okumin commented on code in PR #6458:
URL: https://github.com/apache/hive/pull/6458#discussion_r4060985612
##########
standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/IcebergAuthorizer.java:
##########
@@ -161,4 +167,104 @@ void validateStageCreateTable(String catalogName,
Namespace namespace, Map<Strin
throw new IllegalStateException("Failed to check privileges
stage-create", e);
}
}
+
+ /**
+ * Translates Hive privileges into storage operations.
+ *
+ * @param catalogName the catalog name
+ * @param identifier the table identifier
+ * @param columnNames the column names
+ * @return a set of acceptable storage operations
+ * @throws IllegalStateException if the authorization plugin fails
+ */
+ Set<StorageOperation> resolveAllowedStorageOperations(String catalogName,
TableIdentifier identifier,
+ List<String> columnNames) {
+ Preconditions.checkArgument(identifier.namespace().levels().length == 1);
+ final var database = identifier.namespace().level(0);
+ final var table = identifier.name();
+
+ final var authorizer = authorizerSupplier.get();
+ if (!isReadable(authorizer, catalogName, database, table, columnNames)) {
+ // Can we accept the write-only user?
+ // I guess no because the write operation requires to read the current
metadata.
+ return EnumSet.noneOf(StorageOperation.class);
+ }
+ return isWritable(authorizer, catalogName, database, table)
+ ? EnumSet.allOf(StorageOperation.class)
+ : EnumSet.of(StorageOperation.LIST, StorageOperation.READ);
+ }
+
+ /**
+ * Apply a similar permission check to the following event.
+ * {@link
org.apache.hadoop.hive.ql.security.authorization.plugin.metastore.events.ReadTableEvent}
+ */
+ private boolean isReadable(HiveAuthorizer authorizer, String catalog, String
database, String table,
+ List<String> columns) {
+ // We may add the owner and owner type in the future. It requires an extra
metastore request.
+ final var readPrivileges = Collections.singletonList(
+ new HivePrivilegeObject(
+ HivePrivilegeObject.HivePrivilegeObjectType.TABLE_OR_VIEW,
+ catalog,
+ database,
+ table,
+ null,
+ columns
+ )
+ );
+ final var builder = new HiveAuthzContext.Builder();
+ builder.setCommandString("read");
+ final var context = builder.build();
+ if (!isAllowed(authorizer, readPrivileges, Collections.emptyList(),
context)) {
+ return false;
+ }
+
+ if (!authorizer.needTransform()) {
+ return true;
+ }
+
+ final List<HivePrivilegeObject> rewritePrivileges;
+ try {
+ rewritePrivileges = authorizer.applyRowFilterAndColumnMasking(context,
readPrivileges);
Review Comment:
With Column or row-level access control enabled, we need some advanced
solutions. The Server-side Planning API w/ server-side filtering (similar to
Hive Warehouse Connector) is an option for untrusted clients, and [read
restriction](https://www.databricks.com/blog/unifying-governance-across-engines-and-catalogs-open-lakehouse)
is an option for trusted clients.
Anyway, both are hard to implement as of today. The current implementation
is defensive; HMS REST does not return credentials when the table is protected
at the row or column level. In this case, Iceberg clients use their own S3
credentials. If they have valid storage access, they can access S3 objects.
##########
standalone-metastore/metastore-rest-catalog/pom.xml:
##########
@@ -26,6 +26,13 @@
<iceberg.version>1.10.1</iceberg.version>
</properties>
<dependencies>
+ <dependency>
+ <groupId>org.apache.hive</groupId>
+ <artifactId>hive-exec</artifactId>
+ <version>${hive.version}</version>
+ <classifier>core</classifier>
+ <scope>provided</scope>
Review Comment:
Potentially. I'd say it requires some strategic moves to decouple HMS and
hive-exec. The authz framework is not the only dependency...
https://github.com/apache/hive/blob/master/ql/src/java/org/apache/hadoop/hive/ql/optimizer/ppr/PartitionExpressionForMetastore.java
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
