You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sentry.apache.org by Shreepadma Venugopalan <sh...@apache.org> on 2013/12/23 22:49:38 UTC
New dev branch
I've created a new dev branch db_policy_store for creating a db backed
store to persist privilege and role information. The relevant JIRA is
SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on this
branch. We'll merge this branch into master eventually.
Concerns/Questions?
Thanks.
Shreepadma
Re: New dev branch
Posted by Brock Noland <br...@cloudera.com>.
Thank you!
On Thu, Mar 13, 2014 at 4:27 PM, Shreepadma Venugopalan <
shreepadma@apache.org> wrote:
> FYI - db_policy_store branch has been merged back into master.
>
>
>
> On Thu, Mar 13, 2014 at 11:09 AM, Brock Noland <br...@cloudera.com> wrote:
>
>> https://issues.apache.org/jira/browse/SENTRY-143
>>
>>
>> On Wed, Mar 12, 2014 at 7:02 PM, Shreepadma Venugopalan <
>> shreepadma@apache.org> wrote:
>>
>>> Sounds good.
>>>
>>>
>>> On Wed, Mar 12, 2014 at 4:42 PM, Brock Noland <br...@cloudera.com>wrote:
>>>
>>>> +1 on merging back to trunk.
>>>>
>>>> I think we can wait on https://issues.apache.org/jira/browse/SENTRY-129until after we merge back to trunk.
>>>>
>>>>
>>>> On Wed, Mar 12, 2014 at 5:20 PM, Shreepadma Venugopalan <
>>>> shreepadma@apache.org> wrote:
>>>>
>>>>> Bulk of the db backed store work has been completed on the branch.
>>>>> Also, we
>>>>> have already branched for 1.3.0 release.
>>>>> Hence, I propose we merge the branch back into master after we commit
>>>>> SENTRY-129 and SENTRY-136.
>>>>>
>>>>> Thanks.
>>>>> Shreepadma
>>>>>
>>>>> On Mon, Dec 23, 2013 at 1:49 PM, Shreepadma Venugopalan <
>>>>> shreepadma@apache.org> wrote:
>>>>>
>>>>> > I've created a new dev branch db_policy_store for creating a db
>>>>> backed
>>>>> > store to persist privilege and role information. The relevant JIRA is
>>>>> > SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen
>>>>> on this
>>>>> > branch. We'll merge this branch into master eventually.
>>>>> >
>>>>> > Concerns/Questions?
>>>>> >
>>>>> > Thanks.
>>>>> > Shreepadma
>>>>> >
>>>>>
>>>>
>>>>
>>>
>>
>
Re: New dev branch
Posted by Shreepadma Venugopalan <sh...@apache.org>.
FYI - db_policy_store branch has been merged back into master.
On Thu, Mar 13, 2014 at 11:09 AM, Brock Noland <br...@cloudera.com> wrote:
> https://issues.apache.org/jira/browse/SENTRY-143
>
>
> On Wed, Mar 12, 2014 at 7:02 PM, Shreepadma Venugopalan <
> shreepadma@apache.org> wrote:
>
>> Sounds good.
>>
>>
>> On Wed, Mar 12, 2014 at 4:42 PM, Brock Noland <br...@cloudera.com> wrote:
>>
>>> +1 on merging back to trunk.
>>>
>>> I think we can wait on https://issues.apache.org/jira/browse/SENTRY-129until after we merge back to trunk.
>>>
>>>
>>> On Wed, Mar 12, 2014 at 5:20 PM, Shreepadma Venugopalan <
>>> shreepadma@apache.org> wrote:
>>>
>>>> Bulk of the db backed store work has been completed on the branch.
>>>> Also, we
>>>> have already branched for 1.3.0 release.
>>>> Hence, I propose we merge the branch back into master after we commit
>>>> SENTRY-129 and SENTRY-136.
>>>>
>>>> Thanks.
>>>> Shreepadma
>>>>
>>>> On Mon, Dec 23, 2013 at 1:49 PM, Shreepadma Venugopalan <
>>>> shreepadma@apache.org> wrote:
>>>>
>>>> > I've created a new dev branch db_policy_store for creating a db backed
>>>> > store to persist privilege and role information. The relevant JIRA is
>>>> > SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on
>>>> this
>>>> > branch. We'll merge this branch into master eventually.
>>>> >
>>>> > Concerns/Questions?
>>>> >
>>>> > Thanks.
>>>> > Shreepadma
>>>> >
>>>>
>>>
>>>
>>
>
Re: New dev branch
Posted by Brock Noland <br...@cloudera.com>.
https://issues.apache.org/jira/browse/SENTRY-143
On Wed, Mar 12, 2014 at 7:02 PM, Shreepadma Venugopalan <
shreepadma@apache.org> wrote:
> Sounds good.
>
>
> On Wed, Mar 12, 2014 at 4:42 PM, Brock Noland <br...@cloudera.com> wrote:
>
>> +1 on merging back to trunk.
>>
>> I think we can wait on https://issues.apache.org/jira/browse/SENTRY-129until after we merge back to trunk.
>>
>>
>> On Wed, Mar 12, 2014 at 5:20 PM, Shreepadma Venugopalan <
>> shreepadma@apache.org> wrote:
>>
>>> Bulk of the db backed store work has been completed on the branch. Also,
>>> we
>>> have already branched for 1.3.0 release.
>>> Hence, I propose we merge the branch back into master after we commit
>>> SENTRY-129 and SENTRY-136.
>>>
>>> Thanks.
>>> Shreepadma
>>>
>>> On Mon, Dec 23, 2013 at 1:49 PM, Shreepadma Venugopalan <
>>> shreepadma@apache.org> wrote:
>>>
>>> > I've created a new dev branch db_policy_store for creating a db backed
>>> > store to persist privilege and role information. The relevant JIRA is
>>> > SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on
>>> this
>>> > branch. We'll merge this branch into master eventually.
>>> >
>>> > Concerns/Questions?
>>> >
>>> > Thanks.
>>> > Shreepadma
>>> >
>>>
>>
>>
>
Re: New dev branch
Posted by Shreepadma Venugopalan <sh...@apache.org>.
Sounds good.
On Wed, Mar 12, 2014 at 4:42 PM, Brock Noland <br...@cloudera.com> wrote:
> +1 on merging back to trunk.
>
> I think we can wait on https://issues.apache.org/jira/browse/SENTRY-129until after we merge back to trunk.
>
>
> On Wed, Mar 12, 2014 at 5:20 PM, Shreepadma Venugopalan <
> shreepadma@apache.org> wrote:
>
>> Bulk of the db backed store work has been completed on the branch. Also,
>> we
>> have already branched for 1.3.0 release.
>> Hence, I propose we merge the branch back into master after we commit
>> SENTRY-129 and SENTRY-136.
>>
>> Thanks.
>> Shreepadma
>>
>> On Mon, Dec 23, 2013 at 1:49 PM, Shreepadma Venugopalan <
>> shreepadma@apache.org> wrote:
>>
>> > I've created a new dev branch db_policy_store for creating a db backed
>> > store to persist privilege and role information. The relevant JIRA is
>> > SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on
>> this
>> > branch. We'll merge this branch into master eventually.
>> >
>> > Concerns/Questions?
>> >
>> > Thanks.
>> > Shreepadma
>> >
>>
>
>
Re: New dev branch
Posted by Brock Noland <br...@cloudera.com>.
+1 on merging back to trunk.
I think we can wait on
https://issues.apache.org/jira/browse/SENTRY-129until after we merge
back to trunk.
On Wed, Mar 12, 2014 at 5:20 PM, Shreepadma Venugopalan <
shreepadma@apache.org> wrote:
> Bulk of the db backed store work has been completed on the branch. Also, we
> have already branched for 1.3.0 release.
> Hence, I propose we merge the branch back into master after we commit
> SENTRY-129 and SENTRY-136.
>
> Thanks.
> Shreepadma
>
> On Mon, Dec 23, 2013 at 1:49 PM, Shreepadma Venugopalan <
> shreepadma@apache.org> wrote:
>
> > I've created a new dev branch db_policy_store for creating a db backed
> > store to persist privilege and role information. The relevant JIRA is
> > SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on
> this
> > branch. We'll merge this branch into master eventually.
> >
> > Concerns/Questions?
> >
> > Thanks.
> > Shreepadma
> >
>
Re: New dev branch
Posted by Shreepadma Venugopalan <sh...@apache.org>.
Bulk of the db backed store work has been completed on the branch. Also, we
have already branched for 1.3.0 release.
Hence, I propose we merge the branch back into master after we commit
SENTRY-129 and SENTRY-136.
Thanks.
Shreepadma
On Mon, Dec 23, 2013 at 1:49 PM, Shreepadma Venugopalan <
shreepadma@apache.org> wrote:
> I've created a new dev branch db_policy_store for creating a db backed
> store to persist privilege and role information. The relevant JIRA is
> SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on this
> branch. We'll merge this branch into master eventually.
>
> Concerns/Questions?
>
> Thanks.
> Shreepadma
>
Re: New dev branch
Posted by Derek Chen-Becker <dc...@gmail.com>.
Sorry to take so long getting back on this. My idea for LDAP storage of
privilege info would be that you could integrate with existing directories
for role and role mapping info. E.g. a user entry could contain a number of
"role" entries (configurable attribute) and a mapping of role name to DN
would allow you to then enumerate permissions on a role entry. So you could
take existing users and groups and all you'd need is to add perm attributes
directly to the group entries. To give a more concrete example, consider
the following (very sparse) entries:
uid=fred,ou=users,dc=foo,dc=com
uid : fred
memberOf : cn=staff,ou=users,dc=foo,dc=com
memberOf : cn=analytics,ou=users,dc=foo,dc=com
uid=barney,ou=users,dc=foo,dc=com
uid : barney
memberOf : cn=staff,ou=users,dc=foo,dc=com
cn=staff,ou=users,dc=foo,dc=com
sentryPerm : server=server1->db=scratch
sentryPerm : server=server1->db=readonly->table=*->select
cn=analytics,ou=users,dc=foo,dc=com
sentryPerm : server=server1->db=analytics
cn=admin,ou=users,dc=foo,dc=com
sentryPerm : server=server1
So, the resolution of perms is done via simple LDAP traversal/search and
you can use LDAP to store all info needed to satisfy authorization needs.
Thanks,
Derek
On Thu, Dec 26, 2013 at 1:48 PM, Shreepadma Venugopalan <
shreepadma@apache.org> wrote:
> Would you also mind sharing the specific use case for storing the privilege
> information in LDAP?
>
>
>
> On Thu, Dec 26, 2013 at 9:20 AM, Brock Noland <br...@cloudera.com> wrote:
>
> > Hi,
> >
> > Would you mind sharing some details on the LDAP and Sentry integration?
> >
> > In regards to storing a policy in LDAP, yes I do think that could make
> > sense. I think we'd probably want to write some design material on that
> > since it might not be a straightforward mapping.
> >
> > Brock
> >
> >
> > On Mon, Dec 23, 2013 at 5:11 PM, Derek Chen-Becker <
> dchenbecker@gmail.com
> > >wrote:
> >
> > > The past few weeks I've been working on LDAP integration with Sentry
> and
> > > Hue. Would it make sense to allow for storing policy in LDAP as well?
> > >
> > >
> > > On Mon, Dec 23, 2013 at 2:49 PM, Shreepadma Venugopalan <
> > > shreepadma@apache.org> wrote:
> > >
> > > > I've created a new dev branch db_policy_store for creating a db
> backed
> > > > store to persist privilege and role information. The relevant JIRA is
> > > > SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on
> > > this
> > > > branch. We'll merge this branch into master eventually.
> > > >
> > > > Concerns/Questions?
> > > >
> > > > Thanks.
> > > > Shreepadma
> > > >
> > >
> >
> >
> >
> > --
> > Apache MRUnit - Unit testing MapReduce - http://mrunit.apache.org
> >
>
Re: New dev branch
Posted by Shreepadma Venugopalan <sh...@apache.org>.
Would you also mind sharing the specific use case for storing the privilege
information in LDAP?
On Thu, Dec 26, 2013 at 9:20 AM, Brock Noland <br...@cloudera.com> wrote:
> Hi,
>
> Would you mind sharing some details on the LDAP and Sentry integration?
>
> In regards to storing a policy in LDAP, yes I do think that could make
> sense. I think we'd probably want to write some design material on that
> since it might not be a straightforward mapping.
>
> Brock
>
>
> On Mon, Dec 23, 2013 at 5:11 PM, Derek Chen-Becker <dchenbecker@gmail.com
> >wrote:
>
> > The past few weeks I've been working on LDAP integration with Sentry and
> > Hue. Would it make sense to allow for storing policy in LDAP as well?
> >
> >
> > On Mon, Dec 23, 2013 at 2:49 PM, Shreepadma Venugopalan <
> > shreepadma@apache.org> wrote:
> >
> > > I've created a new dev branch db_policy_store for creating a db backed
> > > store to persist privilege and role information. The relevant JIRA is
> > > SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on
> > this
> > > branch. We'll merge this branch into master eventually.
> > >
> > > Concerns/Questions?
> > >
> > > Thanks.
> > > Shreepadma
> > >
> >
>
>
>
> --
> Apache MRUnit - Unit testing MapReduce - http://mrunit.apache.org
>
Re: New dev branch
Posted by Brock Noland <br...@cloudera.com>.
Hi,
Would you mind sharing some details on the LDAP and Sentry integration?
In regards to storing a policy in LDAP, yes I do think that could make
sense. I think we'd probably want to write some design material on that
since it might not be a straightforward mapping.
Brock
On Mon, Dec 23, 2013 at 5:11 PM, Derek Chen-Becker <dc...@gmail.com>wrote:
> The past few weeks I've been working on LDAP integration with Sentry and
> Hue. Would it make sense to allow for storing policy in LDAP as well?
>
>
> On Mon, Dec 23, 2013 at 2:49 PM, Shreepadma Venugopalan <
> shreepadma@apache.org> wrote:
>
> > I've created a new dev branch db_policy_store for creating a db backed
> > store to persist privilege and role information. The relevant JIRA is
> > SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on
> this
> > branch. We'll merge this branch into master eventually.
> >
> > Concerns/Questions?
> >
> > Thanks.
> > Shreepadma
> >
>
--
Apache MRUnit - Unit testing MapReduce - http://mrunit.apache.org
Re: New dev branch
Posted by Derek Chen-Becker <dc...@gmail.com>.
The past few weeks I've been working on LDAP integration with Sentry and
Hue. Would it make sense to allow for storing policy in LDAP as well?
On Mon, Dec 23, 2013 at 2:49 PM, Shreepadma Venugopalan <
shreepadma@apache.org> wrote:
> I've created a new dev branch db_policy_store for creating a db backed
> store to persist privilege and role information. The relevant JIRA is
> SENTRY-37. All the commits for SENTRY-37 and sub JIRAs will happen on this
> branch. We'll merge this branch into master eventually.
>
> Concerns/Questions?
>
> Thanks.
> Shreepadma
>