danhuawang opened a new issue, #10978:
URL: https://github.com/apache/gravitino/issues/10978
### Version
main branch
### Describe what's wrong
After an idle period of 90 minutes following an initial Trino CLI query,
subsequent executions of the same query result in a ForbiddenException.
```
trino> SELECT * FROM remote_irc.gt_iceberg_test_update.tb01 ORDER BY name;
name | salary
------------+--------
alice | 16
alice2 | 16
bob_update | 14
lisa | 15
lisa2 | 15
tom | 12
(6 rows)
Query 20260506_075018_00095_ffihd, FINISHED, 1 node
http://34.138.225.171:8080/ui/query.html?20260506_075018_00095_ffihd
Splits: 8 total, 8 done (100.00%)
CPU Time: 0.0s total, 153 rows/s, 49.9KB/s, 39% active
Per Node: 0.0 parallelism, 2 rows/s, 668B/s
Parallelism: 0.0
Peak Memory: 556B
2.99 [6 rows, 1.95KB] [2 rows/s, 668B/s]
trino> SELECT * FROM remote_irc.gt_iceberg_test_update.tb01 ORDER BY name;
Query 20260506_092941_00096_ffihd failed: Failed to load view 'tb01'
io.trino.spi.TrinoException: Failed to load view 'tb01'
at
io.trino.plugin.iceberg.catalog.rest.TrinoRestCatalog.getIcebergView(TrinoRestCatalog.java:732)
at
io.trino.plugin.iceberg.catalog.rest.TrinoRestCatalog.getView(TrinoRestCatalog.java:699)
at
io.trino.plugin.iceberg.IcebergMetadata.getView(IcebergMetadata.java:3261)
at
io.trino.plugin.base.classloader.ClassLoaderSafeConnectorMetadata.getView(ClassLoaderSafeConnectorMetadata.java:717)
at
io.trino.tracing.TracingConnectorMetadata.getView(TracingConnectorMetadata.java:853)
at
io.trino.metadata.MetadataManager.getViewInternal(MetadataManager.java:1610)
at io.trino.metadata.MetadataManager.getView(MetadataManager.java:1548)
at io.trino.tracing.TracingMetadata.getView(TracingMetadata.java:921)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.visitTable(StatementAnalyzer.java:2303)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.visitTable(StatementAnalyzer.java:531)
at io.trino.sql.tree.Table.accept(Table.java:70)
at io.trino.sql.tree.AstVisitor.process(AstVisitor.java:27)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.process(StatementAnalyzer.java:550)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.analyzeFrom(StatementAnalyzer.java:5085)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.visitQuerySpecification(StatementAnalyzer.java:3142)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.visitQuerySpecification(StatementAnalyzer.java:531)
at
io.trino.sql.tree.QuerySpecification.accept(QuerySpecification.java:155)
at io.trino.sql.tree.AstVisitor.process(AstVisitor.java:27)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.process(StatementAnalyzer.java:550)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.process(StatementAnalyzer.java:558)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.visitQuery(StatementAnalyzer.java:1587)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.visitQuery(StatementAnalyzer.java:531)
at io.trino.sql.tree.Query.accept(Query.java:130)
at io.trino.sql.tree.AstVisitor.process(AstVisitor.java:27)
at
io.trino.sql.analyzer.StatementAnalyzer$Visitor.process(StatementAnalyzer.java:550)
at
io.trino.sql.analyzer.StatementAnalyzer.analyze(StatementAnalyzer.java:510)
at
io.trino.sql.analyzer.StatementAnalyzer.analyze(StatementAnalyzer.java:499)
at io.trino.sql.analyzer.Analyzer.analyze(Analyzer.java:98)
at io.trino.sql.analyzer.Analyzer.analyze(Analyzer.java:87)
at
io.trino.execution.SqlQueryExecution.analyze(SqlQueryExecution.java:283)
at
io.trino.execution.SqlQueryExecution.<init>(SqlQueryExecution.java:218)
at
io.trino.execution.SqlQueryExecution$SqlQueryExecutionFactory.createQueryExecution(SqlQueryExecution.java:882)
at
io.trino.dispatcher.LocalDispatchQueryFactory.lambda$createDispatchQuery$0(LocalDispatchQueryFactory.java:158)
at io.trino.$gen.Trino_478____20260505_160451_2.call(Unknown Source)
at
com.google.common.util.concurrent.TrustedListenableFutureTask$TrustedFutureInterruptibleTask.runInterruptibly(TrustedListenableFutureTask.java:128)
at
com.google.common.util.concurrent.InterruptibleTask.run(InterruptibleTask.java:74)
at
com.google.common.util.concurrent.TrustedListenableFutureTask.run(TrustedListenableFutureTask.java:80)
at
java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)
at
java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)
at java.base/java.lang.Thread.run(Thread.java:1474)
Caused by: org.apache.iceberg.exceptions.ForbiddenException: Forbidden:
Forbidden: User 'service-account-postman-client' is not authorized to perform
operation 'loadView' on metadata
'metalake_b.catalog_1.gt_iceberg_test_update.tb01' with expression 'ANY(OWNER,
METALAKE, CATALOG) ||
SCHEMA_OWNER_WITH_USE_CATALOG ||
ANY_USE_CATALOG && ANY_USE_SCHEMA && (VIEW::OWNER || ANY_SELECT_VIEW ||
ANY_CREATE_VIEW
|| ANY_SELECT_TABLE || ANY_MODIFY_TABLE || ANY_CREATE_TABLE)
'
at
org.apache.iceberg.rest.ErrorHandlers$DefaultErrorHandler.accept(ErrorHandlers.java:238)
at
org.apache.iceberg.rest.ErrorHandlers$ViewErrorHandler.accept(ErrorHandlers.java:168)
at
org.apache.iceberg.rest.ErrorHandlers$ViewErrorHandler.accept(ErrorHandlers.java:152)
at org.apache.iceberg.rest.HTTPClient.throwFailure(HTTPClient.java:240)
at org.apache.iceberg.rest.HTTPClient.execute(HTTPClient.java:336)
at org.apache.iceberg.rest.HTTPClient.execute(HTTPClient.java:297)
at org.apache.iceberg.rest.BaseHTTPClient.get(BaseHTTPClient.java:77)
at org.apache.iceberg.rest.RESTClient.get(RESTClient.java:88)
at
org.apache.iceberg.rest.RESTSessionCatalog.loadView(RESTSessionCatalog.java:1139)
at
io.trino.plugin.iceberg.catalog.rest.TrinoRestCatalog.getIcebergView(TrinoRestCatalog.java:726)
... 39 more
trino> SELECT * FROM remote_irc.gt_iceberg_test_update.tb01 ORDER BY name;
name | salary
------------+--------
alice | 16
alice2 | 16
bob_update | 14
lisa | 15
lisa2 | 15
tom | 12
(6 rows)
Query 20260506_092954_00097_ffihd, FINISHED, 1 node
http://34.138.225.171:8080/ui/query.html?20260506_092954_00097_ffihd
Splits: 8 total, 8 done (100.00%)
CPU Time: 0.1s total, 59 rows/s, 19.3KB/s, 24% active
Per Node: 0.0 parallelism, 1 rows/s, 651B/s
Parallelism: 0.0
Peak Memory: 648B
3.06 [6 rows, 1.95KB] [1 rows/s, 651B/s]
```
### Error message and/or stacktrace
```
2026-05-06 07:50:13.761 INFO [iceberg-rest-41]
[org.apache.iceberg.BaseMetastoreTableOperations.refreshFromMetadataLocation(BaseMetastoreTableOperations.java:190)]
- Refreshing table metadata from new version:
s3://irc-e2e-env1-metalake-b-warehouse/env1/metalake_b/catalog_1/gt_iceberg_test_update/tb01-3e4a81aa1e634eecb72bd2d983654a6f/metadata/00003-9ffab56e-0449-40f3-b1e9-38e9a883e946.metadata.json
2026-05-06 07:50:13.815 INFO [iceberg-rest-41]
[org.apache.iceberg.BaseMetastoreCatalog.loadTable(BaseMetastoreCatalog.java:69)]
- Table loaded by catalog: jdbc.gt_iceberg_test_update.tb01
2026-05-06 07:50:13.900 INFO [iceberg-rest-41]
[org.apache.iceberg.BaseMetastoreTableOperations.commit(BaseMetastoreTableOperations.java:130)]
- Successfully committed to table gt_iceberg_test_update.tb01 in 82 ms
2026-05-06 07:50:13.902 INFO [iceberg-rest-41]
[org.apache.iceberg.BaseMetastoreTableOperations.refreshFromMetadataLocation(BaseMetastoreTableOperations.java:190)]
- Refreshing table metadata from new version:
s3://irc-e2e-env1-metalake-b-warehouse/env1/metalake_b/catalog_1/gt_iceberg_test_update/tb01-3e4a81aa1e634eecb72bd2d983654a6f/metadata/00004-3868eba2-fba8-4126-835b-564753fd813b.metadata.json
2026-05-06 07:50:19.732 INFO [iceberg-rest-40]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> true
2026-05-06 07:50:19.732 INFO [iceberg-rest-40]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy:
[2891671032967709200, METALAKE, 1365525684669152879, USE_CATALOG, allow]
2026-05-06 07:50:19.733 INFO [iceberg-rest-40]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> false
2026-05-06 07:50:19.733 INFO [iceberg-rest-40]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 07:50:19.733 INFO [iceberg-rest-40]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, CATALOG, 1836798795800232444, USE_CATALOG] ---> false
2026-05-06 07:50:19.733 INFO [iceberg-rest-40]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 07:50:19.733 INFO [iceberg-rest-40]
[org.apache.gravitino.iceberg.service.rest.IcebergViewOperations.loadView(IcebergViewOperations.java:175)]
- Load Iceberg view, catalog: catalog_1, namespace: gt_iceberg_test_update,
view: tb01
2026-05-06 07:50:19.735 INFO [iceberg-rest-40]
[org.apache.gravitino.iceberg.service.IcebergExceptionMapper.toRESTResponse(IcebergExceptionMapper.java:136)]
- Iceberg REST server error maybe caused by user request, response http
status: 404, exception: class
org.apache.iceberg.exceptions.NoSuchViewException, exception message: View does
not exist: gt_iceberg_test_update.tb01
2026-05-06 07:50:19.823 INFO [iceberg-rest-36]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> true
2026-05-06 07:50:19.823 INFO [iceberg-rest-36]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy:
[2891671032967709200, METALAKE, 1365525684669152879, USE_CATALOG, allow]
2026-05-06 07:50:19.823 INFO [iceberg-rest-36]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> false
2026-05-06 07:50:19.823 INFO [iceberg-rest-36]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 07:50:19.824 INFO [iceberg-rest-36]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, CATALOG, 1836798795800232444, USE_CATALOG] ---> false
2026-05-06 07:50:19.824 INFO [iceberg-rest-36]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 07:50:19.824 INFO [iceberg-rest-36]
[org.apache.gravitino.iceberg.service.rest.IcebergTableOperations.loadTable(IcebergTableOperations.java:301)]
- Load Iceberg table, catalog: catalog_1, namespace: gt_iceberg_test_update,
table: tb01, access delegation: vended-credentials, credential vending: true
2026-05-06 07:50:19.826 INFO [iceberg-rest-36]
[org.apache.iceberg.BaseMetastoreTableOperations.refreshFromMetadataLocation(BaseMetastoreTableOperations.java:190)]
- Refreshing table metadata from new version:
s3://irc-e2e-env1-metalake-b-warehouse/env1/metalake_b/catalog_1/gt_iceberg_test_update/tb01-3e4a81aa1e634eecb72bd2d983654a6f/metadata/00004-3868eba2-fba8-4126-835b-564753fd813b.metadata.json
2026-05-06 07:50:19.919 INFO [iceberg-rest-36]
[org.apache.iceberg.BaseMetastoreCatalog.loadTable(BaseMetastoreCatalog.java:69)]
- Table loaded by catalog: jdbc.gt_iceberg_test_update.tb01
2026-05-06 07:50:19.920 INFO [iceberg-rest-36]
[org.apache.gravitino.iceberg.service.CatalogWrapperForREST.injectCredentialConfig(CatalogWrapperForREST.java:295)]
- Generate credential: s3-token for Iceberg table: gt_iceberg_test_update.tb01
2026-05-06 07:55:11.600 INFO [ForkJoinPool.commonPool-worker-44]
[org.apache.gravitino.iceberg.service.IcebergCatalogWrapperManager.lambda$new$0(IcebergCatalogWrapperManager.java:66)]
- Remove IcebergCatalogWrapper cache default_catalog.
2026-05-06 07:55:11.609 INFO [ForkJoinPool.commonPool-worker-44]
[org.apache.gravitino.iceberg.common.ops.IcebergCatalogWrapper.close(IcebergCatalogWrapper.java:355)]
- Closing IcebergCatalogWrapper for catalog: jdbc
2026-05-06 07:55:19.828 INFO [ForkJoinPool.commonPool-worker-44]
[org.apache.gravitino.catalog.CatalogManager.lambda$new$0(CatalogManager.java:320)]
- Closing catalog metalake_b.catalog_1.
2026-05-06 07:55:19.842 INFO [ForkJoinPool.commonPool-worker-44]
[org.apache.gravitino.iceberg.service.IcebergCatalogWrapperManager.lambda$new$0(IcebergCatalogWrapperManager.java:66)]
- Remove IcebergCatalogWrapper cache catalog_1.
2026-05-06 07:55:19.844 INFO [ForkJoinPool.commonPool-worker-44]
[org.apache.gravitino.iceberg.common.ops.IcebergCatalogWrapper.close(IcebergCatalogWrapper.java:355)]
- Closing IcebergCatalogWrapper for catalog: jdbc
2026-05-06 08:59:10.827 INFO [RelationalBackend-Garbage-Collector]
[org.apache.gravitino.storage.relational.RelationalGarbageCollector.collectAndClean(RelationalGarbageCollector.java:94)]
- Start to collect and delete old version data by thread 23
2026-05-06 09:29:44.134 INFO [iceberg-rest-40]
[org.apache.gravitino.connector.BaseCatalog.initAuthorizationPluginInstance(BaseCatalog.java:265)]
- Authorization provider is not set!
2026-05-06 09:29:44.318 INFO [iceberg-rest-40]
[org.apache.gravitino.iceberg.common.utils.IcebergCatalogUtil.loadCatalogBackend(IcebergCatalogUtil.java:163)]
- Load catalog backend of JDBC
2026-05-06 09:29:44.342 INFO [iceberg-rest-40]
[org.apache.iceberg.CatalogUtil.loadFileIO(CatalogUtil.java:382)] - Loading
custom FileIO implementation: org.apache.iceberg.aws.s3.S3FileIO
2026-05-06 09:29:44.543 INFO [iceberg-rest-41]
[org.apache.gravitino.iceberg.common.utils.IcebergCatalogUtil.loadCatalogBackend(IcebergCatalogUtil.java:163)]
- Load catalog backend of JDBC
2026-05-06 09:29:44.563 INFO [iceberg-rest-41]
[org.apache.iceberg.CatalogUtil.loadFileIO(CatalogUtil.java:382)] - Loading
custom FileIO implementation: org.apache.iceberg.aws.s3.S3FileIO
2026-05-06 09:29:44.828 INFO [iceberg-rest-41]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> false
2026-05-06 09:29:44.828 INFO [iceberg-rest-41]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 09:29:44.828 INFO [iceberg-rest-41]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, CATALOG, 1836798795800232444, USE_CATALOG] ---> false
2026-05-06 09:29:44.829 INFO [iceberg-rest-41]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 09:29:44.829 INFO [iceberg-rest-41]
[org.apache.gravitino.server.web.filter.BaseMetadataAuthorizationMethodInterceptor.invoke(BaseMetadataAuthorizationMethodInterceptor.java:192)]
- User 'service-account-postman-client' is not authorized to perform operation
'loadView' on metadata 'metalake_b.catalog_1.gt_iceberg_test_update.tb01' with
expression 'ANY(OWNER, METALAKE, CATALOG) ||
SCHEMA_OWNER_WITH_USE_CATALOG ||
ANY_USE_CATALOG && ANY_USE_SCHEMA && (VIEW::OWNER || ANY_SELECT_VIEW ||
ANY_CREATE_VIEW
|| ANY_SELECT_TABLE || ANY_MODIFY_TABLE || ANY_CREATE_TABLE)
'
2026-05-06 09:29:44.829 INFO [iceberg-rest-41]
[org.apache.gravitino.iceberg.service.IcebergExceptionMapper.toRESTResponse(IcebergExceptionMapper.java:136)]
- Iceberg REST server error maybe caused by user request, response http
status: 403, exception: class org.apache.iceberg.exceptions.ForbiddenException,
exception message: User 'service-account-postman-client' is not authorized to
perform operation 'loadView' on metadata
'metalake_b.catalog_1.gt_iceberg_test_update.tb01' with expression 'ANY(OWNER,
METALAKE, CATALOG) ||
SCHEMA_OWNER_WITH_USE_CATALOG ||
ANY_USE_CATALOG && ANY_USE_SCHEMA && (VIEW::OWNER || ANY_SELECT_VIEW ||
ANY_CREATE_VIEW
|| ANY_SELECT_TABLE || ANY_MODIFY_TABLE || ANY_CREATE_TABLE)
'
2026-05-06 09:29:55.020 INFO [iceberg-rest-43]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> true
2026-05-06 09:29:55.020 INFO [iceberg-rest-43]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy:
[2891671032967709200, METALAKE, 1365525684669152879, USE_CATALOG, allow]
2026-05-06 09:29:55.020 INFO [iceberg-rest-43]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> false
2026-05-06 09:29:55.020 INFO [iceberg-rest-43]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 09:29:55.021 INFO [iceberg-rest-43]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, CATALOG, 1836798795800232444, USE_CATALOG] ---> false
2026-05-06 09:29:55.021 INFO [iceberg-rest-43]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 09:29:55.021 INFO [iceberg-rest-43]
[org.apache.gravitino.iceberg.service.rest.IcebergViewOperations.loadView(IcebergViewOperations.java:175)]
- Load Iceberg view, catalog: catalog_1, namespace: gt_iceberg_test_update,
view: tb01
2026-05-06 09:29:55.024 INFO [iceberg-rest-43]
[org.apache.gravitino.iceberg.service.IcebergExceptionMapper.toRESTResponse(IcebergExceptionMapper.java:136)]
- Iceberg REST server error maybe caused by user request, response http
status: 404, exception: class
org.apache.iceberg.exceptions.NoSuchViewException, exception message: View does
not exist: gt_iceberg_test_update.tb01
2026-05-06 09:29:55.100 INFO [iceberg-rest-42]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> true
2026-05-06 09:29:55.101 INFO [iceberg-rest-42]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy:
[2891671032967709200, METALAKE, 1365525684669152879, USE_CATALOG, allow]
2026-05-06 09:29:55.101 INFO [iceberg-rest-42]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, METALAKE, 1365525684669152879, USE_CATALOG] ---> false
2026-05-06 09:29:55.101 INFO [iceberg-rest-42]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 09:29:55.101 INFO [iceberg-rest-42]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:115)] - Request:
[839279769178943184, CATALOG, 1836798795800232444, USE_CATALOG] ---> false
2026-05-06 09:29:55.101 INFO [iceberg-rest-42]
[org.casbin.jcasbin.util.Util.logEnforce(Util.java:117)] - Hit Policy: []
2026-05-06 09:29:55.102 INFO [iceberg-rest-42]
[org.apache.gravitino.iceberg.service.rest.IcebergTableOperations.loadTable(IcebergTableOperations.java:301)]
- Load Iceberg table, catalog: catalog_1, namespace: gt_iceberg_test_update,
table: tb01, access delegation: vended-credentials, credential vending: true
2026-05-06 09:29:55.105 INFO [iceberg-rest-42]
[org.apache.iceberg.BaseMetastoreTableOperations.refreshFromMetadataLocation(BaseMetastoreTableOperations.java:190)]
- Refreshing table metadata from new version:
s3://irc-e2e-env1-metalake-b-warehouse/env1/metalake_b/catalog_1/gt_iceberg_test_update/tb01-3e4a81aa1e634eecb72bd2d983654a6f/metadata/00004-3868eba2-fba8-4126-835b-564753fd813b.metadata.json
2026-05-06 09:29:55.382 INFO [iceberg-rest-42]
[org.apache.iceberg.BaseMetastoreCatalog.loadTable(BaseMetastoreCatalog.java:69)]
- Table loaded by catalog: jdbc.gt_iceberg_test_update.tb01
2026-05-06 09:29:55.517 INFO [iceberg-rest-42]
[org.apache.gravitino.iceberg.service.CatalogWrapperForREST.injectCredentialConfig(CatalogWrapperForREST.java:295)]
- Generate credential: s3-token for Iceberg table: gt_iceberg_test_update.tb01
```
### How to reproduce
0. Environment background:
a. Gravitino enable OAuth2
b. IRC catalog properties:
```
{
"code": 0,
"catalog": {
"name": "catalog_1",
"type": "relational",
"provider": "lakehouse-iceberg",
"comment": "env1 catalog",
"properties": {
"jdbc-password": "gravitino",
"jdbc-driver": "org.postgresql.Driver",
"jdbc-schema-version": "V1",
"io-impl": "org.apache.iceberg.aws.s3.S3FileIO",
"s3-secret-access-key": "XXXXXX",
"warehouse":
"s3://irc-e2e-env1-warehouse/env1/metalake_b/catalog_1",
"credential-providers": "s3-token",
"uri":
"jdbc:postgresql://gravitino-env1-metalake-b-postgresql.irc-e2e-env1:5432/gravitinoIRC",
"in-use": "true",
"catalog-backend": "jdbc",
"s3-access-key-id": "XXXXXXX",
"s3-token-expire-in-secs": "900",
"jdbc-user": "gravitino",
"jdbc-initialize": "true",
"s3-region": "us-east-1",
"s3-role-arn": "arn:aws:iam::XXXXX:role/sts_s3_role"
},
"audit": {
"creator": "service-account-postman-client",
"createTime": "2026-04-27T11:54:16.594716071Z",
"lastModifier": "admin",
"lastModifiedTime": "2026-05-06T04:26:01.170748872Z"
}
}
}
```
c. Trino catalog properties:
```
cat /etc/trino/catalog/remote_irc.properties
connector.name=iceberg
iceberg.catalog.type=rest
iceberg.rest-catalog.uri=http://gravitino.irc-e2e-env1:9001/iceberg/
iceberg.rest-catalog.prefix=catalog_2
iceberg.rest-catalog.warehouse=catalog_2
iceberg.rest-catalog.security=OAUTH2
iceberg.rest-catalog.oauth2.server-uri=http://XXXX:8080/realms/myrealm/protocol/openid-connect/token
iceberg.rest-catalog.oauth2.credential=trino-client:XXXX
iceberg.rest-catalog.oauth2.scope=openid profile email
iceberg.rest-catalog.nested-namespace-enabled=true
iceberg.rest-catalog.vended-credentials-enabled=true
fs.native-s3.enabled=true
s3.region=us-east-1
```
1. Trino (connecting IRC),run sql:
```
trino> SELECT * FROM remote_irc.gt_iceberg_test_update.tb01 ORDER BY name;
```
2. after an idle period of 90 minutes (maybe shorten)
3. Rerun sql:
```
trino> SELECT * FROM remote_irc.gt_iceberg_test_update.tb01 ORDER BY name;
```
### Additional context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
