Hi all, Polaris can already vend S3 credentials against a non-public endpoint. Catalog storage configuration includes endpoint and stsEndpoint, and the Floci S3 integration tests run vended-credentials on that path.
Azure and GCS have no equivalent. Polaris mints Azure user-delegation SAS against https://{account}.dfs.core.windows.net (or blob), derived from the table location. GCS downscoping always uses the public IAM and STS hosts. Private-link and emulator deployments cannot direct that minting at a local or private endpoint. The in-tree Floci Azure and GCS integration tests show the gap. Iceberg clients receive static shared-key or OAuth tokens plus a client host extra, because Polaris cannot vend through Floci. Therefore I propose optional catalog endpoint fields for Azure and GCS, analogous to S3 endpoint and stsEndpoint. Polaris would use them when minting Azure SAS and GCS downscoped tokens, and would pass the storage endpoint to Iceberg clients as FileIO extras. Azure token fetch uses the default credential chain against public Entra, so an emulator that also issues tokens may need an authority override as well. The Floci Azure and GCS integration tests could then use vended-credentials instead of static tokens. If this direction looks reasonable, I'll put up a PR & adjust the shape based on feedback here.. Thanks, Vignesh
