Hide Forgot
project_key: SOA Given a role that grants access to a table whose transformation uses a UDF, but does NOT grant access to the function itself, the user possessing that role is able to query the table. For example, "tester1" has "role1" and is able to execute "SELECT PART_NAME, SecretCode FROM PartsVirtual.usesFunction". Role1 does not grant access to the UDF. Here's the role as seen in the VDB: <data-role allow-create-temporary-tables="false" any-authenticated="false" name="Data Role 1"> <description>Allow READ of source A and virtual model, but NOT sourceB</description> <permission> <resource-name>PartsVirtual</resource-name> <allow-create>false</allow-create> <allow-read>true</allow-read> <allow-update>false</allow-update> <allow-delete>false</allow-delete> </permission> <permission> <resource-name>Soundex</resource-name> <allow-create>false</allow-create> <allow-read>false</allow-read> <allow-update>false</allow-update> <allow-delete>false</allow-delete> </permission> <permission> <resource-name>PartsSourceB</resource-name> <allow-create>false</allow-create> <allow-read>false</allow-read> <allow-update>false</allow-update> <allow-delete>false</allow-delete> </permission> <permission> <resource-name>PartsSourceA</resource-name> <allow-create>false</allow-create> <allow-read>true</allow-read> <allow-update>false</allow-update> <allow-delete>false</allow-delete> </permission> <mapped-role-name>role1</mapped-role-name> </data-role> All of the PartsVirtual resource is readable, including the usesFunction table. When this query is executed by tester1, the table is successfully queried. It should not be. I'll attach a bunch of artifacts.
Attachment: Added: RolesWithFunction_MPS.zip Attachment: Added: teiid-security-roles.properties Attachment: Added: teiid-jboss-beans.xml Attachment: Added: RolesVDB.vdb
I disagree. I think this is the way we want it. It follows the same pattern as roles for tables. Example, if you have 3 layers of models (physical and 2 virtual layers), and only expose the top layer (i.e., set permissions), then only the top layer is executable by the user. But you don't have to enable permissions on the lower models that are used in transformations at the top level in order for the user to execute a query. The lower models have their permissions turned off so that users can't directly execute them. This would be the same behavior for functions.
After mulling it over, I agree with Van, that this is how it should work. So, I'm self-rejecting this Jira.
I entered it. I rejected it. I'm closing it.