Hi Rajesh, The current situation regarding vended credentials in federated catalogs has been explained in the linked GG discussion, I believe :)
Re: future direction, you're part of the community too :) I wonder whether vended credential pass-through is something that is beneficial to your use cases... just trying to understand the situation better. Why would you want the "BU" catalog to control credential vending? Thanks, Dmitri, On Tue, Jun 30, 2026 at 11:37 AM Rajesh Bulleddula < [email protected]> wrote: > Following the discussion on GitHub, starting a dev thread on credential > vending behavior in Apache Polaris catalog federation. > > https://github.com/apache/polaris/discussions/4929 > > I am evaluating catalog federation behavior in a data lakehouse setup using > Apache Iceberg with Apache Polaris. > > Architecture: > > - One central enterprise catalog > - Multiple BU (Business Unit) level child catalogs federated into the > central catalog > > Expected flow (based on my understanding): > > - Client queries an Iceberg table through the central catalog > - Central catalog forwards the request to the appropriate BU catalog > after RBAC validation > - BU catalog returns table metadata and vended credentials > - Central catalog returns the BU catalog’s metadata and the same vended > credentials back to the client > > Actual behavior observed: > > - BU catalog does return metadata + vended credentials > - Central catalog drops/ignores the BU-provided vended credentials > - Central catalog generates new vended credentials and sends that to the > client instead > > Question: > > What is the intended credential vending model for catalog federation? > > - Should the central catalog propagate the vended credentials returned by > the child catalog to the client (credential pass-through)? > > Or > > - Should the central catalog always generate and return its own vended > credentials, regardless of whether the child catalog has already vended > credentials? > > I'm interested in understanding the intended design philosophy for > federation and whether supporting vended credential pass-through is > something the community believes should be part of Polaris. > > -- > Thanks & Regards, > Rajesh Bulleddula >
