Add connector SPI for returning security-sensitive properties #23103
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The SPI will be used by the engine to mask security-sensitive information in statements that manage catalogs. It has been added at the connector factory level, rather than the connector level, to allow more flexibility in retrieving properties. In some cases, we want to perform masking before a connector is initiated. For example, when we create a new catalog by issuing the CREATE CATALOG statement.
This was referenced Aug 22, 2024
The purpose of the included test is to identify security-sensitive properties that may be used by the connector. It uses the output generated by the maven-dependency-plugin, configured in the connector's pom.xml file. This output contains the connector's runtime classpath, which is then scanned to identify all property names annotated with @ConfigSecuritySensitive. Scanning the classpath ensures that all configuration classes are included, even those used conditionally.
piotrrzysko
force-pushed
the
piotrrzysko/sensitive-properties-spi
branch
from
1586f14 to
41589ee
Compare
|
Closing in favour of #24562 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR implements the SPI changes proposed in #22887. In the issue, we suggested that connectors should return security-sensitive properties. During the development of this PR, we realized it would be more flexible to retrieve these properties from connector factories, as in some cases, we want to mask security-sensitive properties before a connector is initiated. For instance, when creating a new catalog with the
CREATE CATALOGstatement.Additionally, this PR includes an implementation of the new SPI for the PostgreSQL connector. Once we confirm that the approach is correct, we will apply it to the remaining connectors.
Here is a PR demonstrating how the new SPI could be used to mask security-sensitive properties in queries related to creating catalogs: #23104.
Additional context and related issues
Release notes
( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
(x) Release notes are required, with the following suggested text: