-
Notifications
You must be signed in to change notification settings - Fork 5.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support role management (v3) #10904
Closed
findepi
wants to merge
57
commits into
prestodb:master
from
starburstdata:epic/support-role-management/pr3
Closed
Support role management (v3) #10904
findepi
wants to merge
57
commits into
prestodb:master
from
starburstdata:epic/support-role-management/pr3
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
findepi
force-pushed
the
epic/support-role-management/pr3
branch
8 times, most recently
from
June 25, 2018 20:58
7dc6bbc
to
abe2f68
Compare
findepi
changed the title
Support role management (v3)
[WIP, Don't review just yet] Support role management (v3)
Jun 26, 2018
findepi
force-pushed
the
epic/support-role-management/pr3
branch
4 times, most recently
from
June 26, 2018 12:01
7e6cefd
to
d40b3be
Compare
Leverage newly introduced method for recursive role grants traversal
Identity must hold all the selected roles for all the catalogs. ConnectorIdentity holds only the role selected for some particular catalog.
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
hasGrantOptionForPrivilege cannot be used in security checks for createView because it doesn't consider the session role. Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Verify that role set with `SET ROLE` is considering during the access check. Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Previously when SqlStandardAccessControl was checking if given role is enabled, it listed all role grants and check if that role is is among all listed role grants. Now it list all role grants until it finds that role. Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
That way roles are enumerated lazily. Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
This way table privileges are enumerated lazily. Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Currently Presto shows that the owner of a table has ALL privileges, even after some privileges are revoked. This commit fixes this issue by listing only privileges actually present in the metastore. Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
Presto currently lists only privilges of the tables owned by the current user, even after the admin role is set. This commit fixes this and lists all privileges for admins. Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
When tables of the same name exist across different schemas, Presto lists privileges of the table from all schemas instead of the single schema mentioned in the SHOW GRANTS query. This commit fixes the issue. Extracted-From: prestodb/presto#10904
sopel39
pushed a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
sopel39
added a commit
to trinodb/trino
that referenced
this pull request
Jan 29, 2019
arhimondr
pushed a commit
to arhimondr/presto
that referenced
this pull request
Feb 27, 2019
arhimondr
pushed a commit
that referenced
this pull request
Feb 27, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR enables roles management through Presto.
It covers all the syntax explained here: Teradata#494
Although the PR is enormous - it can be reviewed and merged partially.
CREATE/DROP/LIST ROLES
- commits throughIntroduce CREATE ROLE and DROP ROLE statements
toImplement Create/Drop/List roles in Hive connector
GRANT/REVOKE ROLES
- commits throughIntroduce GRANT/REVOKE roles statements
toPrepare metastore interface to accept ROLE for GRANT/REVOKE
SET ROLE
- commits throughIntroduce SET ROLE statement
toAccept ROLE in GRANT/REVOKE Privileges statements
SHOW ROLES
,SHOW CURRENT ROLES
,SHOW ROLE GRANTS
shortcuts - commits throughAdd SHOW ROLES to the parser
toAccess control for SHOW ROLE GRANTS and SHOW CURRENT ROLES
Consider role set with
SET ROLE
when checking permissions - commits throughRemove redundant checkDatabasePermission methods
toMore product tests for SET ROLE
Roles management documentation -
Document role management
Supersedes #9366