LuciferYang opened a new issue, #13682: URL: https://github.com/apache/gravitino/issues/13682
### Version main branch, 1.3.0 ### Describe what's wrong With authorization enabled, view and function checks resolve the object's id through `MetadataIdConverter.getID`. `METADATA_SCOPE_MAPPING` has no entry for VIEW or FUNCTION, so the identifier is not case-normalized and the entity store is queried with the schema name exactly as the request spelled it. Hive schema names are case-insensitive and stored in lower case. On the data path `ViewNormalizeDispatcher` and `FunctionNormalizeDispatcher` fold the schema, so with authorization off `catalog.SALES.f1` finds `catalog.sales.f1`. With authorization on, the id lookup for `SALES` misses, so the caller's ownership or object-level privilege on the function does not count and the request is rejected. Tables in the same schema are not affected, because TABLE is in the mapping. View checks go through the same lookup. ### Error message and/or stacktrace ``` ForbiddenException: User 'tester2' is not authorized to perform operation 'getFunction' on metadata 'testMetalake.catalog.SALES.f1' ``` ### How to reproduce 1. Enable authorization, create a Hive catalog `catalog` and a schema `sales`. 2. Grant a user USE_CATALOG, USE_SCHEMA and REGISTER_FUNCTION on the catalog, and register function `sales.f1` as that user. 3. As that user, `getFunction(sales.f1)` succeeds and `getFunction(SALES.f1)` fails with the error above. A service admin can load `SALES.f1`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
