nevzheng opened a new issue, #14270:
URL: https://github.com/apache/gravitino/issues/14270
### Version
main branch
### Describe what's wrong
`CatalogManager#dropCatalog(ident, force=true)` drops each schema of the
catalog through the catalog's
own schema operations. That skips `SchemaHookDispatcher#dropSchema`, which
is the only place that removes
a schema's privileges from the authorization plugin, including the Ranger
HDFS policy on the schema's
path (for Hive, `<warehouse>/<db>.db`).
So after a force drop of a Hive catalog that uses the Ranger HDFS plugin,
the catalog and its schemas
are gone, but the HDFS policies on the schema paths stay. A new schema or
table created on the same path
picks them up. The same applies to a forced metalake drop, which force-drops
its catalogs. #14269 removes
only the policy on the catalog's own warehouse path.
### Error message and/or stacktrace
None. The drop returns `true`.
### How to reproduce
1. Enable authorization. Create a Hive catalog `c` with
`authorization-provider=ranger` and Ranger
service type `HDFS`, and a schema `db` with a privilege granted on it, so
that Ranger has a policy on
`/warehouse/db.db`.
2. `DELETE /api/metalakes/m/catalogs/c?force=true`.
3. Reload the HDFS policies in Ranger.
Expected: the Gravitino-managed items of the policies of `c`'s schemas (and
tables) are removed, or the
drop is refused.
Actual: the `/warehouse/db.db` policy is unchanged.
### Additional context
Possible fixes: before the force drop, remove the plugin privileges of the
catalog's schemas and tables,
refusing the drop when their locations cannot be looked up (as #14269 does
for the catalog); or let the
HDFS plugin's catalog removal also cover paths under the catalog location
that no other catalog uses.
A test with the HDFS plugin's own behaviour and an in-memory Ranger, as in
#14269, would cover it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
