPrivilege.getPrincipal().getPrivileges().add(requiredPrivilege);
            principalDAO.merge(requiredPrivilege.getPrincipal());
          }
        }
        for (PrivilegeEntity currentPrivilege: currentPrivileges) {
          boolean isInBothLists = false;
          for (PrivilegeEntity requiredPrivilege: requiredEntities) {
            if (requiredPrivilege.getPermission().getPermissionName().equals(currentPrivilege.getPermission().getPermissionName()) &&
                    requiredPrivilege.getPrincipal().getId().equals(currentPrivilege.getPrincipal().getId())) {
              isInBothLists = true;
              break;
            }
          }
          if (!isInBothLists) {
            if (!checkResourceTypes(currentPrivilege)) {
              throw new AmbariException("Can't remove " + currentPrivilege.getPermission().getResourceType().getName() +
                  " permission from a " + currentPrivilege.getResource().getResourceType().getName() + " resource.");
            }
            currentPrivilege.getPrincipal().getPrivileges().remove(currentPrivilege);
            principalDAO.merge(currentPrivilege.getPrincipal());
            privilegeDAO.remove(currentPrivilege);
          }
        }
        return null;
      }
Convert the given map of properties to a privilege entity for the resource
identified by the given id.

@param properties  the property map
@param resourceId  the resource id

@return the new privilege entity
ambari-server/src/main/java/org/apache/ambari/server/controller/internal/PrivilegeResourceProvider.java