yuqi1129 opened a new issue, #12574: URL: https://github.com/apache/gravitino/issues/12574
### Describe the subtask Document the authentication and authorization behavior of the Lance REST server once the metadata authorization work of #9087 is complete. The individual authorization subtasks (#12558 - #12562) deliberately ship without documentation, because describing partial coverage would mislead users about which operations are protected. This subtask adds the documentation in one place after the last of them lands. - Describe how a Lance REST request is authenticated in auxiliary and standalone mode, including the configured service identity fallback. - Document the privileges required by each namespace and table operation, matching the Iceberg REST authorization documentation. - State that metadata authorization applies to auxiliary mode only, and that standalone per-user authorization and credential vending are out of scope. - Explain that listings hide the catalogs, schemas and tables the caller may not access, and that an inaccessible object is concealed rather than reported. - Update `docs/lance-rest-service.md` and, where relevant, `docs/lance-rest-integration.md`. Depends on #12562. ### Parent issue #9087 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
