lasdf1234 opened a new issue, #12724:
URL: https://github.com/apache/gravitino/issues/12724
### Version
main branch
### Describe what's wrong
When catalog properties such as `jdbc-password` / `s3-secret-access-key` are
stored as secret-manager URNs (`secretBindings`), `GET
.../objects/{type}/{fullName}/credentials` returns the raw URN in
`JdbcCredential` (and other static-key credentials) instead of resolved
plaintext.
`getSecrets` already returns plaintext; credential vending should as well so
clients (Iceberg REST standalone, connectors) can use credentials directly.
### Error message and/or stacktrace
`jdbc-password` in the credentials response looks like:
```text
urn:gravitino-secret:vault:catalog:<id>:jdbc-password
```
Standalone Iceberg REST then overlays this URN onto catalog props and JDBC
auth fails (`Wrong user name or password`).
### How to reproduce
1. Configure a secret provider (for example memory or Vault).
2. Create a catalog with `credential-providers=jdbc-user-password` and
`secretBindings.jdbc-password`.
3. Call `GET
/api/metalakes/{metalake}/objects/catalog/{catalog}/credentials`.
4. Observe `credentialInfo.jdbc-password` is still a URN.
### Additional context
Root cause: `BaseCatalog.catalogCredentialManager()` builds
`CatalogCredentialManager` from `propertiesWithCredentialProviders()` (entity
storage URNs) without calling `SecretManager.toPlaintextProperties`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
