[
https://issues.apache.org/jira/browse/HIVE-27195?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17745576#comment-17745576
]
Stamatis Zampetakis commented on HIVE-27195:
--------------------------------------------
Thanks for your hard work Riju!
I went over the results in the spreadsheet and I have a few questions.
Q1. Is it normal that when the table or database is missing the behavior of
DROP TABLE is the same (NOOP) with and without the IF EXISTS clause?
The [Hive
wiki|https://cwiki.apache.org/confluence/display/hive/languagemanual+ddl#LanguageManualDDL-DropTable]
mentions the following:
"In Hive 0.7.0 or later, DROP returns an error if the table doesn't exist,
unless IF EXISTS is specified or the configuration variable
hive.exec.drop.ignorenonexistent is set to true."
Q2. I noticed that for non-temporary tables there is a "GRANT DROP ON TABLE"
statement in the sample test case? Why is this needed? Left also a related
comment in the PR.
Q3. I observed that DROP TABLE *IF EXISTS* will throw an authentication error
even when the operations is NOOP (i.e., the database/table does not exist). I
am wondering what happens with respect to authorization if we do CREATE TABLE
*IF NOT EXISTS* and the table is already there. Do we perform the authorization
anyways or we simply return as NOOP? Maybe it's worth keeping the behavior of
the two operations consistent. Anyways, I am not an authorization expert so
will defer the decision about the expected output to [~rmani] or [~hemanth619].
> Add database authorization for drop table command
> -------------------------------------------------
>
> Key: HIVE-27195
> URL: https://issues.apache.org/jira/browse/HIVE-27195
> Project: Hive
> Issue Type: Bug
> Reporter: Riju Trivedi
> Assignee: Riju Trivedi
> Priority: Major
> Labels: pull-request-available
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Include authorization of the database object during the "drop table" command.
> Similar to "Create table", DB permissions should be verified in the case of
> "drop table" too. Add the database object along with the table object to the
> list of output objects sent for verifying privileges. This change would
> ensure that in case of a non-existent table or temporary table (skipped from
> authorization after HIVE-20051), the authorizer will verify privileges for
> the database object.
> This would also prevent DROP TABLE IF EXISTS command failure for temporary or
> non-existing tables with `RangerHiveAuthorizer`. In case of
> temporary/non-existing table, empty input and output HivePrivilege Objects
> are sent to Ranger authorizer and after
> https://issues.apache.org/jira/browse/RANGER-3407 authorization request is
> built from command in case of empty objects. Hence, the drop table if Exists
> command fails with HiveAccessControlException.
> Steps to Repro:
> {code:java}
> use test; CREATE TEMPORARY TABLE temp_table (id int);
> drop table if exists test.temp_table;
> Error: Error while compiling statement: FAILED: HiveAccessControlException
> Permission denied: user [rtrivedi] does not have [DROP] privilege on
> [test/temp_table] (state=42000,code=40000) {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
