[JBoss JIRA] (TEIID-2695) Unable to use CASE statement in Select
by Steven Hawkins (JIRA)
[ https://issues.jboss.org/browse/TEIID-2695?page=com.atlassian.jira.plugin... ]
Steven Hawkins commented on TEIID-2695:
---------------------------------------
As noted in the docs, you need to be case sensitive.
> Unable to use CASE statement in Select
> --------------------------------------
>
> Key: TEIID-2695
> URL: https://issues.jboss.org/browse/TEIID-2695
> Project: Teiid
> Issue Type: Bug
> Components: Query Engine
> Affects Versions: 8.4.1
> Reporter: Van Halbert
> Assignee: Steven Hawkins
> Attachments: portfolio-vdb.xml
>
>
> Trying to add a <mask> of:
> <permission>
> <resource-name>Stocks.StockPrices.Price</resource-name>
> <mask>CASE WHEN hasRole('prices') THEN Price END</mask>
> </permission>
> even tried using "= true" just to see
> but it it always returns null for Prices.
> To test it, I logged in as 'user' using CommandLog vdb and issued:
> Select VDB, CASE WHEN hasRole('prices') THEN 'Y' Else 'N' END as V from TEIID_COMMANDLOG
> and 'N' was always returned for column V.
> teiid roles file:
> # A roles.properties file for use with the UsersRolesLoginModule
> # username=role1,role2
> portfolio=superuser
> viewonly=readonly
> user=user,prices
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2695) Unable to use CASE statement in Select
by Van Halbert (JIRA)
[ https://issues.jboss.org/browse/TEIID-2695?page=com.atlassian.jira.plugin... ]
Van Halbert commented on TEIID-2695:
------------------------------------
I added the data role to the VDB (trying with and without any-authenticated=true)
<data-role name="Prices" any-authenticated="true" >
<description>Allow ReadOnly Operations to see pricing</description>
<permission>
<resource-name>Stocks</resource-name>
<allow-read>true</allow-read>
</permission>
<mapped-role-name>prices</mapped-role-name>
</data-role>
And still can't get hasRole('prices') to come back true (tried both queries below
- SELECT symbol,price, CASE WHEN hasRole('prices') THEN 'Y' Else 'N' END as V From StockPrices
- Select hasRole('prices')
> Unable to use CASE statement in Select
> --------------------------------------
>
> Key: TEIID-2695
> URL: https://issues.jboss.org/browse/TEIID-2695
> Project: Teiid
> Issue Type: Bug
> Components: Query Engine
> Affects Versions: 8.4.1
> Reporter: Van Halbert
> Assignee: Steven Hawkins
> Attachments: portfolio-vdb.xml
>
>
> Trying to add a <mask> of:
> <permission>
> <resource-name>Stocks.StockPrices.Price</resource-name>
> <mask>CASE WHEN hasRole('prices') THEN Price END</mask>
> </permission>
> even tried using "= true" just to see
> but it it always returns null for Prices.
> To test it, I logged in as 'user' using CommandLog vdb and issued:
> Select VDB, CASE WHEN hasRole('prices') THEN 'Y' Else 'N' END as V from TEIID_COMMANDLOG
> and 'N' was always returned for column V.
> teiid roles file:
> # A roles.properties file for use with the UsersRolesLoginModule
> # username=role1,role2
> portfolio=superuser
> viewonly=readonly
> user=user,prices
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2693) Logging/message tweaks
by Steven Hawkins (JIRA)
[ https://issues.jboss.org/browse/TEIID-2693?page=com.atlassian.jira.plugin... ]
Steven Hawkins resolved TEIID-2693.
-----------------------------------
Resolution: Done
Made the updates from the description.
> Logging/message tweaks
> ----------------------
>
> Key: TEIID-2693
> URL: https://issues.jboss.org/browse/TEIID-2693
> Project: Teiid
> Issue Type: Quality Risk
> Reporter: Steven Hawkins
> Assignee: Steven Hawkins
> Fix For: 8.6
>
>
> The source sql is being redundantly logged in JDBCQueryExecution.
> We should continue to refine how odbc/jdbc uncaught exceptions are logged - if it's not clearly a closed connection, then it should be a warning.
> If a local connection is tried outside of AS the result is an npe. A better message should be given.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2577) Translator API to provide session backed connection
by Steven Hawkins (JIRA)
[ https://issues.jboss.org/browse/TEIID-2577?page=com.atlassian.jira.plugin... ]
Steven Hawkins commented on TEIID-2577:
---------------------------------------
> Do the appropriate JDBC methods throw IllegalState (or some other exception) in this case?
close/rollback are noop. The the other transaction or change user methods will throw an exception (although I think I left out a good message).
> Client state? Are you referring to Teiid internals or something that's exposed through JDBC like client info?
Mostly I'm referring to url/execution properties that are typically handled on the client side. Things like session variables that are handled on the server-side will be consistent.
> Translator API to provide session backed connection
> ---------------------------------------------------
>
> Key: TEIID-2577
> URL: https://issues.jboss.org/browse/TEIID-2577
> Project: Teiid
> Issue Type: Feature Request
> Components: Connector API
> Reporter: Mark Addleman
> Assignee: Steven Hawkins
> Fix For: 8.6
>
>
> Provide an API (probably from an ExecutionContext) to obtain a JDBC connection to the same Teiid instance under the client's session.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2577) Translator API to provide session backed connection
by Mark Addleman (JIRA)
[ https://issues.jboss.org/browse/TEIID-2577?page=com.atlassian.jira.plugin... ]
Mark Addleman commented on TEIID-2577:
--------------------------------------
> The connection disables explicit transaction control, switching the user, and close.
Do the appropriate JDBC methods throw IllegalState (or some other exception) in this case? Although I don't expect to use any of these features, it would be nice to know if we inadvertently trip over a disabled feature.
> Each connection obtained off of the command context is unique and any client state will not be shared (and any client state from the initial user connection won't be available either).
Client state? Are you referring to Teiid internals or something that's exposed through JDBC like client info?
> Translator API to provide session backed connection
> ---------------------------------------------------
>
> Key: TEIID-2577
> URL: https://issues.jboss.org/browse/TEIID-2577
> Project: Teiid
> Issue Type: Feature Request
> Components: Connector API
> Reporter: Mark Addleman
> Assignee: Steven Hawkins
> Fix For: 8.6
>
>
> Provide an API (probably from an ExecutionContext) to obtain a JDBC connection to the same Teiid instance under the client's session.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2577) Translator API to provide session backed connection
by Mark Addleman (JIRA)
[ https://issues.jboss.org/browse/TEIID-2577?page=com.atlassian.jira.plugin... ]
Mark Addleman commented on TEIID-2577:
--------------------------------------
> The connection disables explicit transaction control, switching the user, and close.
Do the appropriate JDBC methods throw IllegalState (or some other exception) in this case? Although I don't expect to use any of these features, it would be nice to know if we inadvertently trip over a disabled feature.
> Each connection obtained off of the command context is unique and any client state will not be shared (and any client state from the initial user connection won't be available either).
Client state? Are you referring to Teiid internals or something that's exposed through JDBC like client info?
> Translator API to provide session backed connection
> ---------------------------------------------------
>
> Key: TEIID-2577
> URL: https://issues.jboss.org/browse/TEIID-2577
> Project: Teiid
> Issue Type: Feature Request
> Components: Connector API
> Reporter: Mark Addleman
> Assignee: Steven Hawkins
> Fix For: 8.6
>
>
> Provide an API (probably from an ExecutionContext) to obtain a JDBC connection to the same Teiid instance under the client's session.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2577) Translator API to provide session backed connection
by Steven Hawkins (JIRA)
[ https://issues.jboss.org/browse/TEIID-2577?page=com.atlassian.jira.plugin... ]
Steven Hawkins resolved TEIID-2577.
-----------------------------------
Resolution: Done
Added the initial implementation available via CommandContext.getConnection
It's probably best to leave this as a somewhat experimental/undocumented feature at this point.
The connection disables explicit transaction control, switching the user, and close. Each connection obtained off of the command context is unique and any client state will not be shared (and any client state from the initial user connection won't be available either).
At least for socket connections since we store the useCallingThread on the DQPWorkContext this means that the resulting internal connections will consume an additional processing thread, which can be addressed later on.
> Translator API to provide session backed connection
> ---------------------------------------------------
>
> Key: TEIID-2577
> URL: https://issues.jboss.org/browse/TEIID-2577
> Project: Teiid
> Issue Type: Feature Request
> Components: Connector API
> Reporter: Mark Addleman
> Assignee: Steven Hawkins
> Fix For: 8.6
>
>
> Provide an API (probably from an ExecutionContext) to obtain a JDBC connection to the same Teiid instance under the client's session.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2695) Unable to use CASE statement in Select
by Steven Hawkins (JIRA)
[ https://issues.jboss.org/browse/TEIID-2695?page=com.atlassian.jira.plugin... ]
Steven Hawkins commented on TEIID-2695:
---------------------------------------
> You can't have a role defined in vdb.xml and not JAAS, and still give permission, can you?
The any-authenticated case is the typical scenario for defining a role with no mappings.
> Therefore, wouldn't it be better to just use what defined in JAAS, and not worry about the vdb.xml, cause it all has to be in JAAS anyway to work
Again no. One of the major trusts of virtualization is to fully encapsulate the virtual environment. Not allowing a user to do that for security metadata would be quite odd.
Furthermore you still have to map Teiid roles to JAAS groups somehow - you cannot / should not assume a 1-1 mapping. For example a Teiid role could be granted to several groups.
> Unable to use CASE statement in Select
> --------------------------------------
>
> Key: TEIID-2695
> URL: https://issues.jboss.org/browse/TEIID-2695
> Project: Teiid
> Issue Type: Bug
> Components: Query Engine
> Affects Versions: 8.4.1
> Reporter: Van Halbert
> Assignee: Steven Hawkins
> Attachments: portfolio-vdb.xml
>
>
> Trying to add a <mask> of:
> <permission>
> <resource-name>Stocks.StockPrices.Price</resource-name>
> <mask>CASE WHEN hasRole('prices') THEN Price END</mask>
> </permission>
> even tried using "= true" just to see
> but it it always returns null for Prices.
> To test it, I logged in as 'user' using CommandLog vdb and issued:
> Select VDB, CASE WHEN hasRole('prices') THEN 'Y' Else 'N' END as V from TEIID_COMMANDLOG
> and 'N' was always returned for column V.
> teiid roles file:
> # A roles.properties file for use with the UsersRolesLoginModule
> # username=role1,role2
> portfolio=superuser
> viewonly=readonly
> user=user,prices
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2695) Unable to use CASE statement in Select
by Van Halbert (JIRA)
[ https://issues.jboss.org/browse/TEIID-2695?page=com.atlassian.jira.plugin... ]
Van Halbert commented on TEIID-2695:
------------------------------------
If in procedure, I need to do conditioning logic based on if this person is part of a group (say accounting vs hr). Basically, anywhere I need to check the role before doing something.
You can't have a role defined in vdb.xml and not JAAS, and still give permission, can you? Therefore, wouldn't it be better to just use what defined in JAAS, and not worry about the vdb.xml, cause it all has to be in JAAS anyway to work
> Unable to use CASE statement in Select
> --------------------------------------
>
> Key: TEIID-2695
> URL: https://issues.jboss.org/browse/TEIID-2695
> Project: Teiid
> Issue Type: Bug
> Components: Query Engine
> Affects Versions: 8.4.1
> Reporter: Van Halbert
> Assignee: Steven Hawkins
> Attachments: portfolio-vdb.xml
>
>
> Trying to add a <mask> of:
> <permission>
> <resource-name>Stocks.StockPrices.Price</resource-name>
> <mask>CASE WHEN hasRole('prices') THEN Price END</mask>
> </permission>
> even tried using "= true" just to see
> but it it always returns null for Prices.
> To test it, I logged in as 'user' using CommandLog vdb and issued:
> Select VDB, CASE WHEN hasRole('prices') THEN 'Y' Else 'N' END as V from TEIID_COMMANDLOG
> and 'N' was always returned for column V.
> teiid roles file:
> # A roles.properties file for use with the UsersRolesLoginModule
> # username=role1,role2
> portfolio=superuser
> viewonly=readonly
> user=user,prices
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months
[JBoss JIRA] (TEIID-2695) Unable to use CASE statement in Select
by Steven Hawkins (JIRA)
[ https://issues.jboss.org/browse/TEIID-2695?page=com.atlassian.jira.plugin... ]
Steven Hawkins commented on TEIID-2695:
---------------------------------------
> Hm, I thought the hasRole('role') call was the way to determine if this current user has this role assigned to them (in other words, a member of the group).
You are using the terms too loosely. A Teiid role (and a role concept in general) is a specific entity that combines permissions and groups. A JAAS group (what UsersRolesLoginModule is terming as a role - which is misleading as it does not specify any permissions) is generally not something that we want specifically referenced by the vdb - what happens if you want to change the source group names, they change between environments, etc.
> I think this is not good, because you can no longer use functional based permissions in view's to control behavior.
Can you explain that more?
> Unable to use CASE statement in Select
> --------------------------------------
>
> Key: TEIID-2695
> URL: https://issues.jboss.org/browse/TEIID-2695
> Project: Teiid
> Issue Type: Bug
> Components: Query Engine
> Affects Versions: 8.4.1
> Reporter: Van Halbert
> Assignee: Steven Hawkins
> Attachments: portfolio-vdb.xml
>
>
> Trying to add a <mask> of:
> <permission>
> <resource-name>Stocks.StockPrices.Price</resource-name>
> <mask>CASE WHEN hasRole('prices') THEN Price END</mask>
> </permission>
> even tried using "= true" just to see
> but it it always returns null for Prices.
> To test it, I logged in as 'user' using CommandLog vdb and issued:
> Select VDB, CASE WHEN hasRole('prices') THEN 'Y' Else 'N' END as V from TEIID_COMMANDLOG
> and 'N' was always returned for column V.
> teiid roles file:
> # A roles.properties file for use with the UsersRolesLoginModule
> # username=role1,role2
> portfolio=superuser
> viewonly=readonly
> user=user,prices
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 2 months