Examples with Identity com.facebook.presto.spi.security.Identity used on opensource projects

Example 1 with Identity

use of com.facebook.presto.spi.security.Identity in project presto by prestodb.

the class TestQueryQueueDefinition method testNameExpansion.

@Test
public void testNameExpansion() {
    Session session = TestingSession.testSessionBuilder().setIdentity(new Identity("bob", Optional.empty())).setSource("the-internet").build();
    QueryQueueDefinition definition = new QueryQueueDefinition("user.${USER}", 1, 1);
    assertEquals(definition.getExpandedTemplate(session), "user.bob");
    definition = new QueryQueueDefinition("source.${SOURCE}", 1, 1);
    assertEquals(definition.getExpandedTemplate(session), "source.the-internet");
    definition = new QueryQueueDefinition("${USER}.${SOURCE}", 1, 1);
    assertEquals(definition.getExpandedTemplate(session), "bob.the-internet");
    definition = new QueryQueueDefinition("global", 1, 1);
    assertEquals(definition.getExpandedTemplate(session), "global");
}

Example 2 with Identity

use of com.facebook.presto.spi.security.Identity in project presto by prestodb.

the class AbstractTestDistributedQueries method testViewAccessControl.

@Test
public void testViewAccessControl() {
    skipTestUnless(supportsViews());
    Session viewOwnerSession = TestingSession.testSessionBuilder().setIdentity(new Identity("test_view_access_owner", Optional.empty())).setCatalog(getSession().getCatalog().get()).setSchema(getSession().getSchema().get()).build();
    // TEST COLUMN-LEVEL PRIVILEGES
    // view creation permissions are only checked at query time, not at creation
    assertAccessAllowed(viewOwnerSession, "CREATE VIEW test_view_access AS SELECT * FROM orders", privilege("orders", CREATE_VIEW_WITH_SELECT_COLUMNS));
    // verify selecting from a view over a table requires the view owner to have special view creation privileges for the table
    assertAccessDenied("SELECT * FROM test_view_access", "View owner 'test_view_access_owner' cannot create view that selects from .*.orders.*", privilege(viewOwnerSession.getUser(), "orders", CREATE_VIEW_WITH_SELECT_COLUMNS));
    // verify the view owner can select from the view even without special view creation privileges
    assertAccessAllowed(viewOwnerSession, "SELECT * FROM test_view_access", privilege(viewOwnerSession.getUser(), "orders", CREATE_VIEW_WITH_SELECT_COLUMNS));
    // verify selecting from a view over a table does not require the session user to have SELECT privileges on the underlying table
    assertAccessAllowed("SELECT * FROM test_view_access", privilege(getSession().getUser(), "orders", CREATE_VIEW_WITH_SELECT_COLUMNS));
    assertAccessAllowed("SELECT * FROM test_view_access", privilege(getSession().getUser(), "orders", SELECT_COLUMN));
    Session nestedViewOwnerSession = TestingSession.testSessionBuilder().setIdentity(new Identity("test_nested_view_access_owner", Optional.empty())).setCatalog(getSession().getCatalog().get()).setSchema(getSession().getSchema().get()).build();
    // view creation permissions are only checked at query time, not at creation
    assertAccessAllowed(nestedViewOwnerSession, "CREATE VIEW test_nested_view_access AS SELECT * FROM test_view_access", privilege("test_view_access", CREATE_VIEW_WITH_SELECT_COLUMNS));
    // verify selecting from a view over a view requires the view owner of the outer view to have special view creation privileges for the inner view
    assertAccessDenied("SELECT * FROM test_nested_view_access", "View owner 'test_nested_view_access_owner' cannot create view that selects from .*.test_view_access.*", privilege(nestedViewOwnerSession.getUser(), "test_view_access", CREATE_VIEW_WITH_SELECT_COLUMNS));
    // verify selecting from a view over a view does not require the session user to have SELECT privileges for the inner view
    assertAccessAllowed("SELECT * FROM test_nested_view_access", privilege(getSession().getUser(), "test_view_access", CREATE_VIEW_WITH_SELECT_COLUMNS));
    assertAccessAllowed("SELECT * FROM test_nested_view_access", privilege(getSession().getUser(), "test_view_access", SELECT_COLUMN));
    // verify that INVOKER security runs as session user
    assertAccessAllowed(viewOwnerSession, "CREATE VIEW test_invoker_view_access SECURITY INVOKER AS SELECT * FROM orders", privilege("orders", CREATE_VIEW_WITH_SELECT_COLUMNS));
    assertAccessAllowed("SELECT * FROM test_invoker_view_access", privilege(viewOwnerSession.getUser(), "orders", SELECT_COLUMN));
    assertAccessDenied("SELECT * FROM test_invoker_view_access", "Cannot select from columns \\[.*\\] in table .*.orders.*", privilege(getSession().getUser(), "orders", SELECT_COLUMN));
    assertAccessAllowed(nestedViewOwnerSession, "DROP VIEW test_nested_view_access");
    assertAccessAllowed(viewOwnerSession, "DROP VIEW test_view_access");
    assertAccessAllowed(viewOwnerSession, "DROP VIEW test_invoker_view_access");
}

Example 3 with Identity

use of com.facebook.presto.spi.security.Identity in project presto by prestodb.

the class TestHiveIntegrationSmokeTest method testCurrentUserInView.

@Test
public void testCurrentUserInView() {
    checkState(getSession().getCatalog().isPresent(), "catalog is not set");
    checkState(getSession().getSchema().isPresent(), "schema is not set");
    String testAccountsUnqualifiedName = "test_accounts";
    String testAccountsViewUnqualifiedName = "test_accounts_view";
    String testAccountsViewFullyQualifiedName = format("%s.%s.%s", getSession().getCatalog().get(), getSession().getSchema().get(), testAccountsViewUnqualifiedName);
    assertUpdate(format("CREATE TABLE %s AS SELECT user_name, account_name" + "  FROM (VALUES ('user1', 'account1'), ('user2', 'account2'))" + "  t (user_name, account_name)", testAccountsUnqualifiedName), 2);
    assertUpdate(format("CREATE VIEW %s AS SELECT account_name FROM test_accounts WHERE user_name = CURRENT_USER", testAccountsViewUnqualifiedName));
    assertUpdate(format("GRANT SELECT ON %s TO user1", testAccountsViewFullyQualifiedName));
    assertUpdate(format("GRANT SELECT ON %s TO user2", testAccountsViewFullyQualifiedName));
    Session user1 = testSessionBuilder().setCatalog(getSession().getCatalog().get()).setSchema(getSession().getSchema().get()).setIdentity(new Identity("user1", getSession().getIdentity().getPrincipal())).build();
    Session user2 = testSessionBuilder().setCatalog(getSession().getCatalog().get()).setSchema(getSession().getSchema().get()).setIdentity(new Identity("user2", getSession().getIdentity().getPrincipal())).build();
    assertQuery(user1, "SELECT account_name FROM test_accounts_view", "VALUES 'account1'");
    assertQuery(user2, "SELECT account_name FROM test_accounts_view", "VALUES 'account2'");
    assertUpdate("DROP VIEW test_accounts_view");
    assertUpdate("DROP TABLE test_accounts");
}

Example 4 with Identity

use of com.facebook.presto.spi.security.Identity in project presto by prestodb.

the class TestHiveLogicalPlanner method testRefreshMaterializedViewAccessControl.

@Test
public void testRefreshMaterializedViewAccessControl() {
    QueryRunner queryRunner = getQueryRunner();
    Session invokerSession = Session.builder(getSession()).setIdentity(new Identity("test_view_invoker", Optional.empty())).setCatalog(getSession().getCatalog().get()).setSchema(getSession().getSchema().get()).build();
    Session ownerSession = getSession();
    queryRunner.execute(ownerSession, "CREATE TABLE test_orders_base WITH (partitioned_by = ARRAY['orderstatus']) " + "AS SELECT orderkey, custkey, totalprice, orderstatus FROM orders LIMIT 10");
    queryRunner.execute(ownerSession, "CREATE MATERIALIZED VIEW test_orders_view " + "WITH (partitioned_by = ARRAY['orderstatus']) " + "AS SELECT orderkey, totalprice, orderstatus FROM test_orders_base");
    String refreshMaterializedView = "REFRESH MATERIALIZED VIEW test_orders_view WHERE orderstatus = 'F'";
    try {
        // Verify that refresh checks the owner's permission instead of the invoker's permission on the base table
        assertAccessDenied(invokerSession, refreshMaterializedView, "Cannot select from columns \\[.*\\] in table .*test_orders_base.*", privilege(ownerSession.getUser(), "test_orders_base", SELECT_COLUMN));
        assertAccessAllowed(invokerSession, refreshMaterializedView, privilege(invokerSession.getUser(), "test_orders_base", SELECT_COLUMN));
        // Verify that refresh checks owner's permission instead of the invokers permission on the materialized view.
        // Verify that refresh requires INSERT_TABLE permission instead of SELECT_COLUMN permission on the materialized view.
        assertAccessDenied(invokerSession, refreshMaterializedView, "Cannot insert into table .*test_orders_view.*", privilege(ownerSession.getUser(), "test_orders_view", INSERT_TABLE));
        assertAccessAllowed(invokerSession, refreshMaterializedView, privilege(invokerSession.getUser(), "test_orders_view", INSERT_TABLE));
        assertAccessAllowed(invokerSession, refreshMaterializedView, privilege(ownerSession.getUser(), "test_orders_view", SELECT_COLUMN));
        assertAccessAllowed(invokerSession, refreshMaterializedView, privilege(invokerSession.getUser(), "test_orders_view", SELECT_COLUMN));
        // Verify for the owner invoking refresh
        assertAccessDenied(ownerSession, refreshMaterializedView, "Cannot select from columns \\[.*\\] in table .*test_orders_base.*", privilege(ownerSession.getUser(), "test_orders_base", SELECT_COLUMN));
        assertAccessDenied(ownerSession, refreshMaterializedView, "Cannot insert into table .*test_orders_view.*", privilege(ownerSession.getUser(), "test_orders_view", INSERT_TABLE));
        assertAccessAllowed(ownerSession, refreshMaterializedView);
    } finally {
        queryRunner.execute(ownerSession, "DROP MATERIALIZED VIEW test_orders_view");
        queryRunner.execute(ownerSession, "DROP TABLE test_orders_base");
    }
}

Example 5 with Identity

use of com.facebook.presto.spi.security.Identity in project presto by prestodb.

the class TestHiveLogicalPlanner method testMaterializedViewQueryAccessControl.

@Test
public void testMaterializedViewQueryAccessControl() {
    QueryRunner queryRunner = getQueryRunner();
    Session invokerSession = Session.builder(getSession()).setIdentity(new Identity("test_view_invoker", Optional.empty())).setCatalog(getSession().getCatalog().get()).setSchema(getSession().getSchema().get()).setSystemProperty(QUERY_OPTIMIZATION_WITH_MATERIALIZED_VIEW_ENABLED, "true").build();
    Session ownerSession = getSession();
    queryRunner.execute(ownerSession, "CREATE TABLE test_orders_base WITH (partitioned_by = ARRAY['orderstatus']) " + "AS SELECT orderkey, custkey, totalprice, orderstatus FROM orders LIMIT 10");
    queryRunner.execute(ownerSession, "CREATE MATERIALIZED VIEW test_orders_view " + "WITH (partitioned_by = ARRAY['orderstatus']) " + "AS SELECT SUM(totalprice) AS totalprice, orderstatus FROM test_orders_base GROUP BY orderstatus");
    setReferencedMaterializedViews((DistributedQueryRunner) getQueryRunner(), "test_orders_base", ImmutableList.of("test_orders_view"));
    Consumer<String> testQueryWithDeniedPrivilege = query -> {
        // Verify checking the base table instead of the materialized view for SELECT permission
        assertAccessDenied(invokerSession, query, "Cannot select from columns \\[.*\\] in table .*test_orders_base.*", privilege(invokerSession.getUser(), "test_orders_base", SELECT_COLUMN));
        assertAccessAllowed(invokerSession, query, privilege(invokerSession.getUser(), "test_orders_view", SELECT_COLUMN));
    };
    try {
        // Check for both the direct materialized view query and the base table query optimization with materialized view
        String directMaterializedViewQuery = "SELECT totalprice, orderstatus FROM test_orders_view";
        String queryWithMaterializedViewOptimization = "SELECT SUM(totalprice) AS totalprice, orderstatus FROM test_orders_base GROUP BY orderstatus";
        // Test when the materialized view is not materialized yet
        testQueryWithDeniedPrivilege.accept(directMaterializedViewQuery);
        testQueryWithDeniedPrivilege.accept(queryWithMaterializedViewOptimization);
        // Test when the materialized view is partially materialized
        queryRunner.execute(ownerSession, "REFRESH MATERIALIZED VIEW test_orders_view WHERE orderstatus = 'F'");
        testQueryWithDeniedPrivilege.accept(directMaterializedViewQuery);
        testQueryWithDeniedPrivilege.accept(queryWithMaterializedViewOptimization);
        // Test when the materialized view is fully materialized
        queryRunner.execute(ownerSession, "REFRESH MATERIALIZED VIEW test_orders_view WHERE orderstatus <> 'F'");
        testQueryWithDeniedPrivilege.accept(directMaterializedViewQuery);
        testQueryWithDeniedPrivilege.accept(queryWithMaterializedViewOptimization);
    } finally {
        queryRunner.execute(ownerSession, "DROP MATERIALIZED VIEW test_orders_view");
        queryRunner.execute(ownerSession, "DROP TABLE test_orders_base");
    }
}