You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by "morningman (via GitHub)" <gi...@apache.org> on 2023/02/13 16:20:59 UTC
[GitHub] [doris] morningman opened a new pull request, #16679: [Refactor](auth) Add AccessController to support customized authorization
morningman opened a new pull request, #16679:
URL: https://github.com/apache/doris/pull/16679
# Proposed changes
Issue Number: close #xxx
## Problem summary
In current implementation, the class `Auth` is used for:
1. Manager all authentication and authorization info such as user, role, password, privileges.
2. Provide an interface for privilege checking
Some user may want to integrate external access management system such as Apache Ranger.
So we should provide a way to let user set their own access controller.
This PR mainly changes:
1. A new class `SystemAccessController`
This access controller is used to check the global level privileges and resource privileges.
2. A new interface `CatalogAccessController`
This interface is used to check catalog/database/tbl level privileges.
It has a default implements `InternalCatalogAccessController`.
All privilege checking methods are moved from `Auth` to either `SystemAccessController` or
`InternalCatalogAccessController`
3. A new class `AccessControllerManager`
This is the entry point of privilege authentication. All methods previously called from `Auth`
now are called from `AccessControllerManager`
Now, user can implement the interface `CatalogAccessController` to use their own access controller.
And when creating external catalog, user can specified the access controller class name, so that
different external catalog can use different access controller.
## Checklist(Required)
* [ ] Does it affect the original behavior
* [ ] Has unit tests been added
* [ ] Has document been added or modified
* [ ] Does it need to update dependencies
* [ ] Is this PR support rollback (If NO, please explain WHY)
## Further comments
If this is a relatively large or complex change, kick off the discussion at [dev@doris.apache.org](mailto:dev@doris.apache.org) by explaining why you chose the solution you did and what alternatives you considered, etc...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [doris] morningman commented on a diff in pull request #16679: [Refactor](auth) Add AccessController to support customized authorization
Posted by "morningman (via GitHub)" <gi...@apache.org>.
morningman commented on code in PR #16679:
URL: https://github.com/apache/doris/pull/16679#discussion_r1105357384
##########
fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/AccessControllerManager.java:
##########
@@ -0,0 +1,161 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.doris.mysql.privilege;
+
+import org.apache.doris.analysis.TableName;
+import org.apache.doris.analysis.UserIdentity;
+import org.apache.doris.catalog.AuthorizationInfo;
+import org.apache.doris.datasource.InternalCatalog;
+import org.apache.doris.mysql.privilege.Auth.PrivLevel;
+import org.apache.doris.qe.ConnectContext;
+
+import com.google.common.base.Preconditions;
+import com.google.common.collect.Maps;
+
+import java.util.Map;
+
+/**
+ * AccessControllerManager is the entry point of privilege authentication.
+ * There are 2 kinds of access controller:
+ * SystemAccessController: for global level priv, resource priv and other Doris internal priv checking
+ * CatalogAccessController: for specified catalog's priv checking, can be customized.
+ * And using InternalCatalogAccessController as default.
+ */
+public class AccessControllerManager {
+ private SystemAccessController sysAccessController;
+ private CatalogAccessController internalAccessController;
+ private Map<String, CatalogAccessController> ctlToCtlAccessController = Maps.newConcurrentMap();
+
+ public AccessControllerManager(Auth auth) {
+ sysAccessController = new SystemAccessController(auth);
+ internalAccessController = new InternalCatalogAccessController(auth);
+ ctlToCtlAccessController.put(InternalCatalog.INTERNAL_CATALOG_NAME, internalAccessController);
+ }
+
+ private CatalogAccessController getAccessControllerOrDefault(String ctl) {
+ return ctlToCtlAccessController.getOrDefault(ctl, internalAccessController);
+ }
+
+ public void addCatalogAccessControl(String ctl, CatalogAccessController controller) {
+ ctlToCtlAccessController.put(ctl, controller);
+ }
+
+ public Auth getAuth() {
+ return sysAccessController.getAuth();
+ }
+
+ // ==== Global ====
+ public boolean checkGlobalPriv(ConnectContext ctx, PrivPredicate wanted) {
+ return checkGlobalPriv(ctx.getCurrentUserIdentity(), wanted);
+ }
+
+ public boolean checkGlobalPriv(UserIdentity currentUser, PrivPredicate wanted) {
+ return sysAccessController.checkGlobalPriv(currentUser, wanted);
+ }
+
+ // ==== Catalog ====
+ public boolean checkCtlPriv(ConnectContext ctx, String ctl, PrivPredicate wanted) {
+ return checkCtlPriv(ctx.getCurrentUserIdentity(), ctl, wanted);
+ }
+
+ public boolean checkCtlPriv(UserIdentity currentUser, String ctl, PrivPredicate wanted) {
+ boolean hasGlobal = sysAccessController.checkGlobalPriv(currentUser, wanted);
+ boolean hasCtl = getAccessControllerOrDefault(ctl).checkCtlPriv(hasGlobal, currentUser, ctl, wanted);
+ return hasGlobal || hasCtl;
Review Comment:
No exactly,
`CatalogAccessController` can be customized, and some implementation need to audit all request.
So we need to make sure that `CatalogAccessController` is called for each request.
And `sysAccessController` is used to check global level privilege(which is not included in `CatalogAccessController`)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [doris] zddr commented on a diff in pull request #16679: [Refactor](auth) Add AccessController to support customized authorization
Posted by "zddr (via GitHub)" <gi...@apache.org>.
zddr commented on code in PR #16679:
URL: https://github.com/apache/doris/pull/16679#discussion_r1105217886
##########
fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/AccessControllerManager.java:
##########
@@ -0,0 +1,161 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.doris.mysql.privilege;
+
+import org.apache.doris.analysis.TableName;
+import org.apache.doris.analysis.UserIdentity;
+import org.apache.doris.catalog.AuthorizationInfo;
+import org.apache.doris.datasource.InternalCatalog;
+import org.apache.doris.mysql.privilege.Auth.PrivLevel;
+import org.apache.doris.qe.ConnectContext;
+
+import com.google.common.base.Preconditions;
+import com.google.common.collect.Maps;
+
+import java.util.Map;
+
+/**
+ * AccessControllerManager is the entry point of privilege authentication.
+ * There are 2 kinds of access controller:
+ * SystemAccessController: for global level priv, resource priv and other Doris internal priv checking
+ * CatalogAccessController: for specified catalog's priv checking, can be customized.
+ * And using InternalCatalogAccessController as default.
+ */
+public class AccessControllerManager {
+ private SystemAccessController sysAccessController;
+ private CatalogAccessController internalAccessController;
+ private Map<String, CatalogAccessController> ctlToCtlAccessController = Maps.newConcurrentMap();
+
+ public AccessControllerManager(Auth auth) {
+ sysAccessController = new SystemAccessController(auth);
+ internalAccessController = new InternalCatalogAccessController(auth);
+ ctlToCtlAccessController.put(InternalCatalog.INTERNAL_CATALOG_NAME, internalAccessController);
+ }
+
+ private CatalogAccessController getAccessControllerOrDefault(String ctl) {
+ return ctlToCtlAccessController.getOrDefault(ctl, internalAccessController);
+ }
+
+ public void addCatalogAccessControl(String ctl, CatalogAccessController controller) {
+ ctlToCtlAccessController.put(ctl, controller);
+ }
+
+ public Auth getAuth() {
+ return sysAccessController.getAuth();
+ }
+
+ // ==== Global ====
+ public boolean checkGlobalPriv(ConnectContext ctx, PrivPredicate wanted) {
+ return checkGlobalPriv(ctx.getCurrentUserIdentity(), wanted);
+ }
+
+ public boolean checkGlobalPriv(UserIdentity currentUser, PrivPredicate wanted) {
+ return sysAccessController.checkGlobalPriv(currentUser, wanted);
+ }
+
+ // ==== Catalog ====
+ public boolean checkCtlPriv(ConnectContext ctx, String ctl, PrivPredicate wanted) {
+ return checkCtlPriv(ctx.getCurrentUserIdentity(), ctl, wanted);
+ }
+
+ public boolean checkCtlPriv(UserIdentity currentUser, String ctl, PrivPredicate wanted) {
+ boolean hasGlobal = sysAccessController.checkGlobalPriv(currentUser, wanted);
+ boolean hasCtl = getAccessControllerOrDefault(ctl).checkCtlPriv(hasGlobal, currentUser, ctl, wanted);
+ return hasGlobal || hasCtl;
Review Comment:
logic is repeated with 'CatalogAccessController.checkCtlPriv(boolean hasGlobal, UserIdentity currentUser, String ctl, PrivPredicate wanted)',here,can we use 'CatalogAccessController.checkCtlPriv(UserIdentity currentUser, String ctl, PrivPredicate wanted)'? and delete 'CatalogAccessController.checkCtlPriv(boolean hasGlobal, UserIdentity currentUser, String ctl, PrivPredicate wanted)'?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [doris] hello-stephen commented on pull request #16679: [Refactor](auth) Add AccessController to support customized authorization
Posted by "hello-stephen (via GitHub)" <gi...@apache.org>.
hello-stephen commented on PR #16679:
URL: https://github.com/apache/doris/pull/16679#issuecomment-1428363681
TeamCity pipeline, clickbench performance test result:
the sum of best hot time: 34.36 seconds
stream load tsv: 501 seconds loaded 74807831229 Bytes, about 142 MB/s
stream load json: 37 seconds loaded 2358488459 Bytes, about 60 MB/s
stream load orc: 69 seconds loaded 1101869774 Bytes, about 15 MB/s
stream load parquet: 28 seconds loaded 861443392 Bytes, about 29 MB/s
https://doris-community-test-1308700295.cos.ap-hongkong.myqcloud.com/tmp/20230213173121_clickbench_pr_95660.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [doris] morningman commented on pull request #16679: [Refactor](auth) Add AccessController to support customized authorization
Posted by "morningman (via GitHub)" <gi...@apache.org>.
morningman commented on PR #16679:
URL: https://github.com/apache/doris/pull/16679#issuecomment-1429815128
> If a catalog uses range authentication, what should we do when the user uses' grant 'to authorize the table under the catalog?
When checking the privilege of this catalog, it will skip InternalAccessController, only use user specified RangeAccessController.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [doris] zddr commented on pull request #16679: [Refactor](auth) Add AccessController to support customized authorization
Posted by "zddr (via GitHub)" <gi...@apache.org>.
zddr commented on PR #16679:
URL: https://github.com/apache/doris/pull/16679#issuecomment-1429237762
If a catalog uses range authentication, what should we do when the user uses' grant 'to authorize the table under the catalog?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [doris] zddr commented on a diff in pull request #16679: [Refactor](auth) Add AccessController to support customized authorization
Posted by "zddr (via GitHub)" <gi...@apache.org>.
zddr commented on code in PR #16679:
URL: https://github.com/apache/doris/pull/16679#discussion_r1105221458
##########
fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/AccessControllerManager.java:
##########
@@ -0,0 +1,161 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.doris.mysql.privilege;
+
+import org.apache.doris.analysis.TableName;
+import org.apache.doris.analysis.UserIdentity;
+import org.apache.doris.catalog.AuthorizationInfo;
+import org.apache.doris.datasource.InternalCatalog;
+import org.apache.doris.mysql.privilege.Auth.PrivLevel;
+import org.apache.doris.qe.ConnectContext;
+
+import com.google.common.base.Preconditions;
+import com.google.common.collect.Maps;
+
+import java.util.Map;
+
+/**
+ * AccessControllerManager is the entry point of privilege authentication.
+ * There are 2 kinds of access controller:
+ * SystemAccessController: for global level priv, resource priv and other Doris internal priv checking
+ * CatalogAccessController: for specified catalog's priv checking, can be customized.
+ * And using InternalCatalogAccessController as default.
+ */
+public class AccessControllerManager {
+ private SystemAccessController sysAccessController;
+ private CatalogAccessController internalAccessController;
+ private Map<String, CatalogAccessController> ctlToCtlAccessController = Maps.newConcurrentMap();
+
+ public AccessControllerManager(Auth auth) {
+ sysAccessController = new SystemAccessController(auth);
+ internalAccessController = new InternalCatalogAccessController(auth);
+ ctlToCtlAccessController.put(InternalCatalog.INTERNAL_CATALOG_NAME, internalAccessController);
+ }
+
+ private CatalogAccessController getAccessControllerOrDefault(String ctl) {
+ return ctlToCtlAccessController.getOrDefault(ctl, internalAccessController);
+ }
+
+ public void addCatalogAccessControl(String ctl, CatalogAccessController controller) {
+ ctlToCtlAccessController.put(ctl, controller);
+ }
+
+ public Auth getAuth() {
+ return sysAccessController.getAuth();
+ }
+
+ // ==== Global ====
+ public boolean checkGlobalPriv(ConnectContext ctx, PrivPredicate wanted) {
+ return checkGlobalPriv(ctx.getCurrentUserIdentity(), wanted);
+ }
+
+ public boolean checkGlobalPriv(UserIdentity currentUser, PrivPredicate wanted) {
+ return sysAccessController.checkGlobalPriv(currentUser, wanted);
+ }
+
+ // ==== Catalog ====
+ public boolean checkCtlPriv(ConnectContext ctx, String ctl, PrivPredicate wanted) {
+ return checkCtlPriv(ctx.getCurrentUserIdentity(), ctl, wanted);
+ }
+
+ public boolean checkCtlPriv(UserIdentity currentUser, String ctl, PrivPredicate wanted) {
+ boolean hasGlobal = sysAccessController.checkGlobalPriv(currentUser, wanted);
+ boolean hasCtl = getAccessControllerOrDefault(ctl).checkCtlPriv(hasGlobal, currentUser, ctl, wanted);
+ return hasGlobal || hasCtl;
+ }
+
+ // ==== Database ====
+ public boolean checkDbPriv(ConnectContext ctx, String qualifiedDb, PrivPredicate wanted) {
+ return checkDbPriv(ctx.getCurrentUserIdentity(), qualifiedDb, wanted);
+ }
+
+ public boolean checkDbPriv(UserIdentity currentUser, String db, PrivPredicate wanted) {
+ return checkDbPriv(currentUser, Auth.DEFAULT_CATALOG, db, wanted);
+ }
+
+ public boolean checkDbPriv(ConnectContext ctx, String ctl, String db, PrivPredicate wanted) {
+ return checkDbPriv(ctx.getCurrentUserIdentity(), ctl, db, wanted);
+ }
+
+ public boolean checkDbPriv(UserIdentity currentUser, String ctl, String db, PrivPredicate wanted) {
+ boolean hasGlobal = sysAccessController.checkGlobalPriv(currentUser, wanted);
+ boolean hasDb = getAccessControllerOrDefault(ctl).checkDbPriv(hasGlobal, currentUser, ctl, db, wanted);
Review Comment:
same as 'checkCtlPriv'
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [doris] zddr commented on a diff in pull request #16679: [Refactor](auth) Add AccessController to support customized authorization
Posted by "zddr (via GitHub)" <gi...@apache.org>.
zddr commented on code in PR #16679:
URL: https://github.com/apache/doris/pull/16679#discussion_r1105224143
##########
fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/AccessControllerManager.java:
##########
@@ -0,0 +1,161 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.doris.mysql.privilege;
+
+import org.apache.doris.analysis.TableName;
+import org.apache.doris.analysis.UserIdentity;
+import org.apache.doris.catalog.AuthorizationInfo;
+import org.apache.doris.datasource.InternalCatalog;
+import org.apache.doris.mysql.privilege.Auth.PrivLevel;
+import org.apache.doris.qe.ConnectContext;
+
+import com.google.common.base.Preconditions;
+import com.google.common.collect.Maps;
+
+import java.util.Map;
+
+/**
+ * AccessControllerManager is the entry point of privilege authentication.
+ * There are 2 kinds of access controller:
+ * SystemAccessController: for global level priv, resource priv and other Doris internal priv checking
+ * CatalogAccessController: for specified catalog's priv checking, can be customized.
+ * And using InternalCatalogAccessController as default.
+ */
+public class AccessControllerManager {
+ private SystemAccessController sysAccessController;
+ private CatalogAccessController internalAccessController;
+ private Map<String, CatalogAccessController> ctlToCtlAccessController = Maps.newConcurrentMap();
+
+ public AccessControllerManager(Auth auth) {
+ sysAccessController = new SystemAccessController(auth);
+ internalAccessController = new InternalCatalogAccessController(auth);
+ ctlToCtlAccessController.put(InternalCatalog.INTERNAL_CATALOG_NAME, internalAccessController);
+ }
+
+ private CatalogAccessController getAccessControllerOrDefault(String ctl) {
+ return ctlToCtlAccessController.getOrDefault(ctl, internalAccessController);
+ }
+
+ public void addCatalogAccessControl(String ctl, CatalogAccessController controller) {
+ ctlToCtlAccessController.put(ctl, controller);
+ }
+
+ public Auth getAuth() {
+ return sysAccessController.getAuth();
+ }
+
+ // ==== Global ====
+ public boolean checkGlobalPriv(ConnectContext ctx, PrivPredicate wanted) {
+ return checkGlobalPriv(ctx.getCurrentUserIdentity(), wanted);
+ }
+
+ public boolean checkGlobalPriv(UserIdentity currentUser, PrivPredicate wanted) {
+ return sysAccessController.checkGlobalPriv(currentUser, wanted);
+ }
+
+ // ==== Catalog ====
+ public boolean checkCtlPriv(ConnectContext ctx, String ctl, PrivPredicate wanted) {
+ return checkCtlPriv(ctx.getCurrentUserIdentity(), ctl, wanted);
+ }
+
+ public boolean checkCtlPriv(UserIdentity currentUser, String ctl, PrivPredicate wanted) {
+ boolean hasGlobal = sysAccessController.checkGlobalPriv(currentUser, wanted);
+ boolean hasCtl = getAccessControllerOrDefault(ctl).checkCtlPriv(hasGlobal, currentUser, ctl, wanted);
+ return hasGlobal || hasCtl;
+ }
+
+ // ==== Database ====
+ public boolean checkDbPriv(ConnectContext ctx, String qualifiedDb, PrivPredicate wanted) {
+ return checkDbPriv(ctx.getCurrentUserIdentity(), qualifiedDb, wanted);
+ }
+
+ public boolean checkDbPriv(UserIdentity currentUser, String db, PrivPredicate wanted) {
+ return checkDbPriv(currentUser, Auth.DEFAULT_CATALOG, db, wanted);
+ }
+
+ public boolean checkDbPriv(ConnectContext ctx, String ctl, String db, PrivPredicate wanted) {
+ return checkDbPriv(ctx.getCurrentUserIdentity(), ctl, db, wanted);
+ }
+
+ public boolean checkDbPriv(UserIdentity currentUser, String ctl, String db, PrivPredicate wanted) {
+ boolean hasGlobal = sysAccessController.checkGlobalPriv(currentUser, wanted);
+ boolean hasDb = getAccessControllerOrDefault(ctl).checkDbPriv(hasGlobal, currentUser, ctl, db, wanted);
+ return hasGlobal || hasDb;
+ }
+
+ // ==== Table ====
+ public boolean checkTblPriv(ConnectContext ctx, String qualifiedCtl,
+ String qualifiedDb, String tbl, PrivPredicate wanted) {
+ return checkTblPriv(ctx.getCurrentUserIdentity(), qualifiedCtl, qualifiedDb, tbl, wanted);
+ }
+
+ public boolean checkTblPriv(ConnectContext ctx, String qualifiedDb, String tbl, PrivPredicate wanted) {
+ return checkTblPriv(ctx, Auth.DEFAULT_CATALOG, qualifiedDb, tbl, wanted);
+ }
+
+ public boolean checkTblPriv(ConnectContext ctx, TableName tableName, PrivPredicate wanted) {
+ Preconditions.checkState(tableName.isFullyQualified());
+ return checkTblPriv(ctx, tableName.getCtl(), tableName.getDb(), tableName.getTbl(), wanted);
+ }
+
+ public boolean checkTblPriv(UserIdentity currentUser, String db, String tbl, PrivPredicate wanted) {
+ return checkTblPriv(currentUser, Auth.DEFAULT_CATALOG, db, tbl, wanted);
+ }
+
+ public boolean checkTblPriv(UserIdentity currentUser, String ctl, String db, String tbl, PrivPredicate wanted) {
+ boolean hasGlobal = sysAccessController.checkGlobalPriv(currentUser, wanted);
+ boolean hasTbl = getAccessControllerOrDefault(ctl).checkTblPriv(hasGlobal, currentUser, ctl, db, tbl, wanted);
Review Comment:
same as 'checkCtlPriv'
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
[GitHub] [doris] yiguolei merged pull request #16679: [Refactor](auth) Add AccessController to support customized authorization
Posted by "yiguolei (via GitHub)" <gi...@apache.org>.
yiguolei merged PR #16679:
URL: https://github.com/apache/doris/pull/16679
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org