diqiu50 opened a new issue, #12021: URL: https://github.com/apache/gravitino/issues/12021
### Describe the feature Extend `gravitino.client.session.forwardUser` to also work with `authType=oauth2`, forwarding the real end user's token to Gravitino (and Iceberg REST catalogs) instead of only trusting the username via `authType=simple`. ### Motivation Session forwarding today only supports `simple`, which isn't enough for deployments that need real per-user authorization. `oauth2` is currently rejected outright when `forwardUser=true`. ### Describe the solution - `GravitinoAuthProvider.buildForSession` reads the forwarded token from Trino session extra-credentials (key `token`) and uses it via a new `StaticUserTokenProvider`. - Per-user session cache keyed by `authType:user` instead of hardcoded `simple:`. - `IcebergCatalogPropertyConverter` sets `security=OAUTH2`/`session=USER` for REST-backed Iceberg catalogs so forwarding also reaches the IRC. ### Additional context Requires a Trino coordinator that forwards the end user's IdP token as an extra credential (tracked separately). Verified end-to-end locally, including negative and multi-user cases. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
