[SENTRY-74] Add column-level privileges for Hive/Impala

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.3.0
• Fix Version/s: 1.5.0
• Assignee: Dapeng Sun
• Reporter: Jeremy Beard
• Created: 20/Dec/13 02:16
• Updated: 26/Aug/15 09:58
• Resolved: 18/Nov/14 08:54

Description

Currently the finest grain of privilege is at the table/view level. This leads to the unwieldy scenario where a different view has to be created for each combination of columns that need to be restricted. With column level privileges this would not be required.

In the policy file column privileges might potentially look like:

server=server1->db=default->table=employees->column=salary->action=select

Issue Links

• contains: SENTRY-389 Database implementation for column
• contains: SENTRY-390 Extend Thrift API to support column-level privilege
• contains: SENTRY-391 Extend sentrystore query for column level privilege
• contains: SENTRY-392 Authorization for column level security
• contains: SENTRY-393 Grant/Revoke and Show Grant info support for column level privilege
• contains: SENTRY-394 PolicyFile and ConfigImport support for column level privilege
• contains: SENTRY-426 Add upgrade scripts for column level privileges
• contains: SENTRY-847 [column level privilege] if grant column level privilege to user, show columns in table shouldn't require extra table level privilege
• incorporates: SENTRY-754 Support column level privileges on views
• incorporates: SENTRY-753 Add documentation for Column level authorization
• is blocked by: HIVE-7932 It may cause NP exception when add accessed columns to ReadEntity
• is blocked by: SENTRY-509 upgrade HIVE version to 0.13.1-cdh5.3.0-SNAPSHOT in SENTRY
• is blocked by: HIVE-7730 Extend ReadEntity to add accessed columns from query
• is depended upon by: SENTRY-491 Column privilege should filter the unauthorized columns in metadata listing
• is related to: SENTRY-531 Add column authorization for metadata read protection
• relates to: SENTRY-389 Database implementation for column
• relates to: SENTRY-756 Blacklist columns instead of whitelist in column level privileges
• relates to: SENTRY-755 HDFS access of data files should be disabled for user with privileges only on some columns
• relates to: SENTRY-844 Add tests for cases: Column-level privileges are updated when table columns are dropped, changed or replaced (i.e., using an ALTER TABLE stmt)
• relates to: SENTRY-758 Add test cases for partition columns with column level privileges
• relates to: SENTRY-742 Add describe, show/compute stats tests for column level privileges
• links to: Review board

Sub-Tasks

• Add upgrade scripts for column level privileges: Resolved
• Database implementation for column: Resolved
• Extend sentrystore query for column level privilege: Resolved
• Extend Thrift API to support column-level privilege: Resolved
• Grant/Revoke and Show Grant info support for column level privilege: Resolved
• Authorization for column level security: Resolved
• PolicyFile and ConfigImport support for column level privilege: Resolved