nevzheng opened a new issue, #14265:
URL: https://github.com/apache/gravitino/issues/14265
### Version
main branch
### Describe what's wrong
`CatalogHookDispatcher#dropCatalog` calls
`AuthorizationUtils.removeCatalogPrivileges` before it calls
`CatalogManager#dropCatalog`. The manager can still refuse the drop:
- `CatalogInUseException` when the catalog is enabled and `force` is false.
Catalogs are enabled by
default, so this is the usual result of a first plain drop.
- `NonEmptyCatalogException` when the catalog still has schemas.
When the drop is refused, Gravitino keeps the catalog, its roles and its
grants, but the privileges
already pushed to the catalog's authorization plugin (for example Ranger
`HadoopSQL`) have been removed.
Engines that enforce through the plugin then deny access that Gravitino
still shows as granted, and
nothing pushes the privileges again. Only a revoke and re-grant restores
them.
The plugin call sits before the drop on purpose, because closing the dropped
catalog closes its plugin.
But that ordering also runs it when the drop does not happen.
### Error message and/or stacktrace
The client gets the normal refusal, for example
`Catalog m.c is in use, please disable it first or use force option`. No log
line mentions the
privilege removal.
### How to reproduce
1. Enable authorization and create a Hive catalog `c` in metalake `m` with
`authorization-provider=ranger` and a Ranger `HadoopSQL` service.
2. Grant a role with `USE_CATALOG` and `CREATE_SCHEMA` on `c` to a user, and
check the policy items in
Ranger.
3. `DELETE /api/metalakes/m/catalogs/c` without `force`. It is refused with
`CatalogInUseException`.
4. Reload the Ranger policies.
Expected: nothing changed, in Gravitino or in Ranger.
Actual: the catalog and role are unchanged in Gravitino, but the policy
items for `c` are gone from
Ranger. The same happens for a disabled catalog that still has schemas
(`NonEmptyCatalogException`).
### Additional context
Proposed fix: remove the plugin privileges only after the drop has
succeeded, while the dropped catalog
(and its plugin) is still open. One way is a callback that
`CatalogManager#dropCatalog` runs after the
entity is deleted and before the catalog is closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
