More readable 403s #396
More readable 403s #396
Conversation
eric-maynard
requested review from
jbonofre,
ashvina,
RussellSpitzer,
snazy,
vvcephei,
takidau,
jackye1995,
flyrain,
collado-mike and
ebyhr
as code owners
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizer.java
Outdated
Show resolved
Hide resolved
| throw new ForbiddenException( | ||
| "Principal '%s' with activated PrincipalRoles '%s' and activated ids '%s' is not authorized for op %s", | ||
| "Principal '%s' with activated PrincipalRoles '%s' and activated grants via '%s' is not authorized for op %s", |
There was a problem hiding this comment.
Minor: Not sure if this is clearer? grants via -> grant on
There was a problem hiding this comment.
I think what this message is trying to say is that you have grants through / via these roles. So you may have a grant on table X through your principal role A and catalog role B but you fail when you try to read table Y. This message will say ...and activated grants via [A, B]
There was a problem hiding this comment.
I guess you also have grants on A and B but they are not privilege grants, they are role grants.
There was a problem hiding this comment.
My bad. I thought they're table/namespace entities.
There was a problem hiding this comment.
Ah no they are roles. But I am still not sure if this verbiage is totally correct, maybe you are right
There was a problem hiding this comment.
The via makes sense to me if they are roles.
Description
Currently, when a request is rejected users see an error like this:
org.apache.iceberg.exceptions.ForbiddenException: Forbidden: Principal 'quickstart_user' with activated PrincipalRoles '[]' and activated ids '[6, 7]' is not authorized for op CREATE_NAMESPACEWith this change, users will see something more like the following:
org.apache.iceberg.exceptions.ForbiddenException: Forbidden: Principal 'quickstart_user' with activated PrincipalRoles '[]' and activated grants via '[quickstart_catalog_role, quickstart_user_role]' is not authorized for op CREATE_NAMESPACE