dprmfl opened a new issue, #13383:
URL: https://github.com/apache/gravitino/issues/13383
### Version
main branch
### Describe what's wrong
With authentication.impersonation-enable=true on a lakehouse-iceberg catalog
with Hive backend, impersonation is applied to some paths but not to the HDFS
access that happens while building table changes for ALTER.
IcebergCatalogOperations.initialize() wraps the catalog with
KerberosAwareIcebergCatalogProxy, but then passes the inner raw Catalog
object to the helper:
```java
// IcebergCatalogOperations.java L132-137
this.icebergCatalogWrapper =
authenticationConfig.isKerberosAuth() && rawWrapper.getCatalog()
instanceof SupportsKerberos
? new
KerberosAwareIcebergCatalogProxy(rawWrapper).getProxy(icebergConfig)
: rawWrapper;
this.icebergCatalogWrapperHelper =
new IcebergCatalogWrapperHelper(icebergCatalogWrapper.getCatalog()); //
raw Catalog
```
IcebergCatalogWrapperHelper.buildIcebergTableChanges() then calls
icebergCatalog.loadTable() on that raw object, so the proxy never intercepts
the call and UGI.doAs() is not applied. The metadata.json read runs as the
principal from authentication.kerberos.principal.
updateTable() on the next line does go through the proxy, but execution never
reaches it because buildIcebergTableChanges() fails first.
### Error message and/or stacktrace
```
java.lang.RuntimeException: Failed to operate object [tbl] operation [ALTER]
under [db],
reason [Failed to open input stream for file:
hdfs://<ns>/<warehouse>/db/tbl/metadata/00004-xxxx.metadata.json]
org.apache.iceberg.exceptions.RuntimeIOException: Failed to open input
stream for file: ...
at
org.apache.iceberg.hadoop.HadoopInputFile.newStream(HadoopInputFile.java:187)
at
org.apache.iceberg.TableMetadataParser.read(TableMetadataParser.java:300)
at
org.apache.iceberg.BaseMetastoreTableOperations.refreshFromMetadataLocation(BaseMetastoreTableOperations.java:200)
at
org.apache.iceberg.hive.HiveTableOperations.doRefresh(HiveTableOperations.java:206)
at
org.apache.iceberg.BaseMetastoreCatalog.loadTable(BaseMetastoreCatalog.java:49)
at
org.apache.gravitino.catalog.lakehouse.iceberg.ops.IcebergCatalogWrapperHelper.buildIcebergTableChanges(IcebergCatalogWrapperHelper.java:266)
at
org.apache.gravitino.catalog.lakehouse.iceberg.IcebergCatalogOperations.internalUpdateTable(IcebergCatalogOperations.java:459)
at
org.apache.gravitino.catalog.lakehouse.iceberg.IcebergCatalogOperations.alterTable(IcebergCatalogOperations.java:451)
Caused by: org.apache.hadoop.security.AccessControlException:
Permission denied: user=gravitino, access=EXECUTE,
inode="/<warehouse>":hdfs:<group>:drwxrwx---
at
org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.check(FSPermissionChecker.java:661)
at
org.apache.hadoop.hdfs.server.namenode.FSPermissionChecker.checkTraverse(FSPermissionChecker.java:577)
```
HDFS audit log, same file within the same second:
```
allowed=true ugi=alice@REALM cmd=open
src=/<warehouse>/db/tbl/metadata/00004-xxxx.metadata.json
allowed=false ugi=gravitino@REALM cmd=open
src=/<warehouse>/db/tbl/metadata/00004-xxxx.metadata.json
```
The first line is the query engine reading with the user's own ticket.
The second is the Gravitino server, which fails.
### How to reproduce
The warehouse directory must NOT be accessible by the service account.
In our case it is owned by `hdfs:<group>` with mode `drwxrwx---`, the service
account is not in `<group>`, and the query user is.
Run as a user other than the service account:
```sql
ALTER TABLE ice_catalog.db.tbl ADD COLUMNS (memo string);
```
Observed scope:
| Operation | Result |
|---|---|
| ALTER COLUMN (add / type / drop / comment) | fails |
| SET TBLPROPERTIES | fails |
| RENAME TO | works — only updates the HMS pointer, no metadata.json read |
| SELECT | works — the engine reads metadata.json with the user's own ticket
|
Hive catalog is not affected.
### Additional context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
