unitycatalog / unitycatalog/unitycatalog

Schema doesnt appear in schema list with auth enabled for user that created schema

Open
#1,105 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Java
Stars
3.5k
Forks
672
Avg merge
6d 16h
Merged PRs (30d)
30

Description

Describe the bug

A user (other than admin), that has create schema rights, can create a schema. With auth enabled, when said user subsequently uses schema list, the schema doesn't appear in the list despite the user being the schema owner.

To Reproduce

Steps to reproduce the behavior:

  1. enable authentication and start uc server
  2. create a user:
    bin/uc --auth_token $(cat etc/conf/token.txt) user create --name "Your User" --email your@user.com
  3. give user rights USE CATALOG and CREATE SCHEMA on catalog unity:
    bin/uc --auth_token $(cat etc/conf/token.txt) permission create --securable_type catalog --name unity --privilege "USE CATALOG" --principal your@user.com
    bin/uc --auth_token $(cat etc/conf/token.txt) permission create --securable_type catalog --name unity --privilege "CREATE SCHEMA" --principal your@user.com
  4. Get authentication token for your new user: bin/uc auth login --output jsonPretty
  5. create a new schema using token from step 4:
    bin/uc --auth_token $user_token schema create --catalog unity --name test
  6. list schemas with user:
    bin/uc --auth_token $user_token schema list --catalog unity
  7. Compare above list to what admin sees:
    bin/uc --auth_token $(cat etc/conf/token.txt) schema list --catalog unity

In step 6, the user should see the schema they created. In step 7 you confirm the schema has been created.

Expected behavior

In step 6, the user should see the schema they created in the list

System [please complete the following information]:

  • OS: macOS Sequoia 15.7
  • Java 17
  • Using keycloak as idp
  • UC Commit b2d072e

Additional context

Granting USE SCHEMA on the newly created user lists the schema normally. Creating tables and viewing tables in the schema works normally, despite not granting any rights on that.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the listed bin/uc user, permission, auth login, schema create, and schema list commands, comparing the regular user's output with the admin's. Trace the schema-list authorization path and verify that a user who owns a created schema can see it without an explicit USE SCHEMA grant, while existing table access continues to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.