Examples with SystemAccessControl io.trino.spi.security.SystemAccessControl used on opensource projects

Example 36 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class TestUserImpersonationAccessControl method createQueryRunner.

@Override
protected QueryRunner createQueryRunner() throws Exception {
    String securityConfigFile = getResource("access_control_rules.json").getPath();
    SystemAccessControl accessControl = new FileBasedSystemAccessControl.Factory().create(ImmutableMap.of(SECURITY_CONFIG_FILE, securityConfigFile));
    QueryRunner queryRunner = DistributedQueryRunner.builder(TEST_SESSION).setNodeCount(1).setSystemAccessControl(accessControl).build();
    queryRunner.installPlugin(new TpchPlugin());
    queryRunner.createCatalog("tpch", "tpch", ImmutableMap.of());
    return queryRunner;
}

Example 37 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class TestAccessControlManager method testColumnMaskOrdering.

@Test
public void testColumnMaskOrdering() {
    try (LocalQueryRunner queryRunner = LocalQueryRunner.create(TEST_SESSION)) {
        TransactionManager transactionManager = queryRunner.getTransactionManager();
        AccessControlManager accessControlManager = createAccessControlManager(transactionManager);
        accessControlManager.addSystemAccessControlFactory(new SystemAccessControlFactory() {

            @Override
            public String getName() {
                return "test";
            }

            @Override
            public SystemAccessControl create(Map<String, String> config) {
                return new SystemAccessControl() {

                    @Override
                    public Optional<ViewExpression> getColumnMask(SystemSecurityContext context, CatalogSchemaTableName tableName, String column, Type type) {
                        return Optional.of(new ViewExpression("user", Optional.empty(), Optional.empty(), "system mask"));
                    }

                    @Override
                    public void checkCanSetSystemSessionProperty(SystemSecurityContext context, String propertyName) {
                    }
                };
            }
        });
        accessControlManager.setSystemAccessControl("test", ImmutableMap.of());
        queryRunner.createCatalog("catalog", MockConnectorFactory.create(), ImmutableMap.of());
        accessControlManager.addCatalogAccessControl(new CatalogName("catalog"), new ConnectorAccessControl() {

            @Override
            public Optional<ViewExpression> getColumnMask(ConnectorSecurityContext context, SchemaTableName tableName, String column, Type type) {
                return Optional.of(new ViewExpression("user", Optional.empty(), Optional.empty(), "connector mask"));
            }

            @Override
            public void checkCanShowCreateTable(ConnectorSecurityContext context, SchemaTableName tableName) {
            }
        });
        transaction(transactionManager, accessControlManager).execute(transactionId -> {
            List<ViewExpression> masks = accessControlManager.getColumnMasks(context(transactionId), new QualifiedObjectName("catalog", "schema", "table"), "column", BIGINT);
            assertEquals(masks.get(0).getExpression(), "connector mask");
            assertEquals(masks.get(1).getExpression(), "system mask");
        });
    }
}

Example 38 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class AccessControlManager method filterColumns.

@Override
public Set<String> filterColumns(SecurityContext securityContext, CatalogSchemaTableName table, Set<String> columns) {
    requireNonNull(securityContext, "securityContext is null");
    requireNonNull(table, "tableName is null");
    if (filterTables(securityContext, table.getCatalogName(), ImmutableSet.of(table.getSchemaTableName())).isEmpty()) {
        return ImmutableSet.of();
    }
    for (SystemAccessControl systemAccessControl : getSystemAccessControls()) {
        columns = systemAccessControl.filterColumns(securityContext.toSystemSecurityContext(), table, columns);
    }
    CatalogAccessControlEntry entry = getConnectorAccessControl(securityContext.getTransactionId(), table.getCatalogName());
    if (entry != null) {
        columns = entry.getAccessControl().filterColumns(entry.toConnectorSecurityContext(securityContext), table.getSchemaTableName(), columns);
    }
    return columns;
}

Example 39 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class AccessControlManager method getColumnMasks.

@Override
public List<ViewExpression> getColumnMasks(SecurityContext context, QualifiedObjectName tableName, String columnName, Type type) {
    requireNonNull(context, "context is null");
    requireNonNull(tableName, "tableName is null");
    ImmutableList.Builder<ViewExpression> masks = ImmutableList.builder();
    // connector-provided masks take precedence over global masks
    CatalogAccessControlEntry entry = getConnectorAccessControl(context.getTransactionId(), tableName.getCatalogName());
    if (entry != null) {
        entry.getAccessControl().getColumnMask(entry.toConnectorSecurityContext(context), tableName.asSchemaTableName(), columnName, type).ifPresent(masks::add);
    }
    for (SystemAccessControl systemAccessControl : getSystemAccessControls()) {
        systemAccessControl.getColumnMask(context.toSystemSecurityContext(), tableName.asCatalogSchemaTableName(), columnName, type).ifPresent(masks::add);
    }
    return masks.build();
}

Example 40 with SystemAccessControl

use of io.trino.spi.security.SystemAccessControl in project trino by trinodb.

the class AccessControlManager method filterCatalogs.

@Override
public Set<String> filterCatalogs(SecurityContext securityContext, Set<String> catalogs) {
    requireNonNull(securityContext, "securityContext is null");
    requireNonNull(catalogs, "catalogs is null");
    for (SystemAccessControl systemAccessControl : getSystemAccessControls()) {
        catalogs = systemAccessControl.filterCatalogs(securityContext.toSystemSecurityContext(), catalogs);
    }
    return catalogs;
}