Semetey Coskun created RANGER-4683: -------------------------------------- Summary: Trino Schema Creation Permission Key: RANGER-4683 URL: https://issues.apache.org/jira/browse/RANGER-4683 Project: Ranger Issue Type: Bug Components: plugins Reporter: Semetey Coskun
Hi, I'm running Trino in docker (trinodb/trino:423) and this environment is integrated to Apache Ranger (2.4.0) for authz policies. Every permissions seem OK but "Create Schema" in a catalog. I've tried various configurations; specifying catalog names with "*" or exact name of the catalog which I'm trying to create schema in it but every time same error. {{io.cloudbeaver.DBWebException: Error executing query: SQL Error [4]: Query failed (#20240129_203356_00589_c9776): Access Denied: Cannot create schema delta.trino_poc at io.cloudbeaver.service.sql.WebSQLProcessor.processQuery(WebSQLProcessor.java:264) at io.cloudbeaver.service.sql.impl.WebServiceSQL$1.run(WebServiceSQL.java:377) at io.cloudbeaver.model.session.WebSession$1.run(WebSession.java:692) at org.jkiss.dbeaver.model.runtime.AbstractJob.run(AbstractJob.java:105) at org.eclipse.core.internal.jobs.Worker.run(Worker.java:63) Caused by: org.jkiss.dbeaver.model.sql.DBSQLException: SQL Error [4]: Query failed (#20240129_203356_00589_c9776): Access Denied: Cannot create schema delta.trino_poc at org.jkiss.dbeaver.model.impl.jdbc.exec.JDBCStatementImpl.executeStatement(JDBCStatementImpl.java:133) at io.cloudbeaver.service.sql.WebSQLProcessor.lambda$1(WebSQLProcessor.java:250) at org.jkiss.dbeaver.model.exec.DBExecUtils.tryExecuteRecover(DBExecUtils.java:190) at io.cloudbeaver.service.sql.WebSQLProcessor.processQuery(WebSQLProcessor.java:207) ... 4 more Caused by: java.sql.SQLException: Query failed (#20240129_203356_00589_c9776): Access Denied: Cannot create schema delta.trino_poc at io.trino.jdbc.AbstractTrinoResultSet.resultsException(AbstractTrinoResultSet.java:1937) at io.trino.jdbc.TrinoResultSet.getColumns(TrinoResultSet.java:318) at io.trino.jdbc.TrinoResultSet.create(TrinoResultSet.java:61) at io.trino.jdbc.TrinoStatement.internalExecute(TrinoStatement.java:262) at io.trino.jdbc.TrinoStatement.execute(TrinoStatement.java:240) at org.jkiss.dbeaver.model.impl.jdbc.exec.JDBCStatementImpl.execute(JDBCStatementImpl.java:330) at org.jkiss.dbeaver.model.impl.jdbc.exec.JDBCStatementImpl.executeStatement(JDBCStatementImpl.java:131) ... 7 more Caused by: io.trino.spi.security.AccessDeniedException: Access Denied: Cannot create schema delta.trino_poc at io.trino.spi.security.AccessDeniedException.denyCreateSchema(AccessDeniedException.java:150) at io.trino.spi.security.AccessDeniedException.denyCreateSchema(AccessDeniedException.java:145) at io.trino.spi.security.SystemAccessControl.checkCanCreateSchema(SystemAccessControl.java:286) at io.trino.security.AccessControlManager.lambda$checkCanCreateSchema$11(AccessControlManager.java:340) at io.trino.security.AccessControlManager.systemAuthorizationCheck(AccessControlManager.java:1363) at io.trino.security.AccessControlManager.checkCanCreateSchema(AccessControlManager.java:340) at io.trino.security.ForwardingAccessControl.checkCanCreateSchema(ForwardingAccessControl.java:125) at io.trino.tracing.TracingAccessControl.checkCanCreateSchema(TracingAccessControl.java:166) at io.trino.execution.CreateSchemaTask.internalExecute(CreateSchemaTask.java:117) at io.trino.execution.CreateSchemaTask.execute(CreateSchemaTask.java:82) at io.trino.execution.CreateSchemaTask.execute(CreateSchemaTask.java:54) at io.trino.execution.DataDefinitionExecution.start(DataDefinitionExecution.java:145) at io.trino.execution.SqlQueryManager.createQuery(SqlQueryManager.java:256) at io.trino.dispatcher.LocalDispatchQuery.startExecution(LocalDispatchQuery.java:145) at io.trino.dispatcher.LocalDispatchQuery.lambda$waitForMinimumWorkers$2(LocalDispatchQuery.java:129) at io.airlift.concurrent.MoreFutures.lambda$addSuccessCallback$12(MoreFutures.java:568) at io.airlift.concurrent.MoreFutures$3.onSuccess(MoreFutures.java:543) at com.google.common.util.concurrent.Futures$CallbackListener.run(Futures.java:1133) at io.trino.$gen.Trino_423____20240129_094308_2.run(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.lang.Thread.run(Thread.java:833)}} {{When I grep the coordinator logs the only policy id I can see in the logs is 27;}} 2024-01-29T20:02:57.087Z INFO Query-20240129_200257_00416_c9776-2066 stdout 20:02:57.087 [Query-20240129_200257_00416_c9776-2066] DEBUG org.apache.ranger.plugin.policyevaluator.RangerDefaultPolicyEvaluator - ==> RangerDefaultPolicyEvaluator.evaluate(policyId=27, RangerAccessRequestImpl=\{resource={RangerResourceImpl={ownerUser={null} elements=\{catalog=delta; } }} accessType=\{use} user=\{005269} userGroups=\{MY USER GROUP LIST } userRoles={} accessTime=\{Mon Jan 29 20:02:57 UTC 2024} clientIPAddress=\{null} forwardedAddresses={} remoteIPAddress=\{null} clientType=\{null} action=\{null} requestData=\{null} sessionId=\{null} resourceMatchingScope=\{SELF} clusterName={} clusterType={} context=\{token:USER={005269} } }, RangerAccessResult=\{isAccessDetermined={false} isAllowed=\{false} isAuditedDetermined=\{false} isAudited=\{false} auditLogId=\{null} policyType=\{0} policyId=\{-1} zoneName=\{null} auditPolicyId=\{-1} policyVersion=\{null} evaluatedPoliciesCount=\{1} reason=\{null} additionalInfo={}}) Policy ID 27 is the default "all - catalog, schema, table, column" configuration: !https://private-user-images.githubusercontent.com/1835976/300598323-d3c802a8-a8e5-48aa-ad14-64f0bb3fa8cc.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MDY2ODExOTMsIm5iZiI6MTcwNjY4MDg5MywicGF0aCI6Ii8xODM1OTc2LzMwMDU5ODMyMy1kM2M4MDJhOC1hOGU1LTQ4YWEtYWQxNC02NGYwYmIzZmE4Y2MucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDEzMSUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDAxMzFUMDYwMTMzWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9NDkxNzU2MmY5MmQwNmY5YmQ4MDM3YzI3OTg2MDc2NzQ4ZGI5NGMxMjhiZDNiM2JmYWJjOTQwZGZkODA2ZmRhZSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.vPiKcbzEz4z9lg-mxOJLQNdMaW5VxB5b4SAuegGlGwk! !https://private-user-images.githubusercontent.com/1835976/300598455-dd5dd6b1-9f34-444f-a66d-b04cf4874c8e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MDY2ODExOTMsIm5iZiI6MTcwNjY4MDg5MywicGF0aCI6Ii8xODM1OTc2LzMwMDU5ODQ1NS1kZDVkZDZiMS05ZjM0LTQ0NGYtYTY2ZC1iMDRjZjQ4NzRjOGUucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDEzMSUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDAxMzFUMDYwMTMzWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9NGYxMDcxMDhhZWMwZDhiYjVkMmZkNzIxYWMwMGJmZDMwYTc5ZTA3MjViMGRjMGY4NTU5NjYyY2E3MWYxZGQyOCZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.75LoXJsRRMJ1sRoVWJLeYs_-ssZxMfk0Mx-R7tWvB-0! Is there any point that I'm missing? Thank you, Kind Regards. -- This message was sent by Atlassian Jira (v8.20.10#820010)