fzhsbc commented on issue #11307: URL: https://github.com/apache/gravitino/issues/11307#issuecomment-6676440579
> I wrote a design for this issue: [#14539](https://github.com/apache/gravitino/pull/14539). It takes a different shape from the decision API sketched above. > > A trusted service sends the end user in an `X-Gravitino-Proxy-User` header, and Gravitino checks it against server-side proxy rules, as Hadoop proxy users do. A `POST /api/metalakes/{metalake}/authorize` endpoint answers only allow or deny: the connector's metadata calls would still run as the service account, so ownership and audit stay wrong, and Lance REST ([#13090](https://github.com/apache/gravitino/issues/13090)) is not covered. The doc's Solution Investigations section compares the two. > > [@fzhsbc](https://github.com/fzhsbc), I'd like to hear your view before implementation. cc [@diqiu50](https://github.com/diqiu50) for the Trino connector changes, and [@yuqi1129](https://github.com/yuqi1129) since [#13092](https://github.com/apache/gravitino/issues/13092) covers the same need for Lance REST. Thanks @LuciferYang. I support the trusted-proxy approach. It reuses Gravitino RBAC and preserves end-user ownership and audit, so I’m happy to leave /authorize and a Trino SystemAccessControl plugin out of v1. Trino: Scope v1 to delegated metadata authorization and require read-only access or separate write controls. Before claiming query-level RBAC, verify that a SELECT_TABLE-only user can read but cannot write, with denial before any storage side effect. Iceberg REST: Document Trino-to-IRC separately from IRC-to-remote federation, which supports both user-token forwarding and service-account mode. Reject unsupported routes in delegated mode to prevent fallback to a service identity. Groups and audit: Forward groups only from an authoritative, complete source. Omitting a group can drop a DENY. Record the effective user and the proxy’s authenticator, principal, and OAuth issuer where applicable. Since the response header is checked after execution, proxy traffic should reach only upgraded nodes, including during rollback. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
