[Subtask] Extended Apache Ranger authorization by configuration

[xunliu]

Describe the subtask

Currently, we are implementing AuthorizationPlugin interface class in the Ranger authorization class RangerAuthorizationPlugin,
The RangerAuthorizationPlugin supports common Ranger policy operations, for example

1. Create a Ranger policy on a Gravitino securable object,
2. Create a Ranger role on a Gravitino role entity
3. And more Ranger operations ...

When we need to supports a new Ranger service(HDFS, Trino, ...), we only need initial different variable of RangerHelper.ownerPrivileges and RangerHelper.privilegesMapping and RangerHelper.policySearchKeys and RangerHelper.policyPreciseFilterKeys.

To make it easier to support different Ranger authorizations, I think we can extend the Ranger authorization by configuring the file. for example:

1. RangerHelper read authorization-hdfs.xml file to initial RangerHelper.ownerPrivileges and privilegesMapping and policySearchKeys and policyPreciseFilterKeys to supports Ranger HDFS authorizatons.
2. RangerHelper read authorization-trion.xml file to supports Ranger Trino authorizations.

authorization configure file

1. Use properties format
2. authorization-hive.properties

# Ranger Hive privileges enum RangerHivePrivilege: create, alter, drop, index, lock, select, insert, update, delete, read, write, all
# defined in the `authorizations/authorization-ranger/src/main/java/org/apache/gravitino/authorization/ranger/reference/RangerDefines.java`
# Case insensitive
gravitino.authorization.owner.privileges = all

# Gravitino privileges defined in the `api/src/main/java/org/apache/gravitino/authorization/Privilege.java`
# authorization.privilege.mapping.<Gravitino-Privilege> = <Ranger-Privilege>,<Ranger-Privilege>,...
gravitino.authorization.privilege.mapping.CREATE_SCHEMA = create
gravitino.authorization.privilege.mapping.CREATE_TABLE = create
gravitino.authorization.privilege.mapping.SELECT_TABLE = read,select
gravitino.authorization.privilege.mapping.MODIFY_TABLE = update,alter,write

# Ranger policy resource defines (fixed configuration, do not change)
gravitino.authorization.ranger.policy.resource.defines = database,table,column

Parent issue

#4615

[xunliu]

hi @lw-yang
I think use properties authorization.owner.multiple = true will support multiple users or groups, But only one of them can be supported at the same time
What's do you think?

[lw-yang]

@xunliu We can set authorization.privileges.mapping.MODIFY_TABLE=ACCESS_TYPE_HIVE_DROP,... to resolve the limitation that only the owner has the delete permission.

so in my opinion, config file for ranger that supports the 'authorization.owner.multiple' is not neccessary. Our requirement is that Gravitino's owner permission model supports multiple owners having delete permissions.

[xunliu]

@xunliu We can set authorization.privileges.mapping.MODIFY_TABLE=ACCESS_TYPE_HIVE_DROP,... to resolve the limitation that only the owner has the delete permission.

so in my opinion, config file for ranger that supports the 'authorization.owner.multiple' is not neccessary. Our requirement is that Gravitino's owner permission model supports multiple owners having delete permissions.

Thank you for your suggestion. I accepted.