Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

view privileges support #29

Open
HaydenHan opened this issue Aug 13, 2019 · 2 comments
Open

view privileges support #29

HaydenHan opened this issue Aug 13, 2019 · 2 comments
Assignees

Comments

@HaydenHan
Copy link

HaydenHan commented Aug 13, 2019

In ranger-hive-plugin,view permissions and original table permissions are separated。
So you can create views on your table with specified conditions(specify partitions, rows, columns),then grant views privilege to some users but not the original table。

After actual verification and reading code,i find spark-authorizer do not support the feature。

Do you think this feature is necessary? In fact, I have already supported it by modifying
the code. If you think it is necessary, I am happy to share the code and ask for your guidance.

@yaooqinn
Copy link
Owner

LGTM, feel free to submit a pr

@yaooqinn yaooqinn assigned yaooqinn and HaydenHan and unassigned yaooqinn Aug 14, 2019
@HaydenHan
Copy link
Author

Both spark and spark-authorizer need to be modified.

directions:
spark LogicalPlan will apply rule extensions “org.apache.spark.sql.catalyst.analysis.EliminateView” before apply rule “org.apache.spark.sql.catalyst.optimizer.RangerSparkAuthorizerExtension”。
“EliminateView” will remove the view information,so when “RangerSparkAuthorizerExtension” builder privileges,it can not get the view Information。In fact, "RangerSparkAuthorizerExtension" does not to get the view informations at all.

modified:
1, in spark,before apply rule “EliminateView”,we can store the view information
2, in spark-authorizer, we can get the view information when build privileges

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants