[Improvement] Support option to auto add new users to Gravitino

[bharos]

What would you like to be improved?

Currently, If a user is not present in a metalake, Gravitino throws an error

2026-02-06 00:51:11 WARN  [MetadataFilterHelper-ThreadPool-149] JcasbinAuthorizer:262 - Can not get user user in metalake metalake
org.apache.gravitino.exceptions.NoSuchUserException: User user does not exist in the metalake metalake
	at org.apache.gravitino.authorization.UserGroupManager.getUser(UserGroupManager.java:122) ~[gravitino-core-1.1.1-SNAPSHOT.jar:?
	at org.apache.gravitino.authorization.AccessControlManager.lambda$getUser$2(AccessControlManager.java:84) ~[gravitino-core-1.1.1-SNAPSHOT.jar:?]

This can be an overhead, to add users when an employee joins a company etc.. ? Also while onboarding to Gravitino, we need to create 1000s of users.
Why not auto-add ? It doesn't give them any permissions still, until they have privileges granted

Not suggesting to change the behavior by default, but is it reasonable to add a config, like

# Configuration proposal
gravitino.authorization.auto-create-user: false  # default for backward compatibility
gravitino.authorization.auto-create-user.metalakes: "*"  # or comma-separated list

# Alternative: per-metalake configuration
gravitino.authorization.metalakes.roku.auto-create-user: true

How should we improve?

No response

[bharos]

Please let me know your thoughts. I can work on this if acceptable
cc @jerryshao @roryqi

[roryqi]

Maybe it's better to use tool to sync users. It should be out of Gravtino's scope. Similarly, Ranger has the user sync service.we should just do separately offline.

[bharos]

How does it work when Ranger is used ? Gravitino stores the users still in the entity store ?
I was considering this option because Gravitino maintains the source of truth of all the available users, so automatically adding any user is also an option followed in some systems, like Hive SqlStd auth (https://hive.apache.org/docs/latest/language/sql-standard-based-hive-authorization/) that says

All users belong to the public role. You use this role in your grant statement to grant a privilege to all users.

[roryqi]

It's not related about Ranger. I just take an example. We should add it offline.
We should fetch all the available users from the user system like AzureAD and add all the users after creating metalakes.
We should create some common roles for the metalake. We should create admin role, public role. We should grant public role to all the of users.
In general, these steps should be considered as the initialize process. If we add them for creating metalakes, it will cost too much time for creating the metalake.