lasdf1234 opened a new issue, #12949:
URL: https://github.com/apache/gravitino/issues/12949
### Version
main branch
### Describe what's wrong
A `lakehouse-iceberg` catalog with `catalog-backend: rest` (or an Iceberg
REST catalog whose backend is another Iceberg REST service) does not forward
`X-Iceberg-Access-Delegation: vended-credentials` when loading a table.
The near-end Iceberg REST server receives the header and logs credential
vending as true, but the forwarded load against the remote catalog has `access
delegation: null` and `credential vending: false`. Direct loads against the
remote catalog return `storage-credentials` (for example
STS/`s3.session-token`). Loads through the federated catalog return only
`metadata-location` / `metadata` / `config`. Engines can list namespaces and
load table metadata, then fail on the first data read.
### Error message and/or stacktrace
Near-end load:
```text
Load Iceberg table, catalog: iceberg_fwd, ... access delegation:
vended-credentials, credential vending: true
```
Forwarded remote load:
```text
Load Iceberg table, catalog: iceberg_s3, ... access delegation: null,
credential vending: false
```
The forwarded `loadTable` JSON has no `storage-credentials`.
### How to reproduce
1. Create a remote Iceberg REST catalog that vends credentials when
`X-Iceberg-Access-Delegation: vended-credentials` is present.
2. Create a Gravitino Iceberg catalog that points at that REST endpoint:
```json
{
"catalog-backend": "rest",
"uri": "http://<remote>:9001/iceberg/",
"warehouse": "iceberg_s3"
}
```
3. Load a table through the federated catalog with:
```http
X-Iceberg-Access-Delegation: vended-credentials
```
4. Compare with the same load sent directly to the remote catalog. The
federated path omits vended credentials.
### Additional context
`FederatedCatalogWrapper.loadTable` ignored `requestCredential` and
delegated to Iceberg's `RESTCatalog.loadTable`, which does not send the
access-delegation header. Scan-plan federation already forwards the header;
load table should do the same and rewrite remote credential refresh endpoints
to this IRC catalog.
Observed on 1.3.0-rc2 as well as current main.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
