4 releases
0.1.5 | Jun 10, 2024 |
---|---|
0.1.4 | May 15, 2024 |
0.1.3 | May 8, 2024 |
0.1.2 | Apr 22, 2024 |
0.1.0 |
|
#19 in #postgresql-extension
11KB
147 lines
Accumulo Access Expressions for PostgreSQL
Introduction
This project provides a PostgreSQL extension that allows to parse, evaluate and filter rows (Row-Level Security) with Accumulo access expressions to be used in PostgreSQL queries. The extension is implemented as a Rust extension to PostgreSQL.
The development wouldn't have been possible without the excellent pgrx project.
Installation
TODO
cargo install cargo-pgrx
cargo pgrx init --pg15=download
cargo build --release
cargo pgrx run pg15
#cargo pgrx package
CREATE EXTENSION accumulo_access_pg;
Usage
Example with Row Level Security
create role users;
create user johnny;
grant users to johnny;
create table secret_stuff(id serial primary key, data text not null, authz_expr text not null);
alter table secret_stuff enable row level security;
insert into secret_stuff(data, authz_expr) values('pretty secret', 'label1');
insert into secret_stuff(data, authz_expr) values('moar secret', 'label1|label2');
insert into secret_stuff(data, authz_expr) values('wat', 'label2');
insert into secret_stuff(data, authz_expr) values('win', 'label2 & (label3 | label4)');
grant select on secret_stuff to users;
create policy evaluate_policies on secret_stuff using ( sec_authz_check(authz_expr, current_setting('session.authorizations')));
-- ...
set session authorization johnny;
select current_user,session_user;
-- current_user | session_user
----------------+--------------
-- johnny | johnny
set session.authorizations = 'label1';
select * from secret_stuff;
-- id | data | authz_expr
------+---------------+---------------
-- 1 | pretty secret | label1
-- 2 | moar secret | label1|label2
-- (2 rows)
set session.authorizations = 'label2,label3';
select * from secret_stuff;
-- id | data | authz_expr
------+-------------+----------------------------
-- 2 | moar secret | label1|label2
-- 3 | wat | label2
-- 4 | win | label2 & (label3 | label4)
-- (3 rows)
TODO
- Make the caching feature configurable (strategy, size)
- Implement some benchmarks.
- Support for signed authorizations (JWT? Just raw signatures?)
License
This project is licensed under both the Apache 2.0 license and the MIT license. See the LICENSE_APACHE
and LICENSE_MIT
files for details.
Contributions
Contributions are welcome. Please open an issue or a pull request.
Dependencies
~24MB
~543K SLoC