morningman opened a new pull request, #16679:
URL: https://github.com/apache/doris/pull/16679
# Proposed changes
Issue Number: close #xxx
## Problem summary
In current implementation, the class `Auth` is used for:
1. Manager all authentication and authorization info such as user, role,
password, privileges.
2. Provide an interface for privilege checking
Some user may want to integrate external access management system such as
Apache Ranger.
So we should provide a way to let user set their own access controller.
This PR mainly changes:
1. A new class `SystemAccessController`
This access controller is used to check the global level privileges and
resource privileges.
2. A new interface `CatalogAccessController`
This interface is used to check catalog/database/tbl level privileges.
It has a default implements `InternalCatalogAccessController`.
All privilege checking methods are moved from `Auth` to either
`SystemAccessController` or
`InternalCatalogAccessController`
3. A new class `AccessControllerManager`
This is the entry point of privilege authentication. All methods
previously called from `Auth`
now are called from `AccessControllerManager`
Now, user can implement the interface `CatalogAccessController` to use their
own access controller.
And when creating external catalog, user can specified the access controller
class name, so that
different external catalog can use different access controller.
## Checklist(Required)
* [ ] Does it affect the original behavior
* [ ] Has unit tests been added
* [ ] Has document been added or modified
* [ ] Does it need to update dependencies
* [ ] Is this PR support rollback (If NO, please explain WHY)
## Further comments
If this is a relatively large or complex change, kick off the discussion at
[[email protected]](mailto:[email protected]) by explaining why you
chose the solution you did and what alternatives you considered, etc...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
