Custom system access control implementation#
Starburst Enterprise platform (SEP) separates the concept of the principal who authenticates to the
coordinator from the username that is responsible for running queries. When
running the CLI, for example, the SEP username can be specified using
By default, the coordinator allows any principal to run queries as any SEP user. In a secure environment, this is probably not desirable behavior and likely requires customization.
SystemAccessControlFactory is responsible for creating a
SystemAccessControl instance. It also defines a
name which is used by the administrator in an SEP configuration.
SystemAccessControl implementations have several responsibilities:
Verifying whether or not a given principal is authorized to execute queries as a specific user.
Determining whether or not a given user can alter values for a given system property.
Performing access checks across all catalogs. These access checks happen before any connector specific checks and thus can deny permissions that would otherwise be allowed by
The implementation of
must be wrapped as a plugin and installed on the SEP cluster.
After a plugin that implements
SystemAccessControlFactory has been installed on the coordinator, it is
configured using the file(s) specified by the
property (the default is a single
All of the properties other than
access-control.name are specific to
access-control.name property is used by SEP to find a registered
SystemAccessControlFactory based on the name returned by
SystemAccessControlFactory.getName(). The remaining properties are passed
as a map to
Example configuration file:
access-control.name=custom-access-control custom-property1=custom-value1 custom-property2=custom-value2