Provide a way to see who the owner is of a schema/table/view

[ksobolew]

There exists a concept of ownership in Trino, embodied in the ALTER (SCHEMA|TABLE|VIEW) SET AUTHORIZATION command. The ownership of an entity is used in access control for authorization; this is most important with views that are SECURITY DEFINER, because for them the access checks are done for the view owner, not for the query invoker. So this is quite an important piece of information for someone designing data governance structure, but there is no way to see who the owner is once the entity is created.

Possible ideas:

• SHOW CREATE (SCHEMA|TABLE|VIEW): does not seem right because its output is a syntactically (and semantically) valid CREATE statement, and currently there is no way to assign the owner at the time of creation.
• Simply add an owner column in information_schema tables as needed, and the corresponding SHOW command(s)

[kokosing]

SHOW CREATE (SCHEMA|TABLE|VIEW): does not seem right because its output is a syntactically (and semantically) valid CREATE statement, and currently there is no way to assign the owner at the time of creation.

I think extending CREATE syntax to allow to SET AUTHORIZATION make sense as it is doable with two statements today. However it is a question about the syntax. cc: @martint

Simply add an owner column in information_schema tables as needed, and the corresponding SHOW command(s)

We would need two columns, for type (user vs role) and name. However tables in information_schema are also defined in ANSI. Maybe we could create dedicated table just for this, that is outside of ANSI?

Also currently there is no way to get that information from connector. io.trino.spi.connector.ConnectorTableMetadata nor io.trino.spi.connector.ConnectorMetadata methods return this information.

[ksobolew]

Also, as the previous discussion shows, this information is considered "sensitive", so it should be protected somehow

[kokosing]

See that schema already supports this:

This is a syntax for CREATE SCHEMA

    | CREATE SCHEMA (IF NOT EXISTS)? qualifiedName
        (AUTHORIZATION principal)?
        (WITH properties)?     

[homar]

Alternative approach would be to allow something like:

SHOW AUTHORIZATION ON ownedEntityKind qualifiedName BY principal

[ksobolew]

Can we consider this fixed by #25907? @homar @kokosing

[kokosing]

You are right!

[ksobolew]

It took only 3,5 years! 🎉 😉

[lhofhansl]

It took only 3,5 years! 🎉 😉

Errm... #3535 and #11341 ... ?