Real-time security model providing intermediate query results to a user in a federated data system
The subject technology provides configurations for receiving a query for data stored across data systems in which the query is associated with a user. It is determined if the user has permission to execute an operation from the query at a data in which the operation is executed upon at least one table provided by the data system. The subject technology determines if the operation corresponds to a cache object in a cache registry if the user has permission. Each cache object is owned by a cache manager user. A view associated with the user is created that provides temporary access privileges to the cache object corresponding to the operation in which the cache object includes results of the operation executed in the query and the cache object is owned by the cache manager user. The results of the operation are then provided in the created view to the user.
1. A computer-implemented method, the method comprising:
receiving a query for data stored across a plurality of data systems, wherein the query is associated with a querying user;
determining if the querying user has permission to access data in at least one table referenced in an operation from the query at a data system among the plurality of data systems, wherein permission is based on the data system checking an access control for the at least one table provided by the data system;
determining a cache object corresponding to the operation from the query is present in a cache registry upon verification of permission for the querying user to access the data in the at least one table at the data system, wherein the cache object includes results of the operation executed from the query, and the cache object is owned by a cache manager user; and
creating a view of the determined cache object associated with the querying user that provides temporary access privileges to the results of the executed operation in the determined cache object.
2. The method of claim 1 , wherein the access control identifies if the querying user has permission to perform the operation on the at least one table at the data system.
3. The method of claim 1 , wherein determining if the querying user has permission to access the data in the at least one table referenced in the operation is based on dynamic binding to verify permissions for each querying user that executes the operation.
4. The method of claim 1 , further comprising:
dropping the view after providing the results of the operation in the created view to the querying user.
5. The method of claim 1 , wherein the cache manager user comprises an administrator account.
6. The method of claim 1 , wherein the view is controlled by the cache manager user.
7. The method of claim 1 , further comprising:
executing the operation to provide results of the executed operation if the operation does not correspond to any existing cache object in the cache registry; and
storing a new cache object including the results of the executed operation in the cache registry.
8. The method of claim 7 , wherein the stored cache object is owned by the cache manager user.
9. The method of claim 1 , further comprising:
invalidating the existing cache object in the cache registry.
10. The method of claim 1 , wherein the querying user does not have ownership privileges to the cache object.
11. The method of claim 1 , wherein the cache object is utilized as a physical plan alternative for one or more operations of a respective query.
12. The method of claim 1 , wherein determining if the querying user has permission to access the data in the at least one table referenced in the operation from the query occurs in real-time.
13. The method of claim 1 , wherein the plurality of data systems store federated data.
14. A system, comprising:
one or more processors;
a machine-readable medium comprising instructions stored therein, which when executed by the one or more processors, cause the processors to perform operations comprising:
receiving a query for data stored across a plurality of data systems, wherein the query is associated with a querying user;
determining if the querying user has permission to access data in at least one table referenced in an operation from the query at a data system among the plurality of data systems, wherein permission is based on the data system checking an access control for the at least one table provided by the data system;
determining a cache object corresponding to the operation from the query is present in a cache registry upon verification of permission for the querying user to to access the data in the at least one table at the data system, wherein the cache object includes results of the operation executed from the query, and the cache object is owned by a cache manager user; and
creating a view of the determined cache object associated with the querying user that provides temporary access privileges to the results of the executed operation in the determined.
15. The system of claim 14 , wherein the access control identifies if the querying user has permission to perform the operation on the at least one table at the data system.
16. The system of claim 14 , further comprising:
dropping the view after providing the results of the operation in the created view to the querying user.
17. The system of claim 14 , further comprising:
executing the operation to provide results of the executed operation if the operation does not correspond to any existing cache object in the cache registry; and
storing a new cache object including the results of the executed operation in the cache registry.
18. A non-transitory machine-readable medium comprising instructions stored therein, which when executed by a machine, cause the machine to perform operations comprising:
receiving a query for data stored across a plurality of data systems, wherein the query is associated with a querying user;
determining if the querying user has permission to access data in at least one table referenced in an operation from the query at a data system among the plurality of data systems, wherein permission is based on the data system checking an access control for the at least one table provided by the data system;
determining a cache object corresponding to the operation from the query is present in a cache registry upon verification of permission for the querying user to access the data in the at least one table at the data system, wherein the cache object includes results of the operation executed from the query, and each cache object is owned by a cache manager user;
providing the cache object for including in a view in response to determining the cache object is present in the cache registry;
creating a view of the determined cache object associated with the querying user that provides temporary access privileges to the results of the executed operation in the determined cache object;
and
dropping the created view after providing the results of the executed operation in the created view.