Skip to content

Add authorization check options to iceberg doc #10670

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kokosing merged 1 commit into from
Jan 25, 2022
Merged

Add authorization check options to iceberg doc #10670

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions docs/src/main/sphinx/connector/iceberg.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,36 @@ At a minimum, ``hive.metastore.uri`` must be configured:
- Maximum number of partitions handled per writer.
- 100

.. _iceberg-authorization:

Authorization checks
^^^^^^^^^^^^^^^^^^^^

You can enable authorization checks for the connector by setting
the ``iceberg.security`` property in the catalog properties file. This
Copy link
Copy Markdown
Contributor

@rosewms rosewms Jan 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the 'iceberg.security' property in the catalog properties file by default or does the user need to add it and set the values?

If they have to add it to the file and choose a value, I suggest reframing the sentence to something like:

To enable authorization checks, add the 'iceberg.security' property to the connector catalog properties file.

Copy link
Copy Markdown
Contributor Author

@jhlodin jhlodin Jan 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't disagree, but we've used the wording "set/by setting the example.property property in the catalog properties file" just about everywhere else in the connector docs. This property is no different, I'd leave it as-is.

property must be one of the following values:

.. list-table:: Iceberg security values
:widths: 30, 60
:header-rows: 1

* - Property value
- Description
* - ``ALLOW_ALL``
- No authorization checks are enforced.
* - ``SYSTEM``
- The connector relies on system-level access control.
* - ``READ_ONLY``
- Operations that read data or metadata, such as :doc:`/sql/select` are
permitted. No operations that write data or metadata, such as
:doc:`/sql/create-table`, :doc:`/sql/insert`, or :doc:`/sql/delete` are
allowed.
* - ``FILE``
- Authorization checks are enforced using a configuration file whose path
is specified in the ``security.config-file`` catalog configuration
property. See :ref:`hive-file-based-authorization` for information on
Comment thread
jhlodin marked this conversation as resolved.
Outdated
the authorzation configuration file.

.. _iceberg-sql-support:

SQL support
Expand Down