[doc] add a minimal documentation for OPA RLS capabilities #22424

harksin · 2024-06-18T15:50:07Z

Description

Add missing docs for OPA security plugin

Release notes

(x) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
( ) Release notes are required, with the following suggested text:

# Section
* Fix some things. ({issue}`issuenumber`)

cla-bot · 2024-06-18T15:50:10Z

Thank you for your pull request and welcome to our community. We could not parse the GitHub identity of the following contributors: roch.
This is most likely caused by a git client misconfiguration; please make sure to:

check if your git client is configured with an email to sign commits git config --list | grep email
If not, set it up using git config --global user.email [email protected]
Make sure that the git commit email is configured in your GitHub account settings, see https://github.com/settings/emails

mosabua · 2024-06-18T16:06:12Z

Please submit a signed CLA and wrap all paragraphs at 80 columns width. Then we can review in detail

cla-bot · 2024-06-18T16:07:06Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to [email protected]. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

vagaerg

Thanks for adding this! This looks good, just some comments

docs/src/main/sphinx/security/opa-access-control.md

vagaerg · 2024-06-18T16:27:39Z

docs/src/main/sphinx/security/opa-access-control.md

+Column masking allow you to denied access to a particular column instead of the entiere tables from your OPA policy.
+
+for these kind of policies to work, make sure to set `opa.policy.column-masking-uri` in the opa-plugin configuration
+
+here is an example bellow


Suggested change

Column masking allow you to denied access to a particular column instead of the entiere tables from your OPA policy.

for these kind of policies to work, make sure to set `opa.policy.column-masking-uri` in the opa-plugin configuration

here is an example bellow

Column masking allows Trino to mask out/obscure the data in some columns for specific users, without

outright denying access. This plugin supports fetching column masks from OPA.

For these policies to be enabled, make sure to set `opa.policy.column-masking-uri` in the opa-plugin configuration.

For instance, a policy configuring column masking may be implemented as below:

sorry pushed a update before seing your proposal :/
changed have been re-introduced with commit a714606

docs/src/main/sphinx/security/opa-access-control.md

vagaerg · 2024-06-18T16:29:30Z

docs/src/main/sphinx/security/opa-access-control.md

+ `https://opa.example.com/v1/data/rowFilters`.
+* - `opa.policy.column-masking-uri`
+ - The **optional** URI for fetching column masks - if not set no masking will be applied, for example,
+ `https://opa.example.com/v1/data/columnMask`.


CC @mosiac1 - once #21997 is merged this should be updated

cla-bot · 2024-06-18T18:43:41Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to [email protected]. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

harksin · 2024-06-18T18:44:17Z

Please submit a signed CLA and wrap all paragraphs at 80 columns width. Then we can review in detail

thanks for the advice, it's done

cla-bot · 2024-06-18T18:58:25Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to [email protected]. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

docs/src/main/sphinx/security/opa-access-control.md

mosabua · 2024-06-19T15:37:21Z

docs/src/main/sphinx/security/opa-access-control.md

+specific users, without outright denying access. This plugin supports fetching
+column masks from OPA.
+
+For these policies to be enabled, make sure to set


Work this into the sentence above like in row filtering

docs/src/main/sphinx/security/opa-access-control.md

mosabua · 2024-06-19T15:38:43Z

docs/src/main/sphinx/security/opa-access-control.md

+ }
+```
+
+Unlike row filtering, only a **single column mask** may be returned for a given


Same as above .. explain what the script does some more and refactor the section here and following into normal sentences.

mosabua · 2024-06-26T21:42:15Z

Can you address the feedback and suggestions @harksin ?

mosabua · 2024-06-26T21:42:25Z

@cla-bot check

cla-bot · 2024-06-26T21:42:28Z

The cla-bot has been summoned, and re-checked this pull request!

Co-authored-by: Manfred Moser <[email protected]>

harksin · 2024-07-09T07:53:45Z

Can you address the feedback and suggestions @harksin ?

Hello mosabua, will do it np, but realy busy these days, it will be beg of august probably.
If you wanna rollout this erlier,feel free to take the hand on this PR

have a great day,

github-actions bot added the docs label Jun 18, 2024

mosabua requested a review from vagaerg June 18, 2024 16:05

add a minimal documentation about OPA RLS capabilities

8ca24f8

harksin force-pushed the docs/opa_rls branch from 161b302 to 8ca24f8 Compare June 18, 2024 16:07

vagaerg reviewed Jun 18, 2024

View reviewed changes

rewrap at 80 col + rego coloration

c4868e8

apply vagaerg review

a714606

mosabua requested changes Jun 19, 2024

View reviewed changes

cla-bot bot added the cla-signed label Jun 26, 2024

harksin and others added 8 commits July 9, 2024 09:44

Update docs/src/main/sphinx/security/opa-access-control.md

d0cb45a

Co-authored-by: Manfred Moser <[email protected]>

Update docs/src/main/sphinx/security/opa-access-control.md

e0dafb0

Co-authored-by: Manfred Moser <[email protected]>

Update docs/src/main/sphinx/security/opa-access-control.md

1efde02

Co-authored-by: Manfred Moser <[email protected]>

Update docs/src/main/sphinx/security/opa-access-control.md

fddcfa6

Co-authored-by: Manfred Moser <[email protected]>

Update docs/src/main/sphinx/security/opa-access-control.md

493de0e

Co-authored-by: Manfred Moser <[email protected]>

Update docs/src/main/sphinx/security/opa-access-control.md

b7e9e74

Co-authored-by: Manfred Moser <[email protected]>

Update docs/src/main/sphinx/security/opa-access-control.md

2e57505

Co-authored-by: Manfred Moser <[email protected]>

Update docs/src/main/sphinx/security/opa-access-control.md

5dd538e

Co-authored-by: Manfred Moser <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[doc] add a minimal documentation for OPA RLS capabilities #22424

[doc] add a minimal documentation for OPA RLS capabilities #22424

harksin commented Jun 18, 2024

cla-bot bot commented Jun 18, 2024

mosabua commented Jun 18, 2024

cla-bot bot commented Jun 18, 2024

vagaerg left a comment

vagaerg Jun 18, 2024

harksin Jun 18, 2024

vagaerg Jun 18, 2024

cla-bot bot commented Jun 18, 2024

harksin commented Jun 18, 2024 •

edited

Loading

cla-bot bot commented Jun 18, 2024

mosabua Jun 19, 2024

mosabua Jun 19, 2024

mosabua commented Jun 26, 2024

mosabua commented Jun 26, 2024

cla-bot bot commented Jun 26, 2024

harksin commented Jul 9, 2024

-Column masking allow you to denied access to a particular column instead of the entiere tables from your OPA policy.
-for these kind of policies to work, make sure to set `opa.policy.column-masking-uri` in the opa-plugin configuration
-here is an example bellow
+Column masking allows Trino to mask out/obscure the data in some columns for specific users, without
+outright denying access. This plugin supports fetching column masks from OPA.
+For these policies to be enabled, make sure to set `opa.policy.column-masking-uri` in the opa-plugin configuration.
+For instance, a policy configuring column masking may be implemented as below:

[doc] add a minimal documentation for OPA RLS capabilities #22424

Are you sure you want to change the base?

[doc] add a minimal documentation for OPA RLS capabilities #22424

Conversation

harksin commented Jun 18, 2024

Description

Release notes

cla-bot bot commented Jun 18, 2024

mosabua commented Jun 18, 2024

cla-bot bot commented Jun 18, 2024

vagaerg left a comment

Choose a reason for hiding this comment

vagaerg Jun 18, 2024

Choose a reason for hiding this comment

harksin Jun 18, 2024

Choose a reason for hiding this comment

vagaerg Jun 18, 2024

Choose a reason for hiding this comment

cla-bot bot commented Jun 18, 2024

harksin commented Jun 18, 2024 • edited Loading

cla-bot bot commented Jun 18, 2024

mosabua Jun 19, 2024

Choose a reason for hiding this comment

mosabua Jun 19, 2024

Choose a reason for hiding this comment

mosabua commented Jun 26, 2024

mosabua commented Jun 26, 2024

cla-bot bot commented Jun 26, 2024

harksin commented Jul 9, 2024

harksin commented Jun 18, 2024 •

edited

Loading