You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "iprithv (via GitHub)" <gi...@apache.org> on 2026/05/11 21:57:02 UTC
[PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
iprithv opened a new pull request, #4406:
URL: https://github.com/apache/polaris/pull/4406
## Description
`PolarisAuthorizerImpl.authorizeOrThrow` today produces only:
```
Principal 'alice' with activated PrincipalRoles '[reader]' and activated grants via '[]' is not authorized for op CREATE_TABLE_DIRECT
```
the operator has no way to tell *which* privilege is missing or on *which* entity, and routinely has to grep the codebase to figure out which grant to add. The explicit TODO at the old short-circuit in `isAuthorized` ("Collect missing privileges to report all at the end and/or return to code that throws NotAuthorizedException for more useful messages.") calls this out.
This is a **diagnostic improvement, not a behavioural change**, every operation that was authorized before is still authorized, every one denied is still denied. Only the text of the 403 changes.
## What changes
- New `findMissingPrivileges` helper that mirrors the old `isAuthorized` traversal but **collects** failures into `List<MissingPrivilege>` instead of short-circuiting.
- `isAuthorized` is preserved bit-for-bit by delegating to `findMissingPrivileges(...).isEmpty()`.
- `authorizeOrThrow` formats the collected list into the `ForbiddenException` message. The legacy prefix (`Principal 'X' with activated PrincipalRoles 'Y' and activated grants via 'Z' is not authorized for op OP`) is preserved verbatim so log scrapers still match.
- A small nested `MissingPrivilege` record carries side (target / secondary), the privilege, and the `PolarisResolvedPathWrapper` it was checked against. Its `describe()` produces the per-entry fragment and is defensive against a null leaf so the error-formatting path never throws.
After this change:
```
Principal 'alice' with activated PrincipalRoles '[reader]' and activated grants via '[]' is not authorized for op CREATE_TABLE_DIRECT; missing TABLE_CREATE on NAMESPACE 'ns1'
```
Secondary failures are labelled `(secondary)` so operators can tell which side of a `RENAME_TABLE`-style op needs grants. Multiple missing privileges are joined with `, ` in one message.
The new SPI's `AuthorizationDecision.deny(e.getMessage())` in `PolarisAuthorizerImpl.authorize()` inherits the richer text automatically.
## Reproduction / verification
**Baseline (production change reverted on this branch):** the three new public-API tests fail with the original generic message:
```
Expecting throwable message:
"Principal 'alice' with activated PrincipalRoles '[reader]' and activated grants via '[]' is not authorized for op CREATE_TABLE_DIRECT"
to contain:
"missing TABLE_CREATE on NAMESPACE 'ns1'"
but did not.
```
**This branch:** all 5 new test cases plus the existing 110 in `polaris-core` pass.
Local runs (Java 21):
- `./gradlew :polaris-core:check` โ `BUILD SUCCESSFUL`
- `./gradlew :polaris-runtime-service:test --tests "...service.auth.*" --tests "...service.admin.*"` โ `BUILD SUCCESSFUL`
- `./gradlew :polaris-runtime-service:spotlessCheck :checkstyleMain :checkstyleTest` โ `BUILD SUCCESSFUL`
- `./gradlew :polaris-extensions-auth-opa:check :polaris-extensions-auth-ranger:check` โ `BUILD SUCCESSFUL`
## Checklist
- [x] ๐ก๏ธ Don't disclose security issues! (contact security@apache.org)
- [x] ๐ Clearly explained why the changes are needed (addresses the TODO at `findMissingPrivileges`)
- [x] ๐งช Added/updated tests with good coverage
- [x] ๐ก Added comments for complex logic
- [x] ๐งพ Updated `CHANGELOG.md` (under `### Changes`)
- [ ] ๐ Updated documentation in `site/content/in-dev/unreleased` (N/A โ diagnostic-text improvement, no user-facing config or schema)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #4406:
URL: https://github.com/apache/polaris/pull/4406#issuecomment-4686737465
This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #4406: Core: include missing privilege and target entity in PolarisAuthorizer 403 messages
URL: https://github.com/apache/polaris/pull/4406
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3223131584
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -902,13 +903,18 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s; missing %s",
Review Comment:
I do not think exposing authZ details to the client in case of denied responses is a good idea. This information can potentially be used by malicious clients to further attacks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3555877245
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -933,13 +934,23 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ String missingDetails = formatMissingPrivileges(missing);
+ LOGGER.info(
+ "Authorization denied for principal '{}' on operation '{}': missing {}",
+ polarisPrincipal.getName(),
+ authzOp,
+ missingDetails);
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
Review Comment:
This approach looks reasonable to me. I think we can merge "as is".
However, as I commented earlier, as more admin-friendly approach might be to add a UUID to this message and also log it on line 942. Whoever needs to investigate the authZ denial, can use the UUID to find related log messages easily (hopefully).
##########
gradle/server-test-runner/.gradle/9.6.1/executionHistory/executionHistory.bin:
##########
Review Comment:
This file looks odd in current PR ๐ค Would you mind re-applying the functional commits to `main` from scratch?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3555933339
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -933,13 +934,23 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ String missingDetails = formatMissingPrivileges(missing);
+ LOGGER.info(
+ "Authorization denied for principal '{}' on operation '{}': missing {}",
+ polarisPrincipal.getName(),
+ authzOp,
+ missingDetails);
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
Review Comment:
... or use request ID as @sungwy suggested: https://lists.apache.org/thread/0l1x090nmxbbrght3jrgdzqdp24fbbsx
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "iprithv (via GitHub)" <gi...@apache.org>.
iprithv commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3556716714
##########
gradle/server-test-runner/.gradle/9.6.1/executionHistory/executionHistory.bin:
##########
Review Comment:
sure, done. thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain merged PR #4406:
URL: https://github.com/apache/polaris/pull/4406
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3230687083
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -902,13 +903,18 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s; missing %s",
Review Comment:
Agreed with @dimas-b. Deny responses should just tell the caller that they're denied, not the shape of the wall they're hitting. Instead, logging the missing privileges should be good.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "iprithv (via GitHub)" <gi...@apache.org>.
iprithv commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3556636179
##########
gradle/server-test-runner/.gradle/9.6.1/executionHistory/executionHistory.bin:
##########
Review Comment:
Good catch โ those were accidental `gradle/server-test-runner/.gradle` cache artifacts that should never have been committed (they're gitignored).
Re-applied the functional changes onto current `main` from scratch in a single clean commit (`review changes`). The PR now only touches:
- `PolarisAuthorizerImpl.java`
- `PolarisAuthorizerImplTest.java`
- `CHANGELOG.md` (under Unreleased)
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -933,13 +934,23 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ String missingDetails = formatMissingPrivileges(missing);
+ LOGGER.info(
+ "Authorization denied for principal '{}' on operation '{}': missing {}",
+ polarisPrincipal.getName(),
+ authzOp,
+ missingDetails);
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
Review Comment:
Thanks โ going with the existing request-ID correlation path for this PR (as suggested by @sungwy on the ML).
Default logging already includes `%X{requestId}` via MDC (`LoggingMDCFilter` + `RequestIdFilter`), and the client already receives `X-Request-ID`. Operators can match a client-side 403 to the server-side INFO log that lists the missing privileges without putting authZ details (or a second synthetic UUID) into the response body.
Leaving the client message generic as-is; happy to follow up later if we want the request ID duplicated into the `ForbiddenException` text as well.
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -933,13 +934,23 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ String missingDetails = formatMissingPrivileges(missing);
+ LOGGER.info(
+ "Authorization denied for principal '{}' on operation '{}': missing {}",
+ polarisPrincipal.getName(),
+ authzOp,
+ missingDetails);
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
Review Comment:
Agreed โ using the existing request ID / `X-Request-ID` is enough here. Default log format already stamps `requestId` from MDC, so no extra UUID in this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "iprithv (via GitHub)" <gi...@apache.org>.
iprithv commented on PR #4406:
URL: https://github.com/apache/polaris/pull/4406#issuecomment-4932381781
Addressed review feedback:
1. **Unrelated gradle cache files** โ removed by re-applying the functional commits onto current `main` from scratch (single commit: `review changes`). No more `gradle/server-test-runner/.gradle/**` in the PR.
2. **UUID / request ID correlation** โ keeping the generic client 403 and relying on existing `X-Request-ID` + MDC `requestId` (already in the default log format) to correlate with the server-side INFO log of missing privileges. No extra UUID for this PR.
PR file set is now only the authorizer impl, tests, and Unreleased CHANGELOG entry.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "iprithv (via GitHub)" <gi...@apache.org>.
iprithv commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3556730843
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -933,13 +934,23 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ String missingDetails = formatMissingPrivileges(missing);
+ LOGGER.info(
+ "Authorization denied for principal '{}' on operation '{}': missing {}",
+ polarisPrincipal.getName(),
+ authzOp,
+ missingDetails);
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
Review Comment:
ah okay, went with existing request-ID correlation. default logs include MDC requestId.. client gets X-Request-ID...leaving client message generic...thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3555877245
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -933,13 +934,23 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ String missingDetails = formatMissingPrivileges(missing);
+ LOGGER.info(
+ "Authorization denied for principal '{}' on operation '{}': missing {}",
+ polarisPrincipal.getName(),
+ authzOp,
+ missingDetails);
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
Review Comment:
This approach looks reasonable to me. I think we can merge "as is".
However, as I commented earlier, as more admin-friendly approach might be to add a UUID to this message and also log it on line 942. Whoever needs to investigate the authZ denial, can use the UUID to find related log messages easily (hopefully).
I'll leave it up to your @iprithv to choose which way to go for this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]
Posted by "iprithv (via GitHub)" <gi...@apache.org>.
iprithv commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3534981584
##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -902,13 +903,18 @@ public void authorizeOrThrow(
.atDebug()
.addKeyValue("principalName", polarisPrincipal.getName())
.log("Root principal allowed to reset credentials");
- } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
- throw new ForbiddenException(
- "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
- polarisPrincipal.getName(),
- polarisPrincipal.getRoles(),
- activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
- authzOp);
+ } else {
+ List<MissingPrivilege> missing =
+ findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+ if (!missing.isEmpty()) {
+ throw new ForbiddenException(
+ "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s; missing %s",
Review Comment:
ah ok, I get it about not exposing authZ details to clients. updated. thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org