You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "maytasm (via GitHub)" <gi...@apache.org> on 2026/04/01 07:58:55 UTC
[PR] Add additional context about the authorization request that can be passed to Authorizer (druid)
maytasm opened a new pull request, #19247:
URL: https://github.com/apache/druid/pull/19247
Add additional context about the authorization request that can be passed to Authorizer
### Description
Currently, the `Authorizer#authorize` interface only accepts `AuthenticationResult`, `Resource`, and `Action`, which provides no context about where an authorization request originated. As a result, authorization requests for the same resource from different code paths look identical. For example, an authorization request for a resource initiated by a user query is indistinguishable from one initiated by a `SystemSchema` request triggered by the UI.
This becomes a problem when analyzing authorization denials. If a user wants to investigate denials for their datasource, those denials are aggregated with denials from `SystemSchema`/`InformationSchema`, making it difficult to distinguish genuine unauthorized access attempts from routine internal checks. When a user refreshes the UI, it iterates over all datasources and issues an internal authorization check for each one; this happens in many places, such as the Supervisors tab, Query tab, and others. As a result, metrics emitted by the `Authorizer` (such as authorization outcomes) become noisy, since denials from internal UI-driven checks are mixed together with denials from actual user queries.
This change adds an optional `Map<String, Object>` `context` parameter to `Authorizer#authorize`. Callers such as `InformationSchema` and `SystemSchema` populate this context map with a `callerPath` key to indicate the source of the authorization request. This context can then be included in the metrics emitted by `Authorizer#authorize`, allowing users to filter out internal authorization checks from user-initiated ones.
##### Key changed/added classes in this PR
* `server/src/main/java/org/apache/druid/server/security/Authorizer.java`
* `server/src/main/java/org/apache/druid/server/security/AuthorizationUtils.java`
* `sql/src/main/java/org/apache/druid/sql/calcite/schema/InformationSchema.java`
* `sql/src/main/java/org/apache/druid/sql/calcite/schema/SystemSchema.java`
This PR has:
- [x] been self-reviewed.
- [ ] using the [concurrency checklist](https://github.com/apache/druid/blob/master/dev/code-review/concurrency.md) (Remove this item if the PR doesn't have any relation to concurrency.)
- [x] added documentation for new or modified features or behaviors.
- [ ] a release note entry in the PR description.
- [x] added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
- [ ] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md)
- [x] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
- [x] added unit tests or modified existing tests to cover new code paths, ensuring the threshold for [code coverage](https://github.com/apache/druid/blob/master/dev/code-review/code-coverage.md) is met.
- [ ] added integration tests.
- [x] been tested in a test Druid cluster.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: Add additional context about the authorization request that can be passed to Authorizer (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on code in PR #19247:
URL: https://github.com/apache/druid/pull/19247#discussion_r3141492501
##########
sql/src/main/java/org/apache/druid/sql/calcite/schema/SystemSchema.java:
##########
@@ -121,6 +121,14 @@ public class SystemSchema extends AbstractSchema
segment.getDataSource())
);
+ /**
+ * Context map passed to {@link AuthorizationUtils} methods to indicate that authorization
+ * is being performed from the SystemSchema.
+ */
+ static final String AUTHORIZATION_CONTEXT_CALLER_PATH_VALUE = SystemSchema.class.getSimpleName();
+ private static final Map<String, Object> SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT =
Review Comment:
[P2] Pass SystemSchema context to server state check
SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT is threaded through the SystemSchema datasource filters, but checkStateReadAccessForServers still calls the three-argument authorizeAllResourceActions, so querying sys.servers performs its STATE READ authorization with an empty context. That leaves this SystemSchema-originated denial indistinguishable from ordinary state reads, undermining the new callerPath contract for one of the UI/system-schema paths; pass SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT into that helper call too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: Add additional context about the authorization request that can be passed to Authorizer (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on code in PR #19247:
URL: https://github.com/apache/druid/pull/19247#discussion_r3889505941
##########
sql/src/main/java/org/apache/druid/sql/calcite/schema/SystemSchema.java:
##########
@@ -121,6 +121,14 @@ public class SystemSchema extends AbstractSchema
segment.getDataSource())
);
+ /**
+ * Context map passed to {@link AuthorizationUtils} methods to indicate that authorization
+ * is being performed from the SystemSchema.
+ */
+ static final String AUTHORIZATION_CONTEXT_CALLER_PATH_VALUE = SystemSchema.class.getSimpleName();
+ private static final Map<String, Object> SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT =
+ ImmutableMap.of(AuthorizationUtils.AUTHORIZATION_CONTEXT_CALLER_PATH_CONTEXT_KEY, AUTHORIZATION_CONTEXT_CALLER_PATH_VALUE);
Review Comment:
[P2] Pass context through server state checks
checkStateReadAccessForServers still calls the four-argument authorizeAllResourceActions overload without SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT. The servers and server_segments scans use that helper, so their STATE READ authorization omits the new callerPath even though row filtering passes it. Thread the context through this helper and its callers so custom authorizers receive consistent context.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: Add additional context about the authorization request that can be passed to Authorizer (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #19247:
URL: https://github.com/apache/druid/pull/19247#issuecomment-4794894469
This pull request has been marked as stale due to 60 days of inactivity.
It will be closed in 4 weeks if no further activity occurs. If you think
that's incorrect or this pull request should instead be reviewed, please simply
write any comment. Even if closed, you can still revive the PR at any time or
discuss it on the dev@druid.apache.org list.
Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: Add additional context about the authorization request that can be passed to Authorizer (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #19247:
URL: https://github.com/apache/druid/pull/19247#issuecomment-5064922678
This pull request/issue has been closed due to lack of activity. If you think that
is incorrect, or the pull request requires review, you can revive the PR at any time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] feat: Add additional context about the authorization request that can be passed to Authorizer (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #19247: feat: Add additional context about the authorization request that can be passed to Authorizer
URL: https://github.com/apache/druid/pull/19247
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org