This is an automated email from the ASF dual-hosted git repository.
yashmayya pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pinot.git
The following commit(s) were added to refs/heads/master by this push:
new d691befa84e Broker configuration to enable row filters (#16174)
d691befa84e is described below
commit d691befa84ea425f0190bb7322545146dbf8c98b
Author: 9aman <[email protected]>
AuthorDate: Thu Jun 26 15:31:38 2025 +0530
Broker configuration to enable row filters (#16174)
---
.../requesthandler/BaseBrokerRequestHandler.java | 3 ++
.../BaseSingleStageBrokerRequestHandler.java | 42 +++++++++++-----------
.../MultiStageBrokerRequestHandler.java | 20 ++++++-----
.../tests/RowLevelSecurityIntegrationTest.java | 1 +
.../apache/pinot/spi/utils/CommonConstants.java | 3 ++
5 files changed, 40 insertions(+), 29 deletions(-)
diff --git
a/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/BaseBrokerRequestHandler.java
b/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/BaseBrokerRequestHandler.java
index c71a0c4620c..e990fc3945e 100644
---
a/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/BaseBrokerRequestHandler.java
+++
b/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/BaseBrokerRequestHandler.java
@@ -85,6 +85,7 @@ public abstract class BaseBrokerRequestHandler implements
BrokerRequestHandler {
protected final Set<String> _trackedHeaders;
protected final BrokerRequestIdGenerator _requestIdGenerator;
protected final long _brokerTimeoutMs;
+ protected final boolean _enableRowColumnLevelAuth;
protected final QueryLogger _queryLogger;
@Nullable
protected final String _enableNullHandling;
@@ -110,6 +111,8 @@ public abstract class BaseBrokerRequestHandler implements
BrokerRequestHandler {
_trackedHeaders = BrokerQueryEventListenerFactory.getTrackedHeaders();
_requestIdGenerator = new BrokerRequestIdGenerator(brokerId);
_brokerTimeoutMs = config.getProperty(Broker.CONFIG_OF_BROKER_TIMEOUT_MS,
Broker.DEFAULT_BROKER_TIMEOUT_MS);
+ _enableRowColumnLevelAuth =
config.getProperty(Broker.CONFIG_OF_BROKER_ENABLE_ROW_COLUMN_LEVEL_AUTH,
+ Broker.DEFAULT_BROKER_ENABLE_ROW_COLUMN_LEVEL_AUTH);
_queryLogger = new QueryLogger(config);
_enableNullHandling =
config.getProperty(Broker.CONFIG_OF_BROKER_QUERY_ENABLE_NULL_HANDLING);
diff --git
a/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/BaseSingleStageBrokerRequestHandler.java
b/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/BaseSingleStageBrokerRequestHandler.java
index c576918e7a2..73c67caef12 100644
---
a/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/BaseSingleStageBrokerRequestHandler.java
+++
b/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/BaseSingleStageBrokerRequestHandler.java
@@ -438,26 +438,28 @@ public abstract class BaseSingleStageBrokerRequestHandler
extends BaseBrokerRequ
throwAccessDeniedError(requestId, query, requestContext, tableName,
authorizationResult);
}
- TableRowColAccessResult rlsFilters =
accessControl.getRowColFilters(requesterIdentity, tableName);
-
- //rewrite query
- Map<String, String> queryOptions =
- pinotQuery.getQueryOptions() == null ? new HashMap<>() :
pinotQuery.getQueryOptions();
-
- rlsFilters.getRLSFilters().ifPresent(rowFilters -> {
- String combinedFilters =
- rowFilters.stream().map(filter -> "( " + filter + "
)").collect(Collectors.joining(" AND "));
- String rowFiltersKey = RlsUtils.buildRlsFilterKey(rawTableName);
- queryOptions.put(rowFiltersKey, combinedFilters);
- pinotQuery.setQueryOptions(queryOptions);
- try {
- CalciteSqlParser.queryRewrite(pinotQuery, RlsFiltersRewriter.class);
- } catch (Exception e) {
- LOGGER.error(
- "Unable to apply RLS filter: {}. Row-level security filtering
will be disabled for this query.",
- RlsFiltersRewriter.class.getName(), e);
- }
- });
+ if (_enableRowColumnLevelAuth) {
+ TableRowColAccessResult rlsFilters =
accessControl.getRowColFilters(requesterIdentity, tableName);
+
+ //rewrite query
+ Map<String, String> queryOptions =
+ pinotQuery.getQueryOptions() == null ? new HashMap<>() :
pinotQuery.getQueryOptions();
+
+ rlsFilters.getRLSFilters().ifPresent(rowFilters -> {
+ String combinedFilters =
+ rowFilters.stream().map(filter -> "( " + filter + "
)").collect(Collectors.joining(" AND "));
+ String rowFiltersKey = RlsUtils.buildRlsFilterKey(rawTableName);
+ queryOptions.put(rowFiltersKey, combinedFilters);
+ pinotQuery.setQueryOptions(queryOptions);
+ try {
+ CalciteSqlParser.queryRewrite(pinotQuery,
RlsFiltersRewriter.class);
+ } catch (Exception e) {
+ LOGGER.error(
+ "Unable to apply RLS filter: {}. Row-level security filtering
will be disabled for this query.",
+ RlsFiltersRewriter.class.getName(), e);
+ }
+ });
+ }
// Validate QPS quota
if (!_queryQuotaManager.acquireDatabase(database)) {
diff --git
a/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/MultiStageBrokerRequestHandler.java
b/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/MultiStageBrokerRequestHandler.java
index 6193eccc164..0ba41ebaf2c 100644
---
a/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/MultiStageBrokerRequestHandler.java
+++
b/pinot-broker/src/main/java/org/apache/pinot/broker/requesthandler/MultiStageBrokerRequestHandler.java
@@ -344,15 +344,17 @@ public class MultiStageBrokerRequestHandler extends
BaseBrokerRequestHandler {
if (!tableAuthorizationResult.hasAccess()) {
throwTableAccessError(tableAuthorizationResult);
}
- AccessControl accessControl = _accessControlFactory.create();
- for (String tableName : tables) {
- accessControl.getRowColFilters(requesterIdentity,
tableName).getRLSFilters()
- .ifPresent(rowFilters -> {
- String combinedFilters =
- rowFilters.stream().map(filter -> "( " + filter + "
)").collect(Collectors.joining(" AND "));
- String key = RlsUtils.buildRlsFilterKey(tableName);
- compiledQuery.getOptions().put(key, combinedFilters);
- });
+ if (_enableRowColumnLevelAuth) {
+ AccessControl accessControl = _accessControlFactory.create();
+ for (String tableName : tables) {
+ accessControl.getRowColFilters(requesterIdentity,
tableName).getRLSFilters()
+ .ifPresent(rowFilters -> {
+ String combinedFilters =
+ rowFilters.stream().map(filter -> "( " + filter + "
)").collect(Collectors.joining(" AND "));
+ String key = RlsUtils.buildRlsFilterKey(tableName);
+ compiledQuery.getOptions().put(key, combinedFilters);
+ });
+ }
}
}
}
diff --git
a/pinot-integration-tests/src/test/java/org/apache/pinot/integration/tests/RowLevelSecurityIntegrationTest.java
b/pinot-integration-tests/src/test/java/org/apache/pinot/integration/tests/RowLevelSecurityIntegrationTest.java
index de24564312a..8c9566f4c92 100644
---
a/pinot-integration-tests/src/test/java/org/apache/pinot/integration/tests/RowLevelSecurityIntegrationTest.java
+++
b/pinot-integration-tests/src/test/java/org/apache/pinot/integration/tests/RowLevelSecurityIntegrationTest.java
@@ -71,6 +71,7 @@ public class RowLevelSecurityIntegrationTest extends
BaseClusterIntegrationTest
@Override
protected void overrideBrokerConf(PinotConfiguration brokerConf) {
+ brokerConf.setProperty("pinot.broker.enable.row.column.level.auth",
"true");
brokerConf.setProperty("pinot.broker.access.control.class",
"org.apache.pinot.broker.broker.BasicAuthAccessControlFactory");
brokerConf.setProperty("pinot.broker.access.control.principals", "admin,
user, user2");
diff --git
a/pinot-spi/src/main/java/org/apache/pinot/spi/utils/CommonConstants.java
b/pinot-spi/src/main/java/org/apache/pinot/spi/utils/CommonConstants.java
index 26305c5698b..9fe08090ed6 100644
--- a/pinot-spi/src/main/java/org/apache/pinot/spi/utils/CommonConstants.java
+++ b/pinot-spi/src/main/java/org/apache/pinot/spi/utils/CommonConstants.java
@@ -341,6 +341,9 @@ public class CommonConstants {
public static final double DEFAULT_BROKER_QUERY_LOG_MAX_RATE_PER_SECOND =
10_000d;
public static final String CONFIG_OF_BROKER_TIMEOUT_MS =
"pinot.broker.timeoutMs";
public static final long DEFAULT_BROKER_TIMEOUT_MS = 10_000L;
+ public static final String CONFIG_OF_BROKER_ENABLE_ROW_COLUMN_LEVEL_AUTH =
+ "pinot.broker.enable.row.column.level.auth";
+ public static final boolean DEFAULT_BROKER_ENABLE_ROW_COLUMN_LEVEL_AUTH =
false;
public static final String CONFIG_OF_BROKER_ID =
"pinot.broker.instance.id";
public static final String CONFIG_OF_BROKER_INSTANCE_TAGS =
"pinot.broker.instance.tags";
public static final String CONFIG_OF_BROKER_HOSTNAME =
"pinot.broker.hostname";
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
