DEV Community

SorrelThorncroft
SorrelThorncroft

Posted on

Apache Gravitino: Authentication and Authorization Are Separate Switches

#zoomeye #gravitino #metadata #authorization

Apache Gravitino: Authentication and Authorization Are Separate Switches

Apache Gravitino acts as a metadata lake and management layer for data catalogs and related services. Its documentation makes a distinction that many deployments miss: authentication establishes the caller, while authorization decides what the caller may do. Either control can be configured incorrectly without the other.

The security documentation says authorization is off by default. It also warns that the default simple authenticator reads an unvalidated HTTP Basic header and is intended for local evaluation. A production deployment that leaves both defaults in place may look like it has a user identity while enforcing neither identity verification nor access policy.

Measured footprint

On 2026-11-12, ZoomEye returned 37 application-fingerprint matches for app="Apache Gravitino" with sub_type=all, page 1, and page size 1. The count is a product observation, not proof that a matched server is reachable with default security settings or holds sensitive metadata.

Verify the effective authenticator

Check gravitino.authenticators and the active server configuration. Simple, Basic, OAuth, and Kerberos modes have different trust properties. Simple mode can accept a client-supplied username, so it is not a production identity control.

For OAuth, validate issuer, audience, JWKS source, principal claim, and group mapping. A valid token from the wrong audience or issuer should be rejected. A user who is removed from the identity provider should not retain a long-lived server session.

If local users are enabled, protect the management endpoints and require HTTPS. Local user storage is for isolated deployments and does not replace a central identity provider.

Verify authorization, not just identity

Review the authorizer implementation and service administrators. A pass-through authorizer that deliberately bypasses every check should be marked as a test configuration. A production policy should bind users and groups to metalakes, catalogs, and operations.

Test metadata reads, metadata changes, and underlying data access separately. A user who can see a table entry may still need a separate credential to read the data. Gravitino's metadata role does not automatically grant every source-system permission.

Check cache and revocation timing

The access-control documentation describes caches with configurable expiration and polling intervals. A role change may not take effect immediately. Record the acceptable delay and test it with a revoked user.

For high-impact permissions, use a shorter cache expiration and monitor authorization failures during the transition. Do not claim immediate revocation if the implementation has a documented cache window.

Test the web and API paths

Request the API version endpoint without credentials. It should fail unless the deployment explicitly allows anonymous access. Then request a metalake endpoint with a low-privilege user and confirm that an unauthorized catalog or operation is denied.

Test the Web UI OIDC callback over HTTPS and verify that PKCE is used as documented. Access the server through a direct port and a proxy hostname to ensure both paths apply the same policy.

Verification checklist

  • Authentication is not left in simple or anonymous mode for shared use.
  • OAuth issuer, audience, JWKS, and principal fields are pinned.
  • Authorization is enabled with named service administrators.
  • Pass-through authorization has a test-only boundary and owner.
  • Metadata and data-source permissions are tested separately.
  • Cache expiration and revocation delay are documented.
  • API, UI, direct port, and proxy paths use the same policy.

The 37 Gravitino app matches are a reason to review the effective security switches. The product is designed to expose useful metadata; the deployment must make sure that discovery does not become anonymous administration.

References

Top comments (0)