Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support role management (v3) #10904

Closed

Conversation

findepi
Copy link
Contributor

@findepi findepi commented Jun 25, 2018

This PR enables roles management through Presto.

It covers all the syntax explained here: Teradata#494

Although the PR is enormous - it can be reviewed and merged partially.

  1. CREATE/DROP/LIST ROLES - commits through Introduce CREATE ROLE and DROP ROLE statements to Implement Create/Drop/List roles in Hive connector

  2. GRANT/REVOKE ROLES - commits through Introduce GRANT/REVOKE roles statements to Prepare metastore interface to accept ROLE for GRANT/REVOKE

  3. SET ROLE - commits through Introduce SET ROLE statement to Accept ROLE in GRANT/REVOKE Privileges statements

  4. SHOW ROLES, SHOW CURRENT ROLES, SHOW ROLE GRANTS shortcuts - commits through Add SHOW ROLES to the parser to Access control for SHOW ROLE GRANTS and SHOW CURRENT ROLES

  5. Consider role set with SET ROLE when checking permissions - commits through Remove redundant checkDatabasePermission methods to More product tests for SET ROLE

  6. Roles management documentation - Document role management

Supersedes #9366

@findepi findepi force-pushed the epic/support-role-management/pr3 branch 8 times, most recently from 7dc6bbc to abe2f68 Compare June 25, 2018 20:58
@findepi findepi changed the title Support role management (v3) [WIP, Don't review just yet] Support role management (v3) Jun 26, 2018
@findepi findepi force-pushed the epic/support-role-management/pr3 branch 4 times, most recently from 7e6cefd to d40b3be Compare June 26, 2018 12:01
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
hasGrantOptionForPrivilege cannot be used in security checks for createView
because it doesn't consider the session role.

Extracted-From: prestodb/presto#10904
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
Verify that role set with `SET ROLE` is considering during the access check.

Extracted-From: prestodb/presto#10904
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
Previously when SqlStandardAccessControl was checking if given role is
enabled, it listed all role grants and check if that role is is among
all listed role grants.
Now it list all role grants until it finds that role.

Extracted-From: prestodb/presto#10904
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
That way roles are enumerated lazily.

Extracted-From: prestodb/presto#10904
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
This way table privileges are enumerated lazily.

Extracted-From: prestodb/presto#10904
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
Currently Presto shows that the owner of a table
has ALL privileges, even after some privileges are revoked.
This commit fixes this issue by listing only privileges
actually present in the metastore.

Extracted-From: prestodb/presto#10904
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
Presto currently lists only privilges of the
tables owned by the current user, even after the
admin role is set. This commit fixes this and lists all
privileges for admins.

Extracted-From: prestodb/presto#10904
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
When tables of the same name exist across different schemas, Presto lists privileges
of the table from all schemas instead of the single schema mentioned in the
SHOW GRANTS query. This commit fixes the issue.

Extracted-From: prestodb/presto#10904
sopel39 pushed a commit to trinodb/trino that referenced this pull request Jan 29, 2019
sopel39 added a commit to trinodb/trino that referenced this pull request Jan 29, 2019
@findepi findepi deleted the epic/support-role-management/pr3 branch January 29, 2019 12:53
arhimondr pushed a commit to arhimondr/presto that referenced this pull request Feb 27, 2019
arhimondr pushed a commit that referenced this pull request Feb 27, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants