This is an automated email from the ASF dual-hosted git repository.
roryqi pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/branch-1.3 by this push:
new 5513fe089b [Cherry-pick to branch-1.3] [#13151] fix(catalogs): return
jdbc-user in plaintext for Iceberg and Paimon (#13150)
5513fe089b is described below
commit 5513fe089be1a1523354ca2fc0533be26fd9a838
Author: MaSai <[email protected]>
AuthorDate: Mon Sep 14 21:05:56 2026 +0800
[Cherry-pick to branch-1.3] [#13151] fix(catalogs): return jdbc-user in
plaintext for Iceberg and Paimon (#13150)
### What changes were proposed in this pull request?
Cherry-pick #13125 onto `branch-1.3`.
Mark `jdbc-user` as not hidden in Iceberg and Paimon catalog properties
metadata, matching JDBC catalogs after #12750. Update unit tests and
docs.
### Why are the changes needed?
#12750 treated `jdbc-user` as an account identifier (plaintext) for
JDBC, but Iceberg/Paimon still masked it as `******`, causing
cross-catalog inconsistency. `main` is fixed by #13125; `branch-1.3`
still has the old behavior.
Fix: #13151
### Does this PR introduce _any_ user-facing change?
Yes. `GET .../catalogs/{catalog}` for lakehouse-iceberg /
lakehouse-paimon now returns `jdbc-user` in plaintext. `jdbc-password`
remains masked.
### How was this patch tested?
```
./gradlew :catalogs:catalog-lakehouse-iceberg:test --tests
org.apache.gravitino.catalog.lakehouse.iceberg.TestIcebergCatalogPropertiesMetadata
\
:catalogs:catalog-lakehouse-paimon:test --tests
org.apache.gravitino.catalog.lakehouse.paimon.TestPaimonCatalogPropertiesMetadata
-PskipITs
```
Co-authored-by: Cursor <[email protected]>
---
.../lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java | 2 +-
.../lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java | 8 ++++++++
.../catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java | 2 +-
.../lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java | 3 ++-
core/src/main/java/org/apache/gravitino/Configs.java | 2 +-
docs/gravitino-server-config.md | 2 +-
docs/lakehouse-iceberg-catalog.md | 2 +-
7 files changed, 15 insertions(+), 6 deletions(-)
diff --git
a/catalogs/catalog-lakehouse-iceberg/src/main/java/org/apache/gravitino/catalog/lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java
b/catalogs/catalog-lakehouse-iceberg/src/main/java/org/apache/gravitino/catalog/lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java
index bf6246a738..8defa29fbd 100644
---
a/catalogs/catalog-lakehouse-iceberg/src/main/java/org/apache/gravitino/catalog/lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java
+++
b/catalogs/catalog-lakehouse-iceberg/src/main/java/org/apache/gravitino/catalog/lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java
@@ -91,7 +91,7 @@ public class IcebergCatalogPropertiesMetadata extends
BaseCatalogPropertiesMetad
"JDBC user for Iceberg JDBC backend",
false /* immutable */,
null /* defaultValue */,
- true /* hidden */),
+ false /* hidden */),
stringOptionalPropertyEntry(
GRAVITINO_JDBC_PASSWORD,
"JDBC password for Iceberg JDBC backend",
diff --git
a/catalogs/catalog-lakehouse-iceberg/src/test/java/org/apache/gravitino/catalog/lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java
b/catalogs/catalog-lakehouse-iceberg/src/test/java/org/apache/gravitino/catalog/lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java
index 0faf851030..8ca4c3d85a 100644
---
a/catalogs/catalog-lakehouse-iceberg/src/test/java/org/apache/gravitino/catalog/lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java
+++
b/catalogs/catalog-lakehouse-iceberg/src/test/java/org/apache/gravitino/catalog/lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java
@@ -35,6 +35,14 @@ public class TestIcebergCatalogPropertiesMetadata {
metadata = new IcebergCatalogPropertiesMetadata();
}
+ @Test
+ void testJdbcUserIsVisibleAndPasswordIsHidden() {
+ Assertions.assertFalse(
+
metadata.isHiddenProperty(IcebergCatalogPropertiesMetadata.GRAVITINO_JDBC_USER));
+ Assertions.assertTrue(
+
metadata.isHiddenProperty(IcebergCatalogPropertiesMetadata.GRAVITINO_JDBC_PASSWORD));
+ }
+
@Test
void testTableMetadataCacheImplDefaultValue() {
Assertions.assertEquals(
diff --git
a/catalogs/catalog-lakehouse-paimon/src/main/java/org/apache/gravitino/catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java
b/catalogs/catalog-lakehouse-paimon/src/main/java/org/apache/gravitino/catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java
index 66234fa76a..ef1faa469f 100644
---
a/catalogs/catalog-lakehouse-paimon/src/main/java/org/apache/gravitino/catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java
+++
b/catalogs/catalog-lakehouse-paimon/src/main/java/org/apache/gravitino/catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java
@@ -197,7 +197,7 @@ public class PaimonCatalogPropertiesMetadata extends
BaseCatalogPropertiesMetada
"Gravitino Paimon catalog jdbc user",
false /* immutable */,
null /* defaultValue */,
- true /* hidden */),
+ false /* hidden */),
stringOptionalPropertyEntry(
GRAVITINO_JDBC_PASSWORD,
"Gravitino Paimon catalog jdbc password",
diff --git
a/catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java
b/catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java
index c4025daa1f..b5a74a1c5b 100644
---
a/catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java
+++
b/catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java
@@ -31,7 +31,6 @@ public class TestPaimonCatalogPropertiesMetadata {
@Test
void testSensitivePropertiesAreHidden() {
-
assertTrue(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.GRAVITINO_JDBC_USER));
assertTrue(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.GRAVITINO_JDBC_PASSWORD));
assertTrue(metadata.isHiddenProperty(S3Properties.GRAVITINO_S3_ACCESS_KEY_ID));
assertTrue(metadata.isHiddenProperty(S3Properties.GRAVITINO_S3_SECRET_ACCESS_KEY));
@@ -48,6 +47,8 @@ public class TestPaimonCatalogPropertiesMetadata {
void testNonSensitivePropertiesAreNotHidden() {
assertFalse(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.WAREHOUSE));
assertFalse(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.URI));
+ // jdbc-user identifies the account rather than a secret — align with JDBC
catalogs.
+
assertFalse(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.GRAVITINO_JDBC_USER));
// DLF token metadata (provider type, path, loader) is not a credential —
stays visible.
assertFalse(metadata.isHiddenProperty(PaimonConstants.GRAVITINO_TOKEN_PROVIDER));
assertFalse(metadata.isHiddenProperty(PaimonConstants.GRAVITINO_DLF_TOKEN_PATH));
diff --git a/core/src/main/java/org/apache/gravitino/Configs.java
b/core/src/main/java/org/apache/gravitino/Configs.java
index 134f36f2e5..4e354f7488 100644
--- a/core/src/main/java/org/apache/gravitino/Configs.java
+++ b/core/src/main/java/org/apache/gravitino/Configs.java
@@ -586,7 +586,7 @@ public class Configs {
public static final ConfigEntry<Boolean>
CATALOG_CREDENTIAL_BACKFILL_TO_PROPERTIES =
new ConfigBuilder("gravitino.catalog.credential.backfillToProperties")
.doc(
- "If true, the server exposes hidden catalog credentials (such as
jdbc-user and "
+ "If true, the server exposes hidden catalog credentials (such as
"
+ "jdbc-password) in the catalog properties response. Enable
only during a "
+ "rolling upgrade while old connectors that do not support
credential vending "
+ "are still in use. Enabling this is a security risk
because credentials "
diff --git a/docs/gravitino-server-config.md b/docs/gravitino-server-config.md
index 94768b8849..5f45568a26 100644
--- a/docs/gravitino-server-config.md
+++ b/docs/gravitino-server-config.md
@@ -343,7 +343,7 @@ vended credentials; the mechanism it opts out of is
described in
|-----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| `gravitino.catalog.cache.evictionIntervalMs` | Interval in
milliseconds before an idle catalog is evicted from the catalog cache.
| `3600000` |
| `gravitino.catalog.classloader.isolated` | Whether to load each
catalog's libraries and configuration in an isolated classloader rather than
the application classloader.
| `true` |
-| `gravitino.catalog.credential.backfillToProperties` | Whether to return
hidden catalog credentials such as `jdbc-user` and `jdbc-password` in the
catalog properties response, for connectors that cannot consume vended
credentials. Anyone who can read catalog properties can then read those
credentials. Turn it off once your connectors are upgraded. | `false` |
+| `gravitino.catalog.credential.backfillToProperties` | Whether to return
hidden catalog credentials such as `jdbc-password` in the catalog properties
response, for connectors that cannot consume vended credentials. Anyone who can
read catalog properties can then read those credentials. Turn it off once your
connectors are upgraded. | `false` |
### Securing the Server
diff --git a/docs/lakehouse-iceberg-catalog.md
b/docs/lakehouse-iceberg-catalog.md
index 881d77699a..332b305506 100644
--- a/docs/lakehouse-iceberg-catalog.md
+++ b/docs/lakehouse-iceberg-catalog.md
@@ -256,7 +256,7 @@ Gravitino provides the build-in
`org.apache.gravitino.iceberg.common.cache.Local
Refer to [Manage Catalogs and
Schemas](./manage-catalogs-and-schemas.md#catalog-operations) for more details.
:::note
-Sensitive catalog properties such as `s3-access-key-id`,
`s3-secret-access-key`, `oss-access-key-id`, and `oss-secret-access-key` are
hidden from the load catalog response. Use the [credential vending
API](security/credential-vending.md) to retrieve them at runtime.
+Sensitive catalog properties such as `jdbc-password`, `s3-access-key-id`,
`s3-secret-access-key`, `oss-access-key-id`, and `oss-secret-access-key` are
hidden from the load catalog response (`jdbc-user` is returned in plaintext).
Use the [credential vending API](security/credential-vending.md) to retrieve
them at runtime.
:::
## Schema
