adutra opened a new pull request, #5119: URL: https://github.com/apache/polaris/pull/5119
This change introduces support for fully external principals, that is, principals that are not backed by an entity in Polaris metastore. The new "principal mode" is configurable on a per-realm basis, and by default, internal mode is used (no changes). When a realm is configured to use external principals instead: - The authentication type for the realm must NOT be `internal` (i.e., an external IDP must be used). - The authorizer type must NOT be `internal` (i.e., an external PDP must be used). - The authenticator bypasses the metastore lookup when authenticating the principal. - The authenticator sets the principal roles directly from the credential's claims, as-is (no prefix stripping, no "ALL" pseudo-role expansion). - The resolver creates synthetic principal and principal role entities if asked by the authorizer to resolve the principal and/or principal roles. Note: in theory, an external authorizer shouldn't attempt to resolve principal roles, but for now it can happen, until the Authorizer SPI is fully refactored to allow more fine-grained resolutions. See design doc: https://docs.google.com/document/d/1VSoN1-QsAJGaM40oWTxeLIoYTp-XlfQM9nG-jqfb_-E/edit Prior work: https://github.com/apache/polaris/pull/3250 GitHub issue: https://github.com/apache/polaris/issues/441 <!-- ๐ Describe what changes you're proposing, especially breaking or user-facing changes. ๐ See https://github.com/apache/polaris/blob/main/CONTRIBUTING.md for more. --> ## Checklist - [ ] ๐ก๏ธ Don't disclose security issues! (contact [email protected]) - [ ] ๐ Clearly explained why the changes are needed, or linked related issues: Fixes # - [ ] ๐งช Added/updated tests with good coverage, or manually tested (and explained how) - [ ] ๐ก Added comments for complex logic - [ ] ๐งพ Updated `CHANGELOG.md` (if needed) - [ ] ๐ Updated documentation in `site/content/in-dev/unreleased` (if needed) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
