roryqi opened a new pull request, #12959: URL: https://github.com/apache/gravitino/pull/12959
### What changes were proposed in this pull request? - Configure Iceberg ADLS FileIO with a token credential provider when a complete Azure service principal is supplied without a shared account key. - Add `AzureClientSecretTokenCredentialProvider` backed by Azure `ClientSecretCredential`. - Preserve shared-key authentication when both the account name and account key are configured. - Mark `azure-client-secret` as a hidden catalog property. - Update the ADLS cloud integration test to operate without a shared account key. - Add tests for authentication-property conversion, Iceberg provider loading, and client-secret masking. ### Why are the changes needed? The Azure storage account name was always translated to Iceberg's shared-key account-name property. When no account key was provided, Iceberg treated the configuration as incomplete shared-key authentication and rejected every storage operation. As a result, a valid service principal could be used for credential vending but not by the server-side ADLS FileIO, forcing users to additionally provide an account-wide shared key. Fix: #12958 ### Does this PR introduce _any_ user-facing change? Yes. An ADLS-backed Iceberg catalog can now use `azure-tenant-id`, `azure-client-id`, and `azure-client-secret` for FileIO authentication without configuring `azure-storage-account-key`. The value of `azure-client-secret` is now masked when catalog properties are returned. No new user-facing property keys are introduced. ### How was this patch tested? - `./gradlew spotlessApply` - `./gradlew :catalogs:catalog-common:test --tests org.apache.gravitino.lakehouse.iceberg.TestIcebergPropertiesUtils` - `./gradlew :iceberg:iceberg-common:test --tests org.apache.gravitino.iceberg.common.credential.TestAzureClientSecretTokenCredentialProvider` - `./gradlew :catalogs:catalog-lakehouse-iceberg:test --tests org.apache.gravitino.catalog.lakehouse.iceberg.TestIcebergCatalog` - `./gradlew :iceberg:iceberg-rest-server:compileTestJava` The Azure cloud integration test was updated to omit the shared account key. It requires the external Azure cloud-test environment and was compiled locally but not executed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
