[
https://issues.apache.org/jira/browse/HIVE-29817?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Henri Biestro updated HIVE-29817:
---------------------------------
Summary: Authorize Iceberg REST catalog load/list operations (was:
Authorize all Iceberg REST catalog operations, not just stage-create)
> Authorize Iceberg REST catalog load/list operations
> ---------------------------------------------------
>
> Key: HIVE-29817
> URL: https://issues.apache.org/jira/browse/HIVE-29817
> Project: Hive
> Issue Type: Improvement
> Components: HiveServer2
> Affects Versions: 4.2.0
> Reporter: Henri Biestro
> Assignee: Henri Biestro
> Priority: Major
> Labels: pull-request-available
> Fix For: 4.3.0
>
>
> Enforce read/list authorization for Iceberg REST catalog operations, closing
> gaps left after HIVE-29035 reduced HMSCachingCatalog to a pure cache.
> • loadTable: the QUERY read check lives in HMSCachingCatalog and runs only on
> cache hits (which bypass HMS); cache misses reload through HMS and are
> authorized by ReadTableEvent, so a cold load is authorized once. The cache is
> authz-aware.
> • loadView: no explicit check — views are never cached, so loadView always
> reaches HMS, which authorizes it.
> • listTables/listViews/listNamespaces: result filtering via
> HiveAuthorizer.filterListCmdObjects; a denied user gets an empty list. HMS
> has no pre-event auth for get_tables/get_databases, so this closes a standing
> gap.
> • Writes remain authorized by the HiveMetaStoreAuthorizer pre-event listener.
> Because read authorization runs on every cache hit, the per-thread authorizer
> building blocks (cloned HiveConf, reflective factory/authenticator lookups)
> are memoized in a ThreadLocal; identity-sensitive steps still run per call to
> bind the current request's user on pooled threads.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
