You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "AlbericByte (via GitHub)" <gi...@apache.org> on 2024/01/09 02:07:06 UTC
[PR] add optional lookup schema authorization (druid)
AlbericByte opened a new pull request, #15645:
URL: https://github.com/apache/druid/pull/15645
<!-- Thanks for trying to help us make Apache Druid be the best it can be! Please fill out as much of the following information as is possible (where relevant, and remove it when irrelevant) to help make the intention and scope of this PR clear in order to ease review. -->
<!-- Please read the doc for contribution (https://github.com/apache/druid/blob/master/CONTRIBUTING.md) before making this PR. Also, once you open a PR, please _avoid using force pushes and rebasing_ since these make it difficult for reviewers to see what you've changed in response to their reviews. See [the 'If your pull request shows conflicts with master' section](https://github.com/apache/druid/blob/master/CONTRIBUTING.md#if-your-pull-request-shows-conflicts-with-master) for more details. -->
Fixes #12728
<!-- Replace XXXX with the id of the issue fixed in this PR. Remove this section if there is no corresponding issue. Don't reference the issue in the title of this pull-request. -->
<!-- If you are a committer, follow the PR action item checklist for committers:
https://github.com/apache/druid/blob/master/dev/committer-instructions.md#pr-and-issue-action-item-checklist-for-committers. -->
### Description
add optional authorization to LOOKUP in SQL as LOOKUP resources, if
the newly added druid.sql.planner.authorizeLookupDirectly is true. For backwards compatibility, this feature is off by default. This allows cluster operators to selectively enable access to LOOKUP, or even disallow completely while still allowing SQL access to Druid datasources (LOOKUP resources).
<!-- Describe the goal of this PR, what problem are you fixing. If there is a corresponding issue (referenced above), it's not necessary to repeat the description here, however, you may choose to keep one summary sentence. -->
<!-- Describe your patch: what did you change in code? How did you fix the problem? -->
<!-- If there are several relatively logically separate changes in this PR, create a mini-section for each of them. For example: -->
<!--
In each section, please describe design decisions made, including:
- Choice of algorithms
- Behavioral aspects. What configuration values are acceptable? How are corner cases and error conditions handled, such as when there are insufficient resources?
- Class organization and design (how the logic is split between classes, inheritance, composition, design patterns)
- Method organization and design (how the logic is split between methods, parameters and return types)
- Naming (class, method, API, configuration, HTTP endpoint, names of emitted metrics)
-->
<!-- It's good to describe an alternative design (or mention an alternative name) for every design (or naming) decision point and compare the alternatives with the designs that you've implemented (or the names you've chosen) to highlight the advantages of the chosen designs and names. -->
<!-- If there was a discussion of the design of the feature implemented in this PR elsewhere (e. g. a "Proposal" issue, any other issue, or a thread in the development mailing list), link to that discussion from this PR description and explain what have changed in your final design compared to your original proposal or the consensus version in the end of the discussion. If something hasn't changed since the original discussion, you can omit a detailed discussion of those aspects of the design here, perhaps apart from brief mentioning for the sake of readability of this PR description. -->
<!-- Some of the aspects mentioned above may be omitted for simple and small changes. -->
#### Release note
<!-- Give your best effort to summarize your changes in a couple of sentences aimed toward Druid users.
If your change doesn't have end user impact, you can skip this section.
For tips about how to write a good release note, see [Release notes](https://github.com/apache/druid/blob/master/CONTRIBUTING.md#release-notes).
-->
<hr>
##### Key changed/added classes in this PR
* `ResourceType`
* `PlannerConfig`
* `SqlResourceCollectorShuttle`
* `NamedLookupSchema`
<hr>
<!-- Check the items by putting "x" in the brackets for the done things. Not all of these items apply to every PR. Remove the items which are not done or not relevant to the PR. None of the items from the checklist below are strictly necessary, but it would be very helpful if you at least self-review the PR. -->
This PR has:
- [*] been self-reviewed.
- [ ] using the [concurrency checklist](https://github.com/apache/druid/blob/master/dev/code-review/concurrency.md) (Remove this item if the PR doesn't have any relation to concurrency.)
- [ ] added documentation for new or modified features or behaviors.
- [ ] a release note entry in the PR description.
- [ ] added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
- [ ] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md)
- [ ] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
- [ ] added unit tests or modified existing tests to cover new code paths, ensuring the threshold for [code coverage](https://github.com/apache/druid/blob/master/dev/code-review/code-coverage.md) is met.
- [ ] added integration tests.
- [*] been tested in a test Druid cluster.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "AlbericByte (via GitHub)" <gi...@apache.org>.
AlbericByte commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-1903417059
Add integration test case for current implement
Still working on QueryLifecycle#authorize
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on code in PR #15645:
URL: https://github.com/apache/druid/pull/15645#discussion_r1493912377
##########
processing/src/main/java/org/apache/druid/math/expr/LookupNameExtractionShuttle.java:
##########
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.druid.math.expr;
+
+
+public class LookupNameExtractionShuttle implements Expr.Shuttle
+{
+ private String lookupName;
+
+ public String getLookupName()
+ {
+ return lookupName;
+ }
+
+ @Override
+ public Expr visit(Expr expr)
+ {
+ if (expr instanceof StringExpr) {
+ this.lookupName = expr.stringify();
+ if (lookupName.startsWith("'") && lookupName.endsWith("'")) {
+ this.lookupName = lookupName.substring(1, lookupName.length() - 1);
Review Comment:
Not sure if an empty string is acceptable to run here. If it's, then the substring function call throws exception
##########
server/src/main/java/org/apache/druid/server/QueryLifecycle.java:
##########
@@ -242,6 +267,70 @@ public Access authorize(HttpServletRequest req)
);
}
+ private String getLookUpName(DimensionSpec dimension)
+ {
+ if (dimension instanceof LookupDimensionSpec) {
+ return ((LookupDimensionSpec) dimension).getName();
+ } else if (dimension instanceof ExtractionDimensionSpec) {
+ ExtractionFn extractionFn = ((ExtractionDimensionSpec) dimension).getExtractionFn();
+ if (extractionFn instanceof RegisteredLookupExtractionFn) {
+ return ((RegisteredLookupExtractionFn) extractionFn).getLookupName();
+ }
+ }
+ return null;
+ }
+
+ private Set<String> collectLookupNames()
+ {
+ if (authConfig.isEnableAuthorizeLookupDirectly()) {
+ Set<String> lookupNames = new HashSet<>();
+ if (baseQuery instanceof GroupByQuery) {
+ GroupByQuery groupByQuery = (GroupByQuery) baseQuery;
+ lookupNames.addAll(getLookupNameFromDimension(groupByQuery));
+ lookupNames.addAll(getLookUpNameFromVirtualColumn());
+ } else if (baseQuery instanceof TopNQuery) {
+ TopNQuery topNQuery = (TopNQuery) baseQuery;
+ DimensionSpec dimension = topNQuery.getDimensionSpec();
+ lookupNames.addAll(getLookUpNameFromVirtualColumn());
+ String lookupName = getLookUpName(dimension);
+ if (!Strings.isNullOrEmpty(lookupName)) {
+ lookupNames.add(lookupName);
+ }
+ } else if (baseQuery instanceof ScanQuery) {
+ lookupNames.addAll(getLookUpNameFromVirtualColumn());
+ }
Review Comment:
there're some other queries like `TimeseriesQuery`, don't need to perform authorization on these queries?
##########
sql/src/main/java/org/apache/druid/sql/calcite/planner/SqlResourceCollectorShuttle.java:
##########
@@ -69,6 +69,16 @@ public SqlNode visit(SqlCall call)
));
}
+ if (call.getOperator().getName().equals("LOOKUP")) {
+ String lookupName = call.getOperandList().get(1).toString();
+ if (lookupName.startsWith("'") && lookupName.endsWith("'")) {
+ lookupName = lookupName.substring(1, lookupName.length() - 1);
Review Comment:
the question, can the lookupName here be an empty string?
##########
server/src/test/java/org/apache/druid/server/QueryLifecycleTest.java:
##########
@@ -181,6 +252,122 @@ public void testRunSimpleUnauthorized()
lifecycle.runSimple(query, authenticationResult, new Access(false));
}
+ @Test
+ public void testScanQuery_authorized()
Review Comment:
Do we have tests for `enableAuthorizeLookupDirectly = 0`? And where is this field set to zero in these test cases?
##########
integration-tests/src/test/java/org/apache/druid/tests/security/ITBasicAuthConfigurationTest.java:
##########
@@ -62,13 +61,9 @@ public class ITBasicAuthConfigurationTest extends AbstractAuthConfigurationTest
@BeforeClass
public void before() throws Exception
{
- // ensure that auth_test segments are loaded completely, we use them for testing system schema tables
- ITRetryUtil.retryUntilTrue(
- () -> coordinatorClient.areSegmentsLoaded("auth_test"), "auth_test segment load"
- );
-
Review Comment:
why is this removed?
##########
server/src/main/java/org/apache/druid/server/QueryLifecycle.java:
##########
@@ -242,6 +267,70 @@ public Access authorize(HttpServletRequest req)
);
}
+ private String getLookUpName(DimensionSpec dimension)
Review Comment:
from the review perspective, I'm suggesting to move this method after the following `collectLookupNames` because it's more related to other two getLookupNameXXX methods below, and more easier to understand the code
##########
server/src/test/java/org/apache/druid/server/QueryLifecycleTest.java:
##########
@@ -181,6 +252,122 @@ public void testRunSimpleUnauthorized()
lifecycle.runSimple(query, authenticationResult, new Access(false));
}
+ @Test
+ public void testScanQuery_authorized()
+ {
+ EasyMock.expect(queryConfig.getContext()).andReturn(ImmutableMap.of()).anyTimes();
+ EasyMock.expect(authenticationResult.getIdentity()).andReturn(IDENTITY).anyTimes();
+ EasyMock.expect(authenticationResult.getAuthorizerName()).andReturn(AUTHORIZER).anyTimes();
+ EasyMock.expect(authorizer.authorize(authenticationResult, new Resource(DATASOURCE, ResourceType.DATASOURCE), Action.READ))
+ .andReturn(Access.OK).times(2);
Review Comment:
Can add a comment to state why the times should be 2
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "abhishekagarwal87 (via GitHub)" <gi...@apache.org>.
abhishekagarwal87 commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-1951759532
I marked this a design review since the approach here needs a thorough review. I can't say confidently that the current approach is robust in extracting all the lookup information. So I will want more committers to look at this change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "AlbericByte (via GitHub)" <gi...@apache.org>.
AlbericByte commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-1884171771
@abhishekagarwal87 updated the description with example, and i will create some unit test cases for these.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #15645: add optional lookup schema authorization
URL: https://github.com/apache/druid/pull/15645
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "abhishekagarwal87 (via GitHub)" <gi...@apache.org>.
abhishekagarwal87 commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-1882385054
Interesting. I didn't understand the bit "disallow completely while still allowing access to lookup resource". can you elaborate through an example?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-1886363165
> or even disallow completely while still allowing SQL access to LOOKUP resources.
From the code, I think this description is ambiguous.
What he want to say I think is, if the the flag is enabled, it's not allowed to access the LOOKUP.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "AlbericByte (via GitHub)" <gi...@apache.org>.
AlbericByte commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-1946866299
@abhishekagarwal87 and @FrankChen021
Could you help to review this code when you have time, this one help me to know a lot about druid.
Current there is 1 failling checks because of "java.util.concurrent.ExecutionException: org.jboss.netty.channel.ChannelException: Faulty channel in resource pool", which is not relative to this pr.
Thanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-2118518055
This pull request/issue has been closed due to lack of activity. If you think that
is incorrect, or the pull request requires review, you can revive the PR at any time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-2067416026
This pull request has been marked as stale due to 60 days of inactivity.
It will be closed in 4 weeks if no further activity occurs. If you think
that's incorrect or this pull request should instead be reviewed, please simply
write any comment. Even if closed, you can still revive the PR at any time or
discuss it on the dev@druid.apache.org list.
Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] add optional lookup schema authorization (druid)
Posted by "abhishekagarwal87 (via GitHub)" <gi...@apache.org>.
abhishekagarwal87 commented on PR #15645:
URL: https://github.com/apache/druid/pull/15645#issuecomment-1886581392
While this PR takes care of lookup access in SQL, a user can submit JSON queries directly, too, and those JSON queries can refer to lookup. So you will also need to make necessary changes in QueryLifecycle#authorize for this feature to be complete.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org