LuciferYang opened a new issue, #13870:
URL: https://github.com/apache/gravitino/issues/13870
### Version
main branch
### Describe what's wrong
With authorization enabled, `LoadTableAuthzHandler` treats every `loadTable`
request whose table name is an Iceberg metadata table type (`files`,
`snapshots`, `history`, `partitions`, ...) and whose namespace has more than
one level as a metadata-table request, and returns 404 before authorization. A
real table with such a name in a nested namespace (a hierarchical schema such
as `a:b`) can therefore never be loaded, by any user. Creating the table is not
rejected, and `HEAD .../tables/files` reports that it exists.
### Error message and/or stacktrace
`GET /iceberg/v1/{prefix}/namespaces/a%1Fb/tables/files` returns 404
`NoSuchTableException: Table files not found`.
### How to reproduce
1. Run the Iceberg REST service inside the Gravitino server with
`gravitino.authorization.enable=true` and a JDBC or memory backend.
2. Create namespace `[a, b]` and a table `files` in it.
3. Load `a.b.files`, for example `SELECT * FROM cat.a.b.files` in Spark. The
load returns 404 even for the table owner.
### Additional context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
