apache / apache/datafusion

Implement authorization in DataFusion

Open
#15,192 4 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
9.3k
Forks
2.4k
Avg merge
3d 7h
Merged PRs (30d)
344

Description

### Is your feature request related to a problem or challenge?

The current problem is that I need to have the ability to do row level security and column level security and column mask and currently I can’t do that.

Trino allows that using their opa plugin and authorization in the Trino engine.

### Describe the solution you'd like

Please support and allow making authorization in datafusion making it a candidate to replace Trino in cases where rls authorization logic is needed.

So every query sent to DataFusion will be parsed and raise an authorization process checking user access and applying rls and column mask if needed.

### Describe alternatives you've considered

Use Trino as a query engine

### Additional context

The main usecase is authorization over iceberg based datalake

Contributor guide

Open the contributing guide

Research direction

Start by reviewing DataFusion's query parsing and execution flow, then compare Trino's OPA authorization approach and the stated Iceberg datalake use case. Define the authorization design and scope before implementation; done should include per-query access checks, row-level security, column-level security, and column masking.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust, sql
Domain
authorization, data-engineering, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.