Examples with SystemAccessControl io.trino.spi.security.SystemAccessControl used on opensource projects

Example 6 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testSessionPropertyRules.

@Test
public void testSessionPropertyRules() {
    SystemAccessControl accessControl = newFileBasedSystemAccessControl("file-based-system-access-session-property.json");
    accessControl.checkCanSetSystemSessionProperty(ADMIN, "dangerous");
    accessControl.checkCanSetSystemSessionProperty(ADMIN, "any");
    accessControl.checkCanSetSystemSessionProperty(ALICE, "safe");
    accessControl.checkCanSetSystemSessionProperty(ALICE, "unsafe");
    accessControl.checkCanSetSystemSessionProperty(ALICE, "staff");
    accessControl.checkCanSetSystemSessionProperty(BOB, "safe");
    accessControl.checkCanSetSystemSessionProperty(BOB, "staff");
    assertAccessDenied(() -> accessControl.checkCanSetSystemSessionProperty(BOB, "unsafe"), SET_SYSTEM_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetSystemSessionProperty(ALICE, "dangerous"), SET_SYSTEM_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetSystemSessionProperty(CHARLIE, "safe"), SET_SYSTEM_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetSystemSessionProperty(CHARLIE, "staff"), SET_SYSTEM_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetSystemSessionProperty(JOE, "staff"), SET_SYSTEM_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    accessControl.checkCanSetCatalogSessionProperty(ADMIN, "any", "dangerous");
    accessControl.checkCanSetCatalogSessionProperty(ADMIN, "alice-catalog", "dangerous");
    accessControl.checkCanSetCatalogSessionProperty(ADMIN, "any", "any");
    accessControl.checkCanSetCatalogSessionProperty(ALICE, "alice-catalog", "safe");
    accessControl.checkCanSetCatalogSessionProperty(ALICE, "alice-catalog", "unsafe");
    accessControl.checkCanSetCatalogSessionProperty(ALICE, "staff-catalog", "staff");
    accessControl.checkCanSetCatalogSessionProperty(BOB, "bob-catalog", "safe");
    accessControl.checkCanSetCatalogSessionProperty(BOB, "staff-catalog", "staff");
    assertAccessDenied(() -> accessControl.checkCanSetCatalogSessionProperty(BOB, "bob-catalog", "any"), SET_CATALOG_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetCatalogSessionProperty(BOB, "alice-catalog", "any"), SET_CATALOG_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetCatalogSessionProperty(BOB, "staff-catalog", "any"), SET_CATALOG_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetCatalogSessionProperty(ALICE, "alice-catalog", "dangerous"), SET_CATALOG_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetCatalogSessionProperty(CHARLIE, "bob-catalog", "safe"), SET_CATALOG_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetCatalogSessionProperty(CHARLIE, "staff-catalog", "staff"), SET_CATALOG_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetCatalogSessionProperty(JOE, "staff-catalog", "staff"), SET_CATALOG_SESSION_PROPERTY_ACCESS_DENIED_MESSAGE);
}

Example 7 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testSystemInformationNotSet.

@Test
public void testSystemInformationNotSet() {
    SystemAccessControl accessControlManager = newFileBasedSystemAccessControl("file-based-system-catalog.json");
    assertThatThrownBy(() -> accessControlManager.checkCanReadSystemInformation(new SystemSecurityContext(bob, Optional.empty()))).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot read system information");
    assertThatThrownBy(() -> accessControlManager.checkCanWriteSystemInformation(new SystemSecurityContext(bob, Optional.empty()))).isInstanceOf(AccessDeniedException.class).hasMessage("Access Denied: Cannot write system information");
}

Example 8 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testTableRulesForCheckCanShowColumns.

@Test
public void testTableRulesForCheckCanShowColumns() {
    SystemAccessControl accessControl = newFileBasedSystemAccessControl("file-based-system-access-table.json");
    accessControl.checkCanShowColumns(ALICE, new CatalogSchemaTableName("some-catalog", "bobschema", "bobtable"));
    accessControl.checkCanShowColumns(BOB, new CatalogSchemaTableName("some-catalog", "bobschema", "bobtable"));
}

Example 9 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testTableRulesForCheckCanSetMaterializedViewProperties.

@Test
public void testTableRulesForCheckCanSetMaterializedViewProperties() {
    SystemAccessControl accessControl = newFileBasedSystemAccessControl("file-based-system-access-table.json");
    accessControl.checkCanSetMaterializedViewProperties(ADMIN, new CatalogSchemaTableName("some-catalog", "bobschema", "bob-materialized-view"), ImmutableMap.of());
    accessControl.checkCanSetMaterializedViewProperties(ALICE, new CatalogSchemaTableName("some-catalog", "aliceschema", "alice-materialized-view"), ImmutableMap.of());
    assertAccessDenied(() -> accessControl.checkCanSetMaterializedViewProperties(ALICE, new CatalogSchemaTableName("some-catalog", "bobschema", "bob-materialized-view"), ImmutableMap.of()), SET_MATERIALIZED_VIEW_PROPERTIES_ACCESS_DENIED_MESSAGE);
    assertAccessDenied(() -> accessControl.checkCanSetMaterializedViewProperties(BOB, new CatalogSchemaTableName("some-catalog", "bobschema", "bob-materialized-view"), ImmutableMap.of()), SET_MATERIALIZED_VIEW_PROPERTIES_ACCESS_DENIED_MESSAGE);
}

Example 10 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class TestFileBasedSystemAccessControl method testCheckCanSetViewAuthorizationForOwner.

@Test
public void testCheckCanSetViewAuthorizationForOwner() {
    SystemAccessControl accessControl = newFileBasedSystemAccessControl("file-based-system-access-table.json");
    accessControl.checkCanSetViewAuthorization(ALICE, new CatalogSchemaTableName("some-catalog", "aliceschema", "test"), new TrinoPrincipal(PrincipalType.ROLE, "some_role"));
    accessControl.checkCanSetViewAuthorization(ALICE, new CatalogSchemaTableName("some-catalog", "aliceschema", "test"), new TrinoPrincipal(PrincipalType.USER, "some_user"));
}