Catalog service configuration based on a privilege model and two-way synchronization
Provided herein are systems, methods, and computer-storage media for managing data object access in a catalog service account. The method includes detecting, at a catalog service account, by a catalog manager (CM), a user request to access a data object. The user request includes identification information of the user and a principal role associated with the user. The CM retrieves one or more catalog roles from a first catalog of the catalog service account. The one or more catalog roles correspond to the principal role. The CM determines a set of hierarchical data objects based on the user request. The set of hierarchical data objects comprise the data object. The CM performs a determination of whether access privileges of the set of hierarchical data objects and access privileges of the one or more catalog roles allow access to the data object. The CM grants access to the data object based on the determination.
1 . A system comprising:
at least one hardware processor; and
at least one memory storing instructions that cause the at least one hardware processor to perform operations comprising:
detecting, at a catalog service account, a user request to access a data object, the user request including identification information of the user and a principal role associated with the user;
retrieving one or more catalog roles from a first catalog of the catalog service account, the one or more catalog roles corresponding to the principal role;
determining a set of hierarchical data objects based on the user request, the set of hierarchical data objects comprising the data object;
performing a determination of whether access privileges of the set of hierarchical data objects and access privileges of the one or more catalog roles allow access to the data object; and
granting access to the data object based on the determination.
2 . The system of claim 1 , the operations further comprising:
retrieving the access privileges of the set of hierarchical data objects and the access privileges of the one or more catalog roles from a role-based security model of the catalog service account.
3 . The system of claim 2 , the operations further comprising:
detecting the set of hierarchical data objects comprises a plurality of nested namespaces; and
determining the access privileges of the set of hierarchical data objects based on access privileges for each namespace of the plurality of nested namespaces.
4 . The system of claim 2 , the operations further comprising:
retrieving a first set of access privileges from the role-based security model, the first set of access privileges associated with the first catalog, and including the access privileges of the one or more catalog roles;
retrieving a second set of access privileges from the role-based security model, the second set of access privileges associated with a second catalog of the catalog service account; and
configuring access to the first catalog and the second catalog based on the first set of access privileges and the second set of access privileges.
5 . The system of claim 1 , the operations further comprising:
retrieving a plurality of principal identities associated with the catalog service account; and
selecting a principal identity of the plurality of principal identities based on the identification information of the user.
6 . The system of claim 5 , the operations further comprising:
retrieving a plurality of catalog roles configured in the first catalog; and
selecting the one or more catalog roles from the plurality of catalog roles based on the principal role.
7 . The system of claim 1 , the operations further comprising:
determining the set of hierarchical data objects based on the one or more catalog roles, the set of hierarchical data objects comprising at least one namespace, at least one table, and at least one table view.
8 . The system of claim 1 , the operations further comprising:
detecting a synchronization request received at the catalog service account, the synchronization request associated with a second catalog that is external to the catalog service account.
9 . The system of claim 8 , the operations further comprising:
generating responsive to the synchronization request, an external catalog representation of the second catalog, the external catalog representation configured as a read-only catalog in the catalog service account.
10 . The system of claim 9 , the operations further comprising:
receiving via an application programming interface (API), a notification of an update posted to the second catalog; and
updating the external catalog representation based on the update.
11 . A method comprising:
detecting, at a catalog service account, by at least one hardware processor, a user request to access a data object, the user request including identification information of the user and a principal role associated with the user;
retrieving one or more catalog roles from a first catalog of the catalog service account, the one or more catalog roles corresponding to the principal role;
determining a set of hierarchical data objects based on the user request, the set of hierarchical data objects comprising the data object;
performing a determination of whether access privileges of the set of hierarchical data objects and access privileges of the one or more catalog roles allow access to the data object; and
granting access to the data object based on the determination.
12 . The method of claim 11 , further comprising:
retrieving the access privileges of the set of hierarchical data objects and the access privileges of the one or more catalog roles from a role-based security model of the catalog service account.
13 . The method of claim 12 , further comprising:
detecting the set of hierarchical data objects comprises a plurality of nested namespaces; and
determining the access privileges of the set of hierarchical data objects based on access privileges for each namespace of the plurality of nested namespaces.
14 . The method of claim 12 , further comprising:
retrieving a first set of access privileges from the role-based security model, the first set of access privileges associated with the first catalog, and including the access privileges of the one or more catalog roles;
retrieving a second set of access privileges from the role-based security model, the second set of access privileges associated with a second catalog of the catalog service account; and
configuring access to the first catalog and the second catalog based on the first set of access privileges and the second set of access privileges.
15 . The method of claim 11 , further comprising:
retrieving a plurality of principal identities associated with the catalog service account; and
selecting a principal identity of the plurality of principal identities based on the identification information of the user.
16 . The method of claim 15 , further comprising:
retrieving a plurality of catalog roles configured in the first catalog; and
selecting the one or more catalog roles from the plurality of catalog roles based on the principal role.
17 . The method of claim 11 , further comprising:
determining the set of hierarchical data objects based on the one or more catalog roles, the set of hierarchical data objects comprising at least one namespace, at least one table, and at least one table view.
18 . The method of claim 11 , further comprising:
detecting a synchronization request received at the catalog service account, the synchronization request associated with a second catalog that is external to the catalog service account.
19 . The method of claim 18 , further comprising:
generating responsive to the synchronization request, an external catalog representation of the second catalog, the external catalog representation configured as a read-only catalog in the catalog service account.
20 . The method of claim 19 , further comprising:
receiving via an application programming interface (API), a notification of an update posted to the second catalog; and
updating the external catalog representation based on the update.
21 . A computer-storage medium comprising instructions that, when executed by one or more processors of a machine, configure the machine to perform operations comprising:
detecting at a catalog service account, a user request to access a data object, the user request including identification information of the user and a principal role associated with the user;
retrieving one or more catalog roles from a first catalog of the catalog service account, the one or more catalog roles corresponding to the principal role;
determining a set of hierarchical data objects based on the user request, the set of hierarchical data objects comprising the data object;
performing a determination of whether access privileges of the set of hierarchical data objects and access privileges of the one or more catalog roles allow access to the data object; and
granting access to the data object based on the determination.
22 . The computer-storage medium of claim 21 , the operations further comprising:
retrieving the access privileges of the set of hierarchical data objects and the access privileges of the one or more catalog roles from a role-based security model of the catalog service account.
23 . The computer-storage medium of claim 22 , the operations further comprising:
detecting the set of hierarchical data objects comprises a plurality of nested namespaces; and
determining the access privileges of the set of hierarchical data objects based on access privileges for each namespace of the plurality of nested namespaces.
24 . The computer-storage medium of claim 22 , the operations further comprising:
retrieving a first set of access privileges from the role-based security model, the first set of access privileges associated with the first catalog, and including the access privileges of the one or more catalog roles;
retrieving a second set of access privileges from the role-based security model, the second set of access privileges associated with a second catalog of the catalog service account; and
configuring access to the first catalog and the second catalog based on the first set of access privileges and the second set of access privileges.
25 . The computer-storage medium of claim 21 , the operations further comprising:
retrieving a plurality of principal identities associated with the catalog service account; and
selecting a principal identity of the plurality of principal identities based on the identification information of the user.
26 . The computer-storage medium of claim 25 , the operations further comprising:
retrieving a plurality of catalog roles configured in the first catalog; and
selecting the one or more catalog roles from the plurality of catalog roles based on the principal role.
27 . The computer-storage medium of claim 21 , the operations further comprising:
determining the set of hierarchical data objects based on the one or more catalog roles, the set of hierarchical data objects comprising at least one namespace, at least one table, and at least one table view.
28 . The computer-storage medium of claim 21 , the operations further comprising:
detecting a synchronization request received at the catalog service account, the synchronization request associated with a second catalog that is external to the catalog service account.
29 . The computer-storage medium of claim 28 , the operations further comprising:
generating responsive to the synchronization request, an external catalog representation of the second catalog, the external catalog representation configured as a read-only catalog in the catalog service account.
30 . The computer-storage medium of claim 29 , the operations further comprising:
receiving via an application programming interface (API), a notification of an update posted to the second catalog; and
updating the external catalog representation based on the update.