HIVE-29992: Iceberg REST catalog: HMS-managed owner and view properties by henrib · Pull Request #6936 · apache/hive

henrib · 2026-11-02T17:21:43Z

What changes were proposed in this pull request?

New setting metastore.iceberg.catalog.client-supplied-owner.enabled (default false).
When disabled, the REST catalog records the authenticated caller as owner of new
tables and views. Embedded HiveCatalog keeps its current behaviour
(iceberg.hive.client-supplied-owner.enabled, default true).
hive.metastore.table.owner, Authorized and hive.metastore.view.authorized are
treated as HMS-managed view properties: they are not copied into HMS parameters, and
the REST catalog drops them from view create/update requests.
REST view responses report the owner and Authorized state recorded in HMS for the
returned metadata version.
HiveRESTCatalogClient maps hive.metastore.view.authorized back to the Authorized
view parameter; MetastoreUtil keeps the HMS-recorded owner when converting a view.

Why are the changes needed?

Keeps owner and view authorization state consistent with what HMS records. See HIVE-29992.

Does this PR introduce any user-facing change?

Yes. With the default configuration, the Iceberg REST catalog sets the owner of new
tables and views to the authenticated caller instead of a client-provided value. The
previous behaviour can be restored with
metastore.iceberg.catalog.client-supplied-owner.enabled=true.

How was this patch tested?

New and updated unit tests: TestRESTViewDeferredAuthorization, TestIcebergAuthorizer,
TestIcebergViewSupport, TestHiveHadoopUtil; new itest
TestHiveRESTCatalogClientViewAuthorization.

🤖 Generated with Claude Code

- Add metastore.iceberg.catalog.client-supplied-owner.enabled (default false). When disabled, the REST catalog records the authenticated caller as owner of new tables and views. Embedded HiveCatalog keeps its current behaviour (iceberg.hive.client-supplied-owner.enabled, default true). - Treat hive.metastore.table.owner, Authorized and hive.metastore.view.authorized as HMS-managed view properties: they are not copied into HMS parameters, and the REST catalog drops them from view create and update requests. - REST view responses report the owner and Authorized state recorded in HMS for the returned metadata version, as hive.metastore.table.owner and hive.metastore.view.authorized. - HiveRESTCatalogClient maps hive.metastore.view.authorized back to the Authorized view parameter; MetastoreUtil keeps the HMS-recorded owner when converting a view. - Add tests. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

🟡 Changes recommended

A view-replacement race can pair replacement SQL with stale authorization state, allowing a non-superuser to bypass underlying-table privilege checks.

1 open issue

Bind view SQL and authorization state to the same metadata version · New

What changed in this PR

This PR makes HMS the source of truth for Iceberg REST catalog ownership and view authorization state, while preserving embedded HiveCatalog owner defaults.

Changes:

Adds a default-off setting for client-supplied owners and aligns owner resolution with authorization checks.
Filters HMS-managed view properties from requests and reports recorded owner and authorization state in REST responses.
Updates Hive client conversion and adds unit and integration coverage.

File	Description
standalone-metastore/metastore-rest-catalog/src/test/java/org/apache/iceberg/rest/TestRESTViewDeferredAuthorization.java	Tests REST ownership, reserved properties, and view authorization state.
standalone-metastore/metastore-rest-catalog/src/test/java/org/apache/iceberg/rest/TestIcebergAuthorizer.java	Tests stage-create owner authorization.
standalone-metastore/metastore-rest-catalog/src/test/java/org/apache/iceberg/rest/extension/HiveRESTCatalogServerExtension.java	Adds a raw metastore client helper for tests.
standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/IcebergAuthorizer.java	Aligns authorization with configured owner resolution.
standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/HMSCatalogFactory.java	Applies REST owner policy to a copied configuration.
standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/HMSCatalogAdapter.java	Filters reserved properties and adds HMS state to view responses.
standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/rest/HMSCachingCatalog.java	Allows underlying catalog access for uncached view-state reads.
standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/hive/MetadataLocator.java	Adds projected owner and parameter retrieval.
standalone-metastore/metastore-common/src/main/java/org/apache/hadoop/hive/metastore/conf/MetastoreConf.java	Defines the client-supplied-owner setting.
itests/hive-iceberg/src/test/java/org/apache/hive/TestHiveRESTCatalogClientViewAuthorization.java	Tests ownership and authorization propagation into Hive.
iceberg/iceberg-rest-catalog-client/src/main/java/org/apache/iceberg/hive/rest/catalog/client/HiveRESTCatalogClient.java	Maps REST authorization state to the HMS view marker.
iceberg/iceberg-catalog/src/test/java/org/apache/iceberg/hive/TestIcebergViewSupport.java	Tests preservation of the HMS authorization marker.
iceberg/iceberg-catalog/src/test/java/org/apache/iceberg/hive/TestHiveHadoopUtil.java	Tests owner resolution defaults and overrides.
iceberg/iceberg-catalog/src/main/java/org/apache/iceberg/hive/MetastoreUtil.java	Preserves recorded owners during view conversion.
iceberg/iceberg-catalog/src/main/java/org/apache/iceberg/hive/HMSTablePropertyHelper.java	Excludes HMS-managed properties from view parameter updates.
iceberg/iceberg-catalog/src/main/java/org/apache/iceberg/hive/HiveViewOperations.java	Uses shared owner resolution for new views.
iceberg/iceberg-catalog/src/main/java/org/apache/iceberg/hive/HiveTableOperations.java	Uses shared owner resolution for new tables.
iceberg/iceberg-catalog/src/main/java/org/apache/iceberg/hive/HiveHadoopUtil.java	Centralizes configurable owner resolution.
iceberg/iceberg-catalog/src/main/java/org/apache/iceberg/hive/HiveCatalog.java	Defines managed view properties and authorization helpers.

_{Review effort: Balanced}

Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

The projected getTables lookup does not catch UnknownDBException, so a namespace dropped during view loading causes HTTP 500 instead of the intended missing-object fallback.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Handle UnknownDBException when fetching missing catalog state

standalone-metastore/metastore-rest-catalog/src/main/java/org/apache/iceberg/hive/MetadataLocator.java:139

The projected getTables API throws UnknownDBException for a missing database/catalog (GetTableHandler.java:278–281), not NoSuchObjectException. Consequently, if the namespace is dropped between loading the view metadata and fetching its HMS state, this lookup throws a RuntimeException and the REST request returns HTTP 500 instead of using the intended missing-object fallback. Catch UnknownDBException here as well and return null.

1 resolved since last review

Bind view SQL and authorization state to the same metadata version

_{Review effort: Balanced}

Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

🔵 Needs a closer look

Owner and deferred-authorization semantics span REST, HMS, and HiveServer2, but mock-based integration coverage leaves default and opt-in behavior needing validation with the deployment’s real authorization plugin.

No open issues 🎉

_{Review effort: Balanced}

illiabarbashov-sketch · 2026-11-03T16:26:39Z

+  }
+
+  /** Drops the reserved properties from the property updates of a view update; see the creation overload. */
+  private UpdateTableRequest withoutReservedProperties(UpdateTableRequest request) {


These reserved properties related methods as well as the withViewAuthorization method increase the size of the adapter class notably. I'm thinking if they can be moved somewhere. I thought about HMSAuthorizer companion for IcebergAuthorizer might be one way to deal with it. What are your thoughts?

Moved to a new HMSViewProperties class in cb61815: it holds the reserved-property filtering and the view state reported in responses; the adapter only delegates. I kept it separate from IcebergAuthorizer since it doesn't make authorization decisions, it filters and reports HMS-managed properties.

illiabarbashov-sketch · 2026-11-03T16:48:15Z

        sqlText);
+    // Take the Authorized state reported with this view version, the one the SQL above comes from. A reported
+    // state only ever marks the view; it never clears an Authorized=false parameter already set.
+    String authorized = view.properties().get(HiveCatalog.VIEW_AUTHORIZED_PROPERTY);


[nitpick] I don't know if that's better but it could be separated into a single method with boolean flag and could be used also in HiveRESTCatalogClient
like this:

public static void applyReportedViewAuthorization(View view, Table hmsView, boolean, markWhenUnreported) { String authorized = view.properties().get(HiveCatalog.VIEW_AUTHORIZED_PROPERTY); if ((authorized != null || markWhenUnreported) && !"true".equalsIgnoreCase(authorized)) { hmsView.getParameters().put(HiveCatalog.HMS_VIEW_AUTHORIZED, "false"); } }

One advantage is that you can add javadoc in one place instead of two separate comments sections.

Done in cb61815: MetastoreUtil.applyReportedViewAuthorization(view, hmsView, markWhenUnreported), used by both paths with a single javadoc.

…ogAdapter Co-Authored-By: Claude <noreply@anthropic.com>

sonarqubecloud · 2026-11-03T18:49:41Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot AI balanced review requested due to automatic review settings November 2, 2026 17:21

asf-ci-hive added the tests pending label Nov 2, 2026

Copilot started reviewing on behalf of henrib November 2, 2026 17:30

View session

Copilot AI reviewed Nov 2, 2026

View reviewed changes

Comment thread ...-client/src/main/java/org/apache/iceberg/hive/rest/catalog/client/HiveRESTCatalogClient.java Resolved

HIVE-29992: Take view Authorized state from the loaded view version

ef55f33

Co-Authored-By: Claude <noreply@anthropic.com>

henrib requested a balanced review from Copilot November 2, 2026 18:09

Copilot started reviewing on behalf of henrib November 2, 2026 18:20

View session

Copilot AI reviewed Nov 2, 2026

View reviewed changes

HIVE-29992: Treat an unknown database as not found in MetadataLocator

0639672

Co-Authored-By: Claude <noreply@anthropic.com>

henrib requested a balanced review from Copilot November 2, 2026 20:05

Copilot started reviewing on behalf of henrib November 2, 2026 20:05

View session

Copilot AI reviewed Nov 2, 2026

View reviewed changes

asf-ci-hive added tests failed tests pending tests unstable and removed tests pending tests failed labels Nov 2, 2026

illiabarbashov-sketch reviewed Nov 3, 2026

View reviewed changes

HIVE-29992: Move HMS-managed view properties handling out of HMSCatal…

cb61815

…ogAdapter Co-Authored-By: Claude <noreply@anthropic.com>

asf-ci-hive added tests pending and removed tests unstable labels Nov 3, 2026

nrg4878 requested review from dengzhhu653, okumin and saihemanth-cloudera November 3, 2026 17:50

asf-ci-hive added tests unstable and removed tests pending labels Nov 3, 2026

Navigation Menu

Repository navigation

HIVE-29992: Iceberg REST catalog: HMS-managed owner and view properties - #6936

HIVE-29992: Iceberg REST catalog: HMS-managed owner and view properties#6936
henrib wants to merge 4 commits into
apache:masterfrom
henrib:HIVE-29992

henrib commented Nov 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

illiabarbashov-sketch Nov 3, 2026

Uh oh!

henrib Nov 3, 2026

Uh oh!

illiabarbashov-sketch Nov 3, 2026

Uh oh!

henrib Nov 3, 2026

Uh oh!

sonarqubecloud Bot commented Nov 3, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

henrib commented Nov 2, 2026

What changes were proposed in this pull request?

Why are the changes needed?

Does this PR introduce any user-facing change?

How was this patch tested?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

illiabarbashov-sketch Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

henrib Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

illiabarbashov-sketch Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

henrib Nov 3, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Nov 3, 2026

Quality Gate passed

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants