arpitjain099 opened a new pull request, #4009: URL: https://github.com/apache/doris-website/pull/4009
Doris has supported external authorization through the `AccessControllerFactory` / `CatalogAccessController` SPI since #40750, with Apache Ranger as the reference implementation, but there is no page documenting the SPI itself. Today anyone who wants to back Doris authorization with a different system (OPA, OpenFGA, an in-house entitlement service) has to reverse-engineer it from the Ranger code. This adds `admin-manual/auth/authorization/custom.md` alongside the existing internal and Ranger authorization docs, and links it into the sidebar. It covers: - the two interfaces you implement, `CatalogAccessController` and `AccessControllerFactory`, with the actual method signatures and the parts worth knowing up front (the `hasGlobal` default overloads, `checkColsPriv` throwing `AuthorizationException` instead of returning a boolean, and masking/row-filter returning empty by default) - the two ways Doris discovers a factory: the classpath `META-INF/services` file for an in-tree plugin, and the external plugin directory for a standalone jar - how a controller is selected and configured, for both the internal catalog (`access_controller_type` + `authorization_config_file_path`) and external catalogs (`access_controller.class` + `access_controller.properties.*`) - a minimal skeleton to start from, plus a pointer to the Ranger integration as the worked example All interface signatures and config keys were checked against the current fe-core source. This also gives external-authorizer work like the OpenFGA controller in #65685 a place to point its readers. Notes on versions and languages: the page is added to the current (dev) docs and in English first. The SPI has existed since 3.0, so this can be backported to the 3.x and 4.x versioned docs and translated to Chinese / Japanese as follow-ups. Happy to fold those into this PR instead if you would prefer them together. ## Versions - [x] dev - [ ] 4.x - [ ] 3.x - [ ] 2.1 or older (not covered by version/language sync gate) ## Languages - [ ] Chinese - [x] English - [ ] Japanese candidate translation needed ## Docs Checklist - [x] Checked by AI - [ ] Test Cases Built - [x] Updated required version and language counterparts, or explained why not - [x] If only one language changed, confirmed whether source/translation counterparts need sync -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
