Skip to content

[feat](authorization)Centralizing Common Authorization Operations in Common Interface #43595

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
CalvinKirs wants to merge 1 commit into from
Closed

[feat](authorization)Centralizing Common Authorization Operations in Common Interface #43595

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 0 additions & 8 deletions ...in/java/org/apache/doris/catalog/authorizer/ranger/doris/RangerDorisAccessController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -218,14 +218,6 @@ private boolean checkAnyPrivWithinTbl(UserIdentity currentUser, String ctl, Stri
public void checkColsPriv(UserIdentity currentUser, String ctl, String db, String tbl, Set<String> cols,
PrivPredicate wanted) throws AuthorizationException {
PrivBitSet checkedPrivs = PrivBitSet.of();
boolean hasTablePriv = checkGlobalPrivInternal(currentUser, wanted, checkedPrivs)
|| checkCtlPrivInternal(currentUser, ctl, wanted, checkedPrivs)
|| checkDbPrivInternal(currentUser, ctl, db, wanted, checkedPrivs)
|| checkTblPrivInternal(currentUser, ctl, db, tbl, wanted, checkedPrivs);
if (hasTablePriv) {
return;
}

for (String col : cols) {
if (!checkColPrivInternal(currentUser, ctl, db, tbl, col, wanted, checkedPrivs.copy())) {
throw new AuthorizationException(String.format(
Expand Down
28 changes: 19 additions & 9 deletions fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/CatalogAccessController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,10 @@
public interface CatalogAccessController {
// ==== Catalog ====
default boolean checkCtlPriv(boolean hasGlobal, UserIdentity currentUser, String ctl, PrivPredicate wanted) {
boolean res = checkCtlPriv(currentUser, ctl, wanted);
return hasGlobal || res;
if (hasGlobal) {
return true;
}
return checkCtlPriv(currentUser, ctl, wanted);
}

// ==== Global ====
Expand All @@ -40,26 +42,34 @@ default boolean checkCtlPriv(boolean hasGlobal, UserIdentity currentUser, String

// ==== Database ====
default boolean checkDbPriv(boolean hasGlobal, UserIdentity currentUser, String ctl, String db,
PrivPredicate wanted) {
boolean res = checkDbPriv(currentUser, ctl, db, wanted);
return hasGlobal || res;
PrivPredicate wanted) {
if (hasGlobal) {
return true;
}
return checkDbPriv(currentUser, ctl, db, wanted);
}

boolean checkDbPriv(UserIdentity currentUser, String ctl, String db, PrivPredicate wanted);

// ==== Table ====
default boolean checkTblPriv(boolean hasGlobal, UserIdentity currentUser, String ctl, String db, String tbl,
PrivPredicate wanted) {
boolean res = checkTblPriv(currentUser, ctl, db, tbl, wanted);
return hasGlobal || res;
PrivPredicate wanted) {
if (hasGlobal) {
return true;
}
return checkTblPriv(currentUser, ctl, db, tbl, wanted);
}

boolean checkTblPriv(UserIdentity currentUser, String ctl, String db, String tbl, PrivPredicate wanted);

// ==== Column ====
default void checkColsPriv(boolean hasGlobal, UserIdentity currentUser, String ctl, String db, String tbl,
Set<String> cols, PrivPredicate wanted) throws AuthorizationException {
Set<String> cols, PrivPredicate wanted) throws AuthorizationException {
try {
boolean hasTablePriv = checkTblPriv(hasGlobal, currentUser, ctl, db, tbl, wanted);
if (hasTablePriv) {
return;
}
checkColsPriv(currentUser, ctl, db, tbl, cols, wanted);
} catch (AuthorizationException e) {
if (!hasGlobal) {
Expand Down
2 changes: 1 addition & 1 deletion fe/fe-core/src/main/java/org/apache/doris/mysql/privilege/Role.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -473,7 +473,7 @@ public boolean checkColPriv(String ctl, String db, String tbl, String col, PrivP
if (!colPrivilege.isPresent()) {
throw new IllegalStateException("this privPredicate should not use checkColPriv:" + wanted);
}
return checkTblPriv(ctl, db, tbl, wanted) || onlyCheckColPriv(ctl, db, tbl, col, colPrivilege.get());
return onlyCheckColPriv(ctl, db, tbl, col, colPrivilege.get());
}

private boolean onlyCheckColPriv(String ctl, String db, String tbl, String col,
Expand Down