dengc367 opened a new pull request, #14343:
URL: https://github.com/apache/gravitino/pull/14343
### What changes were proposed in this pull request?
Adds support for the OAuth2 `password` grant to the Java client, so a Spark
or Flink job submitted
through the Gravitino runtime can request a token on behalf of a user
instead of only being able to
use `grant_type=client_credentials`.
`OAuth2ClientUtil` now accepts a four-part credential
`client_id:client_secret:username:password` in
addition to the existing `client_id:client_secret` and `client_secret`
forms. When the username is
present the token request uses `grant_type=password` and sends `username`
and `password`. The
credential is split into at most four parts, so a password may contain `:`,
and an empty client ID
(`:client_secret:username:password`) is allowed for servers that do not
require one.
The Spark, Flink and Trino connector authentication docs are updated with
the new credential
formats.
### Why are the changes needed?
The connectors authenticate to Gravitino through a single
`oauth2.credential` property. With only
`client_credentials` supported, every job is authenticated as one service
account, so user-level
authorization, audit and group mapping cannot be applied to the actual
submitter. This is the
missing piece reported in #10749.
Fixes #10749
### Does this PR introduce _any_ user-facing change?
Yes. The `oauth2.credential` property of the Spark, Flink and Trino
connectors accepts a new
`client_id:client_secret:username:password` format. The existing one- and
two-part formats keep the
`client_credentials` behavior, and a three-part credential is rejected as
ambiguous.
### How was this patch tested?
- Added `TestOAuth2TokenProvider#testAuthenticationPasswordGrant`, which
asserts the exact form body
(`grant_type=password`, `client_id`, `client_secret`, `username`,
`password`, `scope`) sent to the
token endpoint, including a password that contains `:`.
- Added `TestOAuth2TokenProvider#testInvalidCredential`, which covers the
ambiguous three-part
credential and a missing username/password.
```bash
./gradlew :clients:client-java:test --tests
"org.apache.gravitino.client.TestOAuth2TokenProvider" -PskipITs
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
