apache / apache/pinot

Add Row-Level Security (RLS) Support for ZooKeeper-Based Authentication

Open
#17,220 1 comment 0 reactions 1 assignee Claimed by @NihalJain View on GitHub
feature security
Dominant language
Java
Stars
6.1k
Forks
1.5k
Avg merge
1d 21h
Merged PRs (30d)
189

Description

### Summary
Currently, Row-Level Security (RLS) filters are not supported when using ZooKeeper-based authentication (`ZkBasicAuthAccessControlFactory`). While the RLS infrastructure exists and works with file-based authentication, the ZK authentication implementation passes an empty RLS filters.

This PR adds full RLS support to ZK-based authentication by:
1. Extending `UserConfig` to store RLS filters per table
2. Updating `BasicAuthUtils` to extract and pass RLS filters to `ZkBasicAuthPrincipal`
3. Updating the REST API documentation with RLS filter examples

### Background
Related commits that introduced initial RLS work:
- [Adding changes for supporting RLS (#16043)](https://github.com/apache/pinot/commit/f1cbec74aad225460cd301a3aed4465ed87cc4f9)
- [Introduce rlsFiltersApplied in the broker response (#16208)](https://github.com/apache/pinot/commit/3ecbb61dfb201aa51e099a0668550d66d2898de6)

### Problem
When creating users via the ZK-based authentication REST API, there was no way to specify RLS filters. The `BasicAuthUtils.extractBasicAuthPrincipals(List)` method was hardcoded to pass `Map.of()` (empty map) for RLS filters, resulting in:
- RLS filters being ignored for all ZK-authenticated users

### Proposed Solution
Goal is to implement RLS support by:

1. **UserConfig Changes** (`pinot-spi/src/main/java/org/apache/pinot/spi/config/user/UserConfig.java`)
- Added `rlsFilters` field of type `Map>`
- Added JSON property key `RLS_FILTERS_KEY`
- Added getter method and validation

2. **BasicAuthUtils Changes** (`pinot-core/src/main/java/org/apache/pinot/core/auth/BasicAuthUtils.java`)
- Modified `extractBasicAuthPrincipals(List)` to extract RLS filters from UserConfig
- Replaced empty `Map.of()` with actual RLS filter extraction
- RLS filters now properly passed to `ZkBasicAuthPrincipal` constructor

3. **API Documentation** (`pinot-controller/src/main/java/org/apache/pinot/controller/api/resources/PinotAccessControlUserRestletResource.java`)
- Updated REST API documentation with RLS filter format examples

### API Usage Example
```json
POST /users
{
"username": "userRLS",
"password": "secret",
"component": "BROKER",
"role": "USER",
"tables": ["table1", "table2"],
"permissions": ["READ"],
"rlsFilters": {
"table1": ["column1='value1'"],
"table2": ["column2='value2' AND column3='value3'"]
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.