• One the application is deployed the the user who deployed becomes the owner

Goals

1. Authorize a subset of operations on CDAP entities using Apache Sentry

2. Make the authorization system pluggable. Support the following two systems to begin with:

   1. Sentry based

   2. CDAP Dataset based

...

• Ideally, D-Rock would like to be able to authorize all operations on all entities in CDAP. 
• However, this can be rolled out in phases. In the initial phase, he would like to control who can:
  • Create/update/delete a namespace
    • Only users with WRITE permission on CDAP instance should be able to perform this operation.
    • A property in cdap-site.xml should decide a set of users who have admin permission on cdap instance. These admins can then later grant permissions to other users.
  • Deploy an application in a namespace
    • Only users with WRITE permission on the namespace should be able to perform this operation
    • One the application is deployed the the user who deployed becomes the ownerADMIN of the application. 
  • Start/stop a program
    • Only users with READ permission on the namespace and application, and EXECUTE permission on the program should be able to perform this operation
    • Only users with ADMIN permission on the program can set preference for the program
    • Only users with WRITE permission can provide runtime args
  • Read/write to a stream
    • Only users with READ privilege on the namespace and READ permission on the stream should be able to read from the stream
    • Only users with READ privilege on the namespace and WRITE permission on the stream should be able to write to the stream

...