[
https://issues.apache.org/jira/browse/HIVE-29817?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Henri Biestro updated HIVE-29817:
---------------------------------
Description:
Enforce read/list authorization for Iceberg REST catalog operations, closing
gaps left after HIVE-29035 reduced HMSCachingCatalog to a pure cache.
• loadTable: the QUERY read check lives in HMSCachingCatalog and runs only on
cache hits (which bypass HMS); cache misses reload through HMS and are
authorized by ReadTableEvent, so a cold load is authorized once. The cache is
authz-aware.
• loadView: no explicit check — views are never cached, so loadView always
reaches HMS, which authorizes it.
• listTables/listViews/listNamespaces: result filtering via
HiveAuthorizer.filterListCmdObjects; a denied user gets an empty list. HMS has
no pre-event auth for get_tables/get_databases, so this closes a standing gap.
• Writes remain authorized by the HiveMetaStoreAuthorizer pre-event listener.
Because read authorization runs on every cache hit, the per-thread authorizer
building blocks (cloned HiveConf, reflective factory/authenticator lookups) are
memoized in a ThreadLocal; identity-sensitive steps still run per call to bind
the current request's user on pooled threads.
was:
Today the Iceberg REST catalog only authorizes stage-create, via
IcebergAuthorizer.validateStageCreateTable, which builds typed input/output
HivePrivilegeObjects and calls HiveAuthorizer.checkPrivileges against the real
authorizer.
Every other operation relies on the underlying Hive Metastore for
authorization: writes and cache-miss reads reach HMS, where the
HiveMetaStoreAuthorizer pre-event listener enforces privileges. The gap is
cache-hit reads served by HMSCachingCatalog — they never touch HMS, so they are
currently unchecked at the catalog level. (An earlier
showPrivileges/AccessLevel scheme in HMSCachingCatalog attempted to close this
but was rolled back in HIVE-29035 as lossy and unsafe to cache; the catalog is
now a pure cache.)
This issue extends IcebergAuthorizer with per-operation privilege checks and
enforces them at the HMSCatalogAdapter layer — the single REST choke point,
which already holds the IcebergAuthorizer and authorizes stage-create there.
*Scope*
• Add per-operation methods to IcebergAuthorizer following the existing
stage-create pattern (build typed inputs/outputs, call checkPrivileges,
translate HiveAccessControlException → ForbiddenException and
HiveAuthzPluginException → IllegalStateException; permissive when no authorizer
is configured).
• Operation mapping: load → QUERY, list → SHOWTABLES, create/register →
CREATETABLE, createView → CREATEVIEW, drop → DROPTABLE, dropView → DROPVIEW,
rename → ALTERTABLE_RENAME, renameView → ALTERVIEW_RENAME.
• Normalize metadata-table identifiers to their base table before the load
check so access can't leak via a metadata-table name.
• Invoke one authorize call at the top of each guarded handler in
HMSCatalogAdapter.
Out of scope
• Any change to HMSCachingCatalog, which stays a pure cache.
*Tests*
• Per-method unit tests in TestIcebergAuthorizer (mock HiveAuthorizer +
ArgumentCaptor).
• Adapter-level enforcement test driving the REST request path.
• Note: MockHiveAuthorizer enforces (denies PERMISSION_TEST_USER; denies
PERMISSION_READ_ONLY_USER on write ops), so once reads route through
checkPrivileges, integration tests must run as a permitted user.
> Authorize all Iceberg REST catalog operations, not just stage-create
> --------------------------------------------------------------------
>
> Key: HIVE-29817
> URL: https://issues.apache.org/jira/browse/HIVE-29817
> Project: Hive
> Issue Type: Improvement
> Components: HiveServer2
> Affects Versions: 4.2.0
> Reporter: Henri Biestro
> Assignee: Henri Biestro
> Priority: Major
> Labels: pull-request-available
> Fix For: 4.3.0
>
>
> Enforce read/list authorization for Iceberg REST catalog operations, closing
> gaps left after HIVE-29035 reduced HMSCachingCatalog to a pure cache.
> • loadTable: the QUERY read check lives in HMSCachingCatalog and runs only on
> cache hits (which bypass HMS); cache misses reload through HMS and are
> authorized by ReadTableEvent, so a cold load is authorized once. The cache is
> authz-aware.
> • loadView: no explicit check — views are never cached, so loadView always
> reaches HMS, which authorizes it.
> • listTables/listViews/listNamespaces: result filtering via
> HiveAuthorizer.filterListCmdObjects; a denied user gets an empty list. HMS
> has no pre-event auth for get_tables/get_databases, so this closes a standing
> gap.
> • Writes remain authorized by the HiveMetaStoreAuthorizer pre-event listener.
> Because read authorization runs on every cache hit, the per-thread authorizer
> building blocks (cloned HiveConf, reflective factory/authenticator lookups)
> are memoized in a ThreadLocal; identity-sensitive steps still run per call to
> bind the current request's user on pooled threads.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
