apache / apache/polaris

Remove synthetic principals hack in Resolver

Open
#5,439 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
2.1k
Forks
522
Avg merge
1d 22h
Merged PRs (30d)
137

Description

#5119 is introducing external principals, and is also introducing a temporary "hack" in the Resolver: synthetic principals and principal roles.

Synthetic principal and roles are a temporary workaround for external principals, until external authorizers change their implementation of `PolarisAuthorizer.resolveAuthorizationInputs()` to avoid calling `PolarisResolutionManifest.resolveAll()`, and instead only resolve the securables that are actually needed for authorization, cf. `PolarisResolutionManifest.resolveSelections()`.

Contributor guide

Open the contributing guide

Research direction

Start by reading issue #5119 and the Resolver code, then trace PolarisAuthorizer.resolveAuthorizationInputs() and PolarisResolutionManifest.resolveAll() versus resolveSelections(). Confirm how synthetic principals and principal roles are used; done means the temporary workaround is removed without breaking authorization for external principals.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.