Uploaded image for project: 'Ranger'
  1. Ranger
  2. RANGER-4810

Move Trino authorizer implementation from Ranger git repo to Trino repo

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • 3.0.0, 2.5.0
    • plugins
    • None

    Description

      Moving Trino authorizer implementation from Ranger git repo to Trino repo has several advantages, including:

      1. Keeping the authorizer in sync with the updates in SystemAccessControl interface. For example, following changes in the latest Trino repo are not compatible with the Trino authorizer in Ranger repo:
        1. SystemAccessControl.checkCanAccessCatalog(): removed
        2. SystemAccessControl.getRowFilter(): replaced with getRowFilters()
        3. SystemAccessControl.getColumnMasks(): replaced with getColumnMask()
        4. SystemAccessControl.checkCanSetSystemSessionProperty(): removed
        5. SystemAccessControl.checkCanImpersonateUser(): signature changed
        6. SystemAccessControl.checkCanAccessCatalog(): removed
        7. SystemAccessControl.checkCanCreateSchema(): signature changed
        8. SystemAccessControl.checkCanExecuteQuery(): removed
        9. SystemAccessControl.checkCanViewQueryOwnedBy(): removed
        10. SystemAccessControl.filterViewQueryOwnedBy(): signature changed
        11. SystemAccessControl.checkCanKillQueryOwnedBy(): removed
        12. SystemAccessControl.checkCanGrantExecuteFunctionPrivilege(): removed/replaced
        13. SystemAccessControl.checkCanExecuteFunction(): signature changed
        14. ViewExpression(): constructor changed
        15. AccessDeniedException.denyGrantExecuteFunctionPrivilege(): removed
      2. Trino requires more recent JDK versions (currently JDK 22) than Ranger repo (which still supports JDK 8). Trino authorizer is built separately, as a second phase, in Ranger repo using higher JDK versions. Moving the authorizer to Trino repo will avoid this additional step.

       

      Trino seems to have a class loader isolation in place for its plugins, which can eliminate the need for the shim layer used in Ranger plugin. This needs to be considered along with this move.

      Though the authorizer implementation would move to Trino repp, Ranger repo will continue to have modules used in Ranger admin server for resource look up and default policy creation (class RangerServiceTrino).

      Attachments

        Activity

          People

            madhan Madhan Neethiraj
            madhan Madhan Neethiraj
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 0.5h
                0.5h