Re: [PR] Core: include missing privilege and target entity in PolarisAuthorizer 403 messages [polaris]

["iprithv (via GitHub)" <gi...@apache.org>]

iprithv commented on code in PR #4406:
URL: https://github.com/apache/polaris/pull/4406#discussion_r3534981584


##########
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java:
##########
@@ -902,13 +903,18 @@ public void authorizeOrThrow(
           .atDebug()
           .addKeyValue("principalName", polarisPrincipal.getName())
           .log("Root principal allowed to reset credentials");
-    } else if (!isAuthorized(polarisPrincipal, activatedEntities, authzOp, targets, secondaries)) {
-      throw new ForbiddenException(
-          "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s",
-          polarisPrincipal.getName(),
-          polarisPrincipal.getRoles(),
-          activatedEntities.stream().map(PolarisEntityCore::getName).collect(Collectors.toSet()),
-          authzOp);
+    } else {
+      List<MissingPrivilege> missing =
+          findMissingPrivileges(polarisPrincipal, activatedEntities, authzOp, targets, secondaries);
+      if (!missing.isEmpty()) {
+        throw new ForbiddenException(
+            "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s; missing %s",

Review Comment:
   ah ok, I get it about not exposing authZ details to clients. updated. thanks!



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org