[SENTRY-2140] Metadata Driven Column Masking

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: Core
• Labels: ABAC
• Assignee: Unassigned
• Reporter: Steve Moist
• Created: 02/Feb/18 19:31
• Updated: 31/Aug/18 15:15

Description

As a user, I want to have finer grain control over which users/roles can view data in Hive.  Some information such as Social Security Number is considered very confidential information.  I want to be able to tag columns in Hive with "attributes" or other metadata that prevent users/roles from not accessing or seeing the data.  For users/roles that have that attribute, they should be able to see that information.

Issue Links

• duplicates: SENTRY-1140 Enable Attribute based Access Control
• links to: Google Design Doc

Sub-Tasks

• Static Attribute Ingestion: Patch Available
• Initial Attribute based access control: Patch Available
• Refactor out sentry api from sentry-provider-db to own module: Resolved
• Refactor out Sentry CLI from sentry-provider-db into own module: Resolved
• Refactor out Sentry service into own module from sentry-provider-db: Resolved
• CLI/API: Elaborate implementation design: Resolved
• Expand Sentry data model to store attributes for use in ABAC: Open
• CLI: Refactor existing Sentry CLIs to use jcommander instead of commons-cli: Patch Available
• CLI: Implement ABCM CLI commands: Open
• CLI: Implement ABCM CLI data model: Open
• Expand Sentry data model to store attribute policies for use in ABAC: Open
• Generic Attribute Ingestion and Default Implementation: Open
• Implement subsystem to allow for pluggable attribute providers and transports: Resolved
• Add Lombok for easier development: Resolved