[IMPALA-7571] is_member() function to determine if the current user is in a group

• Type: New Feature
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Component/s: Security
• Epic Color: ghx-label-7
• Assignee: Unassigned
• Reporter: Zsombor Fedor
• Created: 14/Sep/18 12:43
• Updated: 14/Sep/18 12:49

Description

A function which returns if a user is member of a group.

 

Basically, depending on user groups membership, we could mask or hide certain columns or rows of data, similarly how it's implemented in Dremio. Similar concept is available in Oracle, it's called Oracle Virtual Private Database. 

 

It can be implemented for other user-to-group mappings too.

 

For example Dremio, uses a cache for is_member() calls (defautls to 24h), so this group membership check can be cached and consequentially resolved very quickly.

 

For reference:

https://docs.dremio.com/security/column-masking.html

https://docs.dremio.com/security/row-level-permissions.html

https://docs.oracle.com/cd/B28359_01/network.111/b28531/vpd.htm

 

Sub-Tasks

• Impala Doc: is_member() function to determine if the current user is in a group: Open