nevzheng opened a new issue, #14255:
URL: https://github.com/apache/gravitino/issues/14255
### Version
main branch
### Describe what's wrong
`IcebergTableHookDispatcher#renameTable` and
`IcebergViewHookDispatcher#renameView` rename the
object in the backend and move the Gravitino entity to the new name, but
never call
`AuthorizationUtils.authorizationPluginRenamePrivileges`. The same renames
through the Gravitino REST
API do (`TableHookDispatcher#alterTable`, `ViewHookDispatcher#alterView`).
So the plugin privileges stay on the old name:
- **Users lose access to the renamed table.** With a plugin such as Ranger,
a table-level grant on `t1`
does not follow the table to `t2`, although Gravitino shows the grant on
`t2`.
- **A new object under the old name is covered by the old policies.**
- **The name-id cache is not evicted**, so the old name can resolve to the
renamed object's id until the
change poller catches up.
An Iceberg REST rename can also move the table to another namespace, so the
plugin call needs the full
destination identifier.
### Error message and/or stacktrace
None. The rename returns 204.
### How to reproduce
1. Serve an Iceberg catalog with `authorization-provider=ranger` through the
Iceberg REST server, with
`gravitino.authorization.enable=true`.
2. Grant `SELECT_TABLE` on `s1.t1` (and nothing at schema level) to a role
of user `u1`.
3. `POST /v1/{prefix}/tables/rename` with source `s1.t1` and destination
`s1.t2`.
4. As `u1`, query `s1.t2` through an engine with the Ranger plugin.
Expected: the Ranger policy now names `s1.t2`, and the query succeeds, as
after the same rename through
the Gravitino REST API.
Actual: the policy still names `s1.t1`, and the query is denied.
View renames behave the same way.
### Additional context
Proposed fix: read the source table locations before the backend rename and,
after the rename and the
entity update, call `authorizationPluginRenamePrivileges(source, TABLE,
destination, locations)`, and
`(source, VIEW, destination, null)` for views. A failed rename or entity
update throws before the call.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
