Add Row-Level Security (RLS) Support for ZooKeeper-Based Authentication
- Dominant language
- Java
- Stars
- 6.1k
- Forks
- 1.5k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 189
Description
### Summary
Currently, Row-Level Security (RLS) filters are not supported when using ZooKeeper-based authentication (`ZkBasicAuthAccessControlFactory`). While the RLS infrastructure exists and works with file-based authentication, the ZK authentication implementation passes an empty RLS filters.
This PR adds full RLS support to ZK-based authentication by:
1. Extending `UserConfig` to store RLS filters per table
2. Updating `BasicAuthUtils` to extract and pass RLS filters to `ZkBasicAuthPrincipal`
3. Updating the REST API documentation with RLS filter examples
### Background
Related commits that introduced initial RLS work:
- [Adding changes for supporting RLS (#16043)](https://github.com/apache/pinot/commit/f1cbec74aad225460cd301a3aed4465ed87cc4f9)
- [Introduce rlsFiltersApplied in the broker response (#16208)](https://github.com/apache/pinot/commit/3ecbb61dfb201aa51e099a0668550d66d2898de6)
### Problem
When creating users via the ZK-based authentication REST API, there was no way to specify RLS filters. The `BasicAuthUtils.extractBasicAuthPrincipals(List)` method was hardcoded to pass `Map.of()` (empty map) for RLS filters, resulting in:
- RLS filters being ignored for all ZK-authenticated users
### Proposed Solution
Goal is to implement RLS support by:
1. **UserConfig Changes** (`pinot-spi/src/main/java/org/apache/pinot/spi/config/user/UserConfig.java`)
- Added `rlsFilters` field of type `Map>`
- Added JSON property key `RLS_FILTERS_KEY`
- Added getter method and validation
2. **BasicAuthUtils Changes** (`pinot-core/src/main/java/org/apache/pinot/core/auth/BasicAuthUtils.java`)
- Modified `extractBasicAuthPrincipals(List)` to extract RLS filters from UserConfig
- Replaced empty `Map.of()` with actual RLS filter extraction
- RLS filters now properly passed to `ZkBasicAuthPrincipal` constructor
3. **API Documentation** (`pinot-controller/src/main/java/org/apache/pinot/controller/api/resources/PinotAccessControlUserRestletResource.java`)
- Updated REST API documentation with RLS filter format examples
### API Usage Example
```json
POST /users
{
"username": "userRLS",
"password": "secret",
"component": "BROKER",
"role": "USER",
"tables": ["table1", "table2"],
"permissions": ["READ"],
"rlsFilters": {
"table1": ["column1='value1'"],
"table2": ["column2='value2' AND column3='value3'"]
}
}
```
Contributor guide
Assessment
This issue has not been assessed yet.