lasdf1234 opened a new issue, #13137: URL: https://github.com/apache/gravitino/issues/13137
### Version main branch ### Describe what's wrong Built-in Iceberg maintenance jobs cannot authenticate when the Gravitino server enables authenticators (for example `gravitino.authenticators = oauth,basic`). 1. `builtin-iceberg-update-stats` builds a `GravitinoClient` from URI + metalake only (`GravitinoClientUtils`), with no `withSimpleAuth` / `withOAuth` / basic auth. Callbacks to the Gravitino API fail with `UnauthorizedException`. 2. `builtin-iceberg-rewrite-data-files` (and other Spark Iceberg jobs) configure the Spark Iceberg REST catalog with only `type` / `uri` / `warehouse`, so Iceberg REST requests fail with `NotAuthorizedException` when IRC requires auth. Credentials should be passed through job template `environments`, and the client / Spark catalog must match the server authenticator. ### Error message and/or stacktrace ``` org.apache.gravitino.exceptions.UnauthorizedException: The provided credentials did not support ``` ``` org.apache.iceberg.exceptions.NotAuthorizedException: Not authorized: The provided credentials did not support ``` ### How to reproduce 1. Enable server auth, e.g. `gravitino.authenticators = oauth,basic`. 2. Run `builtin-iceberg-update-stats` with `update_mode: all` against an Iceberg REST catalog, or run `builtin-iceberg-rewrite-data-files`. 3. Observe unauthorized failures on the Gravitino API callback and/or Iceberg REST catalog calls. ### Additional context Related enterprise report: datastrato/gravitino-enterprise#1956. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
