org.apache.paimon.privilege

Interface PrivilegeManager

All Known Implementing Classes:

FileBasedPrivilegeManager

public interface PrivilegeManager

Interface for the privilege system which supports identity-based and role-based access control.

When the privilege system is initialized two special users, root and anonymous, will be created by default.

• root is the user with all privileges. The password of root is set when calling initializePrivilege(java.lang.String).
• anonymous is the default username if no user and password are provided when creating the catalog. The default password of anonymous is anonymous.

The privilege system also follows a hierarchical model. That is, If a user has a privilege on an identifier A, he also has this privilege on identifier B, where A is a prefix of B. Identifiers can be

• the whole catalog (identifier is an empty string)
• a database (identifier is <database-name>)
• a table (identifier is <database-name>.<table-name>)

Field Summary

Fields

Modifier and Type	Field and Description
static String	IDENTIFIER_WHOLE_CATALOG
static String	PASSWORD_ANONYMOUS
static String	USER_ANONYMOUS
static String	USER_ROOT

Method Summary

Modifier and Type	Method and Description
void	createUser(String user, String password) Create user with password.
void	dropUser(String user) Remove user from the privilege system.
PrivilegeChecker	getPrivilegeChecker() Get PrivilegeChecker of this privilege system to check if a user has specific privileges on an object.
void	grant(String user, String identifier, PrivilegeType privilege) Grant user with privilege on identifier.
void	initializePrivilege(String rootPassword) Initialize the privilege system if not enabled.
void	objectDropped(String identifier) Notify the privilege system that the object with identifier is dropped.
void	objectRenamed(String oldName, String newName) Notify the privilege system that the identifier of an object is changed from oldName to newName.
boolean	privilegeEnabled() Check if the privilege system is enabled.
int	revoke(String user, String identifier, PrivilegeType privilege) Revoke privilege from user on identifier.

Field Detail

USER_ROOT

static final String USER_ROOT

See Also:

Constant Field Values

USER_ANONYMOUS

static final String USER_ANONYMOUS

See Also:

Constant Field Values

PASSWORD_ANONYMOUS

static final String PASSWORD_ANONYMOUS

See Also:

Constant Field Values

IDENTIFIER_WHOLE_CATALOG

static final String IDENTIFIER_WHOLE_CATALOG

See Also:

Constant Field Values

Method Detail

privilegeEnabled

boolean privilegeEnabled()

Check if the privilege system is enabled.

initializePrivilege

void initializePrivilege(String rootPassword)

Initialize the privilege system if not enabled. Also creates two special users: root and anonymous.

createUser

void createUser(String user,
                String password)

Create user with password.

dropUser

void dropUser(String user)

Remove user from the privilege system.

grant

void grant(String user,
           String identifier,
           PrivilegeType privilege)

Grant user with privilege on identifier.

revoke

int revoke(String user,
           String identifier,
           PrivilegeType privilege)

Revoke privilege from user on identifier. Note that user will also lose privilege on all descendants of identifier.

objectRenamed

void objectRenamed(String oldName,
                   String newName)

Notify the privilege system that the identifier of an object is changed from oldName to newName.

objectDropped

void objectDropped(String identifier)

Notify the privilege system that the object with identifier is dropped.

getPrivilegeChecker

PrivilegeChecker getPrivilegeChecker()

Get PrivilegeChecker of this privilege system to check if a user has specific privileges on an object.