LuciferYang commented on issue #11307: URL: https://github.com/apache/gravitino/issues/11307#issuecomment-6685617425
Thanks @fzhsbc, I've updated #14539. - Trino: Goal 3 now covers per-user metadata authorization only. Security considerations require Trino system access control, or storage that checks each Trino user's own permissions, for catalogs whose users may read but not write. Checking `MODIFY_TABLE` on the connector's write paths is a follow-up task, with your test: a user with only `SELECT_TABLE` can read and is denied before any storage write. - Iceberg REST: Non-Goal 4 now describes the two routes separately. By default the connector routes Iceberg catalogs whose backend is not `rest` through the Iceberg REST service, and Trino's native client cannot send the proxy header, so in proxy mode the connector refuses to register such a catalog rather than run it as the route's identity. For a `rest` backend, reached through the Gravitino API or the Iceberg REST service, `user-token` mode fails for proxied principals. In `service-account` mode (#14595), Gravitino authorizes the proxied user, when authorization is enabled, before it calls the remote catalog as the service account. - Groups and audit: a group's `DENY` applies to a proxied user only when the proxy declares that group, so the doc now requires the groups a rule allows to come from a source that is complete as well as authoritative. Proxied requests also record `realUserAuthenticator`, and `realUserIssuer` for OAuth, next to `user` and `realUser`. - Rollout: servers behind one address must keep the feature while clients proxy through it. Before one of them is downgraded, the clients stop proxying or that server leaves the address. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
