apache / apache/kyuubi

[Improvement] Shall We Add a SparkSession for AccessResource in SparkSQL Authz?

Open
#2,438 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Scala
Stars
2.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/incubator-kyuubi/issues?q=is%3Aissue) and found no similar issues.

### What would you like to be improved?

The current constructor of AccessResource is :
```scala
object AccessResource {
def apply(
objectType: ObjectType,
firstLevelResource: String,
secondLevelResource: String,
thirdLevelResource: String) {
...
}
}
```
In some cases, firstLevelResource maybe null, for example, in spark 2.4,`DESCRIBE TABLE table_name`, will produce a `DescribeTableCommand` without database info, so the correspnding AccessResource's `firstLevelResource` is null. Then it will generate a invaild RangerRequest, because of the databasse field is null.

I'm not sure that when the database is not explicitly specified in the sql statement, there will be other commands without database information.

### How should we improve?

Therefore, I think we should add a sparksession in AccessResource, in the case of databasse is null. When the `firstLevelResource` is null or empty, get `firstLevelResource` from catalog's current database.

### Are you willing to submit PR?

- [X] Yes I am willing to submit a PR!

Contributor guide

Open the contributing guide

Research direction

Start at the AccessResource constructor and the SparkSQL DescribeTableCommand path described in the issue. Trace how a missing firstLevelResource reaches the RangerRequest, then inspect how the catalog exposes the current database. Done means null or empty database values are resolved consistently and the resulting authorization request is valid; the issue does not name specific files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
scala, spark
Domain
backend-api-design, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.