FrankChen021 commented on code in PR #19247:
URL: https://github.com/apache/druid/pull/19247#discussion_r3141492501
##########
sql/src/main/java/org/apache/druid/sql/calcite/schema/SystemSchema.java:
##########
@@ -121,6 +121,14 @@ public class SystemSchema extends AbstractSchema
segment.getDataSource())
);
+ /**
+ * Context map passed to {@link AuthorizationUtils} methods to indicate that
authorization
+ * is being performed from the SystemSchema.
+ */
+ static final String AUTHORIZATION_CONTEXT_CALLER_PATH_VALUE =
SystemSchema.class.getSimpleName();
+ private static final Map<String, Object> SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT
=
Review Comment:
[P2] Pass SystemSchema context to server state check
SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT is threaded through the SystemSchema
datasource filters, but checkStateReadAccessForServers still calls the
three-argument authorizeAllResourceActions, so querying sys.servers performs
its STATE READ authorization with an empty context. That leaves this
SystemSchema-originated denial indistinguishable from ordinary state reads,
undermining the new callerPath contract for one of the UI/system-schema paths;
pass SYSTEM_SCHEMA_AUTHORIZATION_CONTEXT into that helper call too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
