lasdf1234 opened a new pull request, #14289:
URL: https://github.com/apache/gravitino/pull/14289
### What changes were proposed in this pull request?
- Build a `UserPrincipal` (with Authorization header) from
`gravitino.maintenance.gravitinoAuth.*` for TMS control-plane threads.
- Run `policy-expand` and commit-chain collect under `PrincipalUtils.doAs` so
lakehouse `catalog-backend=rest` can forward credentials to Iceberg REST
via
`UserPrincipalForwardingAuthManager`.
- When gravitinoAuth is unset/`none`, behavior is unchanged (jdbc/hive ITs
keep working).
### Why are the changes needed?
db-scheduler has no inbound HTTP Authorization. Nearest-policy resolve calls
`tableExists` → REST catalog → IRC and fails with `NotAuthorized` without a
forwardable principal.
### Does this PR introduce _any_ user-facing change?
Operators with OAuth/basic IRC behind a rest lakehouse catalog should
configure
`gravitino.maintenance.gravitinoAuth.*` so expand/commit resolve can
authenticate
to IRC. No new property keys; reuses existing gravitinoAuth bag.
### How was this patch tested?
- `TestGravitinoAuthSettings` (basic header / principal name)
- `TestMaintenanceControlPlaneAuth` (doAs installs Basic principal)
- `TestPolicyExpandPipeline`
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
