diqiu50 opened a new issue, #13194: URL: https://github.com/apache/gravitino/issues/13194
### What would you like to be improved? Improve the Gravitino Trino connector's compatibility with downstream distributions that support Iceberg REST `OAUTH2_PASSTHROUGH` authentication. In an enterprise deployment using Starburst, metadata-only management queries can run without a delegated user token. The Gravitino connector eagerly calls the native connector's `getMetadata()`, which can trigger authentication before schema listing is served through Gravitino. Separately, when Gravitino client authentication uses OAuth2, `getIcebergRestCatalogConfig()` inherits service OAuth2 properties even when REST security is explicitly configured as `OAUTH2_PASSTHROUGH` or `NONE`. The reported authentication failure concerns the enterprise/Starburst integration. It has not been reproduced with upstream Trino. ### How should we improve? - Defer native metadata initialization for managed `lakehouse-iceberg` catalogs configured with `OAUTH2_PASSTHROUGH`. - Initialize native metadata using the session of the first operation that requires it. - Preserve query lifecycle ordering and propagate native authentication and authorization errors. - Inherit Gravitino service OAuth2 defaults only when REST security is `OAUTH2`, including when it is the default. - Add regression tests for deferred initialization, session propagation, query lifecycle, and configuration inheritance. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
