Support role management #7898
Closed
Support role management #7898
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
arhimondr
force-pushed
the
support_role_management
branch
3 times, most recently
from
5744956 to
0ce6e29
Compare
arhimondr
force-pushed
the
support_role_management
branch
from
0ce6e29 to
8f35e71
Compare
arhimondr
force-pushed
the
support_role_management
branch
from
8f35e71 to
08b367a
Compare
arhimondr
force-pushed
the
support_role_management
branch
2 times, most recently
from
24eaa60 to
31de171
Compare
arhimondr
force-pushed
the
support_role_management
branch
from
31de171 to
bf1739f
Compare
amrutagokhale
force-pushed
the
support_role_management
branch
from
bf1739f to
73a38b1
Compare
arhimondr
force-pushed
the
support_role_management
branch
from
73a38b1 to
77c464d
Compare
arhimondr
force-pushed
the
support_role_management
branch
from
77c464d to
b9dca17
Compare
added 17 commits
August 28, 2017 11:41
Instead of creating the entire TPCH table set it is enough to create one small table, such as nation. After closing a query executor reference must be nullified to prevent memory leaks.
Leverage newly introduced method for recursive role grants traversal
Identity must hold all the selected roles for all the catalogs. ConnectorIdentity holds only the role selected for some particular catalog.
Instead of select * from information_schema.roles, SHOW CURRENT ROLES rewrites to select * from information_schema.enabled_roles. All users can see what roles they're currently using, so no need for access control checks.
Currently the only database permission we support is OWNERSHIP. Instead of creating that permission, and checking if it is granted it is more readable to just call `isDatabaseOwner` directly.
Admin user has all the available permissions for all the entities implicitly. So it may be considered as a database and table "owner" for all tables and databases. Also it has all the SELECT, INSERT, DELETE permissions implicitly.
hasGrantOptionForPrivilege cannot be used in security checks for createView because it doesn't consider the session role.
Verify that role set with `SET ROLE` is considering during the access check.
arhimondr
force-pushed
the
support_role_management
branch
from
b9dca17 to
8f09296
Compare
|
Superseded by #9366 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR enables roles management through Presto.
It covers all the syntax explained here: Teradata#494
Although the PR is enormous - it can be reviewed and merged partially.
CREATE/DROP/LIST ROLES- commits throughIntroduce CREATE ROLE and DROP ROLE statementstoImplement Create/Drop/List roles in Hive connectorGRANT/REVOKE ROLES- commits throughIntroduce GRANT/REVOKE roles statementstoPrepare metastore interface to accept ROLE for GRANT/REVOKESET ROLE- commits throughIntroduce SET ROLE statementtoAccept ROLE in GRANT/REVOKE Privileges statementsSHOW ROLES,SHOW CURRENT ROLES,SHOW ROLE GRANTSshortcuts - commits throughAdd SHOW ROLES to the parsertoAccess control for SHOW ROLE GRANTS and SHOW CURRENT ROLESConsider role set with
SET ROLEwhen checking permissions - commits throughRemove redundant checkDatabasePermission methodstoMore product tests for SET ROLERoles management documentation -
Document role management