[RANGER-4810] Move Trino authorizer implementation from Ranger git repo to Trino repo

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0, 2.5.0
• Component/s: plugins
• Assignee: Madhan Neethiraj
• Reporter: Madhan Neethiraj
• Created: 06/Jun/24 21:04
• Updated: 11/Aug/24 17:26
• Resolved: 11/Aug/24 17:26

Description

Moving Trino authorizer implementation from Ranger git repo to Trino repo has several advantages, including:

1. Keeping the authorizer in sync with the updates in SystemAccessControl interface. For example, following changes in the latest Trino repo are not compatible with the Trino authorizer in Ranger repo:
   1. SystemAccessControl.checkCanAccessCatalog(): removed
   2. SystemAccessControl.getRowFilter(): replaced with getRowFilters()
   3. SystemAccessControl.getColumnMasks(): replaced with getColumnMask()
   4. SystemAccessControl.checkCanSetSystemSessionProperty(): removed
   5. SystemAccessControl.checkCanImpersonateUser(): signature changed
   6. SystemAccessControl.checkCanAccessCatalog(): removed
   7. SystemAccessControl.checkCanCreateSchema(): signature changed
   8. SystemAccessControl.checkCanExecuteQuery(): removed
   9. SystemAccessControl.checkCanViewQueryOwnedBy(): removed
   10. SystemAccessControl.filterViewQueryOwnedBy(): signature changed
   11. SystemAccessControl.checkCanKillQueryOwnedBy(): removed
   12. SystemAccessControl.checkCanGrantExecuteFunctionPrivilege(): removed/replaced
   13. SystemAccessControl.checkCanExecuteFunction(): signature changed
   14. ViewExpression(): constructor changed
   15. AccessDeniedException.denyGrantExecuteFunctionPrivilege(): removed
2. Trino requires more recent JDK versions (currently JDK 22) than Ranger repo (which still supports JDK 8). Trino authorizer is built separately, as a second phase, in Ranger repo using higher JDK versions. Moving the authorizer to Trino repo will avoid this additional step.

 

Trino seems to have a class loader isolation in place for its plugins, which can eliminate the need for the shim layer used in Ranger plugin. This needs to be considered along with this move.

Though the authorizer implementation would move to Trino repp, Ranger repo will continue to have modules used in Ranger admin server for resource look up and default policy creation (class RangerServiceTrino).

Sub-Tasks

• update Trino plugin code to be compliant with coding standards of Trino project: Resolved
• remove unnecessary shim layer for Trino Ranger authorizer: Resolved
• build Trino Ranger plugin in Trino project: Resolved
• Update Trino service-def in Ranger for authorization changes: Resolved