Shohei Okumiya created HIVE-29769:
-------------------------------------
Summary: Authorize a stage-create on Iceberg REST API
Key: HIVE-29769
URL: https://issues.apache.org/jira/browse/HIVE-29769
Project: Hive
Issue Type: Improvement
Components: Iceberg integration, Standalone Metastore
Affects Versions: 4.2.0
Reporter: Shohei Okumiya
Assignee: Shohei Okumiya
The current Iceberg REST Catalog API delegates all authorization to Hive
Metastore. It is not enforced when an end-user calls `POST
/v1/\{prefix}/namespaces/\{namespace}/tables` with `stage-create=true` because
it does not trigger real HMS operations.
[https://github.com/apache/iceberg/blob/apache-iceberg-1.11.0/open-api/rest-catalog-open-api.yaml#L575-L580]
As of today, it is not a real problem. However, it will introduce a very
serious problem once we deliver Credential Vending. As `POST
/v1/\{prefix}/namespaces/\{namespace}/tables` allows end-users to specify any
locations, no authorization against the endpoint will prevent end-users from
obtaining arbitrary storage credentials, as follows.
# Alice calls the API with location = `/user/hive/warehouse`
# Iceberg REST API responds with credentials with write permission for
`/user/hive/warehouse/*`
# Alice can access any data under `/user/hive/warehouse`
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
