diqiu50 opened a new pull request, #13097:
URL: https://github.com/apache/gravitino/pull/13097

   ### What changes were proposed in this pull request?
   
   For OAuth2 user forwarding, reuse the configured service metadata when the 
session's token credential is absent or blank. Keep user forwarding for 
supplied tokens and preserve SIMPLE username forwarding. Add regression tests 
and document the fallback behavior.
   
   ### Why are the changes needed?
   
   Password-authenticated sessions, including internal JDBC catalog-management 
sessions, do not carry an OAuth2 token. They currently fail when Trino invokes 
the connector's metadata entry point despite having a configured service 
identity.
   
   Fix: #13096
   
   ### Does this PR introduce _any_ user-facing change?
   
   Yes. With OAuth2 and `gravitino.client.session.forwardUser=true`, sessions 
without a token access Gravitino metadata under the configured service identity 
and its permissions. Failures using supplied tokens still propagate. No 
configuration keys are added. Downstream catalog/IRC authentication is 
unchanged.
   
   ### How was this patch tested?
   
   Added regression tests for missing-token fallback and credential forwarding. 
Trino connector unit tests and formatting checks passed.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to