Page Comparison

Namespaces

Existing) of READ, WRITE, EXECUTE, or ADMIN

Operation	Privileges Required (	Privileges Required (Proposed)	Integration test name
CreateADMIN (on the CDAP instance)	ADMIN	BasicAuthorizationTestBase.testBasicGrantOperationstestNamespcePrivileges
Update	ADMIN (on the namespace)
Delete	ADMIN (on the namespace)	ADMIN on the namespace, and all entities in the namespace	BasicAuthorizationTestBase.testNamespcePrivileges
View/List	Any	Any privilege on the namespace or any of its descendants.	BasicAuthorizationTestBase. testCreatedDeletedPrivileges This needs to have a more comprehensive test to cover the list of as many entities as possible.
Get Namespace Meta		*Any privilege on the namespace or any of its descendants.*	This can be easily added to test and this is covered in unit test.

Artifacts

Existing (on artifact) (on namespace) | ADMIN (on artifact) (on artifact) of READ, WRITE, EXECUTE, or ADMIN (on namespace) | Any of READ, WRITE, EXECUTE, or ADMIN (on artifact)

Operation	Privileges Required (	Proposed)Privileges Required (Proposed)	Integration test name
Add	WRITE (on the namespace)	ADMINADMIN	Integration tests only tests deploy app with artifact
Add a propertyADMIN (on namespace) \|	ADMIN	ADMIN
Remove a property	ADMIN	ADMIN
Use to deploy an app		ADMIN \| READ	AppAuthorizationTestBase.testDeployApp
DeleteADMIN (on namespace) \|	ADMIN	ADMIN
View/List	Any	Any privilege on the artifact
Get artifact info/summary/detail	ADMIN \| READ
		We have tests in unit test but not in integration tests

Applications

Existing (on the application) | ADMIN (on the namespace)

Operation	Privileges Required (	Proposed)Privileges Required (Proposed)	Integration test name
Add	WRITE (on the namespace) and READ (on the artifact if deployed from an artifact)	ADMIN *Also see artifact privileges and principal privileges	AppAuthorizationTestBase.testDeployApp
Delete	ADMIN	ADMIN	AppAuthorizationTestBase.testDeployApp
View/List	Any of READ, WRITE, EXECUTE, or ADMIN (on namespace) \| Any of READ, WRITE, EXECUTE,* or ADMIN (on application)*	Any privilege on the application *or any of its descendants.*	can easily add
Get application detail		ADMIN \| READ	can easily add

Programs

Existing (on the namespace)) & READ (on the namespace) (on the namespace) | ADMIN (on the application) | ADMIN (on the program) (on the namespace) | ADMIN (on the application) | ADMIN (on the program)
(on the namespace) READ (on the application) | READ (on the program)

Operation	Privileges Required (	Proposed)Privileges Required (Proposed)	Integration test name
Start, Stop, or Debug(EXECUTE (on the program) \| EXECUTE (on the application) \|	EXECUTE	EXECUTE	AppAuthorizationTestBase.testDatasetInProgram
Set instances	ADMIN	ADMIN
Set runtime arguments	ADMIN	ADMIN
Retrieve runtime arguments	READ	\|	READ \| EXECUTE \| ADMIN
Retrieve status	Any of READ, WRITE, EXECUTE, or ADMIN		AppAuthorizationTestBase.testDatasetInProgram
View/List	Any of READ, WRITE, EXECUTE, or ADMIN		easily add
Get program specification	ADMIN \| READ

Datasets

(on the dataset) and READ (namespace)) | READ (on the namespace) (on the namespace) and READ (on the namespace)) (on the dataset) | ADMIN (on the namespace) (on the dataset) | ADMIN (on the namespace)

OperationPrivileges Required (Existing)	Privileges Required (Proposed)	Integration Test Name
Create	WRITE (on the namespace)	ADMIN	BasicAuthorizationTestBase.testDatasetPrivileges
Read(	READ	READ		AppAuthorizationTestBase.testDatasetInProgram
Retrieving properties	Not Documented	Any of READ, WRITE, ADMIN, or EXECUTE	easily add
WriteWRITE (on the dataset) \| WRITE (on the namespace)	WRITE	AppAuthorizationTestBase.testDatasetInProgram
Update(ADMIN (on the dataset) and READ (on the namespace)) \| (	*ADMIN*		*ADMIN*	BasicAuthorizationTestBase.testDatasetPrivileges
Upgrade	*ADMIN*	*ADMIN*
Truncate	*ADMIN*		*ADMIN*	BasicAuthorizationTestBase.testDatasetPrivileges
DropADMIN (on the dataset) \| ADMIN (on the namespace)	*ADMIN*	BasicAuthorizationTestBase.testDatasetPrivileges
View/List	Any of READ, WRITE, EXECUTE, or ADMIN		BasicAuthorizationTestBase.testDatasetPrivileges
Get dataset meta	ADMIN \| READ \| WRITE	BasicAuthorizationTestBase.testDatasetPrivileges

Dataset Modules

Existing (on the dataset module) | ADMIN (on the namespace) (on the namespace)

Operation	Privileges Required (	Proposed)Privileges Required (Proposed)	Integration Test Name
Deploy	WRITE (on the namespace)	ADMIN	ADMIN
Delete	ADMIN	ADMIN
Delete-all in the namespace	ADMIN	ADMIN on all dataset modules in the namespace
View/ListAny of READ, WRITE, EXECUTE, or ADMIN
Get module meta	ADMIN \| READ
		Unit test covers add module during app deployment

Dataset Types

Existing

Operation	Privileges Required (	Proposed)Privileges Required (Proposed)	Integration test name
View/List	Any of READ, WRITE, EXECUTE, or ADMIN		easy to add
Get dataset type meta	ADMIN \| READ	BasicAuthorizationTestBase.testDatasetPrivileges

Secure Keys

ExistingWRITE(on the namespace) (on the key) | ADMIN (on the namespace)

Operation	Privileges Required (	Proposed)Privileges Required (Proposed)
Create	ADMIN		ADMIN
Delete	ADMIN	ADMIN
View/ListAny of READ, WRITE, EXECUTE, or ADMIN
ReadNot Documented	READ (on the key)
		We dont have test for any of them

Streams

Existing (on the stream) & READ (on the namespace) (on the stream) and READ (on the namespace)) | WRITE (on namespace & READ (on the namespace)) (on stream) | ADMIN (on namespace) (on the namespace) | ADMIN (on the stream)

Operation	Privileges Required (	Proposed)Privileges Required (Proposed)	Integration test name
Create	WRITE (on the namespace)	ADMINADMIN	BasicAuthorizationTestBase.testStreamPrivileges
Retrieving events	READ	READ
Retrieving properties	Any of READ, WRITE, ADMIN, or EXECUTE
	BasicAuthorizationTestBase.testStreamPrivileges
Sending events to a stream (sync, async, or batch)(	WRITE	WRITE	BasicAuthorizationTestBase.testStreamPrivileges
Drop	ADMIN	ADMIN	BasicAuthorizationTestBase.testStreamPrivileges
Drop-all in the namespaceADMIN (on the namespace) \| ADMIN (on the stream)	ADMIN on all the streams in the namespace
Update	ADMIN	ADMIN	Truncate	ADMIN (on the namespace) \| ADMIN (on the stream)	ADMIN
Truncate	ADMIN
View/List	Any of READ, WRITE, EXECUTE, or ADMIN		Easy to add
Get stream property	ADMIN \| READ	Easy to add

Principal

Existing

Operation	Privileges Required (	Proposed)Privileges Required (Proposed)	Integration test name
Deploy an app to impersonate a principal		ADMINADMIN	AppImpersonationAuthorizationTest(in pr)
Create a namespace with owner prinicpal	ADMINADMIN	NamespaceImpersonationBasicAuthorizationTest
Create a dataset with owner prinicpal		ADMINADMIN	AppImpersonationAuthorizationTest(in pr)
Create a stream with owner prinicpal	ADMIN

ADMINRun a explore query as impersonated prinicpal EXECUTE

More in integration tests:

Test creating namespaces with two different clients and try to delete them to test the explore user name issue(in pr)
test namespace creation with different owners and make sure the owner is correct(in pr)
all basic tests with ns/app impersonation, custom mapping
role based auth test(in pr)

More to do list:

test create dataset with an unauthorized dataset type
test CDAP-8568 with minimal privilege required

Versions Compared

Old Version 3

New Version Current

Key