[
https://issues.apache.org/jira/browse/HIVE-29817?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated HIVE-29817:
----------------------------------
Labels: pull-request-available (was: )
> Authorize all Iceberg REST catalog operations, not just stage-create
> --------------------------------------------------------------------
>
> Key: HIVE-29817
> URL: https://issues.apache.org/jira/browse/HIVE-29817
> Project: Hive
> Issue Type: Improvement
> Components: HiveServer2
> Affects Versions: 4.2.0
> Reporter: Henri Biestro
> Assignee: Henri Biestro
> Priority: Major
> Labels: pull-request-available
> Fix For: 4.3.0
>
>
> Today the Iceberg REST catalog only authorizes stage-create, via
> IcebergAuthorizer.validateStageCreateTable, which builds typed input/output
> HivePrivilegeObjects and calls HiveAuthorizer.checkPrivileges against the
> real authorizer.
> Every other operation relies on the underlying Hive Metastore for
> authorization: writes and cache-miss reads reach HMS, where the
> HiveMetaStoreAuthorizer pre-event listener enforces privileges. The gap is
> cache-hit reads served by HMSCachingCatalog — they never touch HMS, so they
> are currently unchecked at the catalog level. (An earlier
> showPrivileges/AccessLevel scheme in HMSCachingCatalog attempted to close
> this but was rolled back in HIVE-29035 as lossy and unsafe to cache; the
> catalog is now a pure cache.)
> This issue extends IcebergAuthorizer with per-operation privilege checks and
> enforces them at the HMSCatalogAdapter layer — the single REST choke point,
> which already holds the IcebergAuthorizer and authorizes stage-create there.
> *Scope*
> • Add per-operation methods to IcebergAuthorizer following the existing
> stage-create pattern (build typed inputs/outputs, call checkPrivileges,
> translate HiveAccessControlException → ForbiddenException and
> HiveAuthzPluginException → IllegalStateException; permissive when no
> authorizer is configured).
> • Operation mapping: load → QUERY, list → SHOWTABLES, create/register →
> CREATETABLE, createView → CREATEVIEW, drop → DROPTABLE, dropView → DROPVIEW,
> rename → ALTERTABLE_RENAME, renameView → ALTERVIEW_RENAME.
> • Normalize metadata-table identifiers to their base table before the load
> check so access can't leak via a metadata-table name.
> • Invoke one authorize call at the top of each guarded handler in
> HMSCatalogAdapter.
> Out of scope
> • Any change to HMSCachingCatalog, which stays a pure cache.
> *Tests*
> • Per-method unit tests in TestIcebergAuthorizer (mock HiveAuthorizer +
> ArgumentCaptor).
> • Adapter-level enforcement test driving the REST request path.
> • Note: MockHiveAuthorizer enforces (denies PERMISSION_TEST_USER; denies
> PERMISSION_READ_ONLY_USER on write ops), so once reads route through
> checkPrivileges, integration tests must run as a permitted user.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
