[BUG] Tispark omit the privileges of one user when write in a table

[fran123]

Describe the bug I created a user without privileges and I pass the following:

• Case 1 : the user was able to write to the tables that he should not be able to write when using the TiBatchWrite method.
• Case 2 : The user could not write when using normal method (df.write)
• Case 3 : I gave the user only the select privilege and he was able to write with the normal method (df.write)

What did you do

1. Create of tables and user :

create database db_test;
CREATE TABLE db_test.table_test (
`id` varchar(36) COLLATE utf8_general_ci NOT NULL,
`name` varchar(36) COLLATE utf8_general_ci DEFAULT NULL,
`school` varchar(36) COLLATE utf8_general_ci NOT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `test_unique_1` (`name`,`school`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
CREATE TABLE db_test.table_test2 (
`id` varchar(36) COLLATE utf8_general_ci NOT NULL,
`name` varchar(36) COLLATE utf8_general_ci DEFAULT NULL,
`school` varchar(36) COLLATE utf8_general_ci NOT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `test_unique_1` (`name`,`school`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci;
CREATE USER 'test1' IDENTIFIED BY 'test1';

2. run this code and the user can write in this tables

val sparkConf = new SparkConf()
  .setIfMissing("spark.master", "local[*]")
  .setIfMissing("spark.sql.extensions", "org.apache.spark.sql.TiExtensions")
  .setIfMissing("spark.tispark.pd.addresses", "127.0.0.1:2379")
  .setIfMissing("spark.tispark.isolation_read_engines", "tiflash")
val spark = SparkSession.builder.config(sparkConf).getOrCreate()
import spark.implicits._
val df = Seq(
  ("10", "n5", "n13"),
  ("11", "n7", "n11")
).toDF("id", "name", "school")
val data = Map(DBTable("db_test", "table_test") -> df, DBTable("db_test", "table_test2") -> df)
TiBatchWrite.write(
  data,
  spark,
  Map(
    "tidb.addr" -> "127.0.0.1",
    "tidb.port" -> "4000",
    "tidb.user"-> "test1",
    "tidb.password" -> "test1",
    "replace" -> "true")
)

3. run this code , and the user can't write

val sparkConf = new SparkConf()
  .setIfMissing("spark.master", "local[*]")
  .setIfMissing("spark.sql.extensions", "org.apache.spark.sql.TiExtensions")
  .setIfMissing("spark.tispark.pd.addresses", "127.0.0.1:2379")
  .setIfMissing("spark.tispark.isolation_read_engines", "tiflash")
val spark = SparkSession.builder.config(sparkConf).getOrCreate()
import spark.implicits._
val df = Seq(
  ("10", "n5", "n13"),
  ("11", "n7", "n11")
).toDF("id", "name", "school")
val tidbOptions: Map[String, String] = Map(
  "tidb.addr" -> "127.0.0.1",
  "tidb.port" -> "4000",
  "tidb.user" -> "test1",
  "tidb.password" -> "test1",
  "database" -> "db_test",
  "table"-> "table_test",
  "replace" -> "true"
)
df.write
  .format("tidb")
  .options(tidbOptions)
  .mode("append")
  .save()

4. I only give him the privilege of reading

GRANT SELECT ON db_test.table_test TO 'test1';

5. then run thos code and the user can write

val sparkConf = new SparkConf()
  .setIfMissing("spark.master", "local[*]")
  .setIfMissing("spark.sql.extensions", "org.apache.spark.sql.TiExtensions")
  .setIfMissing("spark.tispark.pd.addresses", "127.0.0.1:2379")
  .setIfMissing("spark.tispark.isolation_read_engines", "tiflash")
val spark = SparkSession.builder.config(sparkConf).getOrCreate()
import spark.implicits._
val df = Seq(
  ("10", "n5", "n13"),
  ("11", "n7", "n11")
).toDF("id", "name", "school")
val tidbOptions: Map[String, String] = Map(
  "tidb.addr" -> "127.0.0.1",
  "tidb.port" -> "4000",
  "tidb.user" -> "test1",
  "tidb.password" -> "test1",
  "database" -> "db_test",
  "table"-> "table_test",
  "replace" -> "true"
)
df.write
  .format("tidb")
  .options(tidbOptions)
  .mode("append")
  .save()

What do you expect

What happens instead The user can write when he should not do it since he does not have enough privileges

Spark and TiSpark version info spark : 2.4.0 tispark : 2.3.16

[sunxiaoguang]

Hi @fran123 Thanks for bring up this issue. The authorization mechanism has not been implemented in big data components yet. We know there are other users having concern about this and we definitely want to get it implemented at some point. Will update this issue once the roadmap about security is clear.

[fran123]

Hi @sunxiaoguang , I have a doubt ,can I use tispark with spark 3 and java 11 ?

[sunxiaoguang]

Master version has spark 3 support, however it's not been widely used yet. Talking about java 11, unfortunately we still compile the package with java 8.

[fran123]

Ok, thank you for the answer

[shiyuhang0]

change it to enhancement

[zhangyangyu]

implement in #2366 , will go in v3.1.0.