danhuawang commented on code in PR #11079:
URL: https://github.com/apache/gravitino/pull/11079#discussion_r3238786542
##########
docs/security/how-to-authenticate.md:
##########
@@ -72,6 +72,102 @@ GravitinoClient client = GravitinoClient.builder(uri)
.build();
```
+#### OAuth 2.0 token refresh for Iceberg REST clients
+
+When Gravitino is used as an Iceberg REST Catalog (IRC), some query engines
may hit OAuth 2.0 token refresh issues during long-running sessions.
+This usually happens when the identity provider doesn't support token
exchange, or when a child authentication session inherits the parent session's
expiration time.
+
+For the native Apache Iceberg OAuth 2.0 implementation, the following upstream
improvements are relevant:
+
+| Version | Change |
+| --- | --- |
+| Iceberg 1.11.0+ | Supports disabling token exchange and using client
credentials for token renewal, and fixes child `AuthSession` expiration
handling so the child session uses its own token lifetime. |
Review Comment:
Do the gravitino IRC upgrade to the 1.11.0? If gravitino IRC is still 1.10,
can we clarify it here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
