[
https://issues.apache.org/jira/browse/HIVE-29769?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated HIVE-29769:
----------------------------------
Labels: pull-request-available (was: )
> Authorize a stage-create on Iceberg REST API
> --------------------------------------------
>
> Key: HIVE-29769
> URL: https://issues.apache.org/jira/browse/HIVE-29769
> Project: Hive
> Issue Type: Improvement
> Components: Iceberg integration, Standalone Metastore
> Affects Versions: 4.2.0
> Reporter: Shohei Okumiya
> Assignee: Shohei Okumiya
> Priority: Major
> Labels: pull-request-available
>
> The current Iceberg REST Catalog API delegates all authorization to Hive
> Metastore. It is not enforced when an end-user calls `POST
> /v1/\{prefix}/namespaces/\{namespace}/tables` with `stage-create=true`
> because it does not trigger real HMS operations.
> [https://github.com/apache/iceberg/blob/apache-iceberg-1.11.0/open-api/rest-catalog-open-api.yaml#L575-L580]
>
> As of today, it is not a real problem. However, it will introduce a very
> serious problem once we deliver Credential Vending. As `POST
> /v1/\{prefix}/namespaces/\{namespace}/tables` allows end-users to specify any
> locations, no authorization against the endpoint will prevent end-users from
> obtaining arbitrary storage credentials, as follows.
> # Alice calls the API with location = `/user/hive/warehouse`
> # Iceberg REST API responds with credentials with write permission for
> `/user/hive/warehouse/*`
> # Alice can access any data under `/user/hive/warehouse`
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
