You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "adutra (via GitHub)" <gi...@apache.org> on 2025/01/16 15:11:37 UTC
[PR] Throw NotAuthorizedException when realm is unknown [polaris]
adutra opened a new pull request, #805:
URL: https://github.com/apache/polaris/pull/805
Throwing IllegalArgumentException, as before, translates into HTTP 500, which is not great.
<!--
Possible security vulnerabilities: STOP here and contact security@apache.org instead!
Please update the title of the PR with a meaningful message - do not leave it "empty" or "generated"
Please update this summary field:
The summary should cover these topics, if applicable:
* the motivation for the change
* a description of the status quo, for example the current behavior
* the desired behavior
* etc
PR checklist:
- Do a self-review of your code before opening a pull request
- Make sure that there's good test coverage for the changes included in this PR
- Run tests locally before pushing a PR (./gradlew check)
- Code should have comments where applicable. Particularly hard-to-understand
areas deserve good in-line documentation.
- Include changes and enhancements to the documentation (in site/content/in-dev/unreleased)
- For Work In Progress Pull Requests, please use the Draft PR feature.
Make sure to add the information BELOW this comment.
Everything in this comment will NOT be added to the PR description.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throw NotAuthorizedException when realm is unknown [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #805:
URL: https://github.com/apache/polaris/pull/805#discussion_r1918739846
##########
service/common/src/main/java/org/apache/polaris/service/context/DefaultRealmIdResolver.java:
##########
@@ -44,7 +45,7 @@ public RealmId resolveRealmContext(
if (headers.containsKey(configuration.headerName())) {
realm = headers.get(configuration.headerName());
if (!configuration.realms().contains(realm)) {
- throw new IllegalArgumentException("Unknown realm: " + realm);
Review Comment:
nit: I'd think `IllegalArgumentException` should translate to 400?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throw NotAuthorizedException when realm is unknown [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on code in PR #805:
URL: https://github.com/apache/polaris/pull/805#discussion_r1918813998
##########
service/common/src/main/java/org/apache/polaris/service/context/DefaultRealmIdResolver.java:
##########
@@ -44,7 +45,7 @@ public RealmId resolveRealmContext(
if (headers.containsKey(configuration.headerName())) {
realm = headers.get(configuration.headerName());
if (!configuration.realms().contains(realm)) {
- throw new IllegalArgumentException("Unknown realm: " + realm);
Review Comment:
Hmm indeed the problem is trickier than I thought. Even `NotAuthorized` yields 500:
```
curl -X POST -H "Polaris-Realm: realm1" http://localhost:8181/api/catalog/v1/oauth/tokens \
-d "grant_type=client_credentials" \
-d "client_id=root" \
-d "client_secret=secret" \
-d "scope=PRINCIPAL_ROLE:ALL"
500 - Internal Server Error
---------------------------
Details:
Error id dea0ee2a-ee5c-4988-9ea6-aa224e1d36cc-1, org.apache.iceberg.exceptions.NotAuthorizedException: Unknown realm: realm1
Stack:
org.apache.iceberg.exceptions.NotAuthorizedException: Unknown realm: realm1
at org.apache.polaris.service.context.DefaultRealmIdResolver.resolveRealmContext(DefaultRealmIdResolver.java:48)
at org.apache.polaris.service.context.DefaultRealmIdResolver_ClientProxy.resolveRealmContext(Unknown Source)
at org.apache.polaris.service.quarkus.config.QuarkusProducers.realmId(QuarkusProducers.java:104)
```
This is because the error is thrown inside Arc... not sure how to fix this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throw NotAuthorizedException when realm is unknown [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #805:
URL: https://github.com/apache/polaris/pull/805#discussion_r1918820768
##########
service/common/src/main/java/org/apache/polaris/service/context/DefaultRealmIdResolver.java:
##########
@@ -44,7 +45,7 @@ public RealmId resolveRealmContext(
if (headers.containsKey(configuration.headerName())) {
realm = headers.get(configuration.headerName());
if (!configuration.realms().contains(realm)) {
- throw new IllegalArgumentException("Unknown realm: " + realm);
Review Comment:
From my POV, (as discussed in https://github.com/apache/polaris/pull/704#discussion_r1917476530) having the realm resolved during request authentication might be more robust and straight-forward.
To be clear, I mean using a custom Quarkus Authentication Mechanism.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throw NotAuthorizedException when realm is unknown [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on PR #805:
URL: https://github.com/apache/polaris/pull/805#issuecomment-2601841194
Closing in favor of a broader fix for #819
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throw NotAuthorizedException when realm is unknown [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on PR #805:
URL: https://github.com/apache/polaris/pull/805#issuecomment-2596162617
Putting this back to draft as the issue is not as easy to fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Throw NotAuthorizedException when realm is unknown [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra closed pull request #805: Throw NotAuthorizedException when realm is unknown
URL: https://github.com/apache/polaris/pull/805
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org