This is an automated email from the ASF dual-hosted git repository.
jerryshao pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new 1a615397a0 [#13124] fix(catalogs): return jdbc-user in plaintext for
Iceberg and Paimon (#13125)
1a615397a0 is described below
commit 1a615397a0d46e5e71c0be879da4c100f0bad905
Author: MaSai <[email protected]>
AuthorDate: Mon Sep 14 17:00:31 2026 +0800
[#13124] fix(catalogs): return jdbc-user in plaintext for Iceberg and
Paimon (#13125)
### What changes were proposed in this pull request?
Mark `jdbc-user` as not hidden in Iceberg and Paimon catalog properties
metadata, matching JDBC catalogs after #12750. Update unit tests and
docs.
### Why are the changes needed?
#12750 treated `jdbc-user` as an account identifier (plaintext) for
JDBC,
but Iceberg/Paimon still masked it as `******`, causing cross-catalog
inconsistency.
Fix: #13124
### Does this PR introduce _any_ user-facing change?
Yes. `GET .../catalogs/{catalog}` for lakehouse-iceberg /
lakehouse-paimon
now returns `jdbc-user` in plaintext. `jdbc-password` remains masked.
### How was this patch tested?
- `TestIcebergCatalogPropertiesMetadata`
- `TestPaimonCatalogPropertiesMetadata`
---------
Co-authored-by: Cursor <[email protected]>
---
.../lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java | 2 +-
.../lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java | 8 ++++++++
.../catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java | 2 +-
.../lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java | 3 ++-
core/src/main/java/org/apache/gravitino/Configs.java | 2 +-
docs/gravitino-server-config.md | 2 +-
docs/lakehouse-iceberg-catalog.md | 2 +-
7 files changed, 15 insertions(+), 6 deletions(-)
diff --git
a/catalogs/catalog-lakehouse-iceberg/src/main/java/org/apache/gravitino/catalog/lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java
b/catalogs/catalog-lakehouse-iceberg/src/main/java/org/apache/gravitino/catalog/lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java
index bf6246a738..8defa29fbd 100644
---
a/catalogs/catalog-lakehouse-iceberg/src/main/java/org/apache/gravitino/catalog/lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java
+++
b/catalogs/catalog-lakehouse-iceberg/src/main/java/org/apache/gravitino/catalog/lakehouse/iceberg/IcebergCatalogPropertiesMetadata.java
@@ -91,7 +91,7 @@ public class IcebergCatalogPropertiesMetadata extends
BaseCatalogPropertiesMetad
"JDBC user for Iceberg JDBC backend",
false /* immutable */,
null /* defaultValue */,
- true /* hidden */),
+ false /* hidden */),
stringOptionalPropertyEntry(
GRAVITINO_JDBC_PASSWORD,
"JDBC password for Iceberg JDBC backend",
diff --git
a/catalogs/catalog-lakehouse-iceberg/src/test/java/org/apache/gravitino/catalog/lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java
b/catalogs/catalog-lakehouse-iceberg/src/test/java/org/apache/gravitino/catalog/lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java
index 0faf851030..8ca4c3d85a 100644
---
a/catalogs/catalog-lakehouse-iceberg/src/test/java/org/apache/gravitino/catalog/lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java
+++
b/catalogs/catalog-lakehouse-iceberg/src/test/java/org/apache/gravitino/catalog/lakehouse/iceberg/TestIcebergCatalogPropertiesMetadata.java
@@ -35,6 +35,14 @@ public class TestIcebergCatalogPropertiesMetadata {
metadata = new IcebergCatalogPropertiesMetadata();
}
+ @Test
+ void testJdbcUserIsVisibleAndPasswordIsHidden() {
+ Assertions.assertFalse(
+
metadata.isHiddenProperty(IcebergCatalogPropertiesMetadata.GRAVITINO_JDBC_USER));
+ Assertions.assertTrue(
+
metadata.isHiddenProperty(IcebergCatalogPropertiesMetadata.GRAVITINO_JDBC_PASSWORD));
+ }
+
@Test
void testTableMetadataCacheImplDefaultValue() {
Assertions.assertEquals(
diff --git
a/catalogs/catalog-lakehouse-paimon/src/main/java/org/apache/gravitino/catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java
b/catalogs/catalog-lakehouse-paimon/src/main/java/org/apache/gravitino/catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java
index 5a7d124e88..deeb86d1da 100644
---
a/catalogs/catalog-lakehouse-paimon/src/main/java/org/apache/gravitino/catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java
+++
b/catalogs/catalog-lakehouse-paimon/src/main/java/org/apache/gravitino/catalog/lakehouse/paimon/PaimonCatalogPropertiesMetadata.java
@@ -199,7 +199,7 @@ public class PaimonCatalogPropertiesMetadata extends
BaseCatalogPropertiesMetada
"Gravitino Paimon catalog jdbc user",
false /* immutable */,
null /* defaultValue */,
- true /* hidden */),
+ false /* hidden */),
stringOptionalPropertyEntry(
GRAVITINO_JDBC_PASSWORD,
"Gravitino Paimon catalog jdbc password",
diff --git
a/catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java
b/catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java
index ead7541c40..433ece5279 100644
---
a/catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java
+++
b/catalogs/catalog-lakehouse-paimon/src/test/java/org/apache/gravitino/catalog/lakehouse/paimon/TestPaimonCatalogPropertiesMetadata.java
@@ -33,7 +33,6 @@ public class TestPaimonCatalogPropertiesMetadata {
@Test
void testSensitivePropertiesAreHidden() {
-
assertTrue(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.GRAVITINO_JDBC_USER));
assertTrue(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.GRAVITINO_JDBC_PASSWORD));
assertTrue(metadata.isHiddenProperty(S3Properties.GRAVITINO_S3_ACCESS_KEY_ID));
assertTrue(metadata.isHiddenProperty(S3Properties.GRAVITINO_S3_SECRET_ACCESS_KEY));
@@ -51,6 +50,8 @@ public class TestPaimonCatalogPropertiesMetadata {
void testNonSensitivePropertiesAreNotHidden() {
assertFalse(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.WAREHOUSE));
assertFalse(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.URI));
+ // jdbc-user identifies the account rather than a secret — align with JDBC
catalogs.
+
assertFalse(metadata.isHiddenProperty(PaimonCatalogPropertiesMetadata.GRAVITINO_JDBC_USER));
assertFalse(metadata.isHiddenProperty(AzureProperties.GRAVITINO_AZURE_STORAGE_ACCOUNT_NAME));
assertFalse(metadata.isHiddenProperty(GCSProperties.GRAVITINO_GCS_SERVICE_ACCOUNT_FILE));
// DLF token metadata (provider type, path, loader) is not a credential —
stays visible.
diff --git a/core/src/main/java/org/apache/gravitino/Configs.java
b/core/src/main/java/org/apache/gravitino/Configs.java
index c638288c39..863492abf7 100644
--- a/core/src/main/java/org/apache/gravitino/Configs.java
+++ b/core/src/main/java/org/apache/gravitino/Configs.java
@@ -618,7 +618,7 @@ public class Configs {
public static final ConfigEntry<Boolean>
CATALOG_CREDENTIAL_BACKFILL_TO_PROPERTIES =
new ConfigBuilder("gravitino.catalog.credential.backfillToProperties")
.doc(
- "If true, the server exposes hidden catalog credentials (such as
jdbc-user and "
+ "If true, the server exposes hidden catalog credentials (such as
"
+ "jdbc-password) in the catalog properties response. Enable
only during a "
+ "rolling upgrade while old connectors that do not support
credential vending "
+ "are still in use. Enabling this is a security risk
because credentials "
diff --git a/docs/gravitino-server-config.md b/docs/gravitino-server-config.md
index 7da4f85cfe..9a39b1a613 100644
--- a/docs/gravitino-server-config.md
+++ b/docs/gravitino-server-config.md
@@ -345,7 +345,7 @@ vended credentials; the mechanism it opts out of is
described in
| `gravitino.catalog.cache.evictionIntervalMs` | Interval in
milliseconds before an idle catalog is evicted from the catalog cache.
| `3600000` |
| `gravitino.catalog.classloader.isolated` | Whether to load each
catalog's libraries and configuration in an isolated classloader rather than
the application classloader.
| `true` |
| `gravitino.catalog.classloader.sharing.enabled` | Whether catalogs whose
isolation-relevant properties match may share one classloader. Sharing reduces
Metaspace usage; disabling it gives every catalog its own.
| `true` |
-| `gravitino.catalog.credential.backfillToProperties` | Whether to return
hidden catalog credentials such as `jdbc-user` and `jdbc-password` in the
catalog properties response, for connectors that cannot consume vended
credentials. Anyone who can read catalog properties can then read those
credentials. Turn it off once your connectors are upgraded. | `false` |
+| `gravitino.catalog.credential.backfillToProperties` | Whether to return
hidden catalog credentials such as `jdbc-password` in the catalog properties
response, for connectors that cannot consume vended credentials. Anyone who can
read catalog properties can then read those credentials. Turn it off once your
connectors are upgraded. | `false` |
### Securing the Server
diff --git a/docs/lakehouse-iceberg-catalog.md
b/docs/lakehouse-iceberg-catalog.md
index 6f4741f15f..5ebe5bbcbb 100644
--- a/docs/lakehouse-iceberg-catalog.md
+++ b/docs/lakehouse-iceberg-catalog.md
@@ -258,7 +258,7 @@ Gravitino provides the build-in
`org.apache.gravitino.iceberg.common.cache.Local
Refer to [Manage Catalogs and
Schemas](./manage-catalogs-and-schemas.md#catalog-operations) for more details.
:::note
-Sensitive catalog properties such as credential-vending keys are hidden from
the default load catalog response. Retrieve secret-manager-backed properties
(including keys that overlap with credential vending) via `getSecrets` / `GET
.../objects/{type}/{fullName}/secrets`. The [credential vending
API](security/credential-vending.md) remains available for typed credential
delivery.
+Sensitive catalog properties such as `jdbc-password` and cloud credential keys
are hidden from the default load catalog response (`jdbc-user` is returned in
plaintext). Retrieve secret-manager-backed properties (including keys that
overlap with credential vending) via `getSecrets` / `GET
.../objects/{type}/{fullName}/secrets`. The [credential vending
API](security/credential-vending.md) remains available for typed credential
delivery.
:::
## Schema
