yuqi1129 opened a new issue, #13092: URL: https://github.com/apache/gravitino/issues/13092
### Describe the subtask Replace raw `Authorization` replay with OAuth 2.0 token exchange (RFC 8693): Lance REST presents its own service identity to the identity provider and obtains a short-lived token issued for the caller with `audience = Gravitino`, then uses that token on the outbound call. This removes three limits of credential replay: Kerberos callers become forwardable (the exchange happens at Lance REST, where the Negotiate ticket is valid); OAuth tokens no longer need to be valid at both services; and Lance REST holds delegated, scoped, short-lived tokens instead of the caller's original credential. Depends on an identity provider that supports the exchange grant. The `LanceCallerTokenProvider` introduced for credential forwarding stays as the per-request seam — only `getCustomTokenInfo()` changes from "return the caller's header" to "exchange and return the delegated token". Deployments whose IdP lacks token exchange keep credential replay. ### Parent issue #13090 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
