Package org.apache.polaris.service.admin

Class PolarisAdminService

java.lang.Object
org.apache.polaris.service.admin.PolarisAdminService
@RequestScoped public class PolarisAdminService extends Object
Just as an Iceberg Catalog represents the logical model of Iceberg business logic to manage Namespaces, Tables and Views, abstracted away from Iceberg REST objects, this class represents the logical model for managing realm-level Catalogs, Principals, Roles, and Grants.

Different API implementers could expose different REST, gRPC, etc., interfaces that delegate to this logical model without being tightly coupled to a single frontend protocol, and can provide different implementations of PolarisEntityManager to abstract away the implementation of the persistence layer.

  • Constructor Summary

    Constructors
    Constructor
    Description
    PolarisAdminService(org.apache.polaris.core.context.CallContext callContext, org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory resolutionManifestFactory, org.apache.polaris.core.persistence.PolarisMetaStoreManager metaStoreManager, org.apache.polaris.core.secrets.UserSecretsManager userSecretsManager, org.apache.polaris.core.identity.provider.ServiceIdentityProvider serviceIdentityProvider, org.apache.polaris.core.auth.PolarisPrincipal principal, org.apache.polaris.core.auth.PolarisAuthorizer authorizer, ReservedProperties reservedProperties)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    assignCatalogRoleToPrincipalRole(String principalRoleName, String catalogName, String catalogRoleName)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    assignPrincipalRole(String principalName, String principalRoleName)
     
    org.apache.polaris.core.entity.PolarisEntity
    createCatalog(org.apache.polaris.core.admin.model.CreateCatalogRequest catalogRequest)
     
    org.apache.polaris.core.entity.PolarisEntity
    createCatalogRole(String catalogName, org.apache.polaris.core.entity.PolarisEntity entity)
     
    org.apache.polaris.core.admin.model.PrincipalWithCredentials
    createPrincipal(org.apache.polaris.core.entity.PrincipalEntity entity)
     
    org.apache.polaris.core.entity.PolarisEntity
    createPrincipalRole(org.apache.polaris.core.entity.PolarisEntity entity)
     
    void
    deleteCatalog(String name)
     
    void
    deleteCatalogRole(String catalogName, String name)
     
    void
    deletePrincipal(String name)
     
    void
    deletePrincipalRole(String name)
     
    org.apache.polaris.core.entity.CatalogEntity
    getCatalog(String name)
     
    org.apache.polaris.core.entity.CatalogRoleEntity
    getCatalogRole(String catalogName, String name)
     
    org.apache.polaris.core.entity.PrincipalEntity
    getPrincipal(String name)
     
    org.apache.polaris.core.entity.PrincipalRoleEntity
    getPrincipalRole(String name)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    grantPrivilegeOnCatalogToRole(String catalogName, String catalogRoleName, org.apache.polaris.core.entity.PolarisPrivilege privilege)
    Adds a catalog-level grant on catalogName to catalogRoleName which resides within the same catalog on which it is being granted the privilege.
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    grantPrivilegeOnNamespaceToRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.Namespace namespace, org.apache.polaris.core.entity.PolarisPrivilege privilege)
    Adds a namespace-level grant on namespace to catalogRoleName.
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    grantPrivilegeOnPolicyToRole(String catalogName, String catalogRoleName, org.apache.polaris.service.types.PolicyIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    grantPrivilegeOnRootContainerToPrincipalRole(String principalRoleName, org.apache.polaris.core.entity.PolarisPrivilege privilege)
    Adds a grant on the root container of this realm to principalRoleName.
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    grantPrivilegeOnTableToRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.TableIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    grantPrivilegeOnViewToRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.TableIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)
     
    List<org.apache.polaris.core.entity.PolarisEntity>
    listAssigneePrincipalRolesForCatalogRole(String catalogName, String catalogRoleName)
     
    List<org.apache.polaris.core.entity.PolarisEntity>
    listAssigneePrincipalsForPrincipalRole(String principalRoleName)
     
    List<org.apache.polaris.core.admin.model.CatalogRole>
    listCatalogRoles(String catalogName)
     
    List<org.apache.polaris.core.entity.PolarisEntity>
    listCatalogRolesForPrincipalRole(String principalRoleName, String catalogName)
     
    List<org.apache.polaris.core.admin.model.Catalog>
    listCatalogs()
    List all catalogs after checking for permission.
    List<org.apache.polaris.core.admin.model.GrantResource>
    listGrantsForCatalogRole(String catalogName, String catalogRoleName)
    Lists all grants on Catalog-level resources (Catalog/Namespace/Table/View) granted to the specified catalogRole.
    List<org.apache.polaris.core.admin.model.PrincipalRole>
    listPrincipalRoles()
     
    List<org.apache.polaris.core.entity.PolarisEntity>
    listPrincipalRolesAssigned(String principalName)
     
    List<org.apache.polaris.core.admin.model.Principal>
    listPrincipals()
     
    org.apache.polaris.core.admin.model.PrincipalWithCredentials
    resetCredentials(String principalName, org.apache.polaris.core.admin.model.ResetPrincipalRequest resetPrincipalRequest)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    revokeCatalogRoleFromPrincipalRole(String principalRoleName, String catalogName, String catalogRoleName)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    revokePrincipalRole(String principalName, String principalRoleName)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    revokePrivilegeOnCatalogFromRole(String catalogName, String catalogRoleName, org.apache.polaris.core.entity.PolarisPrivilege privilege)
    Removes a catalog-level grant on catalogName from catalogRoleName.
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    revokePrivilegeOnNamespaceFromRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.Namespace namespace, org.apache.polaris.core.entity.PolarisPrivilege privilege)
    Removes a namespace-level grant on namespace from catalogRoleName.
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    revokePrivilegeOnPolicyFromRole(String catalogName, String catalogRoleName, org.apache.polaris.service.types.PolicyIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    revokePrivilegeOnRootContainerFromPrincipalRole(String principalRoleName, org.apache.polaris.core.entity.PolarisPrivilege privilege)
    Revokes a grant on the root container of this realm from principalRoleName.
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    revokePrivilegeOnTableFromRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.TableIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)
     
    org.apache.polaris.core.persistence.dao.entity.PrivilegeResult
    revokePrivilegeOnViewFromRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.TableIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)
     
    org.apache.polaris.core.admin.model.PrincipalWithCredentials
    rotateCredentials(String principalName)
     
    org.apache.polaris.core.entity.CatalogEntity
    updateCatalog(String name, org.apache.polaris.core.admin.model.UpdateCatalogRequest updateRequest)
     
    org.apache.polaris.core.entity.CatalogRoleEntity
    updateCatalogRole(String catalogName, String name, org.apache.polaris.core.admin.model.UpdateCatalogRoleRequest updateRequest)
     
    org.apache.polaris.core.entity.PrincipalEntity
    updatePrincipal(String name, org.apache.polaris.core.admin.model.UpdatePrincipalRequest updateRequest)
     
    org.apache.polaris.core.entity.PrincipalRoleEntity
    updatePrincipalRole(String name, org.apache.polaris.core.admin.model.UpdatePrincipalRoleRequest updateRequest)
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • PolarisAdminService

      @Inject public PolarisAdminService(@Nonnull org.apache.polaris.core.context.CallContext callContext, @Nonnull org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory resolutionManifestFactory, @Nonnull org.apache.polaris.core.persistence.PolarisMetaStoreManager metaStoreManager, @Nonnull org.apache.polaris.core.secrets.UserSecretsManager userSecretsManager, @Nonnull org.apache.polaris.core.identity.provider.ServiceIdentityProvider serviceIdentityProvider, @Nonnull org.apache.polaris.core.auth.PolarisPrincipal principal, @Nonnull org.apache.polaris.core.auth.PolarisAuthorizer authorizer, @Nonnull ReservedProperties reservedProperties)

  • Method Details

    • createCatalog

      public org.apache.polaris.core.entity.PolarisEntity createCatalog(org.apache.polaris.core.admin.model.CreateCatalogRequest catalogRequest)

    • deleteCatalog

      public void deleteCatalog(String name)

    • getCatalog

      @Nonnull public org.apache.polaris.core.entity.CatalogEntity getCatalog(String name)

    • updateCatalog

      @Nonnull public org.apache.polaris.core.entity.CatalogEntity updateCatalog(String name, org.apache.polaris.core.admin.model.UpdateCatalogRequest updateRequest)

    • listCatalogs

      public List<org.apache.polaris.core.admin.model.Catalog> listCatalogs()
      List all catalogs after checking for permission.

    • createPrincipal

      public org.apache.polaris.core.admin.model.PrincipalWithCredentials createPrincipal(org.apache.polaris.core.entity.PrincipalEntity entity)

    • deletePrincipal

      public void deletePrincipal(String name)

    • getPrincipal

      @Nonnull public org.apache.polaris.core.entity.PrincipalEntity getPrincipal(String name)

    • updatePrincipal

      @Nonnull public org.apache.polaris.core.entity.PrincipalEntity updatePrincipal(String name, org.apache.polaris.core.admin.model.UpdatePrincipalRequest updateRequest)

    • rotateCredentials

      @Nonnull public org.apache.polaris.core.admin.model.PrincipalWithCredentials rotateCredentials(String principalName)

    • resetCredentials

      @Nonnull public org.apache.polaris.core.admin.model.PrincipalWithCredentials resetCredentials(String principalName, org.apache.polaris.core.admin.model.ResetPrincipalRequest resetPrincipalRequest)

    • listPrincipals

      public List<org.apache.polaris.core.admin.model.Principal> listPrincipals()

    • createPrincipalRole

      public org.apache.polaris.core.entity.PolarisEntity createPrincipalRole(org.apache.polaris.core.entity.PolarisEntity entity)

    • deletePrincipalRole

      public void deletePrincipalRole(String name)

    • getPrincipalRole

      @Nonnull public org.apache.polaris.core.entity.PrincipalRoleEntity getPrincipalRole(String name)

    • updatePrincipalRole

      @Nonnull public org.apache.polaris.core.entity.PrincipalRoleEntity updatePrincipalRole(String name, org.apache.polaris.core.admin.model.UpdatePrincipalRoleRequest updateRequest)

    • listPrincipalRoles

      public List<org.apache.polaris.core.admin.model.PrincipalRole> listPrincipalRoles()

    • createCatalogRole

      public org.apache.polaris.core.entity.PolarisEntity createCatalogRole(String catalogName, org.apache.polaris.core.entity.PolarisEntity entity)

    • deleteCatalogRole

      public void deleteCatalogRole(String catalogName, String name)

    • getCatalogRole

      @Nonnull public org.apache.polaris.core.entity.CatalogRoleEntity getCatalogRole(String catalogName, String name)

    • updateCatalogRole

      @Nonnull public org.apache.polaris.core.entity.CatalogRoleEntity updateCatalogRole(String catalogName, String name, org.apache.polaris.core.admin.model.UpdateCatalogRoleRequest updateRequest)

    • listCatalogRoles

      public List<org.apache.polaris.core.admin.model.CatalogRole> listCatalogRoles(String catalogName)

    • assignPrincipalRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult assignPrincipalRole(String principalName, String principalRoleName)

    • revokePrincipalRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult revokePrincipalRole(String principalName, String principalRoleName)

    • listPrincipalRolesAssigned

      public List<org.apache.polaris.core.entity.PolarisEntity> listPrincipalRolesAssigned(String principalName)

    • assignCatalogRoleToPrincipalRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult assignCatalogRoleToPrincipalRole(String principalRoleName, String catalogName, String catalogRoleName)

    • revokeCatalogRoleFromPrincipalRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult revokeCatalogRoleFromPrincipalRole(String principalRoleName, String catalogName, String catalogRoleName)

    • listAssigneePrincipalsForPrincipalRole

      public List<org.apache.polaris.core.entity.PolarisEntity> listAssigneePrincipalsForPrincipalRole(String principalRoleName)

    • listCatalogRolesForPrincipalRole

      public List<org.apache.polaris.core.entity.PolarisEntity> listCatalogRolesForPrincipalRole(String principalRoleName, String catalogName)

    • grantPrivilegeOnRootContainerToPrincipalRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult grantPrivilegeOnRootContainerToPrincipalRole(String principalRoleName, org.apache.polaris.core.entity.PolarisPrivilege privilege)
      Adds a grant on the root container of this realm to principalRoleName.

    • revokePrivilegeOnRootContainerFromPrincipalRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult revokePrivilegeOnRootContainerFromPrincipalRole(String principalRoleName, org.apache.polaris.core.entity.PolarisPrivilege privilege)
      Revokes a grant on the root container of this realm from principalRoleName.

    • grantPrivilegeOnCatalogToRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult grantPrivilegeOnCatalogToRole(String catalogName, String catalogRoleName, org.apache.polaris.core.entity.PolarisPrivilege privilege)
      Adds a catalog-level grant on catalogName to catalogRoleName which resides within the same catalog on which it is being granted the privilege.

    • revokePrivilegeOnCatalogFromRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult revokePrivilegeOnCatalogFromRole(String catalogName, String catalogRoleName, org.apache.polaris.core.entity.PolarisPrivilege privilege)
      Removes a catalog-level grant on catalogName from catalogRoleName.

    • grantPrivilegeOnNamespaceToRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult grantPrivilegeOnNamespaceToRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.Namespace namespace, org.apache.polaris.core.entity.PolarisPrivilege privilege)
      Adds a namespace-level grant on namespace to catalogRoleName.

    • revokePrivilegeOnNamespaceFromRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult revokePrivilegeOnNamespaceFromRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.Namespace namespace, org.apache.polaris.core.entity.PolarisPrivilege privilege)
      Removes a namespace-level grant on namespace from catalogRoleName.

    • grantPrivilegeOnTableToRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult grantPrivilegeOnTableToRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.TableIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)

    • revokePrivilegeOnTableFromRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult revokePrivilegeOnTableFromRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.TableIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)

    • grantPrivilegeOnViewToRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult grantPrivilegeOnViewToRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.TableIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)

    • revokePrivilegeOnViewFromRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult revokePrivilegeOnViewFromRole(String catalogName, String catalogRoleName, org.apache.iceberg.catalog.TableIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)

    • grantPrivilegeOnPolicyToRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult grantPrivilegeOnPolicyToRole(String catalogName, String catalogRoleName, org.apache.polaris.service.types.PolicyIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)

    • revokePrivilegeOnPolicyFromRole

      public org.apache.polaris.core.persistence.dao.entity.PrivilegeResult revokePrivilegeOnPolicyFromRole(String catalogName, String catalogRoleName, org.apache.polaris.service.types.PolicyIdentifier identifier, org.apache.polaris.core.entity.PolarisPrivilege privilege)

    • listAssigneePrincipalRolesForCatalogRole

      public List<org.apache.polaris.core.entity.PolarisEntity> listAssigneePrincipalRolesForCatalogRole(String catalogName, String catalogRoleName)

    • listGrantsForCatalogRole

      public List<org.apache.polaris.core.admin.model.GrantResource> listGrantsForCatalogRole(String catalogName, String catalogRoleName)
      Lists all grants on Catalog-level resources (Catalog/Namespace/Table/View) granted to the specified catalogRole.