(gravitino) 04/04: [#13033] fix(iceberg): Map PostgreSQL JDBC auth failures to ConnectionFailedException (#13034)

[jshao]

This is an automated email from the ASF dual-hosted git repository.

jerryshao pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git

commit 8d1e1524a579c8b1facffcfb14f01127a069eeb5
Author: MaSai <30949009+lasdf1...@users.noreply.github.com>
AuthorDate: Thu Sep 10 09:03:35 2026 +0800

    [#13033] fix(iceberg): Map PostgreSQL JDBC auth failures to 
ConnectionFailedException (#13034)
    
    Classify Iceberg JDBC catalog authorization failures via SQLState class
    `28` (plus MySQL/PostgreSQL message fallbacks), so PostgreSQL
    bad-credential errors become `ConnectionFailedException` like MySQL
    `Access denied`.
    
    Previously only the literal `Access denied` was matched. PostgreSQL
    reports `password authentication failed` / `role ... does not exist`
    (`28P01` / `28000`), so failures escaped as raw `UncheckedSQLException`.
    
    Fix: #13033
    
    - PostgreSQL Iceberg JDBC catalogs with bad credentials now surface
    `ConnectionFailedException` instead of a generic internal error.
    - No new APIs or property keys.
    
    ```
    ./gradlew :iceberg:iceberg-common:test --tests 
org.apache.gravitino.iceberg.common.utils.TestIcebergCatalogUtil -PskipITs
    ```
    
    ---------
    
    Co-authored-by: Cursor <cursorag...@cursor.com>
---
 .../iceberg/common/utils/IcebergCatalogUtil.java      | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git 
a/iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java
 
b/iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java
index 74aeb2c54b..03a494a4ec 100644
--- 
a/iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java
+++ 
b/iceberg/iceberg-common/src/main/java/org/apache/gravitino/iceberg/common/utils/IcebergCatalogUtil.java
@@ -69,6 +69,15 @@ public class IcebergCatalogUtil {
 
   private static final Logger LOG = 
LoggerFactory.getLogger(IcebergCatalogUtil.class);
 
+  /**
+   * SQLSTATE {@code 28000}: MySQL error 1045 (Access denied), H2 wrong 
user/password, and
+   * PostgreSQL {@code invalid_authorization_specification} (for example 
unknown role).
+   */
+  private static final String SQLSTATE_INVALID_AUTHORIZATION = "28000";
+
+  /** SQLSTATE {@code 28P01}: PostgreSQL {@code invalid_password}. */
+  private static final String SQLSTATE_INVALID_PASSWORD = "28P01";
+
   private static final String GCS_CLOUD_PLATFORM_SCOPE =
       "https://www.googleapis.com/auth/cloud-platform";;
 
@@ -184,9 +193,13 @@ public class IcebergCatalogUtil {
     try {
       jdbcCatalog.initialize(icebergCatalogName, properties);
     } catch (UncheckedSQLException e) {
-      if (e.getCause() instanceof SQLException
-          && e.getCause().getMessage().contains("Access denied")) {
-        throw new ConnectionFailedException(e, e.getMessage());
+      Throwable cause = e.getCause();
+      if (cause instanceof SQLException) {
+        String sqlState = ((SQLException) cause).getSQLState();
+        if (SQLSTATE_INVALID_AUTHORIZATION.equals(sqlState)
+            || SQLSTATE_INVALID_PASSWORD.equals(sqlState)) {
+          throw new ConnectionFailedException(e, e.getMessage());
+        }
       }
       throw e;
     }