okumin commented on code in PR #6458:
URL: https://github.com/apache/hive/pull/6458#discussion_r4335822171
##########
standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/IcebergAuthorizer.java:
##########
@@ -234,6 +239,36 @@ void validateDropTablePurge(String catalogName,
TableIdentifier identifier, Stri
}
}
+ /**
+ * Translates Hive privileges into storage operations.
+ *
+ * @param catalogName the catalog name
+ * @param identifier the table identifier
+ * @param columnNames the column names
+ * @return a set of acceptable storage operations
+ * @throws IllegalStateException if the authorization plugin fails
+ */
+ Set<StorageOperation> resolveAllowedStorageOperations(String catalogName,
TableIdentifier identifier,
+ List<String> columnNames) {
+ Preconditions.checkArgument(identifier.namespace().levels().length == 1);
+ final var database = identifier.namespace().level(0);
+ final var table = identifier.name();
+
+ final var authorizer = authorizerSupplier.get();
+ if (authorizer == null) {
+ LOG.info("No pre-event listener is configured, skipping
credential-vending authorization");
+ return EnumSet.allOf(StorageOperation.class);
Review Comment:
When a Hive operator explicitly configures
`metastore.iceberg.catalog.vended-credentials.enabled=true` without
authorization, I assume he or she intentionally enables the feature. Credential
vending without auth has some potential use cases; e.g., it is convenient for a
thin client. I'm also fine with being defensive for now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
