You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by GitBox <gi...@apache.org> on 2021/09/17 10:27:55 UTC
[GitHub] [druid] kfaraz opened a new pull request #11718: [WIP] Require Datasource WRITE authorization for Supervisor and Task access
kfaraz opened a new pull request #11718:
URL: https://github.com/apache/druid/pull/11718
Follow up PR for #11680
### Description
Supervisor and Task APIs are related to ingestion and must always require Datasource WRITE
authorization even if they are purely informative.
### Changes
- Check Datasource WRITE in `SystemSchema` for tables "supervisors" and "tasks"
- Check Datasource WRITE for APIs `/supervisor/history` and `/supervisor/{id}/history`
- Check Datasource for all Indexing Task APIs
<hr>
<!-- Check the items by putting "x" in the brackets for the done things. Not all of these items apply to every PR. Remove the items which are not done or not relevant to the PR. None of the items from the checklist below are strictly necessary, but it would be very helpful if you at least self-review the PR. -->
This PR has:
- [ ] been self-reviewed.
- [ ] using the [concurrency checklist](https://github.com/apache/druid/blob/master/dev/code-review/concurrency.md) (Remove this item if the PR doesn't have any relation to concurrency.)
- [ ] added documentation for new or modified features or behaviors.
- [ ] added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
- [ ] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md)
- [ ] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
- [ ] added unit tests or modified existing tests to cover new code paths, ensuring the threshold for [code coverage](https://github.com/apache/druid/blob/master/dev/code-review/code-coverage.md) is met.
- [ ] added integration tests.
- [ ] been tested in a test Druid cluster.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r722894777
##########
File path: indexing-service/src/test/java/org/apache/druid/indexing/overlord/http/OverlordResourceTest.java
##########
@@ -116,10 +117,22 @@ public Authorizer getAuthorizer(String name)
@Override
public Access authorize(AuthenticationResult authenticationResult, Resource resource, Action action)
{
- if (resource.getName().equals("allow")) {
- return new Access(true);
- } else {
- return new Access(false);
+ final String username = authenticationResult.getIdentity();
+ switch (resource.getName()) {
+ case "allow":
+ return new Access(true);
+ case Datasources.WIKIPEDIA:
+ // All users can read wikipedia but only writer can write
+ return new Access(
+ action == Action.READ || Users.WIKI_WRITER.equals(username)
Review comment:
Should we include this for readability? Because the logic would remain the same.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] clintropolis commented on pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
clintropolis commented on pull request #11718:
URL: https://github.com/apache/druid/pull/11718#issuecomment-935223110
I think we also need to update the system table docs here https://github.com/apache/druid/blob/master/docs/operations/security-user-auth.md#sql-permissions to indicate that some of these system tables now require write permissions. I haven't found any other places yet in docs where a `READ` should be changed to a `WRITE`, yet at least...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r722895453
##########
File path: indexing-service/src/test/java/org/apache/druid/indexing/common/task/IndexTaskTest.java
##########
@@ -2604,6 +2613,81 @@ private static IndexIngestionSpec createIngestionSpec(
}
}
+ @Test
+ public void testAuthorizeRequest() throws Exception
+ {
+ // Need to run this only once
+ if (lockGranularity == LockGranularity.SEGMENT) {
Review comment:
This is a parameterized unit test. So every test method is run once for SEGMENT granularity and once for TIME_CHUNK. Since this test method does not depend on granularity, figured we should run it only once.
We could explain this part better in the comment or just remove the check.
Please let me know what you think would be better.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r722897951
##########
File path: indexing-service/src/main/java/org/apache/druid/indexing/common/task/AbstractTask.java
##########
@@ -164,6 +167,16 @@ public TaskStatus success()
return TaskStatus.success(getId());
}
+ /**
+ * Authorizes WRITE action on a task's datasource
+ *
+ * @throws ForbiddenException if not authorized
+ */
+ public void authorizeRequest(HttpServletRequest request, AuthorizerMapper authorizerMapper)
Review comment:
Fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r722895453
##########
File path: indexing-service/src/test/java/org/apache/druid/indexing/common/task/IndexTaskTest.java
##########
@@ -2604,6 +2613,81 @@ private static IndexIngestionSpec createIngestionSpec(
}
}
+ @Test
+ public void testAuthorizeRequest() throws Exception
+ {
+ // Need to run this only once
+ if (lockGranularity == LockGranularity.SEGMENT) {
Review comment:
This is a parameterized unit test. So every test method is run once for SEGMENT granularity and once for TIME_CHUNK. Since this test does not depend on granularity, figured we should run it only once.
We could explain this part better in the comment or just remove the check.
Please let me know what you think would be better.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] abhishekagarwal87 merged pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
abhishekagarwal87 merged pull request #11718:
URL: https://github.com/apache/druid/pull/11718
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] suneet-s commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
suneet-s commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r721644565
##########
File path: indexing-service/src/main/java/org/apache/druid/indexing/common/task/IndexTaskUtils.java
##########
@@ -56,28 +56,25 @@
}
/**
- * Authorizes action to be performed on a task's datasource
+ * Authorizes WRITE action on a task's datasource
*
- * @return authorization result
+ * @throws ForbiddenException if not authorized
*/
- public static Access datasourceAuthorizationCheck(
+ public static void datasourceAuthorizationCheck(
Review comment:
nit: similar comment to `AbstractTask.authorizeRequest`
Renaming this to something that indicates that we're checking for DATASOURCE WRITE would make the intent of this function clearer to its' callers.
##########
File path: indexing-service/src/test/java/org/apache/druid/indexing/common/task/IndexTaskTest.java
##########
@@ -2604,6 +2613,81 @@ private static IndexIngestionSpec createIngestionSpec(
}
}
+ @Test
+ public void testAuthorizeRequest() throws Exception
+ {
+ // Need to run this only once
+ if (lockGranularity == LockGranularity.SEGMENT) {
Review comment:
I don't understand this part of the test.
##########
File path: indexing-service/src/test/java/org/apache/druid/indexing/overlord/http/OverlordResourceTest.java
##########
@@ -116,10 +117,22 @@ public Authorizer getAuthorizer(String name)
@Override
public Access authorize(AuthenticationResult authenticationResult, Resource resource, Action action)
{
- if (resource.getName().equals("allow")) {
- return new Access(true);
- } else {
- return new Access(false);
+ final String username = authenticationResult.getIdentity();
+ switch (resource.getName()) {
+ case "allow":
+ return new Access(true);
+ case Datasources.WIKIPEDIA:
+ // All users can read wikipedia but only writer can write
+ return new Access(
+ action == Action.READ || Users.WIKI_WRITER.equals(username)
Review comment:
```suggestion
action == Action.READ || (action == Action.WRITE && Users.WIKI_WRITER.equals(username))
```
I think a similar change is needed on line 132
##########
File path: indexing-service/src/main/java/org/apache/druid/indexing/common/task/AbstractTask.java
##########
@@ -164,6 +167,16 @@ public TaskStatus success()
return TaskStatus.success(getId());
}
+ /**
+ * Authorizes WRITE action on a task's datasource
+ *
+ * @throws ForbiddenException if not authorized
+ */
+ public void authorizeRequest(HttpServletRequest request, AuthorizerMapper authorizerMapper)
Review comment:
nit: If the ForbiddenException is part of the javadoc, we should make it part of the method signature
Also I think the name can be more informative, since the underlying methods are explicitly checking DATASOURCE WRITE permissions - I'm open to a better name for the method.
```suggestion
public void authorizeRequestForDatasourceWrite(HttpServletRequest request, AuthorizerMapper authorizerMapper) throws ForbiddenException
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz edited a comment on pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz edited a comment on pull request #11718:
URL: https://github.com/apache/druid/pull/11718#issuecomment-936119261
@clintropolis , I have made some modifications to `AbstractAuthConfigurationTest`and the corresponding `bootstrap.ldif` as some auth integration tests were failing and I had missed updating them. Please review these changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] clintropolis commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
clintropolis commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r712902915
##########
File path: indexing-service/src/main/java/org/apache/druid/indexing/common/task/AppenderatorDriverRealtimeIndexTask.java
##########
@@ -531,7 +531,7 @@ public Response getRowStats(
@Context final HttpServletRequest req
)
{
- IndexTaskUtils.datasourceAuthorizationCheck(req, Action.READ, getDataSource(), authorizerMapper);
+ IndexTaskUtils.datasourceAuthorizationCheck(req, Action.WRITE, getDataSource(), authorizerMapper);
Review comment:
`IndexTaskUtils.datasourceAuthorizationCheck` should be modified to no longer accept an `Action` since I think after this PR every caller will be using `Action.WRITE`, and it can just be hard coded in the method.
I've also noticed that no callers seem to ever be using the return value, so it could probably be changed to `void` since we seem to mostly be using it to explode if not authorized and otherwise ignore the return value.
##########
File path: indexing-service/src/main/java/org/apache/druid/indexing/seekablestream/SeekableStreamIndexTaskRunner.java
##########
@@ -1354,9 +1354,9 @@ protected void sendResetRequestAndWait(
*
* @return authorization result
*/
- private Access authorizationCheck(final HttpServletRequest req, Action action)
+ private Access datasourceWriteAuthCheck(final HttpServletRequest req)
Review comment:
nearly this same method is also in `ParallelIndexSupervisorTask`, maybe consider moving it to `AbstractTask` and calling it `authorizeRequest`, then here can just `return task.authorizeRequest(req);` (or dropping this wrapper method and calling the new `task.authorizeRequest(req);` method directly in the http api methods of `SeekableStreamIndexTaskRunner`)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] techdocsmith commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
techdocsmith commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r723802515
##########
File path: docs/operations/security-user-auth.md
##########
@@ -139,7 +139,8 @@ Queries on the [system schema tables](../querying/sql.md#system-schema) require
- `segments`: Segments will be filtered based on DATASOURCE READ permissions.
- `servers`: The user requires STATE READ permissions.
- `server_segments`: The user requires STATE READ permissions and segments will be filtered based on DATASOURCE READ permissions.
-- `tasks`: Tasks will be filtered based on DATASOURCE READ permissions.
+- `supervisors`: Supervisors will be filtered based on DATASOURCE WRITE permissions.
+- `tasks`: Tasks will be filtered based on DATASOURCE WRITE permissions.
Review comment:
```suggestion
- `tasks`: Druid filters tasks according to DATASOURCE WRITE permissions.
- `supervisors`: Druid filters supervisors according to DATASOURCE WRITE permissions.
```
Suggested changes to match some other security update language.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] suneet-s commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
suneet-s commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r723368533
##########
File path: indexing-service/src/test/java/org/apache/druid/indexing/overlord/http/OverlordResourceTest.java
##########
@@ -116,10 +117,22 @@ public Authorizer getAuthorizer(String name)
@Override
public Access authorize(AuthenticationResult authenticationResult, Resource resource, Action action)
{
- if (resource.getName().equals("allow")) {
- return new Access(true);
- } else {
- return new Access(false);
+ final String username = authenticationResult.getIdentity();
+ switch (resource.getName()) {
+ case "allow":
+ return new Access(true);
+ case Datasources.WIKIPEDIA:
+ // All users can read wikipedia but only writer can write
+ return new Access(
+ action == Action.READ || Users.WIKI_WRITER.equals(username)
Review comment:
Primarily, yes.
Since there are only 2 actions, I suppose this is equivalent. If a new action was added later, this logic may not match what is described in the comment above.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on pull request #11718:
URL: https://github.com/apache/druid/pull/11718#issuecomment-936119261
@clintropolis , I have made some modifications to `AbstractAuthConfigurationTest`as some auth integration tests were failing and I had missed updating them. Please review these changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r722898037
##########
File path: indexing-service/src/main/java/org/apache/druid/indexing/common/task/IndexTaskUtils.java
##########
@@ -56,28 +56,25 @@
}
/**
- * Authorizes action to be performed on a task's datasource
+ * Authorizes WRITE action on a task's datasource
*
- * @return authorization result
+ * @throws ForbiddenException if not authorized
*/
- public static Access datasourceAuthorizationCheck(
+ public static void datasourceAuthorizationCheck(
Review comment:
Fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r722895453
##########
File path: indexing-service/src/test/java/org/apache/druid/indexing/common/task/IndexTaskTest.java
##########
@@ -2604,6 +2613,81 @@ private static IndexIngestionSpec createIngestionSpec(
}
}
+ @Test
+ public void testAuthorizeRequest() throws Exception
+ {
+ // Need to run this only once
+ if (lockGranularity == LockGranularity.SEGMENT) {
Review comment:
This is a parameterized unit test class. So every test method is run once for SEGMENT granularity and once for TIME_CHUNK. Since this test method does not depend on granularity, figured we should run it only once.
We could explain this part better in the comment or just remove the check.
Please let me know what you think would be better.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on pull request #11718:
URL: https://github.com/apache/druid/pull/11718#issuecomment-924785460
Thanks for the review, @suneet-s . I will add some UTs/ITs as applicable today.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] kfaraz commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
kfaraz commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r713276967
##########
File path: indexing-service/src/main/java/org/apache/druid/indexing/seekablestream/SeekableStreamIndexTaskRunner.java
##########
@@ -1354,9 +1354,9 @@ protected void sendResetRequestAndWait(
*
* @return authorization result
*/
- private Access authorizationCheck(final HttpServletRequest req, Action action)
+ private Access datasourceWriteAuthCheck(final HttpServletRequest req)
Review comment:
Done. Thanks for the suggestion. 👍
##########
File path: indexing-service/src/main/java/org/apache/druid/indexing/common/task/AppenderatorDriverRealtimeIndexTask.java
##########
@@ -531,7 +531,7 @@ public Response getRowStats(
@Context final HttpServletRequest req
)
{
- IndexTaskUtils.datasourceAuthorizationCheck(req, Action.READ, getDataSource(), authorizerMapper);
+ IndexTaskUtils.datasourceAuthorizationCheck(req, Action.WRITE, getDataSource(), authorizerMapper);
Review comment:
Fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
[GitHub] [druid] techdocsmith commented on a change in pull request #11718: Require Datasource WRITE authorization for Supervisor and Task access
Posted by GitBox <gi...@apache.org>.
techdocsmith commented on a change in pull request #11718:
URL: https://github.com/apache/druid/pull/11718#discussion_r723802515
##########
File path: docs/operations/security-user-auth.md
##########
@@ -139,7 +139,8 @@ Queries on the [system schema tables](../querying/sql.md#system-schema) require
- `segments`: Segments will be filtered based on DATASOURCE READ permissions.
- `servers`: The user requires STATE READ permissions.
- `server_segments`: The user requires STATE READ permissions and segments will be filtered based on DATASOURCE READ permissions.
-- `tasks`: Tasks will be filtered based on DATASOURCE READ permissions.
+- `supervisors`: Supervisors will be filtered based on DATASOURCE WRITE permissions.
+- `tasks`: Tasks will be filtered based on DATASOURCE WRITE permissions.
Review comment:
```suggestion
- `tasks`: Druid filters tasks according to DATASOURCE WRITE permissions.
- `supervisors`: Druid filters supervisors according to DATASOURCE WRITE permissions.
```
Suggested changes to match some other security update language.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org