Implement authorization in DataFusion
- Dominant language
- Rust
- Stars
- 9.3k
- Forks
- 2.4k
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 344
Description
### Is your feature request related to a problem or challenge?
The current problem is that I need to have the ability to do row level security and column level security and column mask and currently I can’t do that.
Trino allows that using their opa plugin and authorization in the Trino engine.
### Describe the solution you'd like
Please support and allow making authorization in datafusion making it a candidate to replace Trino in cases where rls authorization logic is needed.
So every query sent to DataFusion will be parsed and raise an authorization process checking user access and applying rls and column mask if needed.
### Describe alternatives you've considered
Use Trino as a query engine
### Additional context
The main usecase is authorization over iceberg based datalake
Contributor guide
Research direction
Start by reviewing DataFusion's query parsing and execution flow, then compare Trino's OPA authorization approach and the stated Iceberg datalake use case. Define the authorization design and scope before implementation; done should include per-query access checks, row-level security, column-level security, and column masking.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust, sql
- Domain
- authorization, data-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100