yuqi1129 opened a new issue, #11810:
URL: https://github.com/apache/gravitino/issues/11810
### Version
main branch
### Describe what's wrong
`IsolatedClassLoader.isCatalogClass()` does not recognize the authorization
plugin packages
(`org.apache.gravitino.authorization.{ranger,chain,jdbc,common}.*`). As a
result these plugin classes are classified as *shared* and delegated to the
server classloader. Under certain classloader-initialization timing windows,
the server classloader becomes the defining classloader of a plugin class (e.g.
`RangerPrivileges`), and its nested/synthetic classes (e.g. the inner enum
`RangerPrivileges$RangerHdfsPrivilege`) cannot be resolved from the server
classpath. The JVM permanently caches this load failure for the lifetime of the
process, so every subsequent role/authorization operation throws
`NoClassDefFoundError` until restart.
This is the same class of bug as #11704 (fixed for the hive packages in
#11705), now affecting the authorization plugins. It surfaces intermittently in
`RangerHiveE2EIT` and is unrelated to the PR under test.
### Error message and/or stacktrace
```
java.lang.NoClassDefFoundError:
org/apache/gravitino/authorization/ranger/RangerPrivileges$RangerHdfsPrivilege
at
org.apache.gravitino.authorization.ranger.RangerPrivileges.<clinit>(RangerPrivileges.java:145)
at
org.apache.gravitino.authorization.ranger.RangerAuthorizationPlugin.doAddSecurableObject(RangerAuthorizationPlugin.java:864)
...
at
org.apache.gravitino.authorization.RoleManager.createRole(RoleManager.java:83)
Caused by: java.lang.ClassNotFoundException: Class not found
```
### How to reproduce
Intermittent. Run `RangerHiveE2EIT` (e.g.
`testSelectModifyTableWithTableLevelRole`) in CI; depending on classloader init
ordering, `RangerPrivileges` gets defined by the server classloader and the
nested enum fails to resolve. Example failing run:
https://github.com/apache/gravitino/actions/runs/28228153382/job/83626344824
### Additional context
Root cause is in
`core/src/main/java/org/apache/gravitino/utils/IsolatedClassLoader.java`
`isCatalogClass()`. Fix: whitelist the authorization plugin sub-packages (but
NOT the bare `org.apache.gravitino.authorization.*`, which holds server-side
classes like `RoleManager`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
