3 ms·
There’s fair reason to be skeptical here. The way databricks deals with user level access control is by passing the user credentials for the user using a clust
by wokwokwok 5y ago
There’s fair reason to be skeptical here.
The way databricks deals with user level access control is by passing the user credentials for the user using a cluster to the underlying access control layer (historically, table and column level permissions).
...but, it’s not that simple. Since anyone on a cluster can do anything with that cluster, you need a cluster per user for this to work. This obviously doesn’t scale.
I’ve used this a lot, and it sucks; the best you can do is offer “reporting clusters” that are for reading pre-canned reports and restricted in what they can see, and not allow anyone to do any actual work using notebooks.
...reading all the things about unity, this seems like it’s just applying the same approach to more types of data objects.
- rxin 5y agoWe have taken a very different approach with the Unity Catalog. It is designed opposite to the "cluster-centric" access control model, and will be user and role centric. Disclosure: I'm a Databricks cofounder and have contributed to the unity catalog.