diqiu50 opened a new issue, #13096: URL: https://github.com/apache/gravitino/issues/13096
### Version main branch (669344265) ### Describe what's wrong With `gravitino.client.authType=oauth2` and `gravitino.client.session.forwardUser=true`, the connector requires every session entering `getMetadata()` to carry a forwarded user token. Password-authenticated sessions, including internal catalog-management JDBC sessions used to register catalogs with the coordinator, have no such token and fail even though a shared service client is configured. ### Error message and/or stacktrace ```text No forwarded user token found in session extra-credentials under key 'token'. ``` The connector calls `resolveSessionMetadata()` from `getMetadata()`, which invokes `GravitinoAuthProvider.buildForSession()` and rejects the missing token. ### How to reproduce 1. Configure valid shared OAuth2 credentials for the connector, with `gravitino.client.authType=oauth2` and `gravitino.client.session.forwardUser=true`. 2. Use a password-authenticated Trino session without a `token` extra-credential. 3. Access metadata on a loaded Gravitino-backed catalog, for example `SHOW SCHEMAS FROM example_catalog`. Internal JDBC catalog registration can encounter the same metadata entry point. 4. Observe the missing-token exception instead of metadata access using the configured service identity. ### Additional context Proposed behavior: reuse shared service metadata when the configured token credential is absent, empty, or whitespace-only. Sessions carrying a token should keep user forwarding and propagate failures. SIMPLE username forwarding should remain unchanged. Tokenless metadata requests consequently use the service account's permissions. Downstream catalog/IRC authentication is separate and is not addressed by this change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
