jerryshao commented on code in PR #14080:
URL: https://github.com/apache/gravitino/pull/14080#discussion_r4337013134
##########
core/src/main/java/org/apache/gravitino/connector/BaseCatalog.java:
##########
@@ -242,6 +245,45 @@ public void validateOnCreate() {
ops();
}
+ /**
+ * Whether this catalog provides path-based credential contexts, which token
credential providers
+ * such as {@code s3-token} require to vend credentials.
+ *
+ * @return {@code true} if path-based credentials are supported; {@code
false} (default) otherwise
+ */
+ public boolean supportsPathBasedCredentials() {
Review Comment:
nit: `supportsPathBasedCredentials()` defaults to false, while path vending
at request time is `ops() instanceof SupportsPathBasedCredentials`. Fileset
sets both; Iceberg correctly overrides only the flag because the Iceberg REST
server builds `PathBasedCredentialContext` itself. Please note on this method
that a custom catalog whose operations implement `SupportsPathBasedCredentials`
must override it, otherwise create/alter will reject `s3-token` even though
`getCredentials` can vend a path. Same docs pass: the "prefer short-lived token
providers" section in `docs/security/credential-vending.md` should say that
those providers are only accepted on Fileset and Iceberg.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
