yuqi1129 opened a new issue, #12447: URL: https://github.com/apache/gravitino/issues/12447
### Version main branch and 1.3.0 ### Describe what is wrong The MCP server always prefixes the static credential configured through `--token` or `GRAVITINO_TOKEN` with `Bearer`. When Gravitino uses Basic authentication and the MCP client cannot attach an incoming `Authorization` header, there is no way to provide a valid identity. For example: `--token "Basic dXNlcjpwYXNz"` is sent as: `Authorization: Bearer Basic dXNlcjpwYXNz` The MCP server should preserve an explicitly provided authorization scheme, while continuing to treat a bare token as an OAuth2 Bearer token. ### Error message and/or stacktrace ``` Error code: 1011, Error type: UnauthorizedException, Error message: The provided credentials did not support ``` ### How to reproduce 1. Configure Gravitino with `gravitino.authenticators = basic`. 2. Start the MCP server with `--token "Basic <base64-credentials>"`. 3. Invoke an MCP tool through stdio, or through HTTP without an incoming `Authorization` header. 4. The request fails because the credential reaches Gravitino with the `Bearer` scheme. ### Additional context Forwarding an incoming `Authorization` header already preserves its scheme. Only the static `--token` / `GRAVITINO_TOKEN` fallback is affected. Related PR: #12439 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
