Add generic SET AUTHORIZATION #21794

djsstarburst · 2024-05-01T20:38:05Z

This commit adds machinery to set the owner of arbitrary entities, by extending the syntax of
ALTER (SCHEMA | TABLE | VIEW) qualifiedName SET AUTHORIZATION to support arbitrary owningKinds in place of SCHEMA, TABLE or VIEW. Checks that a specific SET AUTHORIZATION is legal is done by AccessControl.checkCanSetEntityAuthorization, also defined by SystemAccessControl. Setting the owner is done by Metadata.setEntityAuthorization and
SystemSecurityMetadata.setEntityAuthorization.

Description

Additional context and related issues

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
( ) Release notes are required, with the following suggested text:

# Section
* Fix some things. ({issue}`issuenumber`)

lozbrown · 2024-05-07T12:40:35Z

Would that help with this issue?

#21450

djsstarburst · 2024-05-07T14:24:08Z

Would that help with this issue?

#21450

No, I don't think this change will help. Materialized views must have owners when they are created. Perhaps you could post to the Trino #troubleshooting Slack channel about this.

lozbrown · 2024-05-07T18:27:18Z

I did that some time ago but got no response

https://trinodb.slack.com/archives/CGB0QHWSW/p1712241258245569

github-actions · 2024-06-25T17:03:46Z

This pull request has gone a while without any activity. Tagging the Trino developer relations team: @bitsondatadev @colebow @mosabua

mosabua · 2024-06-25T21:45:25Z

I assume you are still working on this @djsstarburst

djsstarburst · 2024-06-26T00:51:43Z

I assume you are still working on this @djsstarburst

Yes, @mosabua.

djsstarburst · 2024-10-10T16:19:42Z

Hi @martint. We discussed this PR, and you took a quick look at it last spring. I just brought it up-to-date with tip master.

Could you please take another look and see if it can be approved? Thanks!

dain

I would like to take a different approach to this PR. Instead of retaining the existing set*Authorization we remove them entirelly. Then in the SPI we have default implementation of setEntityAuthorization we switch over the entities and call the exisitng methods. Then we mark the existing 3 methods as deprecated for removal. We would do the same thing for the security checks.

The main, notable, difference with the existing code would be that we no longer perform an existance check before doing the authorization assignment. I think that is ok. If we decide we want that later we can add a generic entitiy exists mehtod.

core/trino-grammar/src/main/antlr4/io/trino/grammar/sql/SqlBase.g4

core/trino-main/src/main/java/io/trino/execution/SetAuthorizationTask.java

core/trino-parser/src/test/java/io/trino/sql/parser/TestSqlParser.java

djsstarburst · 2024-11-21T21:44:46Z

I would like to take a different approach to this PR.

@dain - - I've tried to do what you suggested, and I've pushed out the result. But I'm not certain I've gotten the details right. Please take another quick look.

dain

You are getting there. In all modules other than SPI, we should simply remove the methods. In the SPI we leave the methods, but mark them @Deprecated(forRemoval=ture). This means the nothing else in Trino is allowed to call this method. The new method will have a default implementation that calls through to the old deprecated implementations (likely needs the deprecation check suppressed for that method). This way existing implementations should still work, but it forces them to update. Then in a few months we remove the deprecated methods entirelly.

dain · 2024-12-09T20:15:34Z

core/trino-main/src/main/java/io/trino/metadata/Metadata.java

@@ -858,4 +858,6 @@ default boolean isMaterializedView(Session session, QualifiedObjectName viewName
     * Returns writer scaling options for the specified table.
     */
    WriterScalingOptions getInsertWriterScalingOptions(Session session, TableHandle tableHandle);
+
+    void setEntityAuthorization(Session session, String ownedKind, List<String> name, TrinoPrincipal principal);


Remove all other set*Authorization methods from this interface and implementations.

dain · 2024-12-09T20:15:39Z

core/trino-main/src/main/java/io/trino/metadata/MetadataManager.java

@@ -2862,6 +2862,12 @@ public WriterScalingOptions getInsertWriterScalingOptions(Session session, Table
        return metadata.getInsertWriterScalingOptions(session.toConnectorSession(tableHandle.catalogHandle()), tableHandle.connectorHandle());
    }

+    @Override
+    public void setEntityAuthorization(Session session, String ownedKind, List<String> name, TrinoPrincipal principal)


Remove all other set*Authorization methods from this interface and implementations.

dain · 2024-12-09T20:16:43Z

core/trino-main/src/main/java/io/trino/metadata/SystemSecurityMetadata.java

     */
+    @Deprecated
    void setSchemaOwner(Session session, CatalogSchemaName schema, TrinoPrincipal principal);


Sinces this is in the main module, we can remove these methods instead of deprecating them. The only place we would leave the existing methods is in the trino-spi module.

dain · 2024-12-09T20:17:07Z

core/trino-main/src/main/java/io/trino/metadata/SystemSecurityMetadata.java

@@ -238,4 +253,30 @@ default void validateEntityKindAndPrivileges(Session session, String entityKind,
     * Column's NOT NULL constraint was dropped
     */
    void columnNotNullConstraintDropped(Session session, CatalogSchemaTableName table, String column);
+
+    default void setEntityOwner(Session session, String ownedKind, List<String> name, TrinoPrincipal principal)


This should just be an interface method

dain · 2024-12-09T20:17:41Z

core/trino-main/src/main/java/io/trino/security/AccessControl.java

     */
+    @Deprecated
    void checkCanSetSchemaAuthorization(SecurityContext context, CatalogSchemaName schemaName, TrinoPrincipal principal);


These can be removed leaving only the new generic entity version

dain · 2024-12-09T20:17:58Z

core/trino-main/src/main/java/io/trino/security/AccessControlManager.java

@@ -1442,6 +1443,18 @@ public Map<ColumnSchema, ViewExpression> getColumnMasks(SecurityContext context,
        }
    }

+    @Override
+    public void checkCanSetEntityAuthorization(SecurityContext context, String ownedKind, List<String> name, TrinoPrincipal principal)


Remove all other checkCanSet*Authorization methods from this interface and implementations.

dain · 2024-12-09T20:19:13Z

core/trino-spi/src/main/java/io/trino/spi/security/SystemAccessControl.java

     */
+    @Deprecated


These should all be @Deprecated(forRemoval = true)

dain · 2024-12-09T20:20:14Z

core/trino-spi/src/main/java/io/trino/spi/security/SystemAccessControl.java

     */
+    @Deprecated
    default void checkCanSetSchemaAuthorization(SystemSecurityContext context, CatalogSchemaName schema, TrinoPrincipal principal)
    {
        denySetSchemaAuthorization(schema.toString(), principal);


Let's switch all of these to denySetEntityAuthorization

dain · 2024-12-09T20:20:54Z

core/trino-spi/src/main/java/io/trino/spi/security/AccessDeniedException.java

@@ -746,6 +748,21 @@ public static void denyShowCreateFunction(String functionName, String extraInfo)
        throw new AccessDeniedException(format("Cannot show create function for %s%s", functionName, formatExtraInfo(extraInfo)));
    }

+    public static void denySetEntityAuthorization(String ownedKind, List<String> name)


Let's mark all of the old denySet*Authorization @Deprecated(forRemoval = true)

dain · 2024-12-09T20:22:25Z

...-plugin-toolkit/src/main/java/io/trino/plugin/base/security/AllowAllSystemAccessControl.java

@@ -359,6 +359,9 @@ public Map<ColumnSchema, ViewExpression> getColumnMasks(SystemSecurityContext co
        return ImmutableMap.of();
    }

+    @Override
+    public void checkCanSetEntityAuthorization(SystemSecurityContext context, String ownedKind, List<String> name, TrinoPrincipal principal) {}


We can remove the other checkCanSet*Authorization methods from this impleentation and all others, since the engine can never call the other versions (because they are marked for removal)

This commit adds machinery to set the owner of arbitrary entities, by extending the syntax of ALTER (SCHEMA | TABLE | VIEW) qualifiedName SET AUTHORIZATION to support arbitrary owningKinds in place of SCHEMA, TABLE or VIEW. Checks that a specific SET AUTHORIZATION is legal is done by AccessControl.checkCanSetEntityAuthorization, also defined by SystemAccessControl. Setting the owner is done by Metadata.setEntityAuthorization and SystemSecurityMetadata.setEntityAuthorization.

cla-bot bot added the cla-signed label May 1, 2024

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch from 19b0949 to bbb067b Compare May 2, 2024 13:38

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch from bbb067b to a8153d8 Compare May 7, 2024 15:49

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch from a8153d8 to 5b3c06c Compare May 19, 2024 18:57

djsstarburst requested a review from martint May 20, 2024 12:47

djsstarburst marked this pull request as ready for review May 20, 2024 12:53

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch from 5b3c06c to 67040b4 Compare June 4, 2024 15:20

github-actions bot added the stale label Jun 25, 2024

mosabua added stale-ignore Use this label on PRs that should be ignored by the stale bot so they are not flagged or closed. and removed stale labels Jun 25, 2024

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch from 67040b4 to 0bb9bea Compare August 4, 2024 14:20

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch from 0bb9bea to 5ed9185 Compare October 10, 2024 16:18

dain added the syntax-needs-review label Oct 11, 2024

dain requested changes Nov 19, 2024

View reviewed changes

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch 2 times, most recently from 9205917 to a39beac Compare November 21, 2024 21:42

dain requested changes Dec 9, 2024

View reviewed changes

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch 2 times, most recently from f1a9e92 to 7374ecc Compare December 18, 2024 17:10

djsstarburst force-pushed the david.stryker/add-generic-set-authorization branch from 7374ecc to 35814ce Compare December 18, 2024 18:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add generic SET AUTHORIZATION #21794

Add generic SET AUTHORIZATION #21794

djsstarburst commented May 1, 2024

lozbrown commented May 7, 2024

djsstarburst commented May 7, 2024

lozbrown commented May 7, 2024 •

edited

Loading

github-actions bot commented Jun 25, 2024

mosabua commented Jun 25, 2024

djsstarburst commented Jun 26, 2024

djsstarburst commented Oct 10, 2024

dain left a comment

djsstarburst commented Nov 21, 2024

dain left a comment

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

djsstarburst Dec 18, 2024

dain Dec 9, 2024

Add generic SET AUTHORIZATION #21794

Are you sure you want to change the base?

Add generic SET AUTHORIZATION #21794

Conversation

djsstarburst commented May 1, 2024

Description

Additional context and related issues

Release notes

lozbrown commented May 7, 2024

djsstarburst commented May 7, 2024

lozbrown commented May 7, 2024 • edited Loading

github-actions bot commented Jun 25, 2024

mosabua commented Jun 25, 2024

djsstarburst commented Jun 26, 2024

djsstarburst commented Oct 10, 2024

dain left a comment

Choose a reason for hiding this comment

djsstarburst commented Nov 21, 2024

dain left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lozbrown commented May 7, 2024 •

edited

Loading