fzhsbc opened a new issue, #11181:
URL: https://github.com/apache/gravitino/issues/11181

   ## Motivation
   
   The Spark connector currently supports `simple`, `oauth2` and `kerberos` 
authentication when accessing a Gravitino server.
   
   The existing `oauth2` mode requests a token through the configured OAuth2 
token endpoint, which works for client-credentials style deployments. It does 
not cover runtime environments where a trusted platform component has already 
obtained a short-lived user or workload Bearer token and refreshes it outside 
the Spark connector.
   
   Common examples include:
   
   - Kubernetes notebook runtimes where a sidecar refreshes a short-lived token.
   - Enterprise platforms where a runtime credential service writes a token 
file for the local Spark driver.
   - Workload identity systems where Spark should reuse an existing Bearer 
token instead of holding OAuth client credentials.
   
   In these cases, the Spark connector only needs to read the local token and 
send it as:
   
   ```text
   Authorization: Bearer <token>
   ```
   
   The Gravitino server still validates the token and enforces authorization. 
The server does not read the token file.
   
   ## Proposal
   
   Add a Spark connector authentication mode:
   
   ```properties
   spark.sql.gravitino.authType=bearer-token-file
   spark.sql.gravitino.bearer.tokenFile=/path/to/token
   ```
   
   Behavior:
   
   - The token file is local to the Spark driver.
   - The file may contain either the raw token or a `Bearer ` prefixed value.
   - The connector reads the token file when generating authentication data for 
Gravitino client requests.
   - The implementation uses the existing `CustomTokenProvider` extension point.
   - The feature is generic and does not depend on JupyterHub, Kubernetes, a 
specific identity provider, or a specific token issuer.
   
   ## Why not use the existing OAuth2 mode?
   
   The existing OAuth2 mode requires the Spark connector to call the OAuth2 
token endpoint with configured credentials. In the runtime-token-file pattern, 
token acquisition and refresh are handled by a trusted runtime component, and 
the connector should not need OAuth client credentials or refresh tokens.
   
   ## Scope
   
   This issue only proposes a Spark connector client-side authentication mode. 
It does not propose any server-side token issuance behavior or any 
deployment-specific sidecar implementation.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to