[ https://issues.apache.org/jira/browse/CASSANDRA-12859?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15729145#comment-15729145 ]
Boris Melamed edited comment on CASSANDRA-12859 at 12/7/16 4:36 PM: -------------------------------------------------------------------- Please review, the commits are: On my C* trunk fork: https://github.com/bmel/cassandra/commit/4a584dac44e15bff6757121bb39bd9c59e8d5131 On my dtest fork: https://github.com/bmel/cassandra-dtest/commit/360b44630070481afb1ef1bd4623700f446782eb These are on feature branches, named 'col-perms-12859' in both projects. I thought to only create pull requests after an initial review. Let me know if you'd like me to create pull requests already - in which case I'll also pull the trunk/master changes from the past month, into my branch... was (Author: bmel): Please review, the commits are: On my C* trunk fork: https://github.com/bmel/cassandra/commit/4a584dac44e15bff6757121bb39bd9c59e8d5131 On my dtest fork: https://github.com/bmel/cassandra-dtest/commit/360b44630070481afb1ef1bd4623700f446782eb These are on feature branches, named 'col-perms-12859' in both projects. I thought to only create pull requests after an initial review. Let me know if you'd like me to create pull requests already. > Column-level permissions > ------------------------ > > Key: CASSANDRA-12859 > URL: https://issues.apache.org/jira/browse/CASSANDRA-12859 > Project: Cassandra > Issue Type: New Feature > Components: Core, CQL > Reporter: Boris Melamed > Labels: doc-impacting > Attachments: Cassandra Proposal - Column-level permissions v2.docx, > Cassandra Proposal - Column-level permissions.docx > > Original Estimate: 504h > Remaining Estimate: 504h > > h4. Here is a draft of: > Cassandra Proposal - Column-level permissions.docx (attached) > h4. Quoting the 'Overview' section: > The purpose of this proposal is to add column-level (field-level) permissions > to Cassandra. It is my intent to soon start implementing this feature in a > fork, and to submit a pull request once it’s ready. > h4. Motivation > Cassandra already supports permissions on keyspace and table (column family) > level. Sources: > * http://www.datastax.com/dev/blog/role-based-access-control-in-cassandra > * https://cassandra.apache.org/doc/latest/cql/security.html#data-control > At IBM, we have use cases in the area of big data analytics where > column-level access permissions are also a requirement. All industry RDBMS > products are supporting this level of permission control, and regulators are > expecting it from all data-based systems. > h4. Main day-one requirements > # Extend CQL (Cassandra Query Language) to be able to optionally specify a > list of individual columns, in the {{GRANT}} statement. The relevant > permission types are: {{MODIFY}} (for {{UPDATE}} and {{INSERT}}) and > {{SELECT}}. > # Persist the optional information in the appropriate system table > ‘system_auth.role_permissions’. > # Enforce the column access restrictions during execution. Details: > #* Should fit with the existing permission propagation down a role chain. > #* Proposed message format when a user’s roles give access to the queried > table but not to all of the selected, inserted, or updated columns: > "User %s has no %s permission on column %s of table %s" > #* Error will report only the first checked column. > Nice to have: list all inaccessible columns. > #* Error code is the same as for table access denial: 2100. > h4. Additional day-one requirements > # Reflect the column-level permissions in statements of type > {{LIST ALL PERMISSIONS OF someuser;}} > # When columns are dropped or renamed, trigger purging or adapting of their > permissions > # Performance should not degrade in any significant way. > # Backwards compatibility > #* Permission enforcement for DBs created before the upgrade should continue > to work with the same behavior after upgrading to a version that allows > column-level permissions. > #* Previous CQL syntax will remain valid, and have the same effect as before. > h4. Documentation > * > https://cassandra.apache.org/doc/latest/cql/security.html#grammar-token-permission > * Feedback request: any others? -- This message was sent by Atlassian JIRA (v6.3.4#6332)