yuqi1129 opened a new pull request, #13941: URL: https://github.com/apache/gravitino/pull/13941
### What changes were proposed in this pull request? Backport auxiliary-mode Lance REST metadata access to `branch-1.3`: - Use the local catalog, schema and table dispatchers in auxiliary mode; retain HTTP and configured client authentication in standalone mode. - Preserve authenticated caller identity. Use the configured service identity for anonymous requests only when metadata authorization is disabled. - Include namespace/table authorization and list filtering so local dispatcher calls retain permission checks. Share the protocol-neutral authorization pipeline with Iceberg REST. - For `exist_ok`, check read permissions before opening datasets or returning existing metadata and load existing tables without invoking the ownership-changing create hook. A concurrent create is retried as a checked load after a strict `CREATE` conflict. Adapted from #11113, #12563, #12573 and #12693–#12696, using the existing 1.3 privilege model. ### Why are the changes needed? In 1.3, auxiliary-mode Lance REST makes a second HTTP request to its own Gravitino server using separate service credentials. Operations fail when the server does not accept that client's authentication type, even if the incoming Lance request authenticated successfully. Refs: #11089 ### Does this PR introduce _any_ user-facing change? Auxiliary-mode metadata operations run as the authenticated caller and enforce that caller's metadata permissions. A separate Gravitino URI or client credential is no longer needed in this mode. Anonymous requests cannot assume the service identity when authorization is enabled. `exist_ok` no longer discloses unreadable objects or changes an existing table owner. Standalone authentication settings and REST request formats remain unchanged. No new configuration properties. Reusing an existing table follows the normal authorized read path, including any configured version checks or declared-schema hydration. ### How was this patch tested? - Formatting and full non-Docker unit tests for `lance-common`, `lance-rest-server`, `server-common` and `iceberg-rest-server`: 917 tests passed. - Embedded HTTP regression tests exercise the actual Lance service and authentication filter with Basic/Bearer/Negotiate test authenticators, an unusable loopback URI, caller identity assertions and rejected credentials. They do not validate real OAuth2 or Kerberos tokens. - Regression-before-fix verification: all four HTTP tests for forbidden `exist_ok` reads and ownership preservation failed before the hardening fix. Disabling auxiliary dispatcher routing made all three protocol-fixture regression cases fail; the fix was restored. - Embedded H2 integration tests: 38 passed across the existing Lance REST suite, caller audit identity, namespace authorization and table authorization (including `exist_ok` read/owner checks). - Moving the provider load back before the read gate makes the denied-read regression test fail; the correct order was restored and all Lance unit tests rerun. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
