FrankChen021 commented on code in PR #19247:
URL: https://github.com/apache/druid/pull/19247#discussion_r3889505941
##########
sql/src/main/java/org/apache/druid/sql/calcite/schema/SystemSchema.java:
##########
@@ -121,6 +121,14 @@ public class SystemSchema extends AbstractSchema
segment.getDataSource())
);
+ /**
+ * Context map passed to {@link AuthorizationUtils} methods to indicate that
authorization
+ * is being performed from the SystemSchema.
+ */
+ static final String AUTHORIZATION_CONTEXT_CALLER_PATH_VALUE =
SystemSchema.class.getSimpleName();
+ private static final Map<String, Object> SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT
=
+
ImmutableMap.of(AuthorizationUtils.AUTHORIZATION_CONTEXT_CALLER_PATH_CONTEXT_KEY,
AUTHORIZATION_CONTEXT_CALLER_PATH_VALUE);
Review Comment:
[P2] Pass context through server state checks
checkStateReadAccessForServers still calls the four-argument
authorizeAllResourceActions overload without
SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT. The servers and server_segments scans use
that helper, so their STATE READ authorization omits the new callerPath even
though row filtering passes it. Thread the context through this helper and its
callers so custom authorizers receive consistent context.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
