[
https://issues.apache.org/jira/browse/DRILL-8548?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18103990#comment-18103990
]
ASF GitHub Bot commented on DRILL-8548:
---------------------------------------
shfshihuafeng commented on PR #3056:
URL: https://github.com/apache/drill/pull/3056#issuecomment-5264339435
> Thanks for this. I started the review and have a few questions:
>
> 1. Can we move the ranger code to the `contrib/` folder?
> 2. What is the user experience when they are denied access to something?
> 3. Drill supports table aliasing. Is that handled here?
1. Can we move the ranger code to the `contrib/` folder?
I'd recommend keeping the current structure
The Ranger integration differs from typical contrib/ modules (storage/format
plugins) in three ways: (1) it requires hooks in core classes
(DrillCalciteCatalogReader, ColumnAccessChecker, SqlConverter); (2) it needs an
isolated classloader with special distribution packaging
(ranger-drill-plugin-impl/ directory, component.xml excludes, drill-config.sh
classpath additions) to resolve the Jersey 2.35 vs 3.1.9 conflict; (3) it has a
sub-module (drill-ranger-service) that runs on the Ranger Admin JVM, not the
Drillbit. The AccessAuthorizer interface, RangerAccessAuthorizer shim, and
DrillRangerPluginClassLoader must remain in exec/java-exec because core code
references them directly. Moving drill-ranger-plugin and drill-ranger-service
to contrib/ranger/ is mechanically possible but would split the integration
across two top-level directories without simplifying the distribution packaging.
3. Drill supports table aliasing. Is that handled here?
Yes, table aliasing is handled transparently — no special code is needed
> Integrate Apache Ranger authorization for Drill
> -----------------------------------------------
>
> Key: DRILL-8548
> URL: https://issues.apache.org/jira/browse/DRILL-8548
> Project: Apache Drill
> Issue Type: New Feature
> Components: Server
> Affects Versions: 1.23.0
> Reporter: shihuafeng
> Priority: Major
> Fix For: 1.23.0
>
>
> This issue introduces Apache Ranger as a pluggable authorization framework
> for Drill, enabling centralized table-level and column-level access control
> for Drill queries. It is a substantial feature spanning three layers: a new
> drill-ranger module , integration hooks in exec/java-exec, and distribution
> packaging. The design follows Drill's existing AccessAuthorizer SPI and
> Calcite's RelShuttle mechanism so that column-level checks happen in the
> toRel phase before physical planning
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
