bharos commented on issue #11968: URL: https://github.com/apache/gravitino/issues/11968#issuecomment-5186333931
Recording a manual end-to-end verification that active-role narrowing reaches Iceberg credential vending. ### Setup A local Gravitino build of `main` (2.0.0-SNAPSHOT) run as a server with authorization enabled and the Iceberg REST service as an auxiliary service: - Iceberg catalog, JDBC backend (PostgreSQL), warehouse `s3://testbucket/wh` on a local MinIO - `credential-providers=s3-token`, `s3-role-arn=arn:minio:iam:::role/test`, `s3-token-service-endpoint` pointing at MinIO - user `normal` granted two roles: `role_select` (`USE_CATALOG`, `USE_SCHEMA`, `SELECT_TABLE`) and `role_modify` (`USE_CATALOG`, `USE_SCHEMA`, `MODIFY_TABLE`) ### Result Same user, same table `db1.t1`, two `loadTable` requests, both sending `X-Iceberg-Access-Delegation: vended-credentials`: | Request | What the vended credential could do | | --- | --- | | no `X-Gravitino-Active-Roles` | `PutObject` succeeded | | `X-Gravitino-Active-Roles: role_select` | read succeeded, `PutObject` returned `AccessDenied` | The narrowed token is valid — the successful read shows that — but `MODIFY_TABLE` is held without being active, so `getCredentialPrivilege` resolves to `READ` and the vended STS session policy is read-only. ### Notes - MinIO enforces `AssumeRole` session policies, which is what makes this observable without a cloud account. `S3TokenGenerator.getArnPrefix()` returns `arn:aws:s3:::` for a MinIO role ARN, so the generated policy document has the same shape as the one sent to AWS. - Scope of this check: S3 (`s3-token`) and the `loadTable` path only. Other credential providers and `planTableScan` were not exercised. - This is a manual verification, not automated coverage. The existing credential vending ITs are gated by `@EnabledIfEnvironmentVariable(named = "GRAVITINO_TEST_CLOUD_IT", matches = "true")` and require real cloud credentials, so they do not run in CI. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
