danhuawang commented on code in PR #11079:
URL: https://github.com/apache/gravitino/pull/11079#discussion_r3238801932
##########
docs/security/how-to-authenticate.md:
##########
@@ -72,6 +72,102 @@ GravitinoClient client = GravitinoClient.builder(uri)
.build();
```
+#### OAuth 2.0 token refresh for Iceberg REST clients
+
+When Gravitino is used as an Iceberg REST Catalog (IRC), some query engines
may hit OAuth 2.0 token refresh issues during long-running sessions.
+This usually happens when the identity provider doesn't support token
exchange, or when a child authentication session inherits the parent session's
expiration time.
+
+For the native Apache Iceberg OAuth 2.0 implementation, the following upstream
improvements are relevant:
+
+| Version | Change |
+| --- | --- |
+| Iceberg 1.11.0+ | Supports disabling token exchange and using client
credentials for token renewal, and fixes child `AuthSession` expiration
handling so the child session uses its own token lifetime. |
+
+Use the engine-specific settings below.
+
+##### Spark
+
+Disable token exchange in the catalog configuration:
+
+```text
+spark.sql.catalog.${catalog_name}.token-exchange-enabled=false
+```
+
+##### Flink
+
+Disable token exchange in the catalog properties:
+
+```sql
+'token-exchange-enable'='false'
+```
+
+##### Trino
+
+Set the following in the Trino catalog:
+
+```properties
+iceberg.rest-catalog.session=NONE
+iceberg.rest-catalog.oauth2.token-exchange-enabled=false
+```
+
+This setting can be omitted if you want the default behavior, because the
default value is `NONE`.
+
+##### Alternative OAuth 2.0 auth manager for Spark and Flink
+
+If the native Apache Iceberg OAuth 2.0 implementation still doesn't meet your
requirements, you can use the Dremio Iceberg OAuth 2.0 auth manager for Spark
and Flink:
+
+- Repository: `https://github.com/dremio/iceberg-auth-manager`
+- Build command: `./gradlew --no-daemon :authmgr-oauth2-runtime:shadowJar`
+- Output jar:
`${project}/oauth2/runtime/build/libs/authmgr-oauth2-runtime-<version>.jar`
+
+Place the runtime jar in:
+
+- `${SPARK_HOME}/jars` for Spark
+- `${FLINK_HOME}/lib` for Flink
+
+For Spark, also add the jar to both the driver and executor classpaths:
+
+```text
+spark.driver.extraClassPath=${SPARK_HOME}/jars/authmgr-oauth2-runtime-<version>.jar
+spark.executor.extraClassPath=${SPARK_HOME}/jars/authmgr-oauth2-runtime-<version>.jar
+```
+
+Example Spark configuration using client credentials token refresh:
Review Comment:
I think we also add an example for
`spark.sql.catalog.remote_irc_b.rest.auth.oauth2.grant-type password`, this
type make more sense.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
