mirror of https://github.com/apache/cassandra
2e2a49fcdc
Allows to attach the native masking functions and UDFs to the definitions of table columns in the schema, as defined by CEP-20. The functions masking a column can be specified on CREATE TABLE queries, right at the end of the column definition. The mask of a column can also be changed or dropped with an ALTER TABLE query. Once a column is masked, SELECT queries will always return the masked value of the column. That masking is done on the coordinator, at the end of the query execution. Thus, masking won't affect any filters or ordering, which would be based on the clear values of the masked columns. Column masks are stored on the table system_schema.column_masks. A new UNMASK permission allows to see the clear data of columns with an attached mask. Also, a new SELECT_MASKED permission allows to run SELECT queries restricting the clear values of masked columns. Superusers have both permissions by default, whereas regular users don't have them. Dynamic data masking can be enabled/disabled with the config property dynamic_data_masking_enabled in cassandra.yaml. It is disabled by default. This is the combination of multiple tickets: * Add masking functions to column metadata (CASSANDRA-18068) * Add UNMASK permission (CASSANDRA-18069) * Add SELECT_MASKED permission (CASSANDRA-18070) * Add support for using UDFs as masking functions (CASSANDRA-18071) * Add feature flag for dynamic data masking (CASSANDRA-18316) patch by Andrés de la Peña; reviewed by Benjamin Lerer and Berenguer Blasi for CASSANDRA-17940 |
||
|---|---|---|
| .. | ||
| cassandra | ||