yuqi1129 opened a new issue, #13091: URL: https://github.com/apache/gravitino/issues/13091
### Describe the subtask Add a `caller` value for `gravitino.lance-rest.gravitino-auth-type` (and make it the default) under which each outbound Gravitino request carries the incoming caller's `Authorization` header and `X-Gravitino-Active-Roles`, read per request from the authenticated principal, with no service-account fallback. Only `Basic` and `Bearer` are forwardable; `Negotiate` is rejected with 401 since a Kerberos ticket cannot be replayed to a second service. OAuth tokens must be valid at both services. `createNamespace` retries as a create when the preceding load is denied, so a caller holding only the create privilege is not blocked by the read. Documentation must state the trust-boundary change: standalone Lance REST becomes a relay for caller credentials, and a compromised Lance REST process can act as any caller against Gravitino. Implemented by #12984. ### Parent issue #13090 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
