roryqi commented on code in PR #11079:
URL: https://github.com/apache/gravitino/pull/11079#discussion_r3240558973
##########
docs/security/how-to-authenticate.md:
##########
@@ -72,6 +72,143 @@ GravitinoClient client = GravitinoClient.builder(uri)
.build();
```
+#### OAuth 2.0 token refresh for Iceberg REST clients
+
+When Gravitino is used as an Iceberg REST Catalog (IRC), some query engines
may encounter OAuth 2.0 token refresh issues.
+This usually occurs when the identity provider does not support token
exchange, or when a child authentication session inherits the parent session's
expiration time.
+
+For the native Apache Iceberg OAuth 2.0 implementation, the following upstream
improvement is relevant:
+
+| Version | Change |
+| --- | --- |
+| Iceberg 1.11.0+ | Supports disabling token exchange, using client
credentials for token renewal, and fixing child `AuthSession` expiration
handling so that child sessions use their own token lifetime. |
+
+##### Native Apache Iceberg OAuth 2.0 implementation
+
+###### Spark
+
+Disable token exchange in the catalog configuration:
+
+```text
+spark.sql.catalog.${catalog_name}.token-exchange-enabled=false
+```
+
+###### Flink
+
+Disable token exchange in the catalog properties:
+
+```sql
+'token-exchange-enable'='false'
+```
+
+###### Trino
+
+This configuration requires Trino 479 or later.
+
+Add the following properties to the Trino catalog configuration:
+
+```properties
+iceberg.rest-catalog.session=NONE
+iceberg.rest-catalog.oauth2.token-exchange-enabled=false
+```
+
+You can omit `iceberg.rest-catalog.session=NONE` because the default value is
`NONE`.
+
+##### Alternative Dremio Iceberg OAuth 2.0 auth manager
+
+If version of iceberg on the client side can't be upgraded, you can use the
Dremio Iceberg OAuth 2.0 auth manager as an alternative.
Review Comment:
Iceberg library is usually compatible. I don't think this is a good reason.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
