roryqi commented on code in PR #11079:
URL: https://github.com/apache/gravitino/pull/11079#discussion_r3240477898
##########
docs/security/how-to-authenticate.md:
##########
@@ -72,6 +72,143 @@ GravitinoClient client = GravitinoClient.builder(uri)
.build();
```
+#### OAuth 2.0 token refresh for Iceberg REST clients
+
+When Gravitino is used as an Iceberg REST Catalog (IRC), some query engines
may encounter OAuth 2.0 token refresh issues.
+This usually occurs when the identity provider does not support token
exchange, or when a child authentication session inherits the parent session's
expiration time.
+
+For the native Apache Iceberg OAuth 2.0 implementation, the following upstream
improvement is relevant:
+
+| Version | Change |
+| --- | --- |
+| Iceberg 1.11.0+ | Supports disabling token exchange, using client
credentials for token renewal, and fixing child `AuthSession` expiration
handling so that child sessions use their own token lifetime. |
+
+Use the engine-specific settings below.
+
+##### Spark
+
+Disable token exchange in the catalog configuration:
+
+```text
+spark.sql.catalog.${catalog_name}.token-exchange-enabled=false
+```
+
+##### Flink
+
+Disable token exchange in the catalog properties:
+
+```sql
+'token-exchange-enable'='false'
+```
+
+##### Trino
+
+This configuration requires Trino 479 or later.
+
+Add the following properties to the Trino catalog configuration:
+
+```properties
+iceberg.rest-catalog.session=NONE
+iceberg.rest-catalog.oauth2.token-exchange-enabled=false
+```
+
+You can omit `iceberg.rest-catalog.session=NONE` because the default value is
`NONE`.
+
+##### Alternative OAuth 2.0 auth manager
+
+If the native Apache Iceberg OAuth 2.0 implementation does not meet your
requirements, you can use the Dremio Iceberg OAuth 2.0 auth manager.
Review Comment:
I can't get your point. When will we need to use Dremio library?
##########
docs/security/how-to-authenticate.md:
##########
@@ -72,6 +72,143 @@ GravitinoClient client = GravitinoClient.builder(uri)
.build();
```
+#### OAuth 2.0 token refresh for Iceberg REST clients
+
+When Gravitino is used as an Iceberg REST Catalog (IRC), some query engines
may encounter OAuth 2.0 token refresh issues.
+This usually occurs when the identity provider does not support token
exchange, or when a child authentication session inherits the parent session's
expiration time.
+
+For the native Apache Iceberg OAuth 2.0 implementation, the following upstream
improvement is relevant:
+
+| Version | Change |
+| --- | --- |
Review Comment:
Could u fix the format?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
