36 lines
2.0 KiB
Markdown
36 lines
2.0 KiB
Markdown
|
|
# System Access Control
|
|
|
|
openLooKeng separates the concept of the principal who authenticates to the coordinator from the username that is responsible for running queries.
|
|
|
|
When running the openLooKeng CLI, for example, the openLooKeng username can be specified using the `--user` option.
|
|
|
|
By default, the openLooKeng coordinator allows any principal to run queries as any openLooKeng user. In a secure environment, this is probably not desirable behavior and likely requires customization.
|
|
|
|
## Implementation
|
|
|
|
`SystemAccessControlFactory` is responsible for creating a `SystemAccessControl` instance. It also defines a `SystemAccessControl` name which is used by the administrator in a openLooKeng configuration.
|
|
|
|
`SystemAccessControl` implementations have several responsibilities:
|
|
|
|
- Verifying whether or not a given principal is authorized to execute queries as a specific user.
|
|
- Determining whether or not a given user can alter values for a given system property.
|
|
- Performing access checks across all catalogs. These access checks happen before any connector specific checks and thus can deny permissions that would otherwise be allowed by `ConnectorAccessControl`.
|
|
|
|
The implementation of `SystemAccessControl` and `SystemAccessControlFactory` must be wrapped as a plugin and installed on the openLooKeng cluster.
|
|
|
|
## Configuration
|
|
|
|
After a plugin that implements `SystemAccessControl` and `SystemAccessControlFactory` has been installed on the coordinator, it is configured using an `etc/access-control.properties` file. All of the
|
|
properties other than `access-control.name` are specific to the `SystemAccessControl` implementation.
|
|
|
|
The `access-control.name` property is used by openLooKeng to find a registered `SystemAccessControlFactory` based on the name returned by `SystemAccessControlFactory.getName()`. The remaining properties are passed as a map to `SystemAccessControlFactory.create()`.
|
|
|
|
Example configuration file:
|
|
|
|
``` properties
|
|
access-control.name=custom-access-control
|
|
custom-property1=custom-value1
|
|
custom-property2=custom-value2
|
|
```
|