Skip to content

Commit a989899

Browse files
jaceklaskowskijaceklaskowski
committed
Demo: Unity Catalog Server Authorization
1 parent 5a7364c commit a989899

File tree

3 files changed

+85
-60
lines changed

3 files changed

+85
-60
lines changed

‎docs/demo/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,4 @@ The following demo are available:
1313
* [CRUD with External Delta Table](crud-external-delta-table.md)
1414
* [Namespace Support in Spark Connector](namespace-support-in-spark-connector.md)
1515
* [Spark Connector and External Tables on AWS S3](spark-connector-and-external-tables-on-aws-s3.md)
16+
* [Unity Catalog Server Authorization](unity-catalog-server-authorization.md)

‎docs/demo/unity-catalog-server-authorization.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
hide:
3+
- navigation
4+
---
5+
6+
# Demo: Unity Catalog Server Authorization
7+
8+
This demo shows how [Server Authorization](../server-authorization/index.md) works in Unity Catalog.
9+
10+
## Enable Server Authorization
11+
12+
Add the following to `etc/conf/server.properties`:
13+
14+
```text
15+
server.authorization=enable
16+
```
17+
18+
## Enable Authorization Logging
19+
20+
Enable `ALL` logging level for the following loggers:
21+
22+
* [AuthDecorator](../server-authorization/AuthDecorator.md#logging)
23+
* [UnityAccessDecorator](../server-authorization/UnityAccessDecorator.md#logging)
24+
25+
## Start UC Server
26+
27+
Start [Unity Catalog server](../server/index.md).
28+
29+
```bash
30+
./bin/start-uc-server
31+
```
32+
33+
## Unauthorized Access
34+
35+
The UC server requires all interactions to be authenticated using a token or a cookie.
36+
37+
This is why you face "No authorization found." error message unless either is provided.
38+
39+
```bash
40+
./bin/uc catalog list
41+
```
42+
43+
```text
44+
Exception in thread "main" java.lang.RuntimeException: io.unitycatalog.client.ApiException: listCatalogs call failed with: 401 - {"error_code":"UNAUTHENTICATED","details":[{"reason":"UNAUTHENTICATED","metadata":{},"@type":"google.rpc.ErrorInfo"}],"stack_trace":null,"message":"No authorization found."}
45+
at io.unitycatalog.cli.UnityCatalogCli.main(UnityCatalogCli.java:171)
46+
Caused by: io.unitycatalog.client.ApiException: listCatalogs call failed with: 401 - {"error_code":"UNAUTHENTICATED","details":[{"reason":"UNAUTHENTICATED","metadata":{},"@type":"google.rpc.ErrorInfo"}],"stack_trace":null,"message":"No authorization found."}
47+
at io.unitycatalog.client.api.CatalogsApi.getApiException(CatalogsApi.java:77)
48+
at io.unitycatalog.client.api.CatalogsApi.listCatalogsWithHttpInfo(CatalogsApi.java:356)
49+
at io.unitycatalog.client.api.CatalogsApi.listCatalogs(CatalogsApi.java:333)
50+
at io.unitycatalog.cli.CatalogCli.listCatalogs(CatalogCli.java:78)
51+
at io.unitycatalog.cli.CatalogCli.handle(CatalogCli.java:39)
52+
at io.unitycatalog.cli.UnityCatalogCli.main(UnityCatalogCli.java:127)
53+
```
54+
55+
## Authorized Access
56+
57+
Use the admin token that Unity Catalog uses internally and is conveniently stored in `etc/conf/token.txt`.
58+
59+
```bash
60+
./bin/uc --auth_token $(cat etc/conf/token.txt) catalog list
61+
```
62+
63+
```text
64+
┌─────┬────────────┬──────────┬─────┬─────────────┬──────────┬──────────┬──────────┬────────────────────────────────────┐
65+
│NAME │ COMMENT │PROPERTIES│OWNER│ CREATED_AT │CREATED_BY│UPDATED_AT│UPDATED_BY│ ID │
66+
├─────┼────────────┼──────────┼─────┼─────────────┼──────────┼──────────┼──────────┼────────────────────────────────────┤
67+
│unity│Main catalog│{} │null │1721234405334│null │null │null │f029b870-9468-4f10-badc-630b41e5690d│
68+
└─────┴────────────┴──────────┴─────┴─────────────┴──────────┴──────────┴──────────┴────────────────────────────────────┘
69+
```
70+
71+
You should see the following DEBUG messages in the server logs:
72+
73+
```text
74+
DEBUG io.unitycatalog.server.service.AuthDecorator:58 - AuthDecorator checking /api/2.1/unity-catalog/catalogs?max_results=100
75+
DEBUG io.unitycatalog.server.service.AuthDecorator:74 - Validating access-token for issuer: internal and keyId: b995bc0a527ffbbf9b43f108a1a0d825a05eb4070b2831a88dfaf34d2e879733
76+
DEBUG io.unitycatalog.server.service.AuthDecorator:93 - Access allowed for subject: "admin"
77+
DEBUG io.unitycatalog.server.auth.decorator.UnityAccessDecorator:74 - AccessDecorator checking /api/2.1/unity-catalog/catalogs?max_results=100
78+
DEBUG io.unitycatalog.server.auth.decorator.UnityAccessDecorator:252 - serviceName = io.unitycatalog.server.service.CatalogService, methodName = listCatalogs
79+
DEBUG io.unitycatalog.server.auth.decorator.UnityAccessDecorator:194 - authorize expression = #deny
80+
WARN io.unitycatalog.server.auth.decorator.UnityAccessDecorator:89 - No authorization resource(s) found.
81+
INFO org.casbin.jcasbin:113 - Request: [cd941442-6635-45b9-bc7a-c9b527600b3b, 3c527572-1eb3-4e5e-ba95-fa136e1b6d62, OWNER] ---> true
82+
INFO org.casbin.jcasbin:115 - Hit Policy: [cd941442-6635-45b9-bc7a-c9b527600b3b, 3c527572-1eb3-4e5e-ba95-fa136e1b6d62, OWNER]
83+
```

‎docs/server-authorization/index.md‎

Lines changed: 1 addition & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -52,63 +52,4 @@ Unity Catalog Server uses [UnityAccessDecorator](UnityAccessDecorator.md) to enf
5252

5353
## Demo
5454

55-
### Enable Server Authorization
56-
57-
Add the following to `etc/conf/server.properties`:
58-
59-
```text
60-
server.authorization=enable
61-
```
62-
63-
!!! tip
64-
Enable `ALL` logging level for the following loggers:
65-
66-
* [AuthDecorator](AuthDecorator.md#logging)
67-
* [UnityAccessDecorator](UnityAccessDecorator.md#logging)
68-
69-
Start [Unity Catalog server](../server/index.md).
70-
71-
### Unauthorized Access
72-
73-
```console
74-
❯ ./bin/uc catalog list
75-
Exception in thread "main" java.lang.RuntimeException: io.unitycatalog.client.ApiException: listCatalogs call failed with: 401 - {"error_code":"UNAUTHENTICATED","details":[{"reason":"UNAUTHENTICATED","metadata":{},"@type":"google.rpc.ErrorInfo"}],"stack_trace":null,"message":"No authorization found."}
76-
at io.unitycatalog.cli.UnityCatalogCli.main(UnityCatalogCli.java:168)
77-
Caused by: io.unitycatalog.client.ApiException: listCatalogs call failed with: 401 - {"error_code":"UNAUTHENTICATED","details":[{"reason":"UNAUTHENTICATED","metadata":{},"@type":"google.rpc.ErrorInfo"}],"stack_trace":null,"message":"No authorization found."}
78-
at io.unitycatalog.client.api.CatalogsApi.getApiException(CatalogsApi.java:77)
79-
at io.unitycatalog.client.api.CatalogsApi.listCatalogsWithHttpInfo(CatalogsApi.java:356)
80-
at io.unitycatalog.client.api.CatalogsApi.listCatalogs(CatalogsApi.java:333)
81-
at io.unitycatalog.cli.CatalogCli.listCatalogs(CatalogCli.java:74)
82-
at io.unitycatalog.cli.CatalogCli.handle(CatalogCli.java:39)
83-
at io.unitycatalog.cli.UnityCatalogCli.main(UnityCatalogCli.java:127)
84-
```
85-
86-
### Authorized Access
87-
88-
Use `subject_token` as specified in `etc/conf/token.txt`.
89-
90-
```console
91-
./bin/uc --auth_token $(cat etc/conf/token.txt) catalog list
92-
```
93-
94-
```text
95-
┌─────┬────────────┬──────────┬─────────────┬──────────┬────────────────────────────────────┐
96-
│NAME │ COMMENT │PROPERTIES│ CREATED_AT │UPDATED_AT│ ID │
97-
├─────┼────────────┼──────────┼─────────────┼──────────┼────────────────────────────────────┤
98-
│unity│Main catalog│{} │1721234405334│null │f029b870-9468-4f10-badc-630b41e5690d│
99-
└─────┴────────────┴──────────┴─────────────┴──────────┴────────────────────────────────────┘
100-
```
101-
102-
You should see the following DEBUG messages in the server logs:
103-
104-
```text
105-
DEBUG io.unitycatalog.server.service.AuthDecorator:47 - AuthDecorator checking /api/2.1/unity-catalog/catalogs?max_results=100
106-
DEBUG io.unitycatalog.server.service.AuthDecorator:72 - Validating access-token for issuer: internal
107-
DEBUG io.unitycatalog.server.service.AuthDecorator:92 - Access allowed for subject: "admin"
108-
DEBUG io.unitycatalog.server.auth.decorator.UnityAccessDecorator:74 - AccessDecorator checking /api/2.1/unity-catalog/catalogs?max_results=100
109-
DEBUG io.unitycatalog.server.auth.decorator.UnityAccessDecorator:252 - serviceName = io.unitycatalog.server.service.CatalogService, methodName = listCatalogs
110-
DEBUG io.unitycatalog.server.auth.decorator.UnityAccessDecorator:194 - authorize expression = #defer
111-
WARN io.unitycatalog.server.auth.decorator.UnityAccessDecorator:89 - No authorization resource(s) found.
112-
INFO org.casbin.jcasbin:113 - Request: [655136aa-a802-471c-994e-a478eedfce0b, ca7a1095-537c-4f9c-a136-5ca1ab1ec0de, OWNER] ---> true
113-
INFO org.casbin.jcasbin:115 - Hit Policy: [655136aa-a802-471c-994e-a478eedfce0b, ca7a1095-537c-4f9c-a136-5ca1ab1ec0de, OWNER]
114-
```
55+
[Demo: Unity Catalog Server Authorization](../demo/unity-catalog-server-authorization.md)

0 commit comments

Comments
 (0)