(gravitino) branch branch-1.3 updated: [Cherry-pick to branch-1.3] [#11667] improvement(helm): Add OAuth group/principal mapper configs to Helm chart (#11668) (#11690)

[mchades]

This is an automated email from the ASF dual-hosted git repository.

mchades pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/branch-1.3 by this push:
     new ade76269fb [Cherry-pick to branch-1.3] [#11667] improvement(helm): Add 
OAuth group/principal mapper configs to Helm chart (#11668) (#11690)
ade76269fb is described below

commit ade76269fb21c4ce91b708278e3b68c45682d625
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Wed Jun 17 09:44:43 2026 +0800

    [Cherry-pick to branch-1.3] [#11667] improvement(helm): Add OAuth 
group/principal mapper configs to Helm chart (#11668) (#11690)
    
    **Cherry-pick Information:**
    - Original commit: 181e0aee76c0423c57d4e35507f1673e6c204d98
    - Target branch: `branch-1.3`
    - Status: ✅ Clean cherry-pick (no conflicts)
    
    Co-authored-by: dennismdejong 
<55197148+dennismdej...@users.noreply.github.com>
---
 .../gravitino/resources/config/gravitino.conf      | 15 +++++++++++
 dev/charts/gravitino/tests/configmap_test.yaml     | 29 ++++++++++++++++++++++
 dev/charts/gravitino/values.yaml                   | 10 ++++++++
 3 files changed, 54 insertions(+)

diff --git a/dev/charts/gravitino/resources/config/gravitino.conf 
b/dev/charts/gravitino/resources/config/gravitino.conf
index f09a8cb7b4..b715195a70 100644
--- a/dev/charts/gravitino/resources/config/gravitino.conf
+++ b/dev/charts/gravitino/resources/config/gravitino.conf
@@ -113,6 +113,21 @@ gravitino.authenticator.oauth.tokenValidatorClass = {{ 
.tokenValidatorClass }}
 {{- if .principalFields }}
 gravitino.authenticator.oauth.principalFields = {{ .principalFields }}
 {{- end }}
+{{- if .principalMapper }}
+gravitino.authenticator.oauth.principalMapper = {{ .principalMapper }}
+{{- end }}
+{{- if .principalMapperRegexPattern }}
+gravitino.authenticator.oauth.principalMapper.regex.pattern = {{ 
.principalMapperRegexPattern }}
+{{- end }}
+{{- if .groupsFields }}
+gravitino.authenticator.oauth.groupsFields = {{ .groupsFields }}
+{{- end }}
+{{- if .groupMapper }}
+gravitino.authenticator.oauth.groupMapper = {{ .groupMapper }}
+{{- end }}
+{{- if .groupMapperRegexPattern }}
+gravitino.authenticator.oauth.groupMapper.regex.pattern = {{ 
.groupMapperRegexPattern }}
+{{- end }}
 {{- end }}
 {{- end }}
 
diff --git a/dev/charts/gravitino/tests/configmap_test.yaml 
b/dev/charts/gravitino/tests/configmap_test.yaml
index 949f953821..d34ac33e27 100644
--- a/dev/charts/gravitino/tests/configmap_test.yaml
+++ b/dev/charts/gravitino/tests/configmap_test.yaml
@@ -162,6 +162,11 @@ tests:
           jwksUri: https://auth.example.com/.well-known/jwks.json
           tokenValidatorClass: 
org.apache.gravitino.server.authentication.JwksTokenValidator
           principalFields: preferred_username,email
+          principalMapper: regex
+          principalMapperRegexPattern: "^(.*)$"
+          groupsFields: groups
+          groupMapper: regex
+          groupMapperRegexPattern: "^(.*)$"
     asserts:
       - matchRegex:
           path: data["gravitino.conf"]
@@ -193,6 +198,21 @@ tests:
       - matchRegex:
           path: data["gravitino.conf"]
           pattern: "gravitino\\.authenticator\\.oauth\\.principalFields = 
preferred_username,email"
+      - matchRegex:
+          path: data["gravitino.conf"]
+          pattern: "gravitino\\.authenticator\\.oauth\\.principalMapper = 
regex"
+      - matchRegex:
+          path: data["gravitino.conf"]
+          pattern: 
"gravitino\\.authenticator\\.oauth\\.principalMapper\\.regex\\.pattern"
+      - matchRegex:
+          path: data["gravitino.conf"]
+          pattern: "gravitino\\.authenticator\\.oauth\\.groupsFields = groups"
+      - matchRegex:
+          path: data["gravitino.conf"]
+          pattern: "gravitino\\.authenticator\\.oauth\\.groupMapper = regex"
+      - matchRegex:
+          path: data["gravitino.conf"]
+          pattern: 
"gravitino\\.authenticator\\.oauth\\.groupMapper\\.regex\\.pattern"
 
   - it: does not render empty OAuth sub-properties when only some are set
     release:
@@ -216,6 +236,15 @@ tests:
       - notMatchRegex:
           path: data["gravitino.conf"]
           pattern: "gravitino\\.authenticator\\.oauth\\.serverUri"
+      - matchRegex:
+          path: data["gravitino.conf"]
+          pattern: "gravitino\\.authenticator\\.oauth\\.principalMapper = 
regex"
+      - matchRegex:
+          path: data["gravitino.conf"]
+          pattern: "gravitino\\.authenticator\\.oauth\\.groupsFields = groups"
+      - matchRegex:
+          path: data["gravitino.conf"]
+          pattern: "gravitino\\.authenticator\\.oauth\\.groupMapper = regex"
 
   - it: renders entity.maxConnections only when set
     release:
diff --git a/dev/charts/gravitino/values.yaml b/dev/charts/gravitino/values.yaml
index e0ead23596..a8ba533e1a 100644
--- a/dev/charts/gravitino/values.yaml
+++ b/dev/charts/gravitino/values.yaml
@@ -348,6 +348,16 @@ authenticator:
     defaultSignKey: ""
     serverUri: ""
     tokenPath: /realms/myrealm/protocol/openid-connect/token
+    ## Principal mapper type for OAuth (default: regex)
+    principalMapper: "regex"
+    ## Regex pattern for OAuth principal mapping (default: ^(.*)$)
+    principalMapperRegexPattern: "^(.*)$"
+    ## JWT claim field(s) to use for group membership (default: groups)
+    groupsFields: "groups"
+    ## Group mapper type for OAuth (default: regex)
+    groupMapper: "regex"
+    ## Regex pattern for OAuth group mapping (default: ^(.*)$)
+    groupMapperRegexPattern: "^(.*)$"
 
 ## Audit log configuration
 ##