GitHub user melin created a discussion: not authorized for op
CREATE_TABLE_DIRECT_WITH_WRITE_DELEGATION
2026-07-31 09:02:59,027 INFO [org.apa.pol.ser.exc.IcebergExceptionMapper]
[f9fcc048-190f-4a7d-b0b1-a59440b17655_0000000000000000070,default-realm] [,,,]
(executor-thread-2) Handling runtimeException Principal 'root' with activated
PrincipalRoles '[service_admin]' and activated grants via '[service_admin,
catalog_admin]' is not authorized for op
CREATE_TABLE_DIRECT_WITH_WRITE_DELEGATION
```scala
object SparkPolarisSqlTest {
//
https://github.com/aliyun/datalake-catalog-metastore-client/blob/master/README-CN.md
def main(args: Array[String]): Unit = {
val spark = SparkSession.builder()
.master("local")
.config("spark.serializer", "org.apache.spark.serializer.KryoSerializer")
.config("spark.sql.catalog.polaris",
"org.apache.polaris.spark.SparkCatalog")
.config("spark.sql.catalog.polaris.uri",
"http://172.88.0.153:32122/api/catalog";)
.config("spark.sql.catalog.polaris.token-refresh-enabled", "true")
.config("spark.sql.catalog.polaris.credential", "polaris:polaris2026")
.config("spark.sql.catalog.polaris.warehouse", "minio_catalog")
.config("spark.sql.catalog.polaris.scope", "PRINCIPAL_ROLE:ALL")
.config("spark.sql.catalog.polaris.header.X-Iceberg-Access-Delegation",
"vended-credentials")
.config("spark.sql.catalog.polaris.rest.auth.type", "oauth2")
.config("spark.sql.catalog.polaris.oauth2-server-uri",
"http://172.88.0.153:32122/api/catalog/v1/oauth/tokens";)
.getOrCreate()
spark.sql("USE polaris")
spark.sql("CREATE NAMESPACE IF NOT EXISTS iceberg_demos")
spark.sql("USE NAMESPACE iceberg_demos")
spark.sql("""CREATE TABLE IF NOT EXISTS PEOPLE (
id int, name string)
USING iceberg;
""")
}
}
```
```shell
TOKEN=$(curl -s -v -o /tmp/token.json -w "%{http_code}" \
-X POST http://172.88.0.153:32122/api/catalog/v1/oauth/tokens \
-H "Content-Type: application/x-www-form-urlencoded" \
-d
"grant_type=client_credentials&client_id=polaris&client_secret=polaris2026&scope=PRINCIPAL_ROLE:ALL")
echo "HTTP $TOKEN"
TOKEN=$(jq -r '.access_token' /tmp/token.json)
echo "Token: $TOKEN"
CREDS=$(curl -s -v -X POST
http://172.88.0.153:32122/api/management/v1/principals \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-o /tmp/principal.json -w "%{http_code}" \
-d '{
"name": "superior-principal",
"type": "SERVICE"
}')
echo "HTTP $CREDS"
SUPERIOR_CLIENT_ID=$(jq -r '.credentials.clientId' /tmp/principal.json)
SUPERIOR_CLIENT_SECRET=$(jq -r '.credentials.clientSecret' /tmp/principal.json)
echo "Superior Client ID: $SUPERIOR_CLIENT_ID"
echo "Superior Client Secret: $SUPERIOR_CLIENT_SECRET"
```
### create catalog
```shell
curl -X POST http://172.88.0.153:32122/api/management/v1/catalogs \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{
"name": "minio_catalog",
"type": "INTERNAL",
"properties": {
"default-base-location": "s3://cyberengine/polaris-iceberg"
},
"storageConfigInfo": {
"storageType": "S3",
"allowedLocations": ["s3://cyberengine"],
"endpoint": "http://172.18.6.181:9330";,
"endpointInternal": "http://172.18.6.181:9330";,
"pathStyleAccess": true,
"stsUnavailable": true,
"region": "us-east-1"
}
}'
```
### Create a principal role
```shell
# 4a. Create a principal role
curl -X POST "http://172.88.0.153:32122/api/management/v1/principal-roles"; \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"principalRole": {"name": "superior-role"}}'
# 4b. Create a catalog role inside minio_catalog
curl -X POST
"http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"catalogRole": {"name": "superior-catalog-role"}}'
# 4c. Grant CATALOG_MANAGE_CONTENT privilege to the catalog role
curl -X PUT
"http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles/superior-catalog-role/grants";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"grant": {"type": "catalog", "privilege": "CATALOG_MANAGE_CONTENT"}}'
curl -v -X PUT
"http://172.88.0.153:32122/api/management/v1/catalogs/minio_catalog/catalog-roles/superior-catalog-role/grants";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"grant": {"type": "catalog", "privilege": "TABLE_CREATE"}}'
# 4d. Assign the catalog role to the principal role
curl -X PUT
"http://172.88.0.153:32122/api/management/v1/principal-roles/superior-role/catalog-roles/minio_catalog";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"catalogRole": {"name": "superior-catalog-role"}}'
# 4e. Assign the principal role to the superior principal
curl -X PUT
"http://172.88.0.153:32122/api/management/v1/principals/superior-principal/principal-roles";
\
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{"principalRole": {"name": "superior-role"}}'
```
### Create a namespace
```shell
curl -X POST
"http://172.88.0.153:32122/api/catalog/v1/minio_catalog/namespaces"; \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-w "\nHTTP %{http_code}" \
-d '{
"namespace": ["demo"],
"properties": {
"location": "s3://cyberengine/polaris-iceberg/demo"
}
}'
```
GitHub link: https://github.com/apache/polaris/discussions/5207
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: [email protected]
