presto的权限管控

1、 presto的插件

因为自定义鉴权也相当于是一个插件，所以要先介绍插件写法

1.1、presto的插件引入

presto将所有的插件都通过一个接口类暴露使用到spi技术，能够将所有的插件入口统一

  <dependency>
        <groupId>com.facebook.presto</groupId>
        <artifactId>presto-spi</artifactId>
        <version>0.245</version>
        <scope>provided</scope>
    </dependency>

1.2、spi配置文件描述

创建META-INF.services目录及文件
名称： com.facebook.presto.spi.Plugin
内容：自定义插件实现类的类名，
demo：com.presto.plugin.PrivilegePlugin

image.png

2、权限控制插件写法

2.1、入口类

由spi定义权限控制插件入口类，必须实现getSystemAccessControlFactories方法以com.presto.plugin.PrivilegePlugin为例

  public class PrivilegePlugin implements Plugin
  {
      @Override
      public Iterable<SystemAccessControlFactory> getSystemAccessControlFactories()
      {
          return ImmutableList.<SystemAccessControlFactory>builder()
                  .add(new ReadOnlyRangerSystemAccessControl.Factory())
                  .build();
      }

  }

2.2、SystemAccessControlFactory实现类

  public interface SystemAccessControlFactory {
      String getName();  #返回自定义名称，用来配置文件指定鉴权实现类，名称要唯一

      SystemAccessControl create(Map<String, String> config);  #需要返回SystemAccessControl 实现类的实例
  }

2.3、SystemAccessControl类的实现

实现类中重写一下方法，如果不报错即代表有权限。后面的鉴权逻辑可以通过restful服务，也可以通过ranger 服务

  public interface SystemAccessControl {
   void checkCanSetUser(AccessControlContext context, Optional<Principal> principal, String userName);

   void checkQueryIntegrity(Identity identity, AccessControlContext context, String query);

   void checkCanSetSystemSessionProperty(Identity identity, AccessControlContext context, String propertyName);

   default void checkCanAccessCatalog(Identity identity, AccessControlContext context, String catalogName) {
       AccessDeniedException.denyCatalogAccess(catalogName);
   }

   default Set<String> filterCatalogs(Identity identity, AccessControlContext context, Set<String> catalogs) {
       return Collections.emptySet();
   }

   default void checkCanCreateSchema(Identity identity, AccessControlContext context, CatalogSchemaName schema) {
       AccessDeniedException.denyCreateSchema(schema.toString());
   }

   default void checkCanDropSchema(Identity identity, AccessControlContext context, CatalogSchemaName schema) {
       AccessDeniedException.denyDropSchema(schema.toString());
   }

   default void checkCanRenameSchema(Identity identity, AccessControlContext context, CatalogSchemaName schema, String newSchemaName) {
       AccessDeniedException.denyRenameSchema(schema.toString(), newSchemaName);
   }

   default void checkCanShowSchemas(Identity identity, AccessControlContext context, String catalogName) {
       AccessDeniedException.denyShowSchemas();
   }

   default Set<String> filterSchemas(Identity identity, AccessControlContext context, String catalogName, Set<String> schemaNames) {
       return Collections.emptySet();
   }

   default void checkCanCreateTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) {
       AccessDeniedException.denyCreateTable(table.toString());
   }

   default void checkCanDropTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) {
       AccessDeniedException.denyDropTable(table.toString());
   }

   default void checkCanRenameTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table, CatalogSchemaTableName newTable) {
       AccessDeniedException.denyRenameTable(table.toString(), newTable.toString());
   }

   default void checkCanShowTablesMetadata(Identity identity, AccessControlContext context, CatalogSchemaName schema) {
       AccessDeniedException.denyShowTablesMetadata(schema.toString());
   }

   default Set<SchemaTableName> filterTables(Identity identity, AccessControlContext context, String catalogName, Set<SchemaTableName> tableNames) {
       return Collections.emptySet();
   }

   default void checkCanAddColumn(Identity identity, AccessControlContext context, CatalogSchemaTableName table) {
       AccessDeniedException.denyAddColumn(table.toString());
   }

   default void checkCanDropColumn(Identity identity, AccessControlContext context, CatalogSchemaTableName table) {
       AccessDeniedException.denyDropColumn(table.toString());
   }

   default void checkCanRenameColumn(Identity identity, AccessControlContext context, CatalogSchemaTableName table) {
       AccessDeniedException.denyRenameColumn(table.toString());
   }

   default void checkCanSelectFromColumns(Identity identity, AccessControlContext context, CatalogSchemaTableName table, Set<String> columns) {
       AccessDeniedException.denySelectColumns(table.toString(), columns);
   }

   default void checkCanInsertIntoTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) {
       AccessDeniedException.denyInsertTable(table.toString());
   }

   default void checkCanDeleteFromTable(Identity identity, AccessControlContext context, CatalogSchemaTableName table) {
       AccessDeniedException.denyDeleteTable(table.toString());
   }

   default void checkCanCreateView(Identity identity, AccessControlContext context, CatalogSchemaTableName view) {
       AccessDeniedException.denyCreateView(view.toString());
   }

   default void checkCanDropView(Identity identity, AccessControlContext context, CatalogSchemaTableName view) {
       AccessDeniedException.denyDropView(view.toString());
   }

   default void checkCanCreateViewWithSelectFromColumns(Identity identity, AccessControlContext context, CatalogSchemaTableName table, Set<String> columns) {
       AccessDeniedException.denyCreateViewWithSelect(table.toString(), identity);
   }

   default void checkCanSetCatalogSessionProperty(Identity identity, AccessControlContext context, String catalogName, String propertyName) {
       AccessDeniedException.denySetCatalogSessionProperty(propertyName);
   }

   default void checkCanGrantTablePrivilege(Identity identity, AccessControlContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal grantee, boolean withGrantOption) {
       AccessDeniedException.denyGrantTablePrivilege(privilege.toString(), table.toString());
   }

   default void checkCanRevokeTablePrivilege(Identity identity, AccessControlContext context, Privilege privilege, CatalogSchemaTableName table, PrestoPrincipal revokee, boolean grantOptionFor) {
       AccessDeniedException.denyRevokeTablePrivilege(privilege.toString(), table.toString());
   }
  }

3、安装

3.1、配置文件

在$PRESTO_HOME/etc/目录创建access-control.properties
内容： access-control.name=tianzehao

备注： 这里的名称有SystemAccessControlFactory 的实现返回，属于自定义的

3.2、打包插件上传

默认插件位置为 $PRESTO_HOME/plugins，可以自定义catalog.config-dir，重新启动presto