markhoerth opened a new pull request, #12256: URL: https://github.com/apache/gravitino/pull/12256
### What changes were proposed in this pull request? Adds `gravitino.lance-rest.gravitino-auth-type` with `simple` and `oauth2` support, plus the supporting `gravitino-simple.user-name` and `gravitino-oauth2.*` properties, and uses them when constructing the `GravitinoClient` in `GravitinoLanceNamespaceWrapper`. The property names and the dispatch logic mirror `DynamicIcebergConfigProvider.createGravitinoClient`. The builder configuration is split into `newClientBuilder` so it can be tested without opening a connection. Runtime behavior of `initialize()` is unchanged apart from the credentials now being attached. ### Why are the changes needed? The Lance REST service built its client with no `AuthDataProvider`, so its requests to the Gravitino server carried no `Authorization` header. Under the `simple` authenticator those requests are accepted as the anonymous user. Under `oauth2` or `kerberos` no authenticator accepts a null token, so every Lance operation fails. Since `gravitino.authenticators` is server-wide, the only configuration where the service works alongside OAuth2 also lists `simple`, which leaves an anonymous bypass open for all callers of the server. Fix: #12255 ### Does this PR introduce any user-facing change? Yes, six new configuration properties, documented in `docs/lance-rest-service.md`. The default is `simple` with user name `lance-rest-server`, so existing deployments continue to work and gain a named identity in place of anonymous. Documentation here is limited to a config table for the six new properties. A broader rewrite of `lance-rest-service.md` will follow in a separate PR. ### How was this patch tested? New unit tests in `TestGravitinoLanceClientAuth` covering the default auth type, a configured simple user name, case-insensitive parsing, both missing-required-OAuth2-property cases, and rejection of an unsupported auth type. Not covered: end-to-end verification that the OAuth2 provider is attached and accepted by a live server. That needs an integration test alongside `LanceRESTServiceIT`. Happy to add it here or in a follow-up, whichever reviewers prefer. ### Target branch The config entries are marked `1.3.0` because this fixes behavior in the 1.3 line: the Lance REST service cannot operate against a server with authentication enabled. Requesting the branch-1.3 cherry-pick label. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
