Hello Impala Public Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/22716
to look at the new patch set (#7).
Change subject: IMPALA-13011: [WIP] Support authorization for Calcite in Impala
......................................................................
IMPALA-13011: [WIP] Support authorization for Calcite in Impala
This patch adds support for authorization when Calcite is the planner.
Specifically, this patch focuses on the authorization of table-level
and column-level privilege requests.
The issue reported in IMPALA-13767 is also taken care of. To avoid
registering privilege requests for common table expressions (CTEs) in
the WITH clauses in a query, we collect the names of such CTEs when
visiting the SqlNode representing the query and make sure we don't
register privilege requests for those CTEs in the WITH clauses because
those CTEs are not actual tables.
Moreover, we register the VIEW_METADATA privilege for each function
involved in the given query. We hardcode the database associated with
the function to 'BuiltinsDb', which is a bit hacky. We should not be
doing this once each function could be associated with a database when
we are using the Calcite planner. We may need to change Calcite's
parser for this.
Notes:
- This patch already takes care of the case when a View is defined on
top of other View's.
TODO's:
- Need to figure out how to populate 'stmt_' of an AnalysisResult when
we are using Calcite. Currently, analysisResult.getStmt()
evaluates to null when we are using Calcite as the planner.
- Need to distinguish the case when a View was created by a
superuser from the case when a View was created by a
non-superuser based on the table property of 'Authorized'. Refer to
IMPALA-10122 (Part 2) for further details.
- Need to create the audit log lines that are produced by Impala
itself when the classic planner is used, i.e., those not created via
Impala's Ranger plug-in.
Change-Id: I9a7f7e4dc9a86a2da9e387832e552538e34029c1
---
M fe/src/main/java/org/apache/impala/analysis/Analyzer.java
M fe/src/main/java/org/apache/impala/authorization/BaseAuthorizationChecker.java
M
java/calcite-planner/src/main/java/org/apache/impala/calcite/schema/CalciteDb.java
A
java/calcite-planner/src/main/java/org/apache/impala/calcite/schema/ImpalaViewTable.java
M
java/calcite-planner/src/main/java/org/apache/impala/calcite/service/CalciteAnalysisDriver.java
M
java/calcite-planner/src/main/java/org/apache/impala/calcite/service/CalciteMetadataHandler.java
M
java/calcite-planner/src/main/java/org/apache/impala/calcite/service/CalciteParsedStatement.java
A
java/calcite-planner/src/main/java/org/apache/impala/calcite/service/ImpalaPrivilegeRequestsRegistrar.java
8 files changed, 348 insertions(+), 6 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/16/22716/7
--
To view, visit http://gerrit.cloudera.org:8080/22716
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I9a7f7e4dc9a86a2da9e387832e552538e34029c1
Gerrit-Change-Number: 22716
Gerrit-PatchSet: 7
Gerrit-Owner: Fang-Yu Rao <[email protected]>
Gerrit-Reviewer: Impala Public Jenkins <[email protected]>
