lasdf1234 opened a new issue, #13137:
URL: https://github.com/apache/gravitino/issues/13137

   ### Version
   
   main branch
   
   ### Describe what's wrong
   
   Built-in Iceberg maintenance jobs cannot authenticate when the Gravitino 
server enables authenticators (for example `gravitino.authenticators = 
oauth,basic`).
   
   1. `builtin-iceberg-update-stats` builds a `GravitinoClient` from URI + 
metalake only (`GravitinoClientUtils`), with no `withSimpleAuth` / `withOAuth` 
/ basic auth. Callbacks to the Gravitino API fail with `UnauthorizedException`.
   2. `builtin-iceberg-rewrite-data-files` (and other Spark Iceberg jobs) 
configure the Spark Iceberg REST catalog with only `type` / `uri` / 
`warehouse`, so Iceberg REST requests fail with `NotAuthorizedException` when 
IRC requires auth.
   
   Credentials should be passed through job template `environments`, and the 
client / Spark catalog must match the server authenticator.
   
   ### Error message and/or stacktrace
   
   ```
   org.apache.gravitino.exceptions.UnauthorizedException: The provided 
credentials did not support
   ```
   
   ```
   org.apache.iceberg.exceptions.NotAuthorizedException: Not authorized: The 
provided credentials did not support
   ```
   
   ### How to reproduce
   
   1. Enable server auth, e.g. `gravitino.authenticators = oauth,basic`.
   2. Run `builtin-iceberg-update-stats` with `update_mode: all` against an 
Iceberg REST catalog, or run `builtin-iceberg-rewrite-data-files`.
   3. Observe unauthorized failures on the Gravitino API callback and/or 
Iceberg REST catalog calls.
   
   ### Additional context
   
   Related enterprise report: datastrato/gravitino-enterprise#1956.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to