guardian icon indicating copy to clipboard operation
guardian copied to clipboard

Custom group naming convention for metabase provider

Open rahmatrhd opened this issue 3 years ago • 1 comments

for this PR: https://github.com/odpf/guardian/pull/162

Describe the bug custom groups created by guardian in metabase are added as resources

Context

  1. existing metabase provider supports collection and database resource access
  2. (in metabase) database, table, and collection access are granted to groups, and a group has many users
  3. while in guardian, a user access is pointing to a resource directly.
    1. so to accommodate that, we make the metabase provider create a group that is specific for accessing a resource with a specific role, in other words, this group will always have access to one resource with one role.
    2. see below diagram for illustration illustration
  4. we're currently introducing 2 new resources in guardian which are table (child resource under database) and group
  5. table resource is fine, but for group, we don't want to include those custom groups as resources in guardian

Expected behavior custom groups shouldn't be added as resources in guardian

Proposed Solution

  1. have a naming convention for the group name e.g. add prefix _guardian_<group_name>
  2. when fetching group resources from metabase, exclude any groups that have prefix _guardian_

rahmatrhd avatar May 12 '22 07:05 rahmatrhd

https://github.com/odpf/guardian/pull/162/commits/5d01b7c9ae0ef8ddc64a5745f81a208b0b4be9cf

@rahmatrhd added _guardian_ as a prefix to groups created by Guardian, also check on _guardian_ while adding group as resources into Guardian.

singhvikash11 avatar May 12 '22 10:05 singhvikash11