Access Control & Policies
Relevant source files
The following files were used as context for generating this wiki page:
- metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java
- smoke-test/tests/cypress/cypress/e2e/settingsV2/v2_manage_policies.js
- datahub-web-react/src/i18n/locales/en/settings.permissions.json
- docs-website/static/llms.txt
- docs-website/sidebars.js
- datahub-web-react/README.md
Access Control & Policies within DataHub provide a robust framework for managing permissions and security across the metadata graph. The system allows administrators to define fine-grained access to platform-level administrative tasks and metadata-level operations, such as editing tags, ownership, or documentation for specific datasets and dashboards.
The framework is built on two primary pillars: Platform Policies, which govern system-wide administrative actions, and Metadata Policies, which govern actions on specific entities. These policies can be assigned to individual users, service accounts, or groups, and can optionally target specific resource types, domains, or tags to ensure precise governance.
Sources: docs-website/static/llms.txt:98-102, metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:27-30
Policy Types and Scope
DataHub categorizes policies into two main types, each serving a distinct scope within the application.
Platform Policies
Platform policies grant top-level administrative privileges. These include managing users and groups, creating other policies, viewing system analytics, and managing metadata ingestion sources.
Sources: metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:32-154, datahub-web-react/src/i18n/locales/en/settings.permissions.json:104-106
Metadata Policies
Metadata policies allow for specific actions on metadata assets (entities). Privileges under this category include editing tags, glossary terms, owners, and descriptions. These policies can be scoped to specific resource types (e.g., Datasets, Dashboards) or specific instances of resources.
Sources: metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:158-230, datahub-web-react/src/i18n/locales/en/settings.permissions.json:101-103
The following diagram illustrates the relationship between actors, policies, and privileges:
The diagram shows how various Actors are associated with a Policy, which is defined by a Type and State, and then scoped to specific metadata elements and privileges.
Sources: metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:27-30, datahub-web-react/src/i18n/locales/en/settings.permissions.json:5-15
Privilege Configuration
Privileges are the atomic units of permission within DataHub. They are categorized based on whether they apply to the platform or specific resources.
Core Platform Privileges
| Privilege Type | Display Name | Description |
|---|---|---|
MANAGE_POLICIES | Manage Policies | Create and remove access control policies. |
MANAGE_USERS_AND_GROUPS | Manage Users & Groups | Full management of users and groups. |
MANAGE_INGESTION | Manage Metadata Ingestion | Create, remove, and update ingestion sources. |
VIEW_ANALYTICS | View Analytics | Access the DataHub analytics dashboard. |
GENERATE_PERSONAL_ACCESS_TOKENS | Generate Tokens | Create API tokens for personal use. |
MANAGE_GLOSSARIES | Manage Glossaries | Full management of Glossary entities. |
| Sources: metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:34-110 |
Resource-Specific Privileges
Common privileges that apply across most metadata entities:
VIEW_ENTITY_PAGE: Ability to view the entity profile.EDIT_ENTITY_TAGS: Ability to add or remove tags.EDIT_ENTITY_OWNERS: Ability to manage asset ownership.EDIT_ENTITY_DOCS: Ability to edit descriptions and documentation.EDIT_LINEAGE: Ability to manually add or remove lineage edges.
Sources: metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:160-220
Policy Management Workflow
Policies can be created, edited, and deleted via the DataHub UI under the Manage Permissions section. The lifecycle of a policy involves defining the type, configuring privileges, and assigning actors.
Creation Logic
The UI-based policy creation flow follows a step-by-step process:
- Choose Policy Type: Select between Platform or Metadata.
- Configure Privileges: Select the specific actions the policy allows.
- Assign Actors: Select Users, Groups, or Owners that the policy applies to.
Sources: smoke-test/tests/cypress/cypress/e2e/settingsV2/v2_manage_policies.js:46-59, datahub-web-react/src/i18n/locales/en/settings.permissions.json:88-91
Data Structure for Policy Match Criteria
Policies use match criteria to filter which resources they apply to.
public static List<DataHubPolicyInfo> getDefaultPolicies(Urn actorUrn) {
return ImmutableList.<DataHubPolicyInfo>builder()
.add(new DataHubPolicyInfo()
.setDisplayName("View Self")
.setActors(new DataHubActorFilter().setUsers(new UrnArray(actorUrn)))
.setPrivileges(new StringArray(List.of("VIEW_ENTITY_PAGE")))
.setType(METADATA_POLICY_TYPE)
.setState(ACTIVE_POLICY_STATE)
.setResources(new DataHubResourceFilter()
.setFilter(new PolicyMatchFilter()
.setCriteria(new PolicyMatchCriterionArray(
List.of(new PolicyMatchCriterion()
.setField("URN")
.setCondition(PolicyMatchCondition.EQUALS)
.setValues(new StringArray(List.of(actorUrn.toString())))))))));
}
Sources: metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:785-807
API and Group Mapping
DataHub uses internal maps to associate API operations (Create, Read, Update, Delete) with the required privileges. This ensures that REST and GraphQL calls are authorized against the defined policies.
| API Group | Operation | Required Privileges (Disjunctive) |
|---|---|---|
ENTITY | CREATE | CREATE_ENTITY, EDIT_ENTITY |
ENTITY | READ | VIEW_ENTITY_PAGE, GET_ENTITY, EDIT_ENTITY |
LINEAGE | UPDATE | EDIT_ENTITY, EDIT_LINEAGE |
ANALYTICS | READ | VIEW_ANALYTICS, GET_ANALYTICS_PRIVILEGE |
| Sources: metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:622-678 |
The authorization flow during an API request is represented below:
This sequence illustrates how the DataHubAuthorizer uses the configurations defined in PoliciesConfig to validate client requests against stored policies.
Sources: metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:620-640, docs-website/static/llms.txt:98-102
Summary
The Access Control & Policies system in DataHub is a centralized security layer that ensures metadata integrity and administrative security. By leveraging Platform and Metadata policies, administrators can delegate responsibilities while maintaining strict control over sensitive operations like ingestion management and personal access token generation. The system's extensibility allows for granular filtering based on URNs, Domains, and Tags, supporting complex organizational governance requirements.
Sources: docs-website/static/llms.txt:98-102, metadata-utils/src/main/java/com/linkedin/metadata/authorization/PoliciesConfig.java:27-30