alexandrefimov commented on issue #7454: URL: https://github.com/apache/kyuubi/issues/7454#issuecomment-5250073365
Worth adding a second item to this issue's scope: even with `spark.connect.session.user` propagated, a Connect client can switch the extension off. `Config.Set` in the Connect service writes straight to `RuntimeConfig`, so `spark.sql.optimizer.excludedRules` can be made to name `RuleAuthorization` without a `SetCommand` ever existing, and the check rule that guards that key inspects plans only. Reproduced on Spark 4.0.3 with `RangerSparkExtension` in one Connect session: create denied, the same `SET` through SQL rejected, the same key accepted over the Config RPC, create then allowed. The mitigation Kyuubi documents for the JDBC path — `kyuubi.session.conf.restrict.list` — does not reach that far, since it is enforced in the Kyuubi server's `SessionManager` and a Connect client talks to the engine directly. I filed #7623 for the extension-side fix, which covers this channel as well. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
