Skip to content

Commit 75e14ac

Browse files
utk-spartanutk-spartan
committed
[trino] Update spi to v427
Incorporates following changes: Add query start to SystemSecurityContext trinodb/trino#19141 trinodb/trino@925f7e4 Distinguish SystemAccessControl methods not exposing query id trinodb/trino#18973 trinodb/trino@1f46063 Signed-off-by: Utkarsh Saxena <[email protected]>
1 parent cc89586 commit 75e14ac

File tree

4 files changed

+70
-50
lines changed

4 files changed

+70
-50
lines changed

‎plugin-trino/src/main/java/org/apache/ranger/authorization/trino/authorizer/RangerSystemAccessControl.java‎

Lines changed: 45 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -293,18 +293,18 @@ public Set<SchemaTableName> filterTables(SystemSecurityContext context, String c
293293
/** SYSTEM **/
294294

295295
@Override
296-
public void checkCanSetSystemSessionProperty(SystemSecurityContext context, String propertyName) {
297-
if (!hasPermission(createSystemPropertyResource(propertyName), context, TrinoAccessType.ALTER)) {
296+
public void checkCanSetSystemSessionProperty(Identity identity, String propertyName) {
297+
if (!hasPermission(createSystemPropertyResource(propertyName), identity, TrinoAccessType.ALTER)) {
298298
LOG.debug("RangerSystemAccessControl.checkCanSetSystemSessionProperty denied");
299299
AccessDeniedException.denySetSystemSessionProperty(propertyName);
300300
}
301301
}
302302

303303
@Override
304-
public void checkCanImpersonateUser(SystemSecurityContext context, String userName) {
305-
if (!hasPermission(createUserResource(userName), context, TrinoAccessType.IMPERSONATE)) {
304+
public void checkCanImpersonateUser(Identity identity, String userName) {
305+
if (!hasPermission(createUserResource(userName), identity, TrinoAccessType.IMPERSONATE)) {
306306
LOG.debug("RangerSystemAccessControl.checkCanImpersonateUser(" + userName + ") denied");
307-
AccessDeniedException.denyImpersonateUser(context.getIdentity().getUser(), userName);
307+
AccessDeniedException.denyImpersonateUser(identity.getUser(), userName);
308308
}
309309
}
310310

@@ -660,49 +660,49 @@ public Set<String> filterColumns(SystemSecurityContext context, CatalogSchemaTab
660660

661661
/**
662662
* This is a NOOP. Everyone can execute a query
663-
* @param context
663+
* @param identity
664664
*/
665665
@Override
666-
public void checkCanExecuteQuery(SystemSecurityContext context) {
666+
public void checkCanExecuteQuery(Identity identity) {
667667
}
668668

669669
@Override
670-
public void checkCanViewQueryOwnedBy(SystemSecurityContext context, Identity queryOwner) {
671-
if (!hasPermission(createUserResource(queryOwner.getUser()), context, TrinoAccessType.IMPERSONATE)) {
670+
public void checkCanViewQueryOwnedBy(Identity identity, Identity queryOwner) {
671+
if (!hasPermission(createUserResource(queryOwner.getUser()), identity, TrinoAccessType.IMPERSONATE)) {
672672
LOG.debug("RangerSystemAccessControl.checkCanViewQueryOwnedBy(" + queryOwner + ") denied");
673-
AccessDeniedException.denyImpersonateUser(context.getIdentity().getUser(), queryOwner.getUser());
673+
AccessDeniedException.denyImpersonateUser(identity.getUser(), queryOwner.getUser());
674674
}
675675
}
676676

677677
/**
678678
* This is a NOOP, no filtering is applied
679679
*/
680680
@Override
681-
public Collection<Identity> filterViewQueryOwnedBy(SystemSecurityContext context, Collection<Identity> queryOwners) {
681+
public Collection<Identity> filterViewQueryOwnedBy(Identity identity, Collection<Identity> queryOwners) {
682682
return queryOwners;
683683
}
684684

685685
@Override
686-
public void checkCanKillQueryOwnedBy(SystemSecurityContext context, Identity queryOwner) {
687-
if (!hasPermission(createUserResource(queryOwner.getUser()), context, TrinoAccessType.IMPERSONATE)) {
686+
public void checkCanKillQueryOwnedBy(Identity identity, Identity queryOwner) {
687+
if (!hasPermission(createUserResource(queryOwner.getUser()), identity, TrinoAccessType.IMPERSONATE)) {
688688
LOG.debug("RangerSystemAccessControl.checkCanKillQueryOwnedBy(" + queryOwner + ") denied");
689-
AccessDeniedException.denyImpersonateUser(context.getIdentity().getUser(), queryOwner.getUser());
689+
AccessDeniedException.denyImpersonateUser(identity.getUser(), queryOwner.getUser());
690690
}
691691
}
692692

693693
@Override
694-
public void checkCanReadSystemInformation(SystemSecurityContext context) {
695-
if (!hasPermission(createUserResource(context.getIdentity().getUser()), context, TrinoAccessType.IMPERSONATE)) {
696-
LOG.debug("RangerSystemAccessControl.checkCanReadSystemInformation(" + context.getIdentity().getUser() + ") denied");
697-
AccessDeniedException.denyImpersonateUser(context.getIdentity().getUser(), "trino");
694+
public void checkCanReadSystemInformation(Identity identity) {
695+
if (!hasPermission(createUserResource(identity.getUser()), identity, TrinoAccessType.IMPERSONATE)) {
696+
LOG.debug("RangerSystemAccessControl.checkCanReadSystemInformation(" + identity.getUser() + ") denied");
697+
AccessDeniedException.denyImpersonateUser(identity.getUser(), "trino");
698698
}
699699
}
700700

701701
@Override
702-
public void checkCanWriteSystemInformation(SystemSecurityContext context) {
703-
if (!hasPermission(createUserResource(context.getIdentity().getUser()), context, TrinoAccessType.IMPERSONATE)) {
704-
LOG.debug("RangerSystemAccessControl.checkCanWriteSystemInformation(" + context.getIdentity().getUser() + ") denied");
705-
AccessDeniedException.denyImpersonateUser(context.getIdentity().getUser(), "trino");
702+
public void checkCanWriteSystemInformation(Identity identity) {
703+
if (!hasPermission(createUserResource(identity.getUser()), identity, TrinoAccessType.IMPERSONATE)) {
704+
LOG.debug("RangerSystemAccessControl.checkCanWriteSystemInformation(" + identity.getUser() + ") denied");
705+
AccessDeniedException.denyImpersonateUser(identity.getUser(), "trino");
706706
}
707707
}
708708

@@ -766,25 +766,29 @@ public void checkCanExecuteTableProcedure(
766766
/** HELPER FUNCTIONS **/
767767

768768
private RangerTrinoAccessRequest createAccessRequest(RangerTrinoResource resource, SystemSecurityContext context, TrinoAccessType accessType) {
769+
return createAccessRequest(resource, context.getIdentity(), accessType);
770+
}
771+
772+
private RangerTrinoAccessRequest createAccessRequest(RangerTrinoResource resource, Identity identity, TrinoAccessType accessType) {
769773
Set<String> userGroups = null;
770774

771775
if (useUgi) {
772-
UserGroupInformation ugi = UserGroupInformation.createRemoteUser(context.getIdentity().getUser());
776+
UserGroupInformation ugi = UserGroupInformation.createRemoteUser(identity.getUser());
773777

774778
String[] groups = ugi != null ? ugi.getGroupNames() : null;
775779

776780
if (groups != null && groups.length > 0) {
777781
userGroups = new HashSet<>(Arrays.asList(groups));
778782
}
779783
} else {
780-
userGroups = context.getIdentity().getGroups();
784+
userGroups = identity.getGroups();
781785
}
782786

783787
RangerTrinoAccessRequest request = new RangerTrinoAccessRequest(
784-
resource,
785-
context.getIdentity().getUser(),
786-
userGroups,
787-
accessType
788+
resource,
789+
identity.getUser(),
790+
userGroups,
791+
accessType
788792
);
789793

790794
return request;
@@ -803,6 +807,19 @@ private boolean hasPermission(RangerTrinoResource resource, SystemSecurityContex
803807
return ret;
804808
}
805809

810+
private boolean hasPermission(RangerTrinoResource resource, Identity identity, TrinoAccessType accessType) {
811+
boolean ret = false;
812+
813+
RangerTrinoAccessRequest request = createAccessRequest(resource, identity, accessType);
814+
815+
RangerAccessResult result = rangerPlugin.isAccessAllowed(request);
816+
if (result != null && result.getIsAllowed()) {
817+
ret = true;
818+
}
819+
820+
return ret;
821+
}
822+
806823
private static RangerTrinoResource createUserResource(String userName) {
807824
RangerTrinoResource res = new RangerTrinoResource();
808825
res.setValue(RangerTrinoResource.KEY_USER, userName);

‎plugin-trino/src/test/java/org/apache/ranger/authorization/trino/authorizer/RangerSystemAccessControlTest.java‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919

2020
import com.google.common.collect.ImmutableMap;
2121
import com.google.common.collect.ImmutableSet;
22+
import io.trino.spi.QueryId;
2223
import io.trino.spi.connector.CatalogSchemaName;
2324
import io.trino.spi.connector.CatalogSchemaRoutineName;
2425
import io.trino.spi.connector.CatalogSchemaTableName;
@@ -39,6 +40,7 @@
3940
import org.junit.Test;
4041

4142
import javax.security.auth.kerberos.KerberosPrincipal;
43+
import java.time.Instant;
4244
import java.util.HashMap;
4345
import java.util.List;
4446
import java.util.Map;
@@ -77,16 +79,16 @@ public static void setUpBeforeClass() throws Exception {
7779
@SuppressWarnings("PMD")
7880
public void testCanSetUserOperations() {
7981
try {
80-
accessControlManager.checkCanImpersonateUser(context(alice), bob.getUser());
82+
accessControlManager.checkCanImpersonateUser(alice, bob.getUser());
8183
throw new AssertionError("expected AccessDeniedExeption");
8284
}
8385
catch (AccessDeniedException expected) {
8486
}
8587

86-
accessControlManager.checkCanImpersonateUser(context(admin), bob.getUser());
88+
accessControlManager.checkCanImpersonateUser(admin, bob.getUser());
8789

8890
try {
89-
accessControlManager.checkCanImpersonateUser(context(kerberosInvalidAlice), bob.getUser());
91+
accessControlManager.checkCanImpersonateUser(kerberosInvalidAlice, bob.getUser());
9092
throw new AssertionError("expected AccessDeniedExeption");
9193
}
9294
catch (AccessDeniedException expected) {
@@ -174,7 +176,7 @@ public void testMisc()
174176
{
175177
assertEquals(
176178
accessControlManager.filterViewQueryOwnedBy(
177-
context(alice),
179+
alice,
178180
queryOwners.stream().map(Identity::ofUser).collect(toImmutableSet())),
179181
queryOwners.stream().map(Identity::ofUser).collect(toImmutableSet())
180182
);
@@ -197,7 +199,8 @@ public void testMisc()
197199
accessControlManager.checkCanExecuteProcedure(context(alice), aliceProcedure);
198200
}
199201

202+
// TODO: Fix it
200203
private SystemSecurityContext context(Identity id) {
201-
return new SystemSecurityContext(id, Optional.empty());
204+
return new SystemSecurityContext(id, QueryId.valueOf("dummy"), Instant.now());
202205
}
203206
}

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@
169169
<noggit.version>0.8</noggit.version>
170170
<owasp-java-html-sanitizer.version>r239</owasp-java-html-sanitizer.version>
171171
<paranamer.version>2.3</paranamer.version>
172-
<trino.version>426</trino.version>
172+
<trino.version>427</trino.version>
173173
<poi.version>4.1.2</poi.version>
174174
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
175175
<protobuf-java.version>2.5.0</protobuf-java.version>

‎ranger-trino-plugin-shim/src/main/java/org/apache/ranger/authorization/trino/authorizer/RangerSystemAccessControl.java‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,10 @@ public RangerSystemAccessControl(RangerConfig config) {
6565
}
6666

6767
@Override
68-
public void checkCanSetSystemSessionProperty(SystemSecurityContext context, String propertyName) {
68+
public void checkCanSetSystemSessionProperty(Identity identity, String propertyName) {
6969
try {
7070
activatePluginClassLoader();
71-
systemAccessControlImpl.checkCanSetSystemSessionProperty(context, propertyName);
71+
systemAccessControlImpl.checkCanSetSystemSessionProperty(identity, propertyName);
7272
} finally {
7373
deactivatePluginClassLoader();
7474
}
@@ -375,72 +375,72 @@ public void checkCanSetCatalogSessionProperty(SystemSecurityContext context, Str
375375
}
376376

377377
@Override
378-
public void checkCanImpersonateUser(SystemSecurityContext context, String userName) {
378+
public void checkCanImpersonateUser(Identity identity, String userName) {
379379
try {
380380
activatePluginClassLoader();
381-
systemAccessControlImpl.checkCanImpersonateUser(context, userName);
381+
systemAccessControlImpl.checkCanImpersonateUser(identity, userName);
382382
} finally {
383383
deactivatePluginClassLoader();
384384
}
385385
}
386386

387387
@Override
388-
public void checkCanExecuteQuery(SystemSecurityContext context) {
388+
public void checkCanExecuteQuery(Identity identity) {
389389
try {
390390
activatePluginClassLoader();
391-
systemAccessControlImpl.checkCanExecuteQuery(context);
391+
systemAccessControlImpl.checkCanExecuteQuery(identity);
392392
} finally {
393393
deactivatePluginClassLoader();
394394
}
395395
}
396396

397397
@Override
398-
public void checkCanViewQueryOwnedBy(SystemSecurityContext context, Identity queryOwner) {
398+
public void checkCanViewQueryOwnedBy(Identity identity, Identity queryOwner) {
399399
try {
400400
activatePluginClassLoader();
401-
systemAccessControlImpl.checkCanViewQueryOwnedBy(context, queryOwner);
401+
systemAccessControlImpl.checkCanViewQueryOwnedBy(identity, queryOwner);
402402
} finally {
403403
deactivatePluginClassLoader();
404404
}
405405
}
406406

407407
@Override
408-
public Collection<Identity> filterViewQueryOwnedBy(SystemSecurityContext context, Collection<Identity> queryOwners) {
408+
public Collection<Identity> filterViewQueryOwnedBy(Identity identity, Collection<Identity> queryOwners) {
409409
Collection<Identity> filteredQueryOwners;
410410
try {
411411
activatePluginClassLoader();
412-
filteredQueryOwners = systemAccessControlImpl.filterViewQueryOwnedBy(context, queryOwners);
412+
filteredQueryOwners = systemAccessControlImpl.filterViewQueryOwnedBy(identity, queryOwners);
413413
} finally {
414414
deactivatePluginClassLoader();
415415
}
416416
return filteredQueryOwners;
417417
}
418418

419419
@Override
420-
public void checkCanKillQueryOwnedBy(SystemSecurityContext context, Identity queryOwner) {
420+
public void checkCanKillQueryOwnedBy(Identity identity, Identity queryOwner) {
421421
try {
422422
activatePluginClassLoader();
423-
systemAccessControlImpl.checkCanKillQueryOwnedBy(context, queryOwner);
423+
systemAccessControlImpl.checkCanKillQueryOwnedBy(identity, queryOwner);
424424
} finally {
425425
deactivatePluginClassLoader();
426426
}
427427
}
428428

429429
@Override
430-
public void checkCanReadSystemInformation(SystemSecurityContext context) {
430+
public void checkCanReadSystemInformation(Identity identity) {
431431
try {
432432
activatePluginClassLoader();
433-
systemAccessControlImpl.checkCanReadSystemInformation(context);
433+
systemAccessControlImpl.checkCanReadSystemInformation(identity);
434434
} finally {
435435
deactivatePluginClassLoader();
436436
}
437437
}
438438

439439
@Override
440-
public void checkCanWriteSystemInformation(SystemSecurityContext context) {
440+
public void checkCanWriteSystemInformation(Identity identity) {
441441
try {
442442
activatePluginClassLoader();
443-
systemAccessControlImpl.checkCanWriteSystemInformation(context);
443+
systemAccessControlImpl.checkCanWriteSystemInformation(identity);
444444
} finally {
445445
deactivatePluginClassLoader();
446446
}

0 commit comments

Comments
 (0)