markhoerth opened a new issue, #14444:
URL: https://github.com/apache/gravitino/issues/14444
### Version
main branch
### Describe what's wrong
With authorization enabled, the Iceberg REST server governs a namespace as
the Gravitino schema named by its levels joined with the schema separator
(`gravitino.schema.separator`, default `:`). A level may contain that
separator, so the single-level namespace `["x:y"]` and the two-level namespace
`["x","y"]` are different namespaces in the Iceberg catalog but the same
Gravitino schema `x:y`: one owner, one set of privileges, one set of tags.
1. A user who holds only `USE_CATALOG` and `CREATE_SCHEMA` creates `["x:y"]`
while another user owns `["x","y"]`. The create succeeds and makes the creator
owner of schema `x:y`. The creator can then update and drop `["x","y"]` and
load and drop the tables in it, which returned 403 before. The same happens in
the other order.
2. `GET /v1/{prefix}/namespaces` returns the stored `["x:y"]` as
`["x","y"]`, because the authorization filter rebuilds each namespace by
splitting the schema name on the separator.
Code path: `IcebergMetadataAuthorizationMethodInterceptor` (the namespace
path parameter is authorized as `String.join(separator, levels)`),
`IcebergNamespaceHookDispatcher.createNamespace` and
`IcebergOwnershipUtils.setSchemaOwners` (the creator becomes owner of the
joined name), and `IcebergNamespaceOperations.filterListNamespacesResponse`
(splits the name back into levels).
### Error message and/or stacktrace
```
writer GET /v1/cat/namespaces/x%1Fy/tables/t 403
writer POST /v1/cat/namespaces {"namespace":["x:y"]} 200
writer GET /v1/cat/namespaces/x%1Fy/tables/t 200
writer DELETE /v1/cat/namespaces/x%1Fy/tables/t 204
```
### How to reproduce
1. As an admin, create namespace `["x","y"]` and a table `t` in it.
2. As a user with only `USE_CATALOG` and `CREATE_SCHEMA` on the catalog,
create namespace `["x:y"]`.
3. As that user, load and drop `x.y.t`.
### Additional context
A level containing the separator cannot be represented as its own Gravitino
schema, so it should be refused with 400 before anything is created.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
