Giter Club home page Giter Club logo

accumulo-access-pg's Introduction

Accumulo Access Expressions for PostgreSQL

Introduction

This project provides a PostgreSQL extension that allows to parse, evaluate and filter rows (Row-Level Security) with Accumulo access expressions to be used in PostgreSQL queries. The extension is implemented as a Rust extension to PostgreSQL.

The development wouldn't have been possible without the excellent pgrx project.

Installation

TODO

cargo install cargo-pgrx
cargo pgrx init --pg15=download
cargo build --release
cargo pgrx run pg15
#cargo pgrx package
CREATE EXTENSION accumulo_access_pg;

Usage

Example with Row Level Security

create role users;
create user johnny;
grant users to johnny;

create table secret_stuff(id serial primary key, data text not null, authz_expr text not null);
alter table secret_stuff enable row level security;
insert into secret_stuff(data, authz_expr) values('pretty secret', 'label1');
insert into secret_stuff(data, authz_expr) values('moar secret', 'label1|label2');
insert into secret_stuff(data, authz_expr) values('wat', 'label2');
insert into secret_stuff(data, authz_expr) values('win', 'label2 & (label3 | label4)');

grant select on secret_stuff to users;

create policy evaluate_policies on secret_stuff using ( sec_authz_check(authz_expr, current_setting('session.authorizations')));

-- ...
set session authorization johnny;
select current_user,session_user;
-- current_user | session_user 
----------------+--------------
-- johnny       | johnny

set session.authorizations = 'label1';

select * from secret_stuff;
-- id |     data      |  authz_expr   
------+---------------+---------------
--  1 | pretty secret | label1
--  2 | moar secret   | label1|label2
-- (2 rows)

set session.authorizations = 'label2,label3';
select * from secret_stuff;
-- id |    data     |         authz_expr         
------+-------------+----------------------------
--  2 | moar secret | label1|label2
--  3 | wat         | label2
--  4 | win         | label2 & (label3 | label4)
-- (3 rows)

TODO

  • Make the caching feature configurable (strategy, size)
  • Implement some benchmarks.
  • Support for signed authorizations (JWT? Just raw signatures?)

License

This project is licensed under both the Apache 2.0 license and the MIT license. See the LICENSE_APACHE and LICENSE_MIT files for details.

Contributions

Contributions are welcome. Please open an issue or a pull request.

accumulo-access-pg's People

Contributors

larsw avatar

Stargazers

 avatar

Watchers

 avatar  avatar  avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.