[GitHub] [druid] clintropolis commented on pull request #11692: refactor sql authorization to get resource type from schema, resource type to be string

[GitBox <gi...@apache.org>]

clintropolis commented on pull request #11692:
URL: https://github.com/apache/druid/pull/11692#issuecomment-920704924


   >Also, does this framework allow authorization for only SQL based queries, or also native queries too? Also will it work with JDBC?
   
   Yeah, this only impacts how the set of `Resource` for SQL queries are computed (including JDBC), native queries still compute this from the `DataSource`.
   
   It doesn't actually change anything about the Druid authorization model though, so SQL and JSON queries should still require the same set of permissions for the same query, though SQL has some additional things like system tables and views that don't have a native equivalent (yet at least).
   
   Any additional authorization we add in the future will need to be sure to be hooked into both SQL and native queries however, since they compute their `Resource` sets to check differently - `SqlLifecycle.validateAndAuthorize` vs `QueryLifecycle.authorize`  (`SqlLifecycle` actually has one or more `QueryLifecycle` to run the native queries that the SQL planned to, but since they have already been authorized when validating the SQL, they use a pre-authorized path through `QueryLifecycle`)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org