System access control#
A system access control enforces authorization at a global level, before any connector level authorization. Several built-in implementations are available in BDV. Please contact SpinSys customer service for additional information on the implementations that are available.
Multiple system access control implementations may be configured at once
using the access-control.config-files configuration property. It should
contain a comma separated list of the access control property files to use
(rather than the default etc/access-control.properties).
BDV offers the following built-in implementations:
System Access Control Name |
Description |
|---|---|
|
All operations are permitted, except for user impersonation. This is the default access control if none are configured. |
|
All operations are permitted. |
|
Operations that read data or metadata are permitted, but none of the operations that write data or metadata are allowed. |
|
Authorization rules are specified in a config file. See File-based access control. |
Read only system access control#
This access control allows any operation that reads data or
metadata, such as SELECT or SHOW. Setting system level or catalog level
session properties is also permitted. However, any operation that writes data or
metadata, such as CREATE, INSERT or DELETE, is prohibited.
To use this access control, add an etc/access-control.properties
file with the following contents:
access-control.name=read-only