nqvuong1998 opened a new issue, #7742: URL: https://github.com/apache/kyuubi/issues/7742
### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) ### Search before asking - [x] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues. ### Describe the feature Support authorization for multiple Spark catalogs in Kyuubi Spark AuthZ, with each Spark catalog mapped to a different Apache Ranger service. For example: ``` Spark Catalog Ranger Service ------------------------------------ iceberg -> ranger_iceberg paimon -> ranger_paimon hive -> ranger_hive ``` Currently, Kyuubi Spark AuthZ does not provide a clear way to distinguish and authorize resources based on the Spark catalog and route authorization requests to different Ranger services. ### Motivation Spark supports multiple catalogs in the same Spark session, for example: ``` SELECT * FROM iceberg.sales.orders; SELECT * FROM paimon.sales.orders; SELECT * FROM hive.default.customers; ``` In a multi-catalog environment, different catalogs may represent different platforms, table formats, or security domains and may need independent Ranger policies. Using a single Ranger service makes it difficult to isolate and manage authorization policies for each catalog. ### Describe the solution Add support for mapping Spark catalog names to Ranger services. For example: ``` iceberg -> ranger_iceberg paimon -> ranger_paimon hive -> ranger_hive ``` When Kyuubi Spark AuthZ receives an authorization request for: ``` iceberg.sales.orders ``` it should: ``` catalog = iceberg namespace = sales table = orders ↓ Ranger service = ranger_iceberg ↓ Authorize sales.orders using ranger_iceberg ``` Similarly: ``` paimon.sales.orders ↓ Ranger service = ranger_paimon ↓ Authorize sales.orders using ranger_paimon ``` This would allow each Spark catalog to have its own Ranger service and independent authorization policies. ### Additional context This is useful for Spark deployments that use multiple catalogs, such as Iceberg, Paimon, Hive, or other catalogs configured in the same Spark/Kyuubi session. The expected mapping is: ``` Spark Catalog → Ranger Service Namespace → Ranger Database Table → Ranger Table ``` This would allow Kyuubi Spark AuthZ to support multi-catalog authorization without requiring users to combine policies from all catalogs into a single Ranger service. ### Are you willing to submit PR? - [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve. - [x] No. I cannot submit a PR at this time. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
