You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "randomdev2026 (via GitHub)" <gi...@apache.org> on 2026/04/14 12:49:01 UTC
[I] Docs: OPA decisions from /v1/data/.../allow are interpreted as deny, causing 403 OPA denied authorization [polaris]
randomdev2026 opened a new issue, #4196:
URL: https://github.com/apache/polaris/issues/4196
### Describe the bug
There appears to be a mismatch between the documented OPA configuration (https://polaris.apache.org/in-dev/unreleased/managing-security/external-pdp/opa/) and the response format Polaris actually parses.
When Polaris `1.3.0-incubating` is configured with:
```properties
polaris.authorization.type=opa
polaris.authorization.opa.policy-uri=http://<opa-host>:8181/v1/data/polaris/authz/allow
```
and OPA returns:
```json
{"result": true}
```
Polaris still rejects the request with:
```json
{"error":{"message":"OPA denied authorization","type":"ForbiddenException","code":403}}
```
The issue seems to be that Polaris only accepts a response shaped like:
```json
{"result":{"allow":true}}
```
even though the documented `/allow` endpoint naturally returns a boolean `result`.
### To Reproduce
Sadly it would take some time for me to setup a minimal working setup (docker-compose with minIO, Polaris and OPA) which shows this behavior.
The failing request is:
```http
POST /api/management/v1/catalogs
```
The execution flow is:
1. `PolarisServiceImpl#createCatalog(...)`
2. `PolarisAdminService#createCatalog(...)`
3. `PolarisAdminService#authorizeBasicRootOperationOrThrow(...)`
4. `OpaPolarisAuthorizer#authorizeOrThrow(...)`
The actual exception is thrown in `OpaPolarisAuthorizer#authorizeOrThrow(...)`:
```java
boolean allowed = queryOpa(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
if (!allowed) {
throw new ForbiddenException("OPA denied authorization");
}
```
### Actual Behavior
_No response_
### Expected Behavior
_No response_
### Additional context
https://github.com/apache/polaris/blob/apache-polaris-1.3.0-incubating/extensions/auth/opa/impl/src/main/java/org/apache/polaris/extension/auth/opa/OpaPolarisAuthorizer.java#L216
### System information
- Polaris version: `apache/polaris:1.3.0-incubating`
- OPA version: `openpolicyagent/opa:1.16.0-dev-debug`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Docs: OPA decisions from /v1/data/.../allow are interpreted as deny, causing 403 OPA denied authorization [polaris]
Posted by "sungwy (via GitHub)" <gi...@apache.org>.
sungwy closed issue #4196: Docs: OPA decisions from /v1/data/.../allow are interpreted as deny, causing 403 OPA denied authorization
URL: https://github.com/apache/polaris/issues/4196
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Docs: OPA decisions from /v1/data/.../allow are interpreted as deny, causing 403 OPA denied authorization [polaris]
Posted by "randomdev2026 (via GitHub)" <gi...@apache.org>.
randomdev2026 commented on issue #4196:
URL: https://github.com/apache/polaris/issues/4196#issuecomment-4249589341
Hi @sungwy , thanks for your reply.
I tried to create a PR https://github.com/apache/polaris/pull/4204
There is currently still a problem with the following command, however this seems to be unrelated to the PR: `./gradlew check`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Docs: OPA decisions from /v1/data/.../allow are interpreted as deny, causing 403 OPA denied authorization [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on issue #4196:
URL: https://github.com/apache/polaris/issues/4196#issuecomment-4244554976
@sungwy : WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Docs: OPA decisions from /v1/data/.../allow are interpreted as deny, causing 403 OPA denied authorization [polaris]
Posted by "sungwy (via GitHub)" <gi...@apache.org>.
sungwy commented on issue #4196:
URL: https://github.com/apache/polaris/issues/4196#issuecomment-4244846023
Hi @randomdev2026 - thank you for raising the issue.
I agree that the documentation is a source of confusion. I believe the example configuration should be updated to make use of `polaris.authorization.opa.policy-uri=http://<opa-host>:8181/v1/data/polaris/authz` endpoint instead, which is what our test suite also uses: https://github.com/apache/polaris/blob/6e62d1141b0c2fc0ead1b11a84d0e022f9060e6d/extensions/auth/opa/tests/src/intTest/java/org/apache/polaris/extension/auth/opa/test/OpaTestResource.java#L84
That'll return the policy response shape that you reported:
```
{"result":{"allow":true}}
```
Would you be interested in contributing a PR to fix the documented example?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org