diqiu50 opened a new issue, #13096:
URL: https://github.com/apache/gravitino/issues/13096

   ### Version
   
   main branch (669344265)
   
   ### Describe what's wrong
   
   With `gravitino.client.authType=oauth2` and 
`gravitino.client.session.forwardUser=true`, the connector requires every 
session entering `getMetadata()` to carry a forwarded user token. 
Password-authenticated sessions, including internal catalog-management JDBC 
sessions used to register catalogs with the coordinator, have no such token and 
fail even though a shared service client is configured.
   
   ### Error message and/or stacktrace
   
   ```text
   No forwarded user token found in session extra-credentials under key 'token'.
   ```
   
   The connector calls `resolveSessionMetadata()` from `getMetadata()`, which 
invokes `GravitinoAuthProvider.buildForSession()` and rejects the missing token.
   
   ### How to reproduce
   
   1. Configure valid shared OAuth2 credentials for the connector, with 
`gravitino.client.authType=oauth2` and 
`gravitino.client.session.forwardUser=true`.
   2. Use a password-authenticated Trino session without a `token` 
extra-credential.
   3. Access metadata on a loaded Gravitino-backed catalog, for example `SHOW 
SCHEMAS FROM example_catalog`. Internal JDBC catalog registration can encounter 
the same metadata entry point.
   4. Observe the missing-token exception instead of metadata access using the 
configured service identity.
   
   ### Additional context
   
   Proposed behavior: reuse shared service metadata when the configured token 
credential is absent, empty, or whitespace-only. Sessions carrying a token 
should keep user forwarding and propagate failures. SIMPLE username forwarding 
should remain unchanged.
   
   Tokenless metadata requests consequently use the service account's 
permissions. Downstream catalog/IRC authentication is separate and is not 
addressed by this change.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to