[ATLAS-2459] Authorization enhancements to support instance level access controls

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.0
• Component/s: atlas-core
• Assignee: Nixon Rodrigues
• Reporter: Srikanth Venkat
• Created: 23/Feb/18 00:18
• Updated: 16/May/18 21:09
• Resolved: 16/May/18 21:06

Description

Current authorization model in Atlas supports policies at the level of operations - like which users/groups can create/update/delete of types/classifications/entities.

This model needs to be enhanced/replaced to support more finer level of control - for example:

• control operations on entity instances based on entity-type/entity-classification/entity-id
  • users/groups allowed to create/update/delete entities, add/update/remove classifications on entities, what classifications users are allowed to add/update/remove, etc
• control operations on types based on type-name/type-category
  • users/groups allowed to create/update/delete classifications, relationships, etc
• control access to admin operations - like import/export

Issue Links

• requires: ATLAS-2515 add classification to the entity fails if there is no read classification permission
• requires: ATLAS-2463 Documentation for Atlas authorization at instance level
• requires: ATLAS-2486 Policy json file for authorization in distro conf
• requires: ATLAS-2503 Fix authorization while creating/updating EnumDef
• requires: ATLAS-2505 Set client IP to authorization request call for audit logging.
• requires: ATLAS-2544 Initialize Atlas Authorizer after typedef initialization