use of io.trino.spi.security.PrincipalType.USER in project trino by trinodb.
the class SqlStandardAccessControl method isDatabaseOwner.
private boolean isDatabaseOwner(ConnectorSecurityContext context, String databaseName) {
// all users are "owners" of the default database
if (DEFAULT_DATABASE_NAME.equalsIgnoreCase(databaseName)) {
return true;
}
if (isAdmin(context)) {
return true;
}
Optional<Database> databaseMetadata = metastore.getDatabase(context, databaseName);
if (databaseMetadata.isEmpty()) {
return false;
}
Database database = databaseMetadata.get();
// a database can be owned by a user or role
ConnectorIdentity identity = context.getIdentity();
if (database.getOwnerName().isPresent()) {
if (database.getOwnerType().orElse(null) == USER && identity.getUser().equals(database.getOwnerName().get())) {
return true;
}
if (database.getOwnerType().orElse(null) == ROLE && isRoleEnabled(identity, hivePrincipal -> metastore.listRoleGrants(context, hivePrincipal), database.getOwnerName().get())) {
return true;
}
}
return false;
}
use of io.trino.spi.security.PrincipalType.USER in project trino by trinodb.
the class TestSetRoleTask method setUp.
@BeforeClass
public void setUp() {
queryRunner = LocalQueryRunner.create(TEST_SESSION);
MockConnectorFactory mockConnectorFactory = MockConnectorFactory.builder().withListRoleGrants((connectorSession, roles, grantees, limit) -> ImmutableSet.of(new RoleGrant(new TrinoPrincipal(USER, USER_NAME), ROLE_NAME, false))).build();
queryRunner.createCatalog(CATALOG_NAME, mockConnectorFactory, ImmutableMap.of());
MockConnectorFactory systemConnectorFactory = MockConnectorFactory.builder().withName("system_role_connector").build();
queryRunner.createCatalog(SYSTEM_ROLE_CATALOG_NAME, systemConnectorFactory, ImmutableMap.of());
transactionManager = queryRunner.getTransactionManager();
accessControl = queryRunner.getAccessControl();
metadata = queryRunner.getMetadata();
parser = queryRunner.getSqlParser();
executor = newCachedThreadPool(daemonThreadsNamed("test-set-role-task-executor-%s"));
}
use of io.trino.spi.security.PrincipalType.USER in project trino by trinodb.
the class TestRevokeOnTable method initClass.
@BeforeClass
public void initClass() throws Exception {
SchemaTableName table = new SchemaTableName("default", "table_one");
queryRunner = DistributedQueryRunner.builder(userWithAllPrivileges).build();
Grants<SchemaTableName> tableGrants = new MutableGrants<>();
tableGrants.grant(new TrinoPrincipal(USER, admin.getUser()), table, EnumSet.allOf(Privilege.class), true);
tableGrants.grant(new TrinoPrincipal(USER, userWithAllPrivileges.getUser()), table, EnumSet.allOf(Privilege.class), true);
tableGrants.grant(new TrinoPrincipal(USER, userWithCreate.getUser()), table, ImmutableSet.of(Privilege.CREATE), true);
tableGrants.grant(new TrinoPrincipal(USER, userWithSelect.getUser()), table, ImmutableSet.of(Privilege.SELECT), true);
tableGrants.grant(new TrinoPrincipal(USER, userWithInsert.getUser()), table, ImmutableSet.of(Privilege.INSERT), true);
tableGrants.grant(new TrinoPrincipal(USER, userWithUpdate.getUser()), table, ImmutableSet.of(Privilege.UPDATE), true);
tableGrants.grant(new TrinoPrincipal(USER, userWithDelete.getUser()), table, ImmutableSet.of(Privilege.DELETE), true);
MockConnectorFactory connectorFactory = MockConnectorFactory.builder().withListSchemaNames(session -> ImmutableList.of("default")).withListTables((session, schemaName) -> "default".equalsIgnoreCase(schemaName) ? ImmutableList.of(table) : ImmutableList.of()).withGetTableHandle((session, tableName) -> tableName.equals(table) ? new MockConnectorTableHandle(tableName) : null).withSchemaGrants(new MutableGrants<>()).withTableGrants(tableGrants).build();
queryRunner.installPlugin(new MockConnectorPlugin(connectorFactory));
queryRunner.createCatalog("local", "mock");
assertions = new QueryAssertions(queryRunner);
}
use of io.trino.spi.security.PrincipalType.USER in project trino by trinodb.
the class TestFileBasedSystemAccessControl method testViewOperationsReadOnly.
@Test
public void testViewOperationsReadOnly() {
TransactionManager transactionManager = createTestTransactionManager();
AccessControlManager accessControlManager = newAccessControlManager(transactionManager, "catalog_read_only.json");
transaction(transactionManager, accessControlManager).execute(transactionId -> {
SecurityContext context = new SecurityContext(transactionId, alice, queryId);
accessControlManager.checkCanSelectFromColumns(context, aliceView, ImmutableSet.of());
accessControlManager.checkCanSetCatalogSessionProperty(context, "alice-catalog", "property");
});
assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
accessControlManager.checkCanCreateView(new SecurityContext(transactionId, alice, queryId), aliceView);
})).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot create view alice-catalog.schema.view");
assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
accessControlManager.checkCanDropView(new SecurityContext(transactionId, alice, queryId), aliceView);
})).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot drop view alice-catalog.schema.view");
assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
accessControlManager.checkCanGrantTablePrivilege(new SecurityContext(transactionId, alice, queryId), SELECT, aliceTable, new TrinoPrincipal(USER, "grantee"), true);
})).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot grant privilege SELECT on table alice-catalog.schema.table");
assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
accessControlManager.checkCanRevokeTablePrivilege(new SecurityContext(transactionId, alice, queryId), SELECT, aliceTable, new TrinoPrincipal(USER, "revokee"), true);
})).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot revoke privilege SELECT on table alice-catalog.schema.table");
assertThatThrownBy(() -> transaction(transactionManager, accessControlManager).execute(transactionId -> {
accessControlManager.checkCanCreateView(new SecurityContext(transactionId, bob, queryId), aliceView);
})).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot access catalog alice-catalog");
}
use of io.trino.spi.security.PrincipalType.USER in project trino by trinodb.
the class SqlStandardAccessControl method listApplicableTablePrivileges.
private Stream<HivePrivilegeInfo> listApplicableTablePrivileges(ConnectorSecurityContext context, String databaseName, String tableName, ConnectorIdentity identity) {
String user = identity.getUser();
HivePrincipal userPrincipal = new HivePrincipal(USER, user);
Stream<HivePrincipal> principals = Stream.concat(Stream.of(userPrincipal), listApplicableRoles(userPrincipal, hivePrincipal -> metastore.listRoleGrants(context, hivePrincipal)).map(role -> new HivePrincipal(ROLE, role.getRoleName())));
return listTablePrivileges(context, databaseName, tableName, principals);
}
Aggregations