[SENTRY-2361] Document the access check behavior of Sentry and required privileges for DDL operation

• Type: Task
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.1.0
• Component/s: Sentry
• Assignee: Coral
• Reporter: Na Li
• Created: 21/Aug/18 19:10
• Updated: 21/Aug/18 19:11

Description

When an DDL operation requires multiple privileges, Sentry throws exception of SemanticException as soon as checking one of the required privileges fails. Once user adds the requires privilege, it could fails for one of the following privileges.

We don't want to change code to find out all of the required privileges and provide this info in exception messages as that increases processing overhead. Instead, we should document this behavior, so user can check documentations and find out all required privileges, and make changes accordingly.

Issue Links

• is related to: SENTRY-2354 Beeline error message only shows first required permission that failed access check