arpitjain099 opened a new pull request, #65685:
URL: https://github.com/apache/doris/pull/65685
### What problem does this PR solve?
Issue Number: N/A (draft, opening for design discussion)
Problem Summary:
Doris already supports external authorization through the
`AccessControllerFactory` / `CatalogAccessController` SPI (#40750), with Apache
Ranger as the reference implementation. This adds a second external provider
backed by OpenFGA, the open-source Zanzibar implementation, for deployments
that want relationship-based fine-grained authorization managed in a central
policy service. It follows a suggestion from @morningman about integrating
Doris with different authentication and authorization systems.
How it works:
- A new provider under `catalog/authorizer/openfga`:
`OpenFgaDorisAccessControllerFactory` (identifier `openfga-doris`, one client
per JVM) and `OpenFgaDorisAccessController` implementing
`CatalogAccessController`.
- Each `check*Priv` maps the (user, object, privilege) to an OpenFGA
relationship `Check` over a catalog / database / table / column model.
Relations come from `DorisAccessType` (`can_select`, `can_load`, `can_alter`,
...), and the model inherits `from parent`, so a grant at the catalog level
cascades down, matching the existing controller semantics.
- It plugs in through the existing config path
(`access_controller.class=openfga-doris` + `access_controller.properties.*`),
so there are no grammar or core changes. It can also load as an external plugin
jar from the plugin directory with no core dependency at all.
- Checks fail closed: any OpenFGA error, timeout, or missing config denies
rather than allows.
MVP scope: data masking and row filtering return empty for now (OpenFGA is
relationship authorization, not attribute masking), and the Ranger "any
privilege within" SHOW scan isn't expressed yet since it needs a
`ListObjects`/`BatchCheck` rather than a single `Check`. Both are noted in the
docs and are easy follow-ups.
I'm opening this as a draft to get your read on the approach, in particular
whether you'd prefer it in-tree (the OpenFGA Java SDK added to the FE pom, as
here) or shipped as an external plugin jar with no core dependency. The code is
the same either way. I'll keep looking at how I can help Doris support
different authentication and authorization systems.
### Release note
Add an experimental OpenFGA-backed access controller for fine-grained
external authorization, opt-in per catalog via
`access_controller.class=openfga-doris`.
### Check List (For Author)
- Test
- [x] Unit Test
- Behavior changed:
- [x] Yes. Adds a new opt-in external authorizer. No change to existing
behavior unless a catalog explicitly selects it.
- Does this need documentation?
- [x] Yes. Model, usage, and delivery-option docs are included in the
branch under `resources/authorizer/openfga`. A doris-website page will follow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
