[JBoss JIRA] (TEIIDDES-1548) Add GUI handling for permission conditions
by Steven Hawkins (JIRA)
[ https://issues.jboss.org/browse/TEIIDDES-1548?page=com.atlassian.jira.plu... ]
Steven Hawkins commented on TEIIDDES-1548:
------------------------------------------
1) They are at the same level. For a column object both the condition and mask can be specified. This is to accommodate the scenario where you want the masks to be defined on multiple roles. Alternatively if you specify the masks with a single role, then the use of condition and the mask order is not needed.
2) Check the reference. They apply to both. Condition/constraint is applicable for virtual/source model table/view/procedures - although the condition is not yet enforced as a constraint on virtual stuff. Condition/Mask/order apply to virtual/source columns.
> Add GUI handling for permission conditions
> ------------------------------------------
>
> Key: TEIIDDES-1548
> URL: https://issues.jboss.org/browse/TEIIDDES-1548
> Project: Teiid Designer
> Issue Type: Feature Request
> Reporter: Steven Hawkins
> Assignee: Barry LaFond
> Fix For: 8.2
>
> Attachments: add-allowed-language-dialog.png, add-column-mask-dialog.png, add-row-based-security-dialog.png, allowed-languages-tab.png, column-mask-tab.png, row-based-security-tab.png
>
>
> A common request is to implement row based security. Teiid has added the ability to define a permission condition for this purpose:
> <permission>
> <resource-name>...</resource-name>
> <condition>sql</condition>
> ...
> </permission>
> The sql should resolve against the resource specified, ideally designer would check that as well.
> See TEIID-2311 and the reference for how these conditions are applied.
> {code:title=vdb.xml snippet}
> <data-role name="base-role" any-authenticated="true">
> <description>Conditional access</description>
>
> <permission>
> <resource-name>modelName.tblName</resource-name>
> <condition constraint="false">column1=user()</condition>
> </permission>
>
> </data-role>
> {code}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (TEIIDDES-1548) Add GUI handling for permission conditions
by Van Halbert (JIRA)
[ https://issues.jboss.org/browse/TEIIDDES-1548?page=com.atlassian.jira.plu... ]
Van Halbert commented on TEIIDDES-1548:
---------------------------------------
Don't know about #2, but for #1, both use cases: row-based security permission and masking, they both can specify a condition. The masking use case example in the reference documentation is below:
<permission>
<resource-name>modelName.tblName.column1</resource-name>
<condition>column2='x'</condition>
<mask order="1">column1</mask>
</permission>
> Add GUI handling for permission conditions
> ------------------------------------------
>
> Key: TEIIDDES-1548
> URL: https://issues.jboss.org/browse/TEIIDDES-1548
> Project: Teiid Designer
> Issue Type: Feature Request
> Reporter: Steven Hawkins
> Assignee: Barry LaFond
> Fix For: 8.2
>
> Attachments: add-allowed-language-dialog.png, add-column-mask-dialog.png, add-row-based-security-dialog.png, allowed-languages-tab.png, column-mask-tab.png, row-based-security-tab.png
>
>
> A common request is to implement row based security. Teiid has added the ability to define a permission condition for this purpose:
> <permission>
> <resource-name>...</resource-name>
> <condition>sql</condition>
> ...
> </permission>
> The sql should resolve against the resource specified, ideally designer would check that as well.
> See TEIID-2311 and the reference for how these conditions are applied.
> {code:title=vdb.xml snippet}
> <data-role name="base-role" any-authenticated="true">
> <description>Conditional access</description>
>
> <permission>
> <resource-name>modelName.tblName</resource-name>
> <condition constraint="false">column1=user()</condition>
> </permission>
>
> </data-role>
> {code}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (TEIIDDES-1548) Add GUI handling for permission conditions
by Barry LaFond (JIRA)
[ https://issues.jboss.org/browse/TEIIDDES-1548?page=com.atlassian.jira.plu... ]
Barry LaFond commented on TEIIDDES-1548:
----------------------------------------
1) The XSD does not model a condition attribute or element under the mask element. (if I read you right Van)
2) Do condition and mask only apply to "Source" models? i.e. not to view/virtual model columns?
> Add GUI handling for permission conditions
> ------------------------------------------
>
> Key: TEIIDDES-1548
> URL: https://issues.jboss.org/browse/TEIIDDES-1548
> Project: Teiid Designer
> Issue Type: Feature Request
> Reporter: Steven Hawkins
> Assignee: Barry LaFond
> Fix For: 8.2
>
> Attachments: add-allowed-language-dialog.png, add-column-mask-dialog.png, add-row-based-security-dialog.png, allowed-languages-tab.png, column-mask-tab.png, row-based-security-tab.png
>
>
> A common request is to implement row based security. Teiid has added the ability to define a permission condition for this purpose:
> <permission>
> <resource-name>...</resource-name>
> <condition>sql</condition>
> ...
> </permission>
> The sql should resolve against the resource specified, ideally designer would check that as well.
> See TEIID-2311 and the reference for how these conditions are applied.
> {code:title=vdb.xml snippet}
> <data-role name="base-role" any-authenticated="true">
> <description>Conditional access</description>
>
> <permission>
> <resource-name>modelName.tblName</resource-name>
> <condition constraint="false">column1=user()</condition>
> </permission>
>
> </data-role>
> {code}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (TEIIDDES-1548) Add GUI handling for permission conditions
by Van Halbert (JIRA)
[ https://issues.jboss.org/browse/TEIIDDES-1548?page=com.atlassian.jira.plu... ]
Van Halbert commented on TEIIDDES-1548:
---------------------------------------
Let me restate, as with row-level security, mask also has a condition that can be stated, but there's not a text box to enter it.
> Add GUI handling for permission conditions
> ------------------------------------------
>
> Key: TEIIDDES-1548
> URL: https://issues.jboss.org/browse/TEIIDDES-1548
> Project: Teiid Designer
> Issue Type: Feature Request
> Reporter: Steven Hawkins
> Assignee: Barry LaFond
> Fix For: 8.2
>
> Attachments: add-allowed-language-dialog.png, add-column-mask-dialog.png, add-row-based-security-dialog.png, allowed-languages-tab.png, column-mask-tab.png, row-based-security-tab.png
>
>
> A common request is to implement row based security. Teiid has added the ability to define a permission condition for this purpose:
> <permission>
> <resource-name>...</resource-name>
> <condition>sql</condition>
> ...
> </permission>
> The sql should resolve against the resource specified, ideally designer would check that as well.
> See TEIID-2311 and the reference for how these conditions are applied.
> {code:title=vdb.xml snippet}
> <data-role name="base-role" any-authenticated="true">
> <description>Conditional access</description>
>
> <permission>
> <resource-name>modelName.tblName</resource-name>
> <condition constraint="false">column1=user()</condition>
> </permission>
>
> </data-role>
> {code}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (TEIIDDES-1548) Add GUI handling for permission conditions
by Barry LaFond (JIRA)
[ https://issues.jboss.org/browse/TEIIDDES-1548?page=com.atlassian.jira.plu... ]
Barry LaFond commented on TEIIDDES-1548:
----------------------------------------
Currently my UI treats condition and mask elements as independent except that they may reference the same column. In order to tweak the UI, I'd need more definition on the relationship/use-case?
Question: Are there limitations on what columns can have condition and/or mask? If Permission for column_A is currently allow-read == FALSE?
> Add GUI handling for permission conditions
> ------------------------------------------
>
> Key: TEIIDDES-1548
> URL: https://issues.jboss.org/browse/TEIIDDES-1548
> Project: Teiid Designer
> Issue Type: Feature Request
> Reporter: Steven Hawkins
> Assignee: Barry LaFond
> Fix For: 8.2
>
> Attachments: add-allowed-language-dialog.png, add-column-mask-dialog.png, add-row-based-security-dialog.png, allowed-languages-tab.png, column-mask-tab.png, row-based-security-tab.png
>
>
> A common request is to implement row based security. Teiid has added the ability to define a permission condition for this purpose:
> <permission>
> <resource-name>...</resource-name>
> <condition>sql</condition>
> ...
> </permission>
> The sql should resolve against the resource specified, ideally designer would check that as well.
> See TEIID-2311 and the reference for how these conditions are applied.
> {code:title=vdb.xml snippet}
> <data-role name="base-role" any-authenticated="true">
> <description>Conditional access</description>
>
> <permission>
> <resource-name>modelName.tblName</resource-name>
> <condition constraint="false">column1=user()</condition>
> </permission>
>
> </data-role>
> {code}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (TEIIDDES-1548) Add GUI handling for permission conditions
by Van Halbert (JIRA)
[ https://issues.jboss.org/browse/TEIIDDES-1548?page=com.atlassian.jira.plu... ]
Van Halbert edited comment on TEIIDDES-1548 at 7/10/13 4:16 PM:
----------------------------------------------------------------
When defining a mask, need to also allow for defining an optional condition. Also, the order, should it be of type integer, instead of string?
I think you should combine condition and mask on the same panel.
was (Author: van.halbert):
When defining a mask, need to also allow for defining an optional condition. Also, the order, should it be of type integer, instead of string?
> Add GUI handling for permission conditions
> ------------------------------------------
>
> Key: TEIIDDES-1548
> URL: https://issues.jboss.org/browse/TEIIDDES-1548
> Project: Teiid Designer
> Issue Type: Feature Request
> Reporter: Steven Hawkins
> Assignee: Barry LaFond
> Fix For: 8.2
>
> Attachments: add-allowed-language-dialog.png, add-column-mask-dialog.png, add-row-based-security-dialog.png, allowed-languages-tab.png, column-mask-tab.png, row-based-security-tab.png
>
>
> A common request is to implement row based security. Teiid has added the ability to define a permission condition for this purpose:
> <permission>
> <resource-name>...</resource-name>
> <condition>sql</condition>
> ...
> </permission>
> The sql should resolve against the resource specified, ideally designer would check that as well.
> See TEIID-2311 and the reference for how these conditions are applied.
> {code:title=vdb.xml snippet}
> <data-role name="base-role" any-authenticated="true">
> <description>Conditional access</description>
>
> <permission>
> <resource-name>modelName.tblName</resource-name>
> <condition constraint="false">column1=user()</condition>
> </permission>
>
> </data-role>
> {code}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (TEIIDDES-1548) Add GUI handling for permission conditions
by Van Halbert (JIRA)
[ https://issues.jboss.org/browse/TEIIDDES-1548?page=com.atlassian.jira.plu... ]
Van Halbert commented on TEIIDDES-1548:
---------------------------------------
When defining a mask, need to also allow for defining an optional condition. Also, the order, should it be of type integer, instead of string?
> Add GUI handling for permission conditions
> ------------------------------------------
>
> Key: TEIIDDES-1548
> URL: https://issues.jboss.org/browse/TEIIDDES-1548
> Project: Teiid Designer
> Issue Type: Feature Request
> Reporter: Steven Hawkins
> Assignee: Barry LaFond
> Fix For: 8.2
>
> Attachments: add-allowed-language-dialog.png, add-column-mask-dialog.png, add-row-based-security-dialog.png, allowed-languages-tab.png, column-mask-tab.png, row-based-security-tab.png
>
>
> A common request is to implement row based security. Teiid has added the ability to define a permission condition for this purpose:
> <permission>
> <resource-name>...</resource-name>
> <condition>sql</condition>
> ...
> </permission>
> The sql should resolve against the resource specified, ideally designer would check that as well.
> See TEIID-2311 and the reference for how these conditions are applied.
> {code:title=vdb.xml snippet}
> <data-role name="base-role" any-authenticated="true">
> <description>Conditional access</description>
>
> <permission>
> <resource-name>modelName.tblName</resource-name>
> <condition constraint="false">column1=user()</condition>
> </permission>
>
> </data-role>
> {code}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months