You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@polaris.apache.org by yz...@apache.org on 2026/04/02 22:43:10 UTC
(polaris) branch yzou-generic-table-credential-vending updated (f859b8c38e -> 729b2db860)
This is an automated email from the ASF dual-hosted git repository.
yzou pushed a change to branch yzou-generic-table-credential-vending
in repository https://gitbox.apache.org/repos/asf/polaris.git
discard f859b8c38e add tests
add 77dc7fb585 fix(deps): update dependency org.apache.logging.log4j:log4j-core to v2.25.4 (#4074)
add 944daf39ec fix(deps): update dependency com.puppycrawl.tools:checkstyle to v13.4.0 (#4079)
add 3c9d38e25a chore(deps): update amazon/aws-cli docker tag to v2.34.19 (#4080)
add 552952bbb5 fix(deps): update dependency software.amazon.awssdk:bom to v2.42.23 (#4081)
add 03ba9f6fc1 NoSQL: improve test coverage on index-value-serializers (#4072)
add b650003a93 chore(deps): update docker.io/openpolicyagent/opa docker tag to v1.15.1 (#4083)
add ee31ce527c Core: Refactor rbac operation semantics helpers (#4066)
add 1023d76cb8 Keep CLI doctype consistent and fix cli doc (#4077)
add 971c1b8fa2 Add blog for polaris cli setup command (#4082)
add dddb3ec593 NoSQL: Change to detect a theoretically possible recursive call, which must not happen at all. (#4070)
add 206e581816 chore(deps): update dependency mypy to >=1.20, <=1.20.0 (#4098)
add 6ee53bca20 CLI: Add BSD-2-Clause to license allow list (#4100)
add 044eee3ed4 chore(deps): update docker.io/jaegertracing/jaeger docker tag to v2.17.0 (#4102)
add b313ba1dbd Unify equals/hashCode for Index.Element (#4056)
add ab470869e2 NoSQL: Optimize index-impl scratch-buffer reuse (#4071)
add 2acf472b78 Fix Helm Script for non-main branches (#4089)
add aa434fe511 Add doc for setup command under getting started (#4087)
add 3e80dd54ad Ext: Remove the incorrect comment (#4109)
add 52e4c56af2 fix(verify-release): fix bash pipe FD leak causing deadlock on maven checksum verification (#4024)
add 54793ee66c Helm: Add support for polaris.realm-context.require-header option (#4105)
add 4f74a20ada chore(deps): update docker.io/prom/prometheus docker tag to v3.11.0 (#4111)
add ab61cef978 Core: Use record for connection credentials (#4103)
add 8ae5bd8310 Update quay.io/keycloak/keycloak Docker tag to v26.5.7 (#4113)
new 729b2db860 add tests
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (f859b8c38e)
\
N -- N -- N refs/heads/yzou-generic-table-credential-vending (729b2db860)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/ci.yml | 6 +-
.../apache_polaris/cli/command/namespaces.py | 3 +-
.../python/apache_polaris/cli/command/policies.py | 9 +-
.../apache_polaris/cli/command/privileges.py | 6 +-
client/python/apache_polaris/cli/command/setup.py | 10 +
client/python/pyproject.toml | 4 +-
client/python/uv.lock | 158 +++--
.../extension/auth/opa/test/Dockerfile-opa-version | 2 +-
extensions/federation/hive/build.gradle.kts | 1 -
gradle/libs.versions.toml | 4 +-
helm/polaris/templates/configmap.yaml | 1 +
helm/polaris/tests/configmap_test.yaml | 3 +-
helm/polaris/values.schema.json | 4 +
helm/polaris/values.yaml | 5 +
persistence/nosql/persistence/api/build.gradle.kts | 2 +
.../polaris/persistence/nosql/api/index/Index.java | 2 +-
.../persistence/nosql/api/index/IndexElem.java | 53 +-
.../persistence/nosql/api/index/TestIndexElem.java | 72 ++
.../nosql/impl/indexes/AbstractIndexElement.java | 32 +-
.../persistence/nosql/impl/indexes/IndexImpl.java | 222 +++---
.../nosql/impl/indexes/InternalIndexElement.java | 9 -
.../persistence/nosql/impl/indexes/SupplyOnce.java | 6 +-
.../nosql/impl/indexes/TestIndexImpl.java | 266 +++++++-
.../nosql/coretypes/catalog/TestEntityIdSet.java | 20 +
.../nosql/coretypes/changes/TestChanges.java | 14 +
.../nosql/coretypes/realm/TestPolicyMapping.java | 14 +
plugins/spark/v3.5/integration/build.gradle.kts | 2 +-
.../polaris/core/auth/RbacOperationSemantics.java | 741 +++++++++------------
.../connection/ConnectionCredentials.java | 53 +-
.../DefaultPolarisCredentialManager.java | 2 +-
.../BearerConnectionCredentialVendor.java | 11 +-
.../ImplicitConnectionCredentialVendor.java | 6 +-
.../connection/OAuthClientCredentialVendor.java | 11 +-
.../SigV4ConnectionCredentialVendor.java | 16 +-
.../DefaultPolarisCredentialManagerTest.java | 19 +-
.../commons/keycloak/Dockerfile-keycloak-version | 2 +-
.../blog/2026/03/29/polaris-cli-setup-command.md | 108 +++
site/content/guides/ceph/docker-compose.yml | 2 +-
site/content/guides/keycloak/docker-compose.yml | 2 +-
site/content/guides/quickstart/docker-compose.yml | 2 +-
site/content/guides/rustfs/docker-compose.yml | 2 +-
site/content/guides/telemetry/docker-compose.yml | 4 +-
.../in-dev/unreleased/command-line-interface.md | 8 +-
.../in-dev/unreleased/getting-started/_index.md | 2 +
.../getting-started/binary-distribution.md | 2 +-
.../getting-started/install-dependencies.md | 2 +-
.../unreleased/getting-started/setup-tools.md | 101 +++
.../in-dev/unreleased/helm-chart/reference.md | 1 +
tools/verify-release/verify-release.sh | 17 +-
49 files changed, 1270 insertions(+), 774 deletions(-)
create mode 100644 persistence/nosql/persistence/api/src/test/java/org/apache/polaris/persistence/nosql/api/index/TestIndexElem.java
create mode 100644 site/content/blog/2026/03/29/polaris-cli-setup-command.md
create mode 100644 site/content/in-dev/unreleased/getting-started/setup-tools.md
(polaris) 01/01: add tests
Posted by yz...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
yzou pushed a commit to branch yzou-generic-table-credential-vending
in repository https://gitbox.apache.org/repos/asf/polaris.git
commit 729b2db8606696631e15118f879a1aca01461d75
Author: Yun Zou <yu...@gmail.com>
AuthorDate: Mon Mar 23 15:34:27 2026 -0700
add tests
---
.../polaris/core/config/FeatureConfiguration.java | 11 +++
.../service/catalog/common/CatalogHandler.java | 40 +++++++++
.../service/catalog/common/CatalogUtils.java | 20 ++++-
.../generic/GenericTableCatalogHandler.java | 94 +++++++++++++++++++++-
.../generic/GenericTableCatalogHandlerFactory.java | 3 +
.../catalog/iceberg/IcebergCatalogHandler.java | 33 +-------
6 files changed, 165 insertions(+), 36 deletions(-)
diff --git a/polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java b/polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java
index 973d5b8227..f1a661a7ec 100644
--- a/polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java
+++ b/polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java
@@ -321,6 +321,17 @@ public class FeatureConfiguration<T> extends PolarisConfiguration<T> {
.defaultValue(true)
.buildFeatureConfiguration();
+ public static final FeatureConfiguration<Boolean> ENABLE_GENERIC_TABLES_CREDENTIAL_VENDING =
+ PolarisConfiguration.<Boolean>builder()
+ .key("ENABLE_GENERIC_TABLES_CREDENTIAL_VENDING")
+ .catalogConfig("polaris.config.enable.generic-tables.credential-vending")
+ .description(
+ "If set to true, credential vending is enabled for generic tables. "
+ + "When a generic table has a base location, scoped storage credentials "
+ + "will be returned in the load and create responses.")
+ .defaultValue(false)
+ .buildFeatureConfiguration();
+
public static final FeatureConfiguration<Long> ENTITY_CACHE_WEIGHER_TARGET =
PolarisConfiguration.<Long>builder()
.key("ENTITY_CACHE_WEIGHER_TARGET")
diff --git a/runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java b/runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java
index 5605cab033..b1ac58cd83 100644
--- a/runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java
+++ b/runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java
@@ -24,11 +24,14 @@ import static org.apache.polaris.service.catalog.common.ExceptionUtils.notFoundE
import java.util.Arrays;
import java.util.EnumSet;
+import java.util.HashSet;
import java.util.List;
import java.util.Optional;
+import java.util.Set;
import org.apache.iceberg.catalog.Namespace;
import org.apache.iceberg.catalog.TableIdentifier;
import org.apache.iceberg.exceptions.AlreadyExistsException;
+import org.apache.iceberg.exceptions.ForbiddenException;
import org.apache.polaris.core.auth.PolarisAuthorizableOperation;
import org.apache.polaris.core.auth.PolarisAuthorizer;
import org.apache.polaris.core.auth.PolarisPrincipal;
@@ -45,6 +48,7 @@ import org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory;
import org.apache.polaris.core.persistence.resolver.ResolvedPathKey;
import org.apache.polaris.core.persistence.resolver.ResolverPath;
import org.apache.polaris.core.persistence.resolver.ResolverStatus;
+import org.apache.polaris.core.storage.PolarisStorageActions;
import org.apache.polaris.service.types.PolicyIdentifier;
import org.immutables.value.Value;
@@ -263,6 +267,42 @@ public abstract class CatalogHandler {
initializeCatalog();
}
+ /**
+ * Authorizes a load-table-like operation with optional credential vending delegation. When
+ * credential vending is requested, this method attempts write delegation authorization first,
+ * falling back to read delegation. The returned set of storage actions reflects the granted
+ * access level.
+ *
+ * @param tableIdentifier the table to authorize access for
+ * @param subType the entity subtype (e.g., ICEBERG_TABLE, GENERIC_TABLE)
+ * @param requestCredentialVending if true, attempt delegation-based authorization with credential
+ * vending; if false, perform a simple LOAD_TABLE authorization
+ * @return the set of storage actions granted; empty if credential vending was not requested
+ */
+ protected Set<PolarisStorageActions> authorizeLoadTableLike(
+ TableIdentifier tableIdentifier,
+ PolarisEntitySubType subType,
+ boolean requestCredentialVending) {
+ if (!requestCredentialVending) {
+ authorizeBasicTableLikeOperationOrThrow(
+ PolarisAuthorizableOperation.LOAD_TABLE, subType, tableIdentifier);
+ return Set.of();
+ }
+
+ Set<PolarisStorageActions> actionsRequested =
+ new HashSet<>(Set.of(PolarisStorageActions.READ, PolarisStorageActions.LIST));
+ try {
+ authorizeBasicTableLikeOperationOrThrow(
+ PolarisAuthorizableOperation.LOAD_TABLE_WITH_WRITE_DELEGATION, subType, tableIdentifier);
+ actionsRequested.add(PolarisStorageActions.WRITE);
+ } catch (ForbiddenException e) {
+ authorizeBasicTableLikeOperationOrThrow(
+ PolarisAuthorizableOperation.LOAD_TABLE_WITH_READ_DELEGATION, subType, tableIdentifier);
+ }
+
+ return actionsRequested;
+ }
+
protected void authorizeCollectionOfTableLikeOperationOrThrow(
PolarisAuthorizableOperation op,
final PolarisEntitySubType subType,
diff --git a/runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogUtils.java b/runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogUtils.java
index 0dcb1ba2b8..3ad077a64f 100644
--- a/runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogUtils.java
+++ b/runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogUtils.java
@@ -50,9 +50,25 @@ public class CatalogUtils {
*/
public static PolarisResolvedPathWrapper findResolvedStorageEntity(
PolarisResolutionManifestCatalogView resolvedEntityView, TableIdentifier tableIdentifier) {
+ return findResolvedStorageEntity(
+ resolvedEntityView, tableIdentifier, PolarisEntitySubType.ICEBERG_TABLE);
+ }
+
+ /**
+ * Find the resolved entity path that may contain storage information for a given table-like
+ * subtype.
+ *
+ * @param resolvedEntityView The resolved entity view containing catalog entities.
+ * @param tableIdentifier The table identifier for which to find storage information.
+ * @param subType The entity subtype to resolve (e.g., ICEBERG_TABLE, GENERIC_TABLE).
+ * @return The resolved path wrapper that may contain storage information.
+ */
+ public static PolarisResolvedPathWrapper findResolvedStorageEntity(
+ PolarisResolutionManifestCatalogView resolvedEntityView,
+ TableIdentifier tableIdentifier,
+ PolarisEntitySubType subType) {
PolarisResolvedPathWrapper resolvedTableEntities =
- resolvedEntityView.getResolvedPath(
- ResolvedPathKey.ofTableLike(tableIdentifier), PolarisEntitySubType.ICEBERG_TABLE);
+ resolvedEntityView.getResolvedPath(ResolvedPathKey.ofTableLike(tableIdentifier), subType);
if (resolvedTableEntities != null) {
return resolvedTableEntities;
}
diff --git a/runtime/service/src/main/java/org/apache/polaris/service/catalog/generic/GenericTableCatalogHandler.java b/runtime/service/src/main/java/org/apache/polaris/service/catalog/generic/GenericTableCatalogHandler.java
index 0acae1d310..fa4f91efaf 100644
--- a/runtime/service/src/main/java/org/apache/polaris/service/catalog/generic/GenericTableCatalogHandler.java
+++ b/runtime/service/src/main/java/org/apache/polaris/service/catalog/generic/GenericTableCatalogHandler.java
@@ -21,7 +21,10 @@ package org.apache.polaris.service.catalog.generic;
import io.smallrye.common.annotation.Identifier;
import jakarta.enterprise.inject.Instance;
import java.util.LinkedHashSet;
+import java.util.List;
import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
import org.apache.iceberg.catalog.Namespace;
import org.apache.iceberg.catalog.TableIdentifier;
import org.apache.polaris.core.auth.PolarisAuthorizableOperation;
@@ -34,8 +37,13 @@ import org.apache.polaris.core.credentials.PolarisCredentialManager;
import org.apache.polaris.core.entity.CatalogEntity;
import org.apache.polaris.core.entity.PolarisEntitySubType;
import org.apache.polaris.core.entity.table.GenericTableEntity;
+import org.apache.polaris.core.persistence.PolarisResolvedPathWrapper;
+import org.apache.polaris.core.storage.PolarisStorageActions;
+import org.apache.polaris.core.storage.StorageAccessConfig;
import org.apache.polaris.immutables.PolarisImmutable;
import org.apache.polaris.service.catalog.common.CatalogHandler;
+import org.apache.polaris.service.catalog.common.CatalogUtils;
+import org.apache.polaris.service.catalog.io.StorageAccessConfigProvider;
import org.apache.polaris.service.types.GenericTable;
import org.apache.polaris.service.types.ListGenericTablesResponse;
import org.apache.polaris.service.types.LoadGenericTableResponse;
@@ -51,6 +59,8 @@ public abstract class GenericTableCatalogHandler extends CatalogHandler {
protected abstract Instance<ExternalCatalogFactory> externalCatalogFactories();
+ protected abstract StorageAccessConfigProvider storageAccessConfigProvider();
+
private GenericTableCatalog genericTableCatalog;
@Override
@@ -126,7 +136,21 @@ public abstract class GenericTableCatalogHandler extends CatalogHandler {
.setProperties(createdEntity.getPropertiesAsMap())
.build();
- return LoadGenericTableResponse.builder().setTable(createdTable).build();
+ List<org.apache.polaris.service.types.StorageAccessConfig> storageAccessConfigs =
+ isCredentialVendingEnabled()
+ ? vendCredentials(
+ identifier,
+ createdEntity,
+ Set.of(
+ PolarisStorageActions.READ,
+ PolarisStorageActions.WRITE,
+ PolarisStorageActions.LIST))
+ : List.of();
+
+ return LoadGenericTableResponse.builder()
+ .setTable(createdTable)
+ .setStorageAccessConfigs(storageAccessConfigs)
+ .build();
}
public boolean dropGenericTable(TableIdentifier identifier) {
@@ -137,8 +161,12 @@ public abstract class GenericTableCatalogHandler extends CatalogHandler {
}
public LoadGenericTableResponse loadGenericTable(TableIdentifier identifier) {
- PolarisAuthorizableOperation op = PolarisAuthorizableOperation.LOAD_TABLE;
- authorizeBasicTableLikeOperationOrThrow(op, PolarisEntitySubType.GENERIC_TABLE, identifier);
+ ensureResolutionManifestForTable(identifier);
+ boolean credentialVendingEnabled = isCredentialVendingEnabled();
+
+ Set<PolarisStorageActions> actionsRequested =
+ authorizeLoadTableLike(
+ identifier, PolarisEntitySubType.GENERIC_TABLE, credentialVendingEnabled);
GenericTableEntity loadedEntity = this.genericTableCatalog.loadGenericTable(identifier);
GenericTable loadedTable =
@@ -150,6 +178,64 @@ public abstract class GenericTableCatalogHandler extends CatalogHandler {
.setProperties(loadedEntity.getPropertiesAsMap())
.build();
- return LoadGenericTableResponse.builder().setTable(loadedTable).build();
+ List<org.apache.polaris.service.types.StorageAccessConfig> storageAccessConfigs =
+ credentialVendingEnabled
+ ? vendCredentials(identifier, loadedEntity, actionsRequested)
+ : List.of();
+
+ return LoadGenericTableResponse.builder()
+ .setTable(loadedTable)
+ .setStorageAccessConfigs(storageAccessConfigs)
+ .build();
+ }
+
+ private boolean isCredentialVendingEnabled() {
+ return realmConfig()
+ .getConfig(
+ FeatureConfiguration.ENABLE_GENERIC_TABLES_CREDENTIAL_VENDING,
+ resolutionManifest.getResolvedCatalogEntity());
+ }
+
+ private List<org.apache.polaris.service.types.StorageAccessConfig> vendCredentials(
+ TableIdentifier tableIdentifier,
+ GenericTableEntity entity,
+ Set<PolarisStorageActions> actions) {
+ String baseLocation = entity.getBaseLocation();
+ if (baseLocation == null || baseLocation.isEmpty()) {
+ LOGGER.debug(
+ "No base location set for generic table {}, skipping credential vending",
+ tableIdentifier);
+ return List.of();
+ }
+
+ PolarisResolvedPathWrapper resolvedStoragePath =
+ CatalogUtils.findResolvedStorageEntity(
+ resolutionManifest, tableIdentifier, PolarisEntitySubType.GENERIC_TABLE);
+ if (resolvedStoragePath == null) {
+ LOGGER.debug(
+ "Unable to find storage configuration information for generic table {}", tableIdentifier);
+ return List.of();
+ }
+
+ Set<String> tableLocations = Set.of(baseLocation);
+ StorageAccessConfig storageAccessConfig =
+ storageAccessConfigProvider()
+ .getStorageAccessConfig(
+ tableIdentifier, tableLocations, actions, Optional.empty(), resolvedStoragePath);
+
+ Map<String, String> credentials = storageAccessConfig.credentials();
+ if (credentials.isEmpty()) {
+ LOGGER.debug("No credentials vended for generic table {}", tableIdentifier);
+ return List.of();
+ }
+
+ Map<String, String> allConfig = new java.util.HashMap<>(credentials);
+ allConfig.putAll(storageAccessConfig.extraProperties());
+
+ return List.of(
+ org.apache.polaris.service.types.StorageAccessConfig.builder()
+ .setPrefix(baseLocation)
+ .setConfig(allConfig)
+ .build());
}
}
diff --git a/runtime/service/src/main/java/org/apache/polaris/service/catalog/generic/GenericTableCatalogHandlerFactory.java b/runtime/service/src/main/java/org/apache/polaris/service/catalog/generic/GenericTableCatalogHandlerFactory.java
index d0f42ca552..bcd77727b4 100644
--- a/runtime/service/src/main/java/org/apache/polaris/service/catalog/generic/GenericTableCatalogHandlerFactory.java
+++ b/runtime/service/src/main/java/org/apache/polaris/service/catalog/generic/GenericTableCatalogHandlerFactory.java
@@ -29,6 +29,7 @@ import org.apache.polaris.core.context.CallContext;
import org.apache.polaris.core.credentials.PolarisCredentialManager;
import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
import org.apache.polaris.core.persistence.resolver.ResolutionManifestFactory;
+import org.apache.polaris.service.catalog.io.StorageAccessConfigProvider;
@RequestScoped
public class GenericTableCatalogHandlerFactory {
@@ -39,6 +40,7 @@ public class GenericTableCatalogHandlerFactory {
@Inject PolarisAuthorizer authorizer;
@Inject PolarisCredentialManager credentialManager;
@Inject @Any Instance<ExternalCatalogFactory> externalCatalogFactories;
+ @Inject StorageAccessConfigProvider storageAccessConfigProvider;
public GenericTableCatalogHandler createHandler(String catalogName, PolarisPrincipal principal) {
return ImmutableGenericTableCatalogHandler.builder()
@@ -50,6 +52,7 @@ public class GenericTableCatalogHandlerFactory {
.authorizer(authorizer)
.credentialManager(credentialManager)
.externalCatalogFactories(externalCatalogFactories)
+ .storageAccessConfigProvider(storageAccessConfigProvider)
.build();
}
}
diff --git a/runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandler.java b/runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandler.java
index 3b378c7d04..e21da8fcb1 100644
--- a/runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandler.java
+++ b/runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandler.java
@@ -40,7 +40,6 @@ import java.time.ZoneOffset;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.EnumSet;
-import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
@@ -742,36 +741,10 @@ public abstract class IcebergCatalogHandler extends CatalogHandler implements Au
private Set<PolarisStorageActions> authorizeLoadTable(
TableIdentifier tableIdentifier, EnumSet<AccessDelegationMode> delegationModes) {
- if (delegationModes.isEmpty()) {
- authorizeBasicTableLikeOperationOrThrow(
- PolarisAuthorizableOperation.LOAD_TABLE,
- PolarisEntitySubType.ICEBERG_TABLE,
- tableIdentifier);
- return Set.of();
- }
-
- // Here we have a single method that falls through multiple candidate
- // PolarisAuthorizableOperations because instead of identifying the desired operation up-front
- // and
- // failing the authz check if grants aren't found, we find the first most-privileged authz match
- // and respond according to that.
- PolarisAuthorizableOperation read =
- PolarisAuthorizableOperation.LOAD_TABLE_WITH_READ_DELEGATION;
- PolarisAuthorizableOperation write =
- PolarisAuthorizableOperation.LOAD_TABLE_WITH_WRITE_DELEGATION;
-
+ boolean requestCredentialVending = delegationModes.contains(VENDED_CREDENTIALS);
Set<PolarisStorageActions> actionsRequested =
- new HashSet<>(Set.of(PolarisStorageActions.READ, PolarisStorageActions.LIST));
- try {
- // TODO: Refactor to have a boolean-return version of the helpers so we can fallthrough
- // easily.
- authorizeBasicTableLikeOperationOrThrow(
- write, PolarisEntitySubType.ICEBERG_TABLE, tableIdentifier);
- actionsRequested.add(PolarisStorageActions.WRITE);
- } catch (ForbiddenException e) {
- authorizeBasicTableLikeOperationOrThrow(
- read, PolarisEntitySubType.ICEBERG_TABLE, tableIdentifier);
- }
+ authorizeLoadTableLike(
+ tableIdentifier, PolarisEntitySubType.ICEBERG_TABLE, requestCredentialVending);
checkAllowExternalCatalogCredentialVending(delegationModes);