Skip to content

[#6695] fix(authz): Fix the error privileges #6821

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Apr 9, 2025
Merged

[#6695] fix(authz): Fix the error privileges #6821

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
07b3029
minor
jerqi Apr 1, 2025
5b52156
test
jerqi Apr 1, 2025
0bae860
fix style
jerqi Apr 1, 2025
c5dd2fc
fix errors
jerqi Apr 1, 2025
052fe21
fix
jerqi Apr 2, 2025
d9243c8
fix
jerqi Apr 2, 2025
9bebf6d
fix style
jerqi Apr 2, 2025
2532a1f
Add ut
jerqi Apr 3, 2025
15b367b
address comment
jerqi Apr 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions ...mmon/src/main/java/org/apache/gravitino/authorization/common/PathBasedMetadataObject.java
View file
Open in desktop
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don‘t forget to delete these defines.

public class PathBasedMetadataObject implements AuthorizationMetadataObject {

  public static final PathType METALAKE_PATH = new PathType(MetadataObject.Type.METALAKE);
  public static final PathType CATALOG_PATH = new PathType(MetadataObject.Type.CATALOG);
  public static final PathType SCHEMA_PATH = new PathType(MetadataObject.Type.SCHEMA);
  public static final PathType TABLE_PATH = new PathType(MetadataObject.Type.TABLE);
  public static final PathType FILESET_PATH = new PathType(MetadataObject.Type.FILESET);

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @yuqi1129 This follows yu's suggestion.

Original file line number Diff line number Diff line change
Expand Up @@ -92,15 +92,26 @@ public String toString() {
private final String name;
private final String parent;
private final String path;
private final boolean recursive;

private final AuthorizationMetadataObject.Type type;

public PathBasedMetadataObject(
String parent, String name, String path, AuthorizationMetadataObject.Type type) {
this(parent, name, path, type, true);
}

public PathBasedMetadataObject(
String parent,
String name,
String path,
AuthorizationMetadataObject.Type type,
boolean recursive) {
this.parent = parent;
this.name = name;
this.path = path;
this.type = type;
this.recursive = recursive;
}

@Override
Expand All @@ -122,6 +133,10 @@ public String path() {
return path;
}

public boolean recursive() {
return recursive;
}

@Override
public AuthorizationMetadataObject.Type type() {
return this.type;
Expand Down
3 changes: 2 additions & 1 deletion ...mon/src/main/java/org/apache/gravitino/authorization/common/PathBasedSecurableObject.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,9 @@ public PathBasedSecurableObject(
String name,
String path,
AuthorizationMetadataObject.Type type,
boolean recursive,
Set<AuthorizationPrivilege> privileges) {
super(parent, name, path, type);
super(parent, name, path, type, recursive);
this.privileges = ImmutableList.copyOf(privileges);
}

Expand Down
238 changes: 163 additions & 75 deletions ...rc/main/java/org/apache/gravitino/authorization/ranger/RangerAuthorizationHDFSPlugin.java
View file
Open in desktop

Large diffs are not rendered by default.

35 changes: 9 additions & 26 deletions ...in/java/org/apache/gravitino/authorization/ranger/RangerAuthorizationHadoopSQLPlugin.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -396,23 +396,24 @@ protected RangerPolicy createPolicyAddResources(AuthorizationMetadataObject meta
return policy;
}

@Override
public AuthorizationSecurableObject generateAuthorizationSecurableObject(
List<String> names,
String path,
AuthorizationMetadataObject.Type type,
Set<AuthorizationPrivilege> privileges) {
AuthorizationMetadataObject authMetadataObject =
RangerHadoopSQLMetadataObject object =
new RangerHadoopSQLMetadataObject(
AuthorizationMetadataObject.getParentFullName(names),
AuthorizationMetadataObject.getLastName(names),
type);
authMetadataObject.validateAuthorizationMetadataObject();
return generateAuthorizationSecurableObject(object, privileges);
}

@Override
public AuthorizationSecurableObject generateAuthorizationSecurableObject(
AuthorizationMetadataObject object, Set<AuthorizationPrivilege> privileges) {
object.validateAuthorizationMetadataObject();
return new RangerHadoopSQLSecurableObject(
authMetadataObject.parent(),
authMetadataObject.name(),
authMetadataObject.type(),
privileges);
object.parent(), object.name(), object.type(), privileges);
}

@Override
Expand Down Expand Up @@ -455,14 +456,12 @@ public List<AuthorizationSecurableObject> translateOwner(MetadataObject gravitin
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
ImmutableList.of(RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.SCHEMA,
ownerMappingRule()));
// Add `*.*` for the TABLE permission
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
ImmutableList.of(RangerHelper.RESOURCE_ALL, RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.TABLE,
ownerMappingRule()));
// Add `*.*.*` for the COLUMN permission
Expand All @@ -472,7 +471,6 @@ public List<AuthorizationSecurableObject> translateOwner(MetadataObject gravitin
RangerHelper.RESOURCE_ALL,
RangerHelper.RESOURCE_ALL,
RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.COLUMN,
ownerMappingRule()));
break;
Expand All @@ -481,15 +479,13 @@ public List<AuthorizationSecurableObject> translateOwner(MetadataObject gravitin
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
ImmutableList.of(gravitinoMetadataObject.name() /*Schema name*/),
null,
RangerHadoopSQLMetadataObject.Type.SCHEMA,
ownerMappingRule()));
// Add `{schema}.*` for the TABLE permission
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
ImmutableList.of(
gravitinoMetadataObject.name() /*Schema name*/, RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.TABLE,
ownerMappingRule()));
// Add `{schema}.*.*` for the COLUMN permission
Expand All @@ -499,7 +495,6 @@ public List<AuthorizationSecurableObject> translateOwner(MetadataObject gravitin
gravitinoMetadataObject.name() /*Schema name*/,
RangerHelper.RESOURCE_ALL,
RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.COLUMN,
ownerMappingRule()));
break;
Expand All @@ -511,7 +506,6 @@ public List<AuthorizationSecurableObject> translateOwner(MetadataObject gravitin
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
rangerMetadataObject.names(),
null,
RangerHadoopSQLMetadataObject.Type.TABLE,
ownerMappingRule()));
// Add `{schema}.{table}.*` for the COLUMN permission
Expand All @@ -521,7 +515,6 @@ public List<AuthorizationSecurableObject> translateOwner(MetadataObject gravitin
rangerMetadataObject.names().stream(),
Stream.of(RangerHelper.RESOURCE_ALL))
.collect(Collectors.toList()),
null,
RangerHadoopSQLMetadataObject.Type.COLUMN,
ownerMappingRule()));
});
Expand Down Expand Up @@ -568,7 +561,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
ImmutableList.of(RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.SCHEMA,
rangerPrivileges));
break;
Expand All @@ -587,7 +579,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
ImmutableList.of(RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.SCHEMA,
rangerPrivileges));
break;
Expand All @@ -606,7 +597,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
ImmutableList.of(RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.SCHEMA,
rangerPrivileges));
break;
Expand All @@ -615,7 +605,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
ImmutableList.of(securableObject.name() /*Schema name*/),
null,
RangerHadoopSQLMetadataObject.Type.SCHEMA,
rangerPrivileges));
break;
Expand All @@ -637,7 +626,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
generateAuthorizationSecurableObject(
ImmutableList.of(
RangerHelper.RESOURCE_ALL, RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.TABLE,
rangerPrivileges));
// Add `*.*.*` for the COLUMN permission
Expand All @@ -647,7 +635,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
RangerHelper.RESOURCE_ALL,
RangerHelper.RESOURCE_ALL,
RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.COLUMN,
rangerPrivileges));
break;
Expand All @@ -658,7 +645,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
ImmutableList.of(
securableObject.name() /*Schema name*/,
RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.TABLE,
rangerPrivileges));
// Add `{schema}.*.*` for the COLUMN permission
Expand All @@ -668,7 +654,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
securableObject.name() /*Schema name*/,
RangerHelper.RESOURCE_ALL,
RangerHelper.RESOURCE_ALL),
null,
RangerHadoopSQLMetadataObject.Type.COLUMN,
rangerPrivileges));
break;
Expand All @@ -686,7 +671,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
rangerSecurableObjects.add(
generateAuthorizationSecurableObject(
rangerMetadataObject.names(),
null,
RangerHadoopSQLMetadataObject.Type.TABLE,
rangerPrivileges));
// Add `{schema}.{table}.*` for the COLUMN permission
Expand All @@ -696,7 +680,6 @@ public List<AuthorizationSecurableObject> translatePrivilege(SecurableObject sec
rangerMetadataObject.names().stream(),
Stream.of(RangerHelper.RESOURCE_ALL))
.collect(Collectors.toList()),
null,
RangerHadoopSQLMetadataObject.Type.COLUMN,
rangerPrivileges));
});
Expand Down
5 changes: 1 addition & 4 deletions ...er/src/main/java/org/apache/gravitino/authorization/ranger/RangerAuthorizationPlugin.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1028,10 +1028,7 @@ public void close() throws IOException {}

/** Generate authorization securable object */
public abstract AuthorizationSecurableObject generateAuthorizationSecurableObject(
List<String> names,
String path,
AuthorizationMetadataObject.Type type,
Set<AuthorizationPrivilege> privileges);
AuthorizationMetadataObject object, Set<AuthorizationPrivilege> privileges);

public boolean validAuthorizationOperation(List<SecurableObject> securableObjects) {
return securableObjects.stream()
Expand Down
Loading