#postgresql-extension #access #security #expressions #expression-parser #row #accumulo

accumulo_access_pg

PostgreSQL extension for parsing and evaluating Accumulo Access Expressions

4 releases

0.1.5 Jun 10, 2024
0.1.4 May 15, 2024
0.1.3 May 8, 2024
0.1.2 Apr 22, 2024
0.1.0 Jan 8, 2024

#1137 in Database interfaces

MIT/Apache

11KB
147 lines

Accumulo Access Expressions for PostgreSQL

Introduction

This project provides a PostgreSQL extension that allows to parse, evaluate and filter rows (Row-Level Security) with Accumulo access expressions to be used in PostgreSQL queries. The extension is implemented as a Rust extension to PostgreSQL.

The development wouldn't have been possible without the excellent pgrx project.

Installation

TODO

cargo install cargo-pgrx
cargo pgrx init --pg15=download
cargo build --release
cargo pgrx run pg15
#cargo pgrx package
CREATE EXTENSION accumulo_access_pg;

Usage

Example with Row Level Security

create role users;
create user johnny;
grant users to johnny;

create table secret_stuff(id serial primary key, data text not null, authz_expr text not null);
alter table secret_stuff enable row level security;
insert into secret_stuff(data, authz_expr) values('pretty secret', 'label1');
insert into secret_stuff(data, authz_expr) values('moar secret', 'label1|label2');
insert into secret_stuff(data, authz_expr) values('wat', 'label2');
insert into secret_stuff(data, authz_expr) values('win', 'label2 & (label3 | label4)');

grant select on secret_stuff to users;

create policy evaluate_policies on secret_stuff using ( sec_authz_check(authz_expr, current_setting('session.authorizations')));

-- ...
set session authorization johnny;
select current_user,session_user;
-- current_user | session_user 
----------------+--------------
-- johnny       | johnny

set session.authorizations = 'label1';

select * from secret_stuff;
-- id |     data      |  authz_expr   
------+---------------+---------------
--  1 | pretty secret | label1
--  2 | moar secret   | label1|label2
-- (2 rows)

set session.authorizations = 'label2,label3';
select * from secret_stuff;
-- id |    data     |         authz_expr         
------+-------------+----------------------------
--  2 | moar secret | label1|label2
--  3 | wat         | label2
--  4 | win         | label2 & (label3 | label4)
-- (3 rows)

TODO

  • Make the caching feature configurable (strategy, size)
  • Implement some benchmarks.
  • Support for signed authorizations (JWT? Just raw signatures?)

License

This project is licensed under both the Apache 2.0 license and the MIT license. See the LICENSE_APACHE and LICENSE_MIT files for details.

Contributions

Contributions are welcome. Please open an issue or a pull request.

Dependencies

~24MB
~543K SLoC