fzhsbc opened a new issue, #11181: URL: https://github.com/apache/gravitino/issues/11181
## Motivation The Spark connector currently supports `simple`, `oauth2` and `kerberos` authentication when accessing a Gravitino server. The existing `oauth2` mode requests a token through the configured OAuth2 token endpoint, which works for client-credentials style deployments. It does not cover runtime environments where a trusted platform component has already obtained a short-lived user or workload Bearer token and refreshes it outside the Spark connector. Common examples include: - Kubernetes notebook runtimes where a sidecar refreshes a short-lived token. - Enterprise platforms where a runtime credential service writes a token file for the local Spark driver. - Workload identity systems where Spark should reuse an existing Bearer token instead of holding OAuth client credentials. In these cases, the Spark connector only needs to read the local token and send it as: ```text Authorization: Bearer <token> ``` The Gravitino server still validates the token and enforces authorization. The server does not read the token file. ## Proposal Add a Spark connector authentication mode: ```properties spark.sql.gravitino.authType=bearer-token-file spark.sql.gravitino.bearer.tokenFile=/path/to/token ``` Behavior: - The token file is local to the Spark driver. - The file may contain either the raw token or a `Bearer ` prefixed value. - The connector reads the token file when generating authentication data for Gravitino client requests. - The implementation uses the existing `CustomTokenProvider` extension point. - The feature is generic and does not depend on JupyterHub, Kubernetes, a specific identity provider, or a specific token issuer. ## Why not use the existing OAuth2 mode? The existing OAuth2 mode requires the Spark connector to call the OAuth2 token endpoint with configured credentials. In the runtime-token-file pattern, token acquisition and refresh are handled by a trusted runtime component, and the connector should not need OAuth client credentials or refresh tokens. ## Scope This issue only proposes a Spark connector client-side authentication mode. It does not propose any server-side token issuance behavior or any deployment-specific sidecar implementation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
