Hi Team, Starting this thread as per [snazy](https://github.com/snazy)'s suggestion.
Currently all the polaris tools (focussing on mcp and the console ui) works based on client credentials to keep a session active with the REST Catalog. For scenarios where the catalog itself is set up with `polaris.authentication.type=external` - which disables the internal oauth server, we would like to be able to take advantage of OAuth2 flows (eg; Token Exchange). This helps persist the user session and keeps the entire RBAC in one place (the catalog), so clients can directly call the catalog APIs with the same user session. Today this is not possible, since in the mcp-server we either need to pass a long lived client credential or hard coded Bearer token, both of which will obfuscate who is actually accessing the catalog resources. [Issue#173](https://github.com/apache/polaris-tools/issues/197) contains a diagram and the flow I've in mind, along with what I've had success in implementing with minimal changes so far. Please let me know if this is worth spending some time on. Thank You!
