You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "vigneshio (via GitHub)" <gi...@apache.org> on 2026/06/22 16:46:08 UTC
[PR] Fix native catalog credential vending skipping allowedLocations re-validation [polaris]
vigneshio opened a new pull request, #4860:
URL: https://github.com/apache/polaris/pull/4860
## Summary
Native catalog credential vending (the optimized `loadCredentials` path and delegation in `loadTable`) was trusting locations stored in the table entity without re-validating them against the *current* catalog `allowedLocations`.
## Why this is needed
After an admin tightened a catalog's allowed locations, clients could still obtain fresh STS credentials for paths that were no longer allowed. This was a defense-in-depth gap that only affected the native (non-federated) path.
## Changes
- Always perform location validation before vending credentials for native catalogs (removed the `isFederated` guard).
- Added the validation call in the optimized `loadCredentials` path.
- Added a regression test that creates a table, shrinks the catalog's allowed locations, then verifies that `loadCredentials` is rejected..
## Checklist
- [x] Clearly explained why the changes are needed
- [x] Added/updated tests with good coverage
- [x] Updated `CHANGELOG.md` under `[Unreleased] > Fixes`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix native catalog credential vending skipping allowedLocations re-validation [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #4860:
URL: https://github.com/apache/polaris/pull/4860#issuecomment-4793592374
@vigneshio : `CatalogFederationIT` appears to be broken.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix native catalog credential vending skipping allowedLocations re-validation [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b merged PR #4860:
URL: https://github.com/apache/polaris/pull/4860
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix native catalog credential vending skipping allowedLocations re-validation [polaris]
Posted by "vigneshio (via GitHub)" <gi...@apache.org>.
vigneshio commented on PR #4860:
URL: https://github.com/apache/polaris/pull/4860#issuecomment-4794694565
> @vigneshio : `CatalogFederationIT` appears to be broken.
Resolved @dimas-b 👍
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix native catalog credential vending skipping allowedLocations re-validation [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on PR #4860:
URL: https://github.com/apache/polaris/pull/4860#issuecomment-4795008939
@nandorKollar: WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org