Copilot commented on code in PR #13195:
URL: https://github.com/apache/gravitino/pull/13195#discussion_r4016717530
##########
trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConnector.java:
##########
@@ -122,6 +126,37 @@ public ConnectorMetadata getMetadata(
metadata, catalogConnectorContext.getMetadataAdapter(),
internalMetadata);
}
+ /**
+ * Defers native REST authentication until a data operation needs it.
Catalog registration uses a
+ * password-authenticated management session without a delegated user token.
+ *
+ * @param session the authenticated query session
+ * @param transactionHandle the native transaction handle
+ * @return metadata that preserves user authentication at first data access
+ */
+ protected ConnectorMetadata getInternalMetadata(
+ ConnectorSession session, ConnectorTransactionHandle transactionHandle) {
+ if
(ICEBERG_PROVIDER.equals(catalogConnectorContext.getCatalog().getProvider())
+ && OAUTH2_PASSTHROUGH.equalsIgnoreCase(
+ catalogConnectorContext
+ .getConfig()
+ .getIcebergRestCatalogConfig()
+ .getOrDefault(
+ TRINO_ICEBERG_REST_SECURITY,
+ catalogConnectorContext
+ .getCatalog()
+ .getProperties()
+ .get(CATALOG_ICEBERG_REST_SECURITY)))) {
Review Comment:
This precedence is not the effective security mode for every Iceberg
connector. `IcebergConnectorAdapter` applies `gravitino.iceberg.rest-catalog.*`
only when routing through the Gravitino IRC; a `catalog-backend=rest` catalog
is explicitly not rerouted and instead uses its own `trino.bypass.*` settings
(`IcebergConnectorAdapter.java:93-128`). Consequently, with cluster security
`NONE` and a directly REST-backed catalog configured as `OAUTH2_PASSTHROUGH`,
this branch chooses eager initialization and reproduces the missing-token
failure. Base the decision on the internal connector's actual routed
configuration rather than applying cluster-over-catalog precedence
unconditionally.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
