bharos opened a new issue, #11965: URL: https://github.com/apache/gravitino/issues/11965
### Describe the proposal Implement Phase 1 of the approved design [design-docs/gravitino-role-assumption.md](https://github.com/apache/gravitino/blob/main/design-docs/gravitino-role-assumption.md) (discussion #10894): a request header `X-Gravitino-Active-Roles` that lets a caller narrow the active role set for a request on the native authorization path (Iceberg REST + native API). The server validates that the caller holds the declared role(s) and evaluates authorization against only those roles. Subtractive only; an absent header behaves exactly as today. Agreed semantics: - Narrowing removes **allows** only. **Denies are global** — a deny on any role the caller holds always applies, regardless of the active set (keeps narrowing strictly subtractive). - Ownership always applies (Option A). - Grammar: single role, comma-separated list, or the reserved keywords `ALL` / `NONE`. ### Task list - [ ] Parse & validate the `X-Gravitino-Active-Roles` header - [ ] Narrow enforcement in `JcasbinAuthorizer` (allow-only; deny global) - [ ] Apply narrowing to list filtering + credential vending, with ITs & docs _(Subtask issue links added below once created.)_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
