Henri Biestro created HIVE-29817:
------------------------------------
Summary: Authorize all Iceberg REST catalog operations, not just
stage-create
Key: HIVE-29817
URL: https://issues.apache.org/jira/browse/HIVE-29817
Project: Hive
Issue Type: Improvement
Components: HiveServer2
Affects Versions: 4.2.0
Reporter: Henri Biestro
Assignee: Henri Biestro
Fix For: 4.3.0
Today the Iceberg REST catalog only authorizes stage-create, via
IcebergAuthorizer.validateStageCreateTable, which builds typed input/output
HivePrivilegeObjects and calls HiveAuthorizer.checkPrivileges against the real
authorizer.
Every other operation relies on the underlying Hive Metastore for
authorization: writes and cache-miss reads reach HMS, where the
HiveMetaStoreAuthorizer pre-event listener enforces privileges. The gap is
cache-hit reads served by HMSCachingCatalog — they never touch HMS, so they are
currently unchecked at the catalog level. (An earlier
showPrivileges/AccessLevel scheme in HMSCachingCatalog attempted to close this
but was rolled back in HIVE-29035 as lossy and unsafe to cache; the catalog is
now a pure cache.)
This issue extends IcebergAuthorizer with per-operation privilege checks and
enforces them at the HMSCatalogAdapter layer — the single REST choke point,
which already holds the IcebergAuthorizer and authorizes stage-create there.
*Scope*
• Add per-operation methods to IcebergAuthorizer following the existing
stage-create pattern (build typed inputs/outputs, call checkPrivileges,
translate HiveAccessControlException → ForbiddenException and
HiveAuthzPluginException → IllegalStateException; permissive when no authorizer
is configured).
• Operation mapping: load → QUERY, list → SHOWTABLES, create/register →
CREATETABLE, createView → CREATEVIEW, drop → DROPTABLE, dropView → DROPVIEW,
rename → ALTERTABLE_RENAME, renameView → ALTERVIEW_RENAME.
• Normalize metadata-table identifiers to their base table before the load
check so access can't leak via a metadata-table name.
• Invoke one authorize call at the top of each guarded handler in
HMSCatalogAdapter.
Out of scope
• Any change to HMSCachingCatalog, which stays a pure cache.
*Tests*
• Per-method unit tests in TestIcebergAuthorizer (mock HiveAuthorizer +
ArgumentCaptor).
• Adapter-level enforcement test driving the REST request path.
• Note: MockHiveAuthorizer enforces (denies PERMISSION_TEST_USER; denies
PERMISSION_READ_ONLY_USER on write ops), so once reads route through
checkPrivileges, integration tests must run as a permitted user.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
