yuqi1129 opened a new pull request, #12984: URL: https://github.com/apache/gravitino/pull/12984
### What changes were proposed in this pull request? Forward the authenticated caller's Basic/Bearer credentials and active roles on each standalone Lance REST request to Gravitino. Keep explicitly configured simple/OAuth2 service credentials available, preserve remote 401/403 responses, and allow namespace creation without requiring permission to load an absent namespace. ### Why are the changes needed? Standalone currently replaces every caller with a shared service identity. Remote metadata authorization, ownership, and audit attribution should use the caller, as they do in auxiliary mode. Subtask of #9087: standalone caller identity forwarding. This does not implement the full auxiliary authorization pipeline or token exchange. ### Does this PR introduce _any_ user-facing change? Yes. `gravitino.lance-rest.gravitino-auth-type` defaults to `caller`. Missing or non-forwardable credentials fail with 401; there is no service-account fallback. Explicit `simple` and `oauth2` retain the previous behavior. Forwarded OAuth tokens must be accepted by both services. ### How was this patch tested? - Spotless and `check` for Java client, Lance common, and Lance REST server; 511 unit tests passed. - `LanceStandaloneCallerIdentityIT`: two HTTP integration tests passed against embedded Gravitino with authorization enabled, covering caller ownership, active roles, denied users, and anonymous rejection. - Concurrent caller-isolation and namespace creation/hidden-object regression tests. - `git diff --check`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
