markhoerth opened a new issue, #14447:
URL: https://github.com/apache/gravitino/issues/14447
### Version
main branch
### Describe what's wrong
With authorization enabled:
1. `GET /v1/config?warehouse=X` returns catalog `X`'s client configuration
and endpoint list to any authenticated user, including one who is not a member
of the metalake and a member with no privileges. Those users get 403 from every
other Iceberg REST route and from the Gravitino API for the same catalog. The
status also tells them, for any name, whether a catalog exists and is an
Iceberg catalog: 200, 400 "Catalog X is not an Iceberg catalog", or 404. The
cause is that `IcebergRESTAuthInterceptionService` does not intercept
`IcebergConfigOperations`, and `getConfig` has no `@AuthorizationExpression`.
2. A request whose prefix names an existing catalog that is not a
`lakehouse-iceberg` catalog (Glue, JDBC, fileset, Kafka) returns 500
"Authorization failed due to system internal error" to every caller, the
service admin included. A missing name gets 403 instead, so the 500 also tells
users without access that the name exists. The cause is that
`IcebergMetadataAuthorizationMethodInterceptor.shouldSkipAuthorization` catches
only `NoSuchCatalogException` from `getCatalogWrapper`. The provider's
`IllegalArgumentException("Catalog X is not an Iceberg catalog")` escapes to
the interceptor's catch-all, which reports it as an internal error.
### Error message and/or stacktrace
```
outsider GET /v1/config?warehouse=cat 200
{"defaults":{...},"endpoints":[...]}
outsider GET /v1/cat/namespaces 403
admin GET /v1/glue_cat/namespaces 500 "Authorization failed
due to system internal error, User: 'admin', Operation: 'listNamespaces'"
```
### How to reproduce
1. Enable authorization and use the dynamic config provider, with an Iceberg
catalog `cat` and a Glue catalog `glue_cat`.
2. As an authenticated user who is not a member of the metalake, `GET
/v1/config?warehouse=cat`: 200.
3. As the service admin, `GET /v1/glue_cat/namespaces`: 500.
### Additional context
The REST spec lists 403 as a response of `getConfig`. A prefix naming the
wrong kind of catalog is a client error.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
