Update `CatalogHandler` and `PolarisAdminServier` to `authorize` using `AuthorizationIntent` by sungwy · Pull Request #5194 · apache/polaris

sungwy · 2026-07-30T13:01:39Z

Update the handler call sites to use the new authorize method using AuthorizationIntent.

This will allow each PolarisAuthorizer implementations to decide which PolarisEntity needs to be resolved for its authorization decision, allowing them to ignore RBAC resolution by choice.

Checklist

🛡️ Don't disclose security issues! (contact security@apache.org)
🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
🧪 Added/updated tests with good coverage, or manually tested (and explained how)
💡 Added comments for complex logic
🧾 Updated CHANGELOG.md (if needed)
📚 Updated documentation in site/content/in-dev/unreleased (if needed)

Copilot

Pull request overview

This draft PR migrates service handlers and authorizer implementations from the legacy authorizeOrThrow(...) APIs to the newer intent-based authorize(AuthorizationState, AuthorizationRequest) SPI, so each PolarisAuthorizer can decide what it needs to resolve for an authorization decision.

Changes:

Updates handler authorization call sites (catalog/admin/policy) to build AuthorizationRequest objects with AuthorizationIntent and use AuthorizationDecision results.
Extends core auth primitives: deprecates legacy authorizeOrThrow overloads and adds AuthorizationDecision.throwIfDenied().
Implements/updates intent-based authorization behavior in extension authorizers (notably Ranger) and adjusts unit tests accordingly.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
runtime/service/src/testFixtures/java/org/apache/polaris/service/TestServices.java	Updates test fixture stubbing for the new `authorize(...)` return type.
runtime/service/src/test/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandlerTest.java	Refactors mocks/assertions to validate intent-based `AuthorizationRequest` calls.
runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAdminServiceTest.java	Updates admin service tests to stub `authorize(...)` decisions.
runtime/service/src/main/java/org/apache/polaris/service/catalog/policy/PolicyCatalogHandler.java	Migrates policy authorization flow to intent-based requests and decisions.
runtime/service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandler.java	Migrates Iceberg catalog authorization paths to the new SPI.
runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java	Centralizes intent-based authorization helpers for common catalog operations.
runtime/service/src/main/java/org/apache/polaris/service/admin/PolarisAdminService.java	Updates admin authorization helpers to use `AuthorizationRequest` + `AuthorizationDecision`.
polaris-core/src/test/java/org/apache/polaris/core/auth/PolarisAuthorizerImplTest.java	Updates core authorizer tests for intent-based flows and updated internals.
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizerImpl.java	Routes intent-based authorization through RBAC logic; deprecates legacy overloads.
polaris-core/src/main/java/org/apache/polaris/core/auth/PolarisAuthorizer.java	Deprecates legacy entry points in favor of intent-based `authorize(...)`.
polaris-core/src/main/java/org/apache/polaris/core/auth/AuthorizationDecision.java	Adds `throwIfDenied()` helper for decision-to-exception conversion.
extensions/auth/ranger/src/test/java/org/apache/polaris/extension/auth/ranger/RangerPolarisAuthorizerTest.java	Adds/updates tests for Ranger intent-based authorization behavior.
extensions/auth/ranger/src/main/java/org/apache/polaris/extension/auth/ranger/RangerPolarisAuthorizer.java	Implements intent-based `authorize(...)` by resolving targets from intents.
extensions/auth/opa/src/test/java/org/apache/polaris/extension/auth/opa/OpaPolarisAuthorizerTest.java	Updates tests to drive OPA authorization through intent-based requests.
extensions/auth/opa/src/main/java/org/apache/polaris/extension/auth/opa/OpaPolarisAuthorizer.java	Deprecates legacy overloads and clarifies legacy path serialization comments.

Suppressed comments (3)

runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java:304

authorizeResolvedRegisterTableOverwriteOrThrow calls authorize() for overwriteRequest/fallbackRequest without ensuring resolveAuthorizationInputs has been invoked for those specific requests. With the intent-based SPI, an authorizer may populate AuthorizationState based on the request, so each request passed to authorize() should be resolved first.

    if (tableTarget != null) {
      authorizer().authorize(authorizationState, overwriteRequest).throwIfDenied();
    } else {

runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java:369

authorizeResolvedBasicTableLikeOperationOrThrow constructs a new AuthorizationRequest for authorize() but never resolves it. This can break authorizer implementations that rely on resolveAuthorizationInputs to populate AuthorizationState based on the request/intents.

    authorizer()
        .authorize(
            authorizationState,
            new AuthorizationRequest(

runtime/service/src/main/java/org/apache/polaris/service/catalog/common/CatalogHandler.java:406

authorizeBasicTableLikeOperationsOrThrow loops over ops and calls authorize() on per-op AuthorizationRequests without resolving them. To keep the resolve/authorize contract intact and avoid redundant per-op calls, build a single AuthorizationRequest with one intent per operation, resolve it once, then authorize once (intents are AND-combined per PolarisAuthorizer contract).

    for (PolarisAuthorizableOperation op : ops) {
      AuthorizationRequest authorizationRequest =
          new AuthorizationRequest(
              polarisPrincipal(),
              List.of(

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

-            op,
-            target,
-            null /* secondary */);
+    authorizer().authorize(authorizationState, authorizationRequest).throwIfDenied();


dimas-b · 2026-08-11T22:14:29Z

@sungwy : Is this still a draft PR (title / description)?

sungwy · 2026-08-12T01:16:01Z

@sungwy : Is this still a draft PR (title / description)?

I toggling the state while trying to figure out how to unblock the CI that seems to be stuck on this PR 😅

But thank you for the early review @dimas-b . This will help move it closer to the finishline

dimas-b · 2026-08-12T02:58:08Z

@sungwy : as for CI, a rebase or simple force push should help

# Conflicts: # polaris-core/src/test/java/org/apache/polaris/core/auth/PolarisAuthorizerImplTest.java # runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAdminServiceTest.java

sungwy · 2026-08-18T15:13:07Z

Thanks for the detailed reviews @dimas-b

@flyrain and @gracechen09 - could I ask for your reviews on this PR?

flyrain · 2026-08-18T16:42:34Z

Thanks for the detailed reviews @dimas-b

@flyrain and @gracechen09 - could I ask for your reviews on this PR?

@sungwy , just back from the vacation. Sorry for the delay. Will take a look soon.

flyrain

+1 Thanks @sungwy !

flyingImer

I'm aligned with moving handlers to the intent-based SPI, but I don't think this is merge-ready. Details inline.

… SPI usage

…-refactor-phase5

dimas-b · 2026-09-03T06:26:29Z

      // Reuse the already-resolved table view for the read-delegation fallback.
      authorizeResolvedBasicTableLikeOperationOrThrow(
-          read, PolarisEntitySubType.ICEBERG_TABLE, tableIdentifier);
+          authorizationState, read, PolarisEntitySubType.ICEBERG_TABLE, tableIdentifier);


We authorize "read" here but the resolution was done on a "write" request. Practically, this is not significant, since only entity references matter for resolution, but it would be nice to make it explicit in the AuthZ SPI.... meaning that resolution should not have the operation itself as a formal parameter.

This is just a point for follow-up thinking / PR. Not a blocker 🙂

yes, that's right and I think unlike the AuthorizationRequest, it's important that we share the AuthorizationState, since we want to read or write on the same resolved PolarisSecurable.

sungwy · 2026-09-07T17:46:26Z

sorry to ask for your approval again @dimas-b - there was a merge conflict on CHANGELOG.md. I'll merge it now once the CI turns green given that this PR has been open for a while with a number of approvals.

dimas-b

LGTM 👍

OPA -> PolarisAuthorizer

flyingImer

No blocking concerns from my side. Good to merge once CI is green.

…splayName tweak (post-merge) Merging upstream/main pulled in apache#5194 (Update CatalogHandler and PolarisAdminServier to authorize using AuthorizationIntent), which removed PolarisAuthorizer.authorizeOrThrow entirely. Migrate MetricsReportsService.resolveAndAuthorizeTableMetrics to build one AuthorizationRequest of SingleTargetAuthorizationIntent(LIST_TABLE_METRICS, ...) per table, call resolveAuthorizationInputs once, do the existing not-found checks against the manifest, then authorize(...).throwIfDenied() once for the whole batch (AND-combined, short-circuits on first deny) -- mirroring CatalogHandler.authorizeBatchTableLikeOperationOrThrow. Update MetricsReportsServiceTest's mocks to the authorize()/AuthorizationDecision style used elsewhere post-migration. Also revert the dev_polaris.json/polaris-ranger-servicedef.json "Polaris (draft)" -> "Apache Polaris" displayName tweak from the prior commit: unrelated to metrics, flagged in review (apache#4115 (comment)). spotlessApply also reflowed the TABLE_READ_METRICS javadoc comment in PolarisPrivilege.java by a couple of characters (newer google-java-format line-wrap width); included since it touches PR1's own new javadoc. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

sungwy · 2026-09-09T14:30:39Z

Awesome. thanks for the reviews @dimas-b @flyingImer and @flyrain

flyrain · 2026-09-09T16:25:47Z

Thanks a lot for the changes, @sungwy !

Resolves the conflict introduced by apache#5194, which removed the three authorizeOrThrow methods from PolarisAuthorizer. Kept this branch's batch authorize(AuthorizationState, List<AuthorizationRequest>) and dropped the removed methods. apache#5194 also required fixes that git auto-merged cleanly but which do not compile, all caused by overload ambiguity between the single-request and batch authorize: - PolarisAuthorizerTest: dropped the two now-obsolete authorizeOrThrow stubs from RecordingAuthorizer, plus three unused imports. - TestServices, PolarisAdminServiceTest, IcebergCatalogHandlerTest, SemanticModelCatalogHandlerAuthzTest, AbstractSemanticModelCatalogHandlerTest: disambiguated Mockito matchers -- any() -> any(AuthorizationRequest.class), and typed the argThat lambdas. apache#5194 did not touch the list methods, so entity-level filtering is unaffected. Verified: all affected modules compile, spotless clean, and IcebergCatalogHandlerAuthzTest (6929) plus IcebergCatalogHandlerTest (20) pass with all 8 filtering tests intact. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…splayName tweak (post-merge) Merging upstream/main pulled in apache#5194 (Update CatalogHandler and PolarisAdminServier to authorize using AuthorizationIntent), which removed PolarisAuthorizer.authorizeOrThrow entirely. Migrate MetricsReportsService.resolveAndAuthorizeTableMetrics to build one AuthorizationRequest of SingleTargetAuthorizationIntent(LIST_TABLE_METRICS, ...) per table, call resolveAuthorizationInputs once, do the existing not-found checks against the manifest, then authorize(...).throwIfDenied() once for the whole batch (AND-combined, short-circuits on first deny) -- mirroring CatalogHandler.authorizeBatchTableLikeOperationOrThrow. Update MetricsReportsServiceTest's mocks to the authorize()/AuthorizationDecision style used elsewhere post-migration. Also revert the dev_polaris.json/polaris-ranger-servicedef.json "Polaris (draft)" -> "Apache Polaris" displayName tweak from the prior commit: unrelated to metrics, flagged in review (apache#4115 (comment)). spotlessApply also reflowed the TABLE_READ_METRICS javadoc comment in PolarisPrivilege.java by a couple of characters (newer google-java-format line-wrap width); included since it touches PR1's own new javadoc.

github-project-automation Bot added this to Basic Kanban Board Jul 30, 2026

github-project-automation Bot moved this to PRs In Progress in Basic Kanban Board Jul 30, 2026

dimas-b mentioned this pull request Aug 6, 2026

Fix /v1/config disclosing catalog properties without CATALOG_READ_PROPERTIES #5246

Open

sungwy marked this pull request as ready for review August 11, 2026 18:28

Copilot AI lite review requested due to automatic review settings August 11, 2026 18:28

Copilot started reviewing on behalf of sungwy August 11, 2026 18:28 View session

Copilot AI reviewed Aug 11, 2026

View reviewed changes

dimas-b previously approved these changes Aug 11, 2026

View reviewed changes

github-project-automation Bot moved this from PRs In Progress to Ready to merge in Basic Kanban Board Aug 11, 2026

sungwy dismissed dimas-b’s stale review via 65889b5 August 13, 2026 14:23

dimas-b reviewed Aug 13, 2026

View reviewed changes

Comment thread ...sions/auth/opa/src/main/java/org/apache/polaris/extension/auth/opa/OpaPolarisAuthorizer.java Outdated

dimas-b previously approved these changes Aug 13, 2026

View reviewed changes

sungwy added 6 commits August 14, 2026 19:14

use new authorize method with AuthorizationIntent

473e4e5

# Conflicts: # polaris-core/src/test/java/org/apache/polaris/core/auth/PolarisAuthorizerImplTest.java # runtime/service/src/test/java/org/apache/polaris/service/admin/PolarisAdminServiceTest.java

implement authorization using AuthorizationIntent

f218b6d

lint

3c6e7cd

lint

ac73f54

adopt feedback

01f4c23

update semantic model tests to use authorize api

81db7f2

sungwy dismissed dimas-b’s stale review via 81db7f2 August 15, 2026 14:58

sungwy force-pushed the auth-refactor-phase-5 branch from 65889b5 to 81db7f2 Compare August 15, 2026 14:58

remove old authorizeOrThrow SPI instead of deprecating

08abdf5

dimas-b previously approved these changes Aug 17, 2026

View reviewed changes

Comment thread .../service/src/main/java/org/apache/polaris/service/catalog/iceberg/IcebergCatalogHandler.java Outdated

flyrain previously approved these changes Aug 18, 2026

View reviewed changes

flyrain mentioned this pull request Aug 19, 2026

Route table-like authorization through authorize(state, request) #5170

Closed

flyingImer reviewed Aug 19, 2026

View reviewed changes

Comment thread ...sions/auth/opa/src/main/java/org/apache/polaris/extension/auth/opa/OpaPolarisAuthorizer.java

Comment thread polaris-core/src/main/java/org/apache/polaris/core/auth/AuthorizationDecision.java

breaking changes to OPA requests

4cb0834

sungwy dismissed flyrain’s stale review via 4cb0834 August 28, 2026 22:52

Merge branch 'main' into auth-refactor-phase-5

03bd1b0

sungwy requested a review from flyrain September 2, 2026 18:45

sungwy added 2 commits September 2, 2026 18:48

adopt nit to enhance legibility of AuthorizationRequest -> Authorizer…

4676fd7

… SPI usage

Merge remote-tracking branch 'origin/auth-refactor-phase-5' into auth…

dba3247

…-refactor-phase5

sungwy requested review from dimas-b and flyingImer September 3, 2026 01:37

dimas-b previously approved these changes Sep 3, 2026

View reviewed changes

sungwy added this to the 1.8.0 milestone Sep 3, 2026

Merge branch 'main' into auth-refactor-phase-5

f952dc4

sungwy dismissed dimas-b’s stale review via f952dc4 September 7, 2026 17:45

sungwy requested a review from dimas-b September 7, 2026 17:45

dimas-b previously approved these changes Sep 8, 2026

View reviewed changes

Revise changelog wording to include generic PolarisAuthorizer

0dad29f

OPA -> PolarisAuthorizer

sungwy dismissed dimas-b’s stale review via 0dad29f September 8, 2026 15:38

dimas-b approved these changes Sep 8, 2026

View reviewed changes

sungwy enabled auto-merge (squash) September 8, 2026 16:09

flyingImer approved these changes Sep 8, 2026

View reviewed changes

sungwy merged commit 0858f79 into apache:main Sep 8, 2026
24 checks passed

github-project-automation Bot moved this from Ready to merge to Done in Basic Kanban Board Sep 8, 2026

sungwy mentioned this pull request Sep 9, 2026

Tracking Issue: Refactor PolarisAuthorizer SPI to skip native Principal and RBAC resolution requirement in Polaris #3779

Closed

This was referenced Sep 9, 2026

Deduplicate intent-to-resolved-path resolution shared by PolarisAuthorizerImpl and RangerPolarisAuthorizer #5485

Closed

Deduplicate intent-to-resolved-path resolution across authorizers #5486

Merged

Conversation

sungwy commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

dimas-b commented Aug 11, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sungwy commented Aug 12, 2026

Uh oh!

dimas-b commented Aug 12, 2026

Uh oh!

Uh oh!

Uh oh!

sungwy commented Aug 18, 2026

Uh oh!

flyrain commented Aug 18, 2026

Uh oh!

flyrain left a comment

Choose a reason for hiding this comment

Uh oh!

flyingImer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

dimas-b Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

sungwy Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sungwy commented Sep 7, 2026

Uh oh!

dimas-b left a comment

Choose a reason for hiding this comment

Uh oh!

flyingImer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sungwy commented Sep 9, 2026

Uh oh!

flyrain commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sungwy commented Jul 30, 2026 •

edited

Loading

sungwy Sep 3, 2026 •

edited

Loading