roryqi opened a new issue, #12958: URL: https://github.com/apache/gravitino/issues/12958
### Version main branch ### Describe what's wrong A `lakehouse-iceberg` catalog on ADLS cannot perform storage operations when it is configured with a complete Azure service principal but no shared account key. Although `azure-tenant-id`, `azure-client-id`, and `azure-client-secret` are available and work for credential vending, they are not passed to Iceberg's `ADLSFileIO`. Instead, the storage account name is unconditionally mapped to Iceberg shared-key authentication, causing Iceberg to require an account key. The configured service principal should be sufficient for `ADLSFileIO` authentication without requiring an account-wide shared key. ### Error message and/or stacktrace ```text Azure authentication: shared-key requires both adls.auth.shared-key.account.name and adls.auth.shared-key.account.key ``` ### How to reproduce Create a `lakehouse-iceberg` catalog with ADLSFileIO and a service principal, but without `azure-storage-account-key`: ```text "azure-storage-account-name": "<account>", "azure-tenant-id": "<tenant>", "azure-client-id": "<application-id>", "azure-client-secret": "<secret>", "warehouse": "abfss://warehouse@<account>.dfs.core.windows.net/iceberg", "io-impl": "org.apache.iceberg.azure.adlsv2.ADLSFileIO", "credential-providers": "adls-token" ``` Attempt to create a schema, create a table, or load a table. All operations fail with the shared-key validation error. Adding `azure-storage-account-key` makes the same operations succeed. ### Additional context Credential vending can successfully mint a user-delegation SAS using the same service principal, confirming that the credentials are valid. They are simply not wired to the server-side FileIO. A shared account key grants account-wide access and should not be required when a properly scoped service principal is configured. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
