[GitHub] [incubator-kyuubi] bowenliang123 commented on pull request #3838: [KYUUBI #3839] [Authz] WIP: Support signing and verifying `kyuubi.session.user`

[GitBox]

bowenliang123 commented on PR #3838:
URL: 
https://github.com/apache/incubator-kyuubi/pull/3838#issuecomment-1329369052

   With the session user `bowen2`, querying with pyspark.
   In Authz plugin on engine side, the session user `bowen2` are verified with 
public key generated on server side and checked for table privileges with 
session user.
   
   - session user verified, no access privileges to the table:
   <img width="1093" alt="image" 
src="https://user-images.githubusercontent.com/1935105/204326485-f2c05917-d5d6-416e-be79-eae0540ae800.png";>
   
   - session user disguised as `superadmin` directly in SparkContext in user 
code (multi-line scripts for single execution), session user `superadmin`  is 
not verified:
   <img width="1073" alt="image" 
src="https://user-images.githubusercontent.com/1935105/204327264-89dc3d87-e19b-467f-9036-a5ebd06debae.png";>
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscr...@kyuubi.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscr...@kyuubi.apache.org
For additional commands, e-mail: notifications-h...@kyuubi.apache.org