markhoerth opened a new issue, #14450: URL: https://github.com/apache/gravitino/issues/14450
### Version main branch ### Describe what's wrong 1. `X-Iceberg-Access-Delegation` is compared as a whole value. `remote-signing` is refused with 406 and any comma-separated list, including the spec's own example `vended-credentials,remote-signing`, with 400. The spec defines the header as "a comma-separated list of access mechanisms" the client supports, and "the server may choose to supply access via any or none of the requested mechanisms". (`IcebergTableOperations.isCredentialVending`) 2. On a catalog with no credential provider for the table location, every create, register, load or scan-plan request carrying `vended-credentials` returns 400 "No credential provider found for path ...". For create and register the table has already been committed when the 400 is returned. pyiceberg sends the header by default, so such catalogs cannot be used from pyiceberg. (`CatalogWrapperForREST.shouldGenerateCredential` does not check for a provider; `CatalogCredentialManager.getCredentialByPath` throws.) 3. The `s3-token` provider builds its STS client only from `s3-access-key-id` / `s3-secret-access-key`. A server that authenticates to AWS with an instance profile or service account cannot vend credentials, and because the provider fails to initialize, every request on the catalog returns 500, including `/v1/config`. (`S3TokenGenerator.createStsClient`) ### Error message and/or stacktrace ``` GET /v1/cat/namespaces/ns/tables/t X-Iceberg-Access-Delegation: remote-signing 406 GET /v1/cat/namespaces/ns/tables/t X-Iceberg-Access-Delegation: vended-credentials,remote-signing 400 POST /v1/cat/namespaces/ns/tables X-Iceberg-Access-Delegation: vended-credentials (no provider) 400, table created GET /v1/config?warehouse=cat (s3-token, no static keys) 500 "null in s3-access-key-id is invalid" ``` ### How to reproduce 1. Load any table with `X-Iceberg-Access-Delegation: vended-credentials,remote-signing`. 2. On a catalog without `credential-providers`, create a table with `X-Iceberg-Access-Delegation: vended-credentials`, then load it without the header. 3. Create a catalog with `credential-providers=s3-token`, `s3-role-arn` and `s3-region` but no static keys, on a host with an instance profile, then call `/v1/config?warehouse=` that catalog. ### Additional context The header signals what the client supports; it is not a demand the server must refuse when it cannot meet it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
