bharos opened a new pull request, #12461:
URL: https://github.com/apache/gravitino/pull/12461
### What changes were proposed in this pull request?
Covers role narrowing in the Iceberg REST credential vending path, which had
no integration test.
`IcebergAuthorizationIT` can now register a second Spark catalog that sends
`X-Gravitino-Active-Roles`, so the same caller can be exercised with and
without narrowing. The per-catalog configuration moved into a helper; the new
catalog is opt-in through `narrowedCatalogActiveRoles()`, mirroring the
existing `supportsCredentialVending()` hook, so the other subclasses are
unaffected.
The test asserts the WRITE to READ downgrade: the write succeeds through the
default catalog and is refused by the storage layer through the narrowed one,
while the read still succeeds. It lives on
`IcebergRESTCloudTokenAuthorizationBaseIT`, so every cloud subclass inherits
it; MinIO runs it in CI.
The narrowed role carries `USE_CATALOG` and `USE_SCHEMA` itself, because
narrowing deactivates the `USE_SCHEMA` role that `@BeforeEach` grants under a
random name.
### Why are the changes needed?
`RoleAssumptionAuthorizationIT` covers the header grammar and `listCatalogs`
filtering, but nothing covered credential vending, so the
privilege-to-credential mapping under narrowing had no protection against
regressions.
Fix: #11968
### Does this PR introduce _any_ user-facing change?
No. Test only.
### How was this patch tested?
MinIO, in both modes:
```
./gradlew :iceberg:iceberg-rest-server:test --tests
"*IcebergRESTMinIOTokenAuthorizationIT*" \
-PskipTests -PtestMode=deploy -PskipDockerTests=false
```
| Test | Result |
| --- | --- |
| MinIO deploy | 4 pass |
| MinIO embedded | 4 pass |
| IcebergTableAuthorizationIT deploy | 16 pass |
The sibling run checks that the shared base class change did not regress the
other Iceberg authorization ITs.
The test is self-controlling: the same user, table and Spark session write
successfully through the default catalog and fail through the narrowed one, and
the narrowed catalog still reads, so the only difference is the header.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
