FANNG1 opened a new issue, #8177:
URL: https://github.com/apache/gravitino/issues/8177
### Version
main branch
### Describe what's wrong
`HiveBackendProxy` hooks the method of `HiveCatalog` to do the
impersonation, take create table for example, it only hooks catalog.build
method, but the real create table operation acts in the create method which is
not hooked.
```
Table table =
catalog
.buildTable(ident, request.schema())
.withLocation(request.location())
.withPartitionSpec(request.spec())
.withSortOrder(request.writeOrder())
.withProperties(request.properties())
.create();
```
### Error message and/or stacktrace
no
### How to reproduce
apply the patch to
`CatalogIcebergKerberosHiveIT#testIcebergWithKerberosAndUserImpersonation`
```java
+ kerberosHiveContainer.executeInContainer(
+ "hadoop", "fs", "-chmod", "-R", "000",
"/user/hive/warehouse-catalog-iceberg");
+
// Create table
+
NameIdentifier tableNameIdentifier = NameIdentifier.of(SCHEMA_NAME,
TABLE_NAME);
- catalog
- .asTableCatalog()
- .createTable(
- tableNameIdentifier,
- createColumns(),
- "",
- ImmutableMap.of(),
- Transforms.EMPTY_TRANSFORM,
- Distributions.NONE,
- SortOrders.NONE);
+ exception =
+ Assertions.assertThrows(
+ Exception.class,
+ () ->
+ catalog
+ .asTableCatalog()
+ .createTable(
+ tableNameIdentifier,
+ createColumns(),
+ "",
+ ImmutableMap.of(),
+ Transforms.EMPTY_TRANSFORM,
+ Distributions.NONE,
+ SortOrders.NONE));
+ exceptionMessage = Throwables.getStackTraceAsString(exception);
+ System.out.println(exceptionMessage);
+ // Make sure the real user is 'gravitino_client'
+ Assertions.assertTrue(
+ exceptionMessage.contains("Permission denied:
user=gravitino_client, access=WRITE"));
```
### Additional context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
