diqiu50 opened a new issue, #13472: URL: https://github.com/apache/gravitino/issues/13472
### Version main branch ### Describe what's wrong With the Gravitino server using `authType=basic`, the Trino connector authenticates to Gravitino with one fixed Basic credential (`gravitino.client.basic.username`/`.password`). `gravitino.client.session.forwardUser` only supports `authType=simple` and `authType=oauth2` (`GravitinoAuthProvider.buildForSession` throws `UnsupportedOperationException` for `basic`, and `GravitinoConnector`'s config validation rejects `forwardUser=true` with `authType=basic`). Every Trino query is therefore authorized against Gravitino as the connector's configured user, not the individual Trino session user — a user whom Gravitino denies access to a table can still read that table through Trino. ### How to reproduce 1. Enable `gravitino.authenticators=basic` on the Gravitino server and create a local user (e.g. `ana`) with a role that allows `USE_CATALOG`/`USE_SCHEMA`/`SELECT_TABLE` on some catalog but denies `SELECT_TABLE` on one specific table. 2. Configure the Trino connector with `gravitino.client.authType=basic`. 3. As `ana` directly through the Gravitino REST API, loading that table returns `403 ForbiddenException`. 4. As `ana` through Trino (`trino --user ana`), querying the same table succeeds and returns all rows — the per-user denial is bypassed. ### Additional context Root cause: `authType=basic` requires a real password, but Trino's SPI does not propagate the session user's password to connectors after coordinator-side authentication, so there is nothing to forward for this auth type (unlike `simple`, which trusts any username, or `oauth2`, which can forward a bearer token via session extra-credentials). A general "trusted delegated authorization" design that would also close this gap is being tracked in #11307. Until that lands, the immediate fix should be documenting this limitation clearly — already done in `docs/trino-connector/authentication.md`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
