SEC-CAT-003 — Preserve end-user identity through Catalog discovery
| Field | Value |
|---|---|
| Status | Open finding; architecture source-verified, effective authorization unverified |
| Severity | High |
| Affected surface | Catalog, schema, table, and column discovery |
| Implementation issue | bff-api #235 |
| Code-change repository | sparqd/bff-api |
Where the problem appears
Use a test actor denied one resource by Ranger while retaining Catalog access, then correlate every discovery request with Trino and Ranger audit.
Concrete observed case
The top-level tree exposes Superset database registrations rather than a Ranger-filtered Trino catalog list. Deeper discovery reaches Trino, but the Superset path can fall back from a missing or invalid session token to a service credential while retaining an effective user value.
Expected condition
Discover authorized catalogs through the selected Trino connection and preserve one verified end-user identity through catalog, schema, table, column, sample, history, and SQL operations. Never represent connection visibility as proof of data access.
Cause and evidence
- Top-level visibility is governed by Superset registration rather than Trino catalog authorization.
- Ranger enforces deeper Trino operations.
- The fallback path requires audit evidence to prove which principal Ranger actually evaluates.
Why it matters
The UI can disclose connections, omit authorized catalogs, or evaluate metadata under an unintended principal.
Existing controls and workarounds
Verify access by expanding the object or running an approved fully qualified query. Treat the top-level entry only as a route, not authorization evidence.
Alternatives considered
- Recommended: Ranger-filtered catalog discovery with propagated end-user identity.
- Connection node plus separately authorized catalogs — suitable when multiple connections are exposed.
- Filter only in the browser — rejected because unauthorized names may already be disclosed.
Component involvement
- BFF/Superset integration owns identity propagation and catalog discovery.
- Oqullus separates connection routing from catalog authorization.
- Ranger audit is the authoritative verification evidence.
Reproduction and verification
Follow CAT-S015. Record the visible state, request outcome, effective identity, and recovery behavior relevant to this finding.
Resolution conditions
Close when denied and allowed fixtures prove the intended principal, authorized catalogs are complete, denied disclosure matches policy, and fallback cannot gain service-account authority.
Validation and blockers
BFF, Superset, Ranger, and security owners must validate with restricted-user audit evidence.