docs(auth): Add StarRocks Authorization Pushdown Design#11629
docs(auth): Add StarRocks Authorization Pushdown Design#11629zhaohehuhu wants to merge 3 commits into
Conversation
| | Table | Table `{schema}.{table}` | | ||
|
|
||
|
|
||
| ### 4.2 Supported Privileges |
There was a problem hiding this comment.
Gravitino has the concept owner. How to handle it?
There was a problem hiding this comment.
Could we grant all privileges (read and write) to the owner in StarRocks ?
There was a problem hiding this comment.
You would better clarify these in the documents.
Code Coverage Report
|
| | Gravitino object | Gravitino privilege | StarRocks privilege | StarRocks resource | | ||
| |------------------|---------------------|-------------------------------------------------|------------------------------------| | ||
| | Catalog | `USE_CATALOG` | `USAGE` | `default_catalog` | | ||
| | Catalog | `USE_SCHEMA` | `USAGE` | `default_catalog` | |
There was a problem hiding this comment.
Why does use_schema map to USAGE?
There was a problem hiding this comment.
The mapping should be removed or marked as unsupported, because StarRocks does not have corresponding schema-level USAGE privilege.
| REVOKE USAGE ON CATALOG `default_catalog` FROM ROLE `catalog_user`; | ||
| ``` | ||
|
|
||
| ## 6. References |
There was a problem hiding this comment.
Gravitino supports Group now.
There was a problem hiding this comment.
I think we can explicitly throw an exception that StarRocks does not support the group concept.
There was a problem hiding this comment.
OK. We can throw an exception since StarRocks does not support the group concept.
| or ownership changes. | ||
|
|
||
| This creates a gap between the Gravitino authorization model and the access control that | ||
| StarRocks enforces when users query StarRocks directly. StarRocks already has a SQL-based |
There was a problem hiding this comment.
We may need to consider that users may change privileges without using Gravitino since they can query data from StarRocks directly, so how do we synchronize the privileges data?
There was a problem hiding this comment.
StarRocks is the single source of truth for authorization, while Gravitino periodically synchronizes privilege information from StarRocks. As a result, the two systems are eventually consistent.
There was a problem hiding this comment.
Since Gravitino leverages Ranger for authorization pushdown, we could consider adopting a similar design to address this scenario, if feasible.
| | Schema | `SELECT_TABLE` | `SELECT` | `default_catalog.{schema}.*` | | ||
| | Schema | `MODIFY_TABLE` | `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `ALTER` | `default_catalog.{schema}.*` | | ||
| | Table | `SELECT_TABLE` | `SELECT` | `default_catalog.{schema}.{table}` | | ||
| | Table | `MODIFY_TABLE` | `SELECT`, `INSERT`, `UPDATE`, `DELETE`, `ALTER` | `default_catalog.{schema}.{table}` | |
There was a problem hiding this comment.
Which privilege can drop the table?
There was a problem hiding this comment.
Which privilege can drop the schema?
There was a problem hiding this comment.
I don't see any DROP privilege mentioned in the Gravitino documentation. It appears that Gravitino uses ownership to control administrative operations such as dropping objects, rather than defining a dedicated DROP privilege.
There was a problem hiding this comment.
Added an Ownership section(4.2) to the document to support DROP permissions. @roryqi
zhaohehuhu
changed the title
3 participants
What changes were proposed in this pull request?
The design proposes adding StarRocks authorization pushdown support by introducing a new authorization-starrocks provider. The proposed plugin would extend the existing JDBC authorization framework, translate Gravitino users, roles, securable objects, and privileges into StarRocks native authorization SQL, and define object/privilege mappings for catalog, schema, and table-level permissions.
Why are the changes needed?
Gravitino currently supports StarRocks metadata management through jdbc-starrocks, but authorization changes in Gravitino are not pushed into StarRocks.
The design is needed to align Gravitino’s unified authorization model with StarRocks’ native RBAC system.
Does this PR introduce any user-facing change?
No. It's a design doc.
How was this patch tested?
no needed.