unitycatalog / unitycatalog/unitycatalog
Schema doesnt appear in schema list with auth enabled for user that created schema
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 3.5k
- Forks
- 672
- Avg merge
- 6d 16h
- Merged PRs (30d)
- 30
Description
Describe the bug
A user (other than admin), that has create schema rights, can create a schema. With auth enabled, when said user subsequently uses schema list, the schema doesn't appear in the list despite the user being the schema owner.
To Reproduce
Steps to reproduce the behavior:
- enable authentication and start uc server
- create a user:
bin/uc --auth_token $(cat etc/conf/token.txt) user create --name "Your User" --email your@user.com - give user rights USE CATALOG and CREATE SCHEMA on catalog unity:
bin/uc --auth_token $(cat etc/conf/token.txt) permission create --securable_type catalog --name unity --privilege "USE CATALOG" --principal your@user.com
bin/uc --auth_token $(cat etc/conf/token.txt) permission create --securable_type catalog --name unity --privilege "CREATE SCHEMA" --principal your@user.com - Get authentication token for your new user: bin/uc auth login --output jsonPretty
- create a new schema using token from step 4:
bin/uc --auth_token $user_token schema create --catalog unity --name test - list schemas with user:
bin/uc --auth_token $user_token schema list --catalog unity - Compare above list to what admin sees:
bin/uc --auth_token $(cat etc/conf/token.txt) schema list --catalog unity
In step 6, the user should see the schema they created. In step 7 you confirm the schema has been created.
Expected behavior
In step 6, the user should see the schema they created in the list
System [please complete the following information]:
- OS: macOS Sequoia 15.7
- Java 17
- Using keycloak as idp
- UC Commit b2d072e
Additional context
Granting USE SCHEMA on the newly created user lists the schema normally. Creating tables and viewing tables in the schema works normally, despite not granting any rights on that.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the listed bin/uc user, permission, auth login, schema create, and schema list commands, comparing the regular user's output with the admin's. Trace the schema-list authorization path and verify that a user who owns a created schema can see it without an explicit USE SCHEMA grant, while existing table access continues to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authorization, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100