roryqi commented on code in PR #12954:
URL: https://github.com/apache/gravitino/pull/12954#discussion_r3957968576
##########
docs/lance-rest-integration.md:
##########
@@ -109,6 +109,56 @@ Before proceeding, ensure the following requirements are
met:
- For Spark integration: `pyspark`
- For Ray integration: `ray`, `lance-namespace`, `lance-ray`
+## Authentication and authorization
+
+For per-user metadata authorization, connect engines to the auxiliary Lance
REST service with
+`gravitino.authorization.enable=true`. Configure each engine's REST client to
send the caller's
+`Authorization` header on every namespace and table request. If supported by
that client version,
+`X-Gravitino-Active-Roles` can restrict the active roles. See the
+[Lance REST authentication and privilege
matrix](./lance-rest-service.md#authentication-and-authorization).
+
+For example, with development-only `simple` authentication, this request lists
only tables that
+`user1` may access (the password is not validated):
+
+```shell
+curl --user 'user1:unused' \
+ -H 'X-Gravitino-Active-Roles: ALL' \
+
'http://localhost:9101/lance/v1/namespace/lance_catalog.sales/table/list?delimiter=.'
+```
+
+Connector header configuration depends on the connector version. The Spark and
Ray examples
+below omit credentials and assume the default simple-authentication setup; in
auxiliary mode
+such requests use the configured Lance service identity. They do not
demonstrate per-user
+access control. In standalone mode, all metadata requests to Gravitino use the
backend service
+identity even when an engine supplies its own incoming credentials.
+
+Engines that probe before creating need the corresponding creation privileges.
Reading table
+metadata requires `SELECT_TABLE` or `MODIFY_TABLE` with parent access, while
overwriting requires
+`MODIFY_TABLE` and dropping requires ownership. Metadata authorization does
not authorize direct
+reads or writes to object storage: configure storage access independently.
Lance REST responses
+can return shared storage credentials configured on the catalog or table; it
does not issue
+per-user, scoped storage credentials.
+
+### Verify authentication and authorization locally
Review Comment:
This isn't developer document. We shouldn't include this section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
