markhoerth opened a new pull request, #12256:
URL: https://github.com/apache/gravitino/pull/12256

   ### What changes were proposed in this pull request?
   
   Adds `gravitino.lance-rest.gravitino-auth-type` with `simple` and `oauth2`
   support, plus the supporting `gravitino-simple.user-name` and
   `gravitino-oauth2.*` properties, and uses them when constructing the
   `GravitinoClient` in `GravitinoLanceNamespaceWrapper`. The property names and
   the dispatch logic mirror 
`DynamicIcebergConfigProvider.createGravitinoClient`.
   
   The builder configuration is split into `newClientBuilder` so it can be 
tested
   without opening a connection. Runtime behavior of `initialize()` is unchanged
   apart from the credentials now being attached.
   
   ### Why are the changes needed?
   
   The Lance REST service built its client with no `AuthDataProvider`, so its
   requests to the Gravitino server carried no `Authorization` header. Under the
   `simple` authenticator those requests are accepted as the anonymous user.
   Under `oauth2` or `kerberos` no authenticator accepts a null token, so every
   Lance operation fails. Since `gravitino.authenticators` is server-wide, the
   only configuration where the service works alongside OAuth2 also lists
   `simple`, which leaves an anonymous bypass open for all callers of the 
server.
   
   Fix: #12255
   
   ### Does this PR introduce any user-facing change?
   
   Yes, six new configuration properties, documented in
   `docs/lance-rest-service.md`. The default is `simple` with user name
   `lance-rest-server`, so existing deployments continue to work and gain a 
named
   identity in place of anonymous.
   
   Documentation here is limited to a config table for the six new properties. A
   broader rewrite of `lance-rest-service.md` will follow in a separate PR.
   
   ### How was this patch tested?
   
   New unit tests in `TestGravitinoLanceClientAuth` covering the default auth
   type, a configured simple user name, case-insensitive parsing, both
   missing-required-OAuth2-property cases, and rejection of an unsupported auth
   type.
   
   Not covered: end-to-end verification that the OAuth2 provider is attached and
   accepted by a live server. That needs an integration test alongside
   `LanceRESTServiceIT`. Happy to add it here or in a follow-up, whichever
   reviewers prefer.
   
   ### Target branch
   
   The config entries are marked `1.3.0` because this fixes behavior in the 1.3
   line: the Lance REST service cannot operate against a server with
   authentication enabled. Requesting the branch-1.3 cherry-pick label.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to