cassandra-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Yuki Morishita (JIRA)" <>
Subject [jira] [Commented] (CASSANDRA-4490) Improve IAuthority interface by introducing fine-grained access permissions and grant/revoke commands.
Date Tue, 04 Sep 2012 16:26:09 GMT


Yuki Morishita commented on CASSANDRA-4490:

Patch has two incompatible parts:

* IAuthority is now abstract class instead of interface. Implementation needs to change "implements"
to "extends".
* Permission.ALL/NONE are now part of enum instead of static EnumSet. If those are used, then
they need to be changed to FULL_ACCESS/NO_ACCESS.

I only tested with SimpleAuth example, but with above modification, it worked as expected.
Little problem I had is that cqlsh disconnects from C* when NotImplementedException is thrown.

Also note that, it seems that it is implementation's responsibility to who can grant/revoke/list
permission, and because IAuthority#revoke/listPermission don't know which user is calling,
I assume anyone could revoke/list permission?
> Improve IAuthority interface by introducing fine-grained access permissions and grant/revoke
> ------------------------------------------------------------------------------------------------------
>                 Key: CASSANDRA-4490
>                 URL:
>             Project: Cassandra
>          Issue Type: Improvement
>          Components: Core
>            Reporter: Pavel Yaskevich
>            Assignee: Pavel Yaskevich
>            Priority: Minor
>             Fix For: 1.1.5
>         Attachments: CASSANDRA-4490.patch
> In order to improve IAuthority interface I propose to add the following new permissions:
USE, SELECT, CREATE, ALTER, DROP, UPDATE, DELETE, ALL, NONE. And the following new commands
to the CQL 3.0 which would give users possibility (with appropriate implementation) to dynamically
change user's rights to access system objects:
> GRANT  <permission> ON <resource> TO <user> [WITH GRANT OPTION];
> REVOKE <permission> ON <resource> FROM <user_name>;
> LIST GRANTS FOR <user>; // Not 'SHOW' because it's reserved for cqlsh for commands
like 'show cluster'
> where <resource> is Keyspace or ColumnFamily (initially, but extendable to indexes
or configration options in the future), and <permission> is listed above.
> To keep the system backward compatible with old authorization interface implementations
Permission class would include the mappings of the new to old 
> permissions:

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see:

View raw message