yanggl29 opened a new pull request, #17392: URL: https://github.com/apache/iceberg/pull/17392
## Backgroud This PR adds built-in Alibaba Cloud authentication support for Iceberg REST catalogs through `rest.auth.type=aliyun`. It follows the dev-list discussion: https://lists.apache.org/thread/2jrm755rzj3930wmgvcrtw73qzhnl44n MaxCompute (ODPS) REST Catalog requests require Alibaba Cloud AK/SK signing. Without built-in support, users must package and configure a custom `AuthManager` JAR for each Spark, Flink, or other Iceberg deployment. ## Changes - Register `aliyun` as a built-in REST auth type. - Add `AliyunAuthManager` and `AliyunAuthSession`. - Add a pluggable `AliyunRequestSigner` interface. - Add the ODPS signer with V2 and V4 signing support. - Support AK/SK credentials, optional STS tokens, and environment-variable fallback. - Add unit tests for manager loading, credential validation, request canonicalization, V2/V4 signing, STS tokens, paths, and headers. The change is additive: existing defaults remain unchanged, no REST specification files are modified, and no new external runtime dependency is introduced. ## Configuration ```properties rest.auth.type=aliyun aliyun.auth.signing-name=odps aliyun.auth.access-key-id=<access-key-id> aliyun.auth.access-key-secret=<access-key-secret> # Optional: enable V4 signing aliyun.auth.region=cn-hangzhou # Optional: temporary credential aliyun.auth.sts-token=<security-token> ``` ## Signing implementation The ODPS canonical request and signing logic is adapted from the Alibaba Cloud ODPS Java SDK `release/0.58.x`: - [AliyunRequestSigner.java](https://github.com/aliyun/aliyun-odps-java-sdk/blob/release/0.58.x/odps-sdk/odps-sdk-core/src/main/java/com/aliyun/odps/account/AliyunRequestSigner.java) - [SecurityUtils.java](https://github.com/aliyun/aliyun-odps-java-sdk/blob/release/0.58.x/odps-sdk/odps-sdk-core/src/main/java/com/aliyun/odps/account/SecurityUtils.java) Only the required signing logic is included to avoid depending on the full ODPS SDK. The referenced sources are licensed under Apache License 2.0. Feedback is especially welcome on the `aliyun` auth type name and the provider-level signer abstraction. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
