LiJie20190102 opened a new pull request, #13105: URL: https://github.com/apache/gravitino/pull/13105
### What changes were proposed in this pull request? Only register `LanceServiceIdentityFilter` in auxiliary mode when authorization is disabled (`auxMode && !authorizationEnabled`). Add documentation on anonymous request behavior with the `simple` authenticator. Add tests verifying filter registration in both authorization states. ### Why are the changes needed? In auxiliary mode, `LanceServiceIdentityFilter` replaces an `anonymous` principal with the configured service user. With `gravitino.authenticators = simple` and `gravitino.authorization.enable = true`, this turns an unauthenticated request into an authorized one — a privilege escalation. Skipping the filter when authorization is enabled lets `BaseMetadataAuthorizationMethodInterceptor` reject anonymous requests with 403, as it does for any unknown user. Fix: #13093 ### Does this PR introduce _any_ user-facing change? Yes. With `gravitino.authorization.enable = true` in auxiliary mode, anonymous Lance REST requests are now rejected with 403 instead of running as the service user. Deployments that relied on anonymous access must configure proper authentication. ### How was this patch tested? Unit tests in `TestLanceRESTService` verifying the filter is not registered when authorization is enabled and registered when disabled. Existing tests pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
