nevzheng opened a new issue, #14267:
URL: https://github.com/apache/gravitino/issues/14267
### Version
main branch
### Describe what's wrong
`SchemaEntityCleaner#deleteOrphanedSchemaEntities` cascade-deletes the
outermost ancestor schema that no
longer exists in the catalog (`store.delete(outermostOrphan, SCHEMA,
true)`). It does not call the
authorization plugins or the name-id change notification, unlike a user's
schema drop
(`SchemaHookDispatcher#dropSchema`, which calls
`AuthorizationUtils.authorizationPluginRemovePrivileges`).
It runs after schema drops (`SchemaOperationDispatcher`), table and view
drops
(`OrphanedSchemaCleanup`) and the Iceberg REST namespace, table and view
drops
(`IcebergOrphanSchemaCleanup`). The user's drop removes plugin privileges
for the dropped object only.
This matters for hierarchical (Iceberg) schemas. Creating `A:B` when `A`
does not exist creates `A` too
and makes the caller owner of both. With catalogs where a parent namespace
exists only through its
children (for example the Iceberg JDBC catalog), dropping `A:B` makes `A`
disappear from the catalog, and
the cleaner then deletes `A` from Gravitino. The plugin (for example Ranger)
keeps the privileges and
owner policies for `A`, and a schema created later under the name `A` picks
them up.
### Error message and/or stacktrace
None. The drop returns success.
### How to reproduce
1. Enable authorization. Serve an Iceberg catalog with a JDBC backend and
`authorization-provider=ranger` through the Iceberg REST server.
2. As user `u1`, create namespace `["A","B"]` while `A` does not exist.
Ranger now has owner policy items
for `A` with `u1`.
3. As `u1`, drop namespace `A.B`. Gravitino also deletes schema `A`.
4. Reload the Ranger policies.
Expected: the policy items for `A` are gone, as after dropping schema `A`
directly.
Actual: the policy items for `A` are unchanged. If user `u2` later creates
`["A","C"]`, both `u1` and
`u2` hold owner access on `A` in Ranger.
### Additional context
Proposed fix: read the schema locations before the delete and, when the
delete returns true, call
`AuthorizationUtils.authorizationPluginRemovePrivileges(outermostOrphan,
SCHEMA, locations)`. A schema
that still exists keeps its privileges.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
