You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by "Stefan Miklosovic (Jira)" <ji...@apache.org> on 2025/09/09 17:30:00 UTC
[jira] [Commented] (CASSANDRA-20000) Add support for Role's OPTIONS
[ https://issues.apache.org/jira/browse/CASSANDRA-20000?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18019207#comment-18019207 ]
Stefan Miklosovic commented on CASSANDRA-20000:
-----------------------------------------------
For the record, CEP-55 does not need this ticket to save options to a table. All we need is to enable options just to use it as something to carry options for name generator.
We can do just this in CassandraRoleManager:
https://gist.githubusercontent.com/smiklosovic/67265fdeeaa549eff625fc07f43871e5/raw/294b907524f54eda12f5ebbd7cc5f281e0134a9c/gistfile1.txt
Basically we enable people to specify OPTIONS only in case we do not use no-op name generator. If we do not use no-op name generator, there is quite a change that its implementation will act on options passed to that.
> Add support for Role's OPTIONS
> ------------------------------
>
> Key: CASSANDRA-20000
> URL: https://issues.apache.org/jira/browse/CASSANDRA-20000
> Project: Apache Cassandra
> Issue Type: Improvement
> Components: CQL/Semantics, Feature/Authorization
> Reporter: Tiago L. Alves
> Assignee: Tiago L. Alves
> Priority: Normal
> Fix For: 5.x
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> The Cassandra Query Language [https://cassandra.apache.org/doc/stable/cassandra/cql/security.html] / [https://cassandra.apache.org/doc/5.0/cassandra/developing/cql/security.html] specify that a role can have custom options defined as literal map.
> The documentation shows a valid example of these custom options:
> {{CREATE ROLE carlos WITH OPTIONS = \{ 'custom_option1' : 'option1_value', 'custom_option2' : 99 }; }}
> However, the storage/retrieval of such custom options has not been implemented in Cassandra. See for instance, [https://github.com/apache/cassandra/blob/18960d6e3443bf002ef4f46c7f0e1f2ee99734e1/src/java/org/apache/cassandra/auth/CassandraRoleManager.java#L393-L396]
> Storing custom options per role could have multiple usages, for instance, it could allow admins to specify fine-grain permissions that can be interpreted by custom authenticator/authorizer.
> The goal of this task is to add support for Role custom options, by storing them in an additional table called {{role_options}} in the {{system_auth}} keyspace.
> Creating a role with options should write the information in both the {{roles}} and the {{role_options}} tables. Creating a role with no options or having an empty map of options should not write any information in the {{role_options}} table.
> Altering a role should behave as follows when executing an {{ALTER ROLE}} statement:
> * without specifying {{{}OPTIONS{}}}: no changes should be done in the {{role_options}} table.
> * specifying {{OPTIONS}} altering a role with no previous custom options: we should insert the custom options in the {{role_options}} table.
> * specifying {{OPTIONS}} altering a role with previous custom options: we should replace the existent custom options
> * in the {{role_options}} table.
> Dropping a role should drop information in both {{roles}} and {{{}role_options{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org