Catalog access control for roles
@@ -550,6 +550,8 @@ public class AccessControlManager
requireNonNull(grantor, "grantor is null");
requireNonNull(catalogName, "catalogName is null");
+ authenticationCheck(() -> checkCanAccessCatalog(identity, catalogName));
+
CatalogAccessControlEntry entry = getConnectorAccessControl(transactionId, catalogName);
if (entry != null) {
authorizationCheck(() -> entry.getAccessControl().checkCanCreateRole(entry.getTransactionHandle(transactionId), identity.toConnectorIdentity(catalogName), role, grantor));
@@ -563,6 +565,8 @@ public class AccessControlManager
requireNonNull(role, "role is null");
requireNonNull(catalogName, "catalogName is null");
+ authenticationCheck(() -> checkCanAccessCatalog(identity, catalogName));
+
CatalogAccessControlEntry entry = getConnectorAccessControl(transactionId, catalogName);
if (entry != null) {
authorizationCheck(() -> entry.getAccessControl().checkCanDropRole(entry.getTransactionHandle(transactionId), identity.toConnectorIdentity(catalogName), role));
@@ -578,6 +582,8 @@ public class AccessControlManager
requireNonNull(grantor, "grantor is null");
requireNonNull(catalogName, "catalogName is null");
+ authenticationCheck(() -> checkCanAccessCatalog(identity, catalogName));
+
CatalogAccessControlEntry entry = getConnectorAccessControl(transactionId, catalogName);
if (entry != null) {
authorizationCheck(() -> entry.getAccessControl().checkCanGrantRoles(entry.getTransactionHandle(transactionId), identity.toConnectorIdentity(catalogName), roles, grantees, withAdminOption, grantor, catalogName));
@@ -593,6 +599,8 @@ public class AccessControlManager
requireNonNull(grantor, "grantor is null");
requireNonNull(catalogName, "catalogName is null");
+ authenticationCheck(() -> checkCanAccessCatalog(identity, catalogName));
+
CatalogAccessControlEntry entry = getConnectorAccessControl(transactionId, catalogName);
if (entry != null) {
authorizationCheck(() -> entry.getAccessControl().checkCanRevokeRoles(entry.getTransactionHandle(transactionId), identity.toConnectorIdentity(catalogName), roles, grantees, adminOptionFor, grantor, catalogName));
@@ -605,6 +613,9 @@ public class AccessControlManager
requireNonNull(identity, "identity is null");
requireNonNull(role, "role is null");
requireNonNull(catalogName, "catalog is null");
+
+ authenticationCheck(() -> checkCanAccessCatalog(identity, catalogName));
+
CatalogAccessControlEntry entry = getConnectorAccessControl(transactionId, catalogName);
if (entry != null) {
authorizationCheck(() -> entry.getAccessControl().checkCanSetRole(entry.getTransactionHandle(transactionId), identity.toConnectorIdentity(catalogName), role, catalogName));
@@ -617,6 +628,8 @@ public class AccessControlManager
requireNonNull(identity, "identity is null");
requireNonNull(catalogName, "catalogName is null");
+ authenticationCheck(() -> checkCanAccessCatalog(identity, catalogName));
+
CatalogAccessControlEntry entry = getConnectorAccessControl(transactionId, catalogName);
if (entry != null) {
authenticationCheck(() -> entry.getAccessControl().checkCanShowRoles(entry.getTransactionHandle(transactionId), identity.toConnectorIdentity(catalogName), catalogName));
@@ -629,6 +642,8 @@ public class AccessControlManager
requireNonNull(identity, "identity is null");
requireNonNull(catalogName, "catalogName is null");
+ authenticationCheck(() -> checkCanAccessCatalog(identity, catalogName));
+
CatalogAccessControlEntry entry = getConnectorAccessControl(transactionId, catalogName);
if (entry != null) {
authenticationCheck(() -> entry.getAccessControl().checkCanShowCurrentRoles(entry.getTransactionHandle(transactionId), identity.toConnectorIdentity(catalogName), catalogName));
@@ -641,6 +656,8 @@ public class AccessControlManager
requireNonNull(identity, "identity is null");
requireNonNull(catalogName, "catalogName is null");
+ authenticationCheck(() -> checkCanAccessCatalog(identity, catalogName));
+
CatalogAccessControlEntry entry = getConnectorAccessControl(transactionId, catalogName);
if (entry != null) {
authenticationCheck(() -> entry.getAccessControl().checkCanShowRoleGrants(entry.getTransactionHandle(transactionId), identity.toConnectorIdentity(catalogName), catalogName));
