com.facebook.presto.spi.security

Interface SystemAccessControl

public interface SystemAccessControl

Method Summary

Modifier and Type	Method and Description
default void	checkCanAccessCatalog(Identity identity, AccessControlContext context, String catalogName) Check if identity is allowed to access the specified catalog
default void	checkCanAddColumn(Identity identity, AccessControlContext context, CatalogSchemaTableName table) Check if identity is allowed to add columns to the specified table in a catalog.
default void	checkCanCreateSchema(Identity identity, AccessControlContext context, CatalogSchemaName schema) Check if identity is allowed to create the specified schema in a catalog.
default void	checkCanCreateTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) Check if identity is allowed to create the specified table in a catalog.
default void	checkCanCreateView(Identity identity, AccessControlContext context, CatalogSchemaTableName view) Check if identity is allowed to create the specified view in a catalog.
default void	checkCanCreateViewWithSelectFromColumns(Identity identity, AccessControlContext context, CatalogSchemaTableName table, Set<String> columns) Check if identity is allowed to create a view that selects from the specified columns in a relation.
default void	checkCanDeleteFromTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) Check if identity is allowed to delete from the specified table in a catalog.
default void	checkCanDropColumn(Identity identity, AccessControlContext context, CatalogSchemaTableName table) Check if identity is allowed to drop columns from the specified table in a catalog.
default void	checkCanDropSchema(Identity identity, AccessControlContext context, CatalogSchemaName schema) Check if identity is allowed to drop the specified schema in a catalog.
default void	checkCanDropTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) Check if identity is allowed to drop the specified table in a catalog.
default void	checkCanDropView(Identity identity, AccessControlContext context, CatalogSchemaTableName view) Check if identity is allowed to drop the specified view in a catalog.
default void	checkCanGrantTablePrivilege(Identity identity, AccessControlContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal grantee, boolean withGrantOption) Check if identity is allowed to grant the specified privilege to the grantee on the specified table.
default void	checkCanInsertIntoTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) Check if identity is allowed to insert into the specified table in a catalog.
default void	checkCanRenameColumn(Identity identity, AccessControlContext context, CatalogSchemaTableName table) Check if identity is allowed to rename a column in the specified table in a catalog.
default void	checkCanRenameSchema(Identity identity, AccessControlContext context, CatalogSchemaName schema, String newSchemaName) Check if identity is allowed to rename the specified schema in a catalog.
default void	checkCanRenameTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table, CatalogSchemaTableName newTable) Check if identity is allowed to rename the specified table in a catalog.
default void	checkCanRevokeTablePrivilege(Identity identity, AccessControlContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal revokee, boolean grantOptionFor) Check if identity is allowed to revoke the specified privilege on the specified table from the revokee.
default void	checkCanSelectFromColumns(Identity identity, AccessControlContext context, CatalogSchemaTableName table, Set<String> columns) Check if identity is allowed to select from the specified columns in a relation.
default void	checkCanSetCatalogSessionProperty(Identity identity, AccessControlContext context, String catalogName, String propertyName) Check if identity is allowed to set the specified property in a catalog.
void	checkCanSetSystemSessionProperty(Identity identity, AccessControlContext context, String propertyName) Check if identity is allowed to set the specified system property.
void	checkCanSetUser(Identity identity, AccessControlContext context, Optional<Principal> principal, String userName) Check if the principal is allowed to be the specified user.
default void	checkCanShowSchemas(Identity identity, AccessControlContext context, String catalogName) Check if identity is allowed to execute SHOW SCHEMAS in a catalog.
default void	checkCanShowTablesMetadata(Identity identity, AccessControlContext context, CatalogSchemaName schema) Check if identity is allowed to show metadata of tables by executing SHOW TABLES, SHOW GRANTS etc.
default void	checkCanTruncateTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) Check if identity is allowed to truncate the specified table in a catalog.
void	checkQueryIntegrity(Identity identity, AccessControlContext context, String query) Check if the query is unexpectedly modified using the credentials passed in the identity.
default Set<String>	filterCatalogs(Identity identity, AccessControlContext context, Set<String> catalogs) Filter the list of catalogs to those visible to the identity.
default Set<String>	filterSchemas(Identity identity, AccessControlContext context, String catalogName, Set<String> schemaNames) Filter the list of schemas in a catalog to those visible to the identity.
default Set<SchemaTableName>	filterTables(Identity identity, AccessControlContext context, String catalogName, Set<SchemaTableName> tableNames) Filter the list of tables and views to those visible to the identity.
default AuthorizedIdentity	selectAuthorizedIdentity(Identity identity, AccessControlContext context, String userName, List<X509Certificate> certificates)

Method Detail

checkCanSetUser

void checkCanSetUser(Identity identity,
                     AccessControlContext context,
                     Optional<Principal> principal,
                     String userName)

Check if the principal is allowed to be the specified user.

Throws:

AccessDeniedException - if not allowed

selectAuthorizedIdentity

default AuthorizedIdentity selectAuthorizedIdentity(Identity identity,
                                                    AccessControlContext context,
                                                    String userName,
                                                    List<X509Certificate> certificates)

checkQueryIntegrity

void checkQueryIntegrity(Identity identity,
                         AccessControlContext context,
                         String query)

Check if the query is unexpectedly modified using the credentials passed in the identity.

Throws:

AccessDeniedException - if query is modified.

checkCanSetSystemSessionProperty

void checkCanSetSystemSessionProperty(Identity identity,
                                      AccessControlContext context,
                                      String propertyName)

Check if identity is allowed to set the specified system property.

Throws:

AccessDeniedException - if not allowed

checkCanAccessCatalog

default void checkCanAccessCatalog(Identity identity,
                                   AccessControlContext context,
                                   String catalogName)

Check if identity is allowed to access the specified catalog

Throws:

AccessDeniedException - if not allowed

filterCatalogs

default Set<String> filterCatalogs(Identity identity,
                                   AccessControlContext context,
                                   Set<String> catalogs)

Filter the list of catalogs to those visible to the identity.

checkCanCreateSchema

default void checkCanCreateSchema(Identity identity,
                                  AccessControlContext context,
                                  CatalogSchemaName schema)

Check if identity is allowed to create the specified schema in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanDropSchema

default void checkCanDropSchema(Identity identity,
                                AccessControlContext context,
                                CatalogSchemaName schema)

Check if identity is allowed to drop the specified schema in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanRenameSchema

default void checkCanRenameSchema(Identity identity,
                                  AccessControlContext context,
                                  CatalogSchemaName schema,
                                  String newSchemaName)

Check if identity is allowed to rename the specified schema in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanShowSchemas

default void checkCanShowSchemas(Identity identity,
                                 AccessControlContext context,
                                 String catalogName)

Check if identity is allowed to execute SHOW SCHEMAS in a catalog.

NOTE: This method is only present to give users an error message when listing is not allowed. The filterSchemas(com.facebook.presto.spi.security.Identity, com.facebook.presto.spi.security.AccessControlContext, java.lang.String, java.util.Set<java.lang.String>) method must filter all results for unauthorized users, since there are multiple ways to list schemas.

Throws:

AccessDeniedException - if not allowed

filterSchemas

default Set<String> filterSchemas(Identity identity,
                                  AccessControlContext context,
                                  String catalogName,
                                  Set<String> schemaNames)

Filter the list of schemas in a catalog to those visible to the identity.

checkCanCreateTable

default void checkCanCreateTable(Identity identity,
                                 AccessControlContext context,
                                 CatalogSchemaTableName table)

Check if identity is allowed to create the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanDropTable

default void checkCanDropTable(Identity identity,
                               AccessControlContext context,
                               CatalogSchemaTableName table)

Check if identity is allowed to drop the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanRenameTable

default void checkCanRenameTable(Identity identity,
                                 AccessControlContext context,
                                 CatalogSchemaTableName table,
                                 CatalogSchemaTableName newTable)

Check if identity is allowed to rename the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanShowTablesMetadata

default void checkCanShowTablesMetadata(Identity identity,
                                        AccessControlContext context,
                                        CatalogSchemaName schema)

Check if identity is allowed to show metadata of tables by executing SHOW TABLES, SHOW GRANTS etc. in a catalog.

NOTE: This method is only present to give users an error message when listing is not allowed. The filterTables(com.facebook.presto.spi.security.Identity, com.facebook.presto.spi.security.AccessControlContext, java.lang.String, java.util.Set<com.facebook.presto.spi.SchemaTableName>) method must filter all results for unauthorized users, since there are multiple ways to list tables.

Throws:

AccessDeniedException - if not allowed

filterTables

default Set<SchemaTableName> filterTables(Identity identity,
                                          AccessControlContext context,
                                          String catalogName,
                                          Set<SchemaTableName> tableNames)

Filter the list of tables and views to those visible to the identity.

checkCanAddColumn

default void checkCanAddColumn(Identity identity,
                               AccessControlContext context,
                               CatalogSchemaTableName table)

Check if identity is allowed to add columns to the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanDropColumn

default void checkCanDropColumn(Identity identity,
                                AccessControlContext context,
                                CatalogSchemaTableName table)

Check if identity is allowed to drop columns from the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanRenameColumn

default void checkCanRenameColumn(Identity identity,
                                  AccessControlContext context,
                                  CatalogSchemaTableName table)

Check if identity is allowed to rename a column in the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanSelectFromColumns

default void checkCanSelectFromColumns(Identity identity,
                                       AccessControlContext context,
                                       CatalogSchemaTableName table,
                                       Set<String> columns)

Check if identity is allowed to select from the specified columns in a relation. The column set can be empty.

Throws:

AccessDeniedException - if not allowed

checkCanInsertIntoTable

default void checkCanInsertIntoTable(Identity identity,
                                     AccessControlContext context,
                                     CatalogSchemaTableName table)

Check if identity is allowed to insert into the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanDeleteFromTable

default void checkCanDeleteFromTable(Identity identity,
                                     AccessControlContext context,
                                     CatalogSchemaTableName table)

Check if identity is allowed to delete from the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanTruncateTable

default void checkCanTruncateTable(Identity identity,
                                   AccessControlContext context,
                                   CatalogSchemaTableName table)

Check if identity is allowed to truncate the specified table in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanCreateView

default void checkCanCreateView(Identity identity,
                                AccessControlContext context,
                                CatalogSchemaTableName view)

Check if identity is allowed to create the specified view in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanDropView

default void checkCanDropView(Identity identity,
                              AccessControlContext context,
                              CatalogSchemaTableName view)

Check if identity is allowed to drop the specified view in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanCreateViewWithSelectFromColumns

default void checkCanCreateViewWithSelectFromColumns(Identity identity,
                                                     AccessControlContext context,
                                                     CatalogSchemaTableName table,
                                                     Set<String> columns)

Check if identity is allowed to create a view that selects from the specified columns in a relation.

Throws:

AccessDeniedException - if not allowed

checkCanSetCatalogSessionProperty

default void checkCanSetCatalogSessionProperty(Identity identity,
                                               AccessControlContext context,
                                               String catalogName,
                                               String propertyName)

Check if identity is allowed to set the specified property in a catalog.

Throws:

AccessDeniedException - if not allowed

checkCanGrantTablePrivilege

default void checkCanGrantTablePrivilege(Identity identity,
                                         AccessControlContext context,
                                         Privilege privilege,
                                         CatalogSchemaTableName table,
                                         PrestoPrincipal grantee,
                                         boolean withGrantOption)

Check if identity is allowed to grant the specified privilege to the grantee on the specified table.

Throws:

AccessDeniedException - if not allowed

checkCanRevokeTablePrivilege

default void checkCanRevokeTablePrivilege(Identity identity,
                                          AccessControlContext context,
                                          Privilege privilege,
                                          CatalogSchemaTableName table,
                                          PrestoPrincipal revokee,
                                          boolean grantOptionFor)

Check if identity is allowed to revoke the specified privilege on the specified table from the revokee.

Throws:

AccessDeniedException - if not allowed