This is an automated email from the ASF dual-hosted git repository.
yuqi1129 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new 1edfaf5399 [MINOR] docs(trino-connector): Clarify IRC access without a
forwarded token (#13785)
1edfaf5399 is described below
commit 1edfaf53999f8469c577c08ad12155a6ca8769c8
Author: Yuhui <[email protected]>
AuthorDate: Tue Oct 13 14:31:56 2026 +0800
[MINOR] docs(trino-connector): Clarify IRC access without a forwarded token
(#13785)
### What changes were proposed in this pull request?
Clarify in `docs/trino-connector/authentication.md` that with
`iceberg.rest-catalog.session=USER`
the Iceberg REST server (IRC) is reached with the end user's token only:
- Sessions without a forwarded token cannot access tables, although the
catalog is still listed.
On open-source Trino this applies to every OAuth2 sign-in.
- The token is read from the `token` extra-credential key only.
- The privileges the forwarded user needs.
### Why are the changes needed?
The docs describe a service-identity fallback for sessions without a
forwarded token, but it only
applies to Gravitino metadata requests, not to the IRC.
### Does this PR introduce _any_ user-facing change?
No, documentation only.
### How was this patch tested?
Documentation only.
---
docs/trino-connector/authentication.md | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/docs/trino-connector/authentication.md
b/docs/trino-connector/authentication.md
index 6f44668034..a813ad5001 100644
--- a/docs/trino-connector/authentication.md
+++ b/docs/trino-connector/authentication.md
@@ -212,6 +212,20 @@ gravitino.iceberg.rest-catalog.oauth2.scope=email
This is a completely separate credential from the one the connector uses
against the main Gravitino
server; it is not reused automatically.
+:::note
+With `iceberg.rest-catalog.session=USER`, the IRC is reached with the end
user's token only. The
+metadata fallback described above does not apply to the IRC: a session without
a forwarded token
+fails to read or write tables in that catalog instead of using the service
credential, even though
+the catalog is still listed and its schemas can still be browsed. On
open-source Trino this is the
+case for every user who signs in through OAuth2, because the coordinator does
not forward the token
+(see step 1 of the example below).
+
+The IRC always reads the token from the extra-credential key `token`;
+`gravitino.client.session.userTokenCredentialKey` does not apply to it. Unless
the forwarded user
+owns the metalake or the catalog, it needs `USE_CATALOG` and `USE_SCHEMA` in
addition to
+`SELECT_TABLE` or `MODIFY_TABLE`; granting `SELECT_TABLE` at the metalake
level alone is not enough.
+:::
+
For an Iceberg catalog with `catalog-backend=rest` (pointing at an Iceberg
REST Catalog of its own,
which the connector does not re-route), the connector does not set
`iceberg.rest-catalog.security`/`iceberg.rest-catalog.session` on its own —
that catalog's own `gravitino.client.*` config is unrelated to how its
underlying Iceberg REST catalog authenticates. To also forward the end user's
token to the REST catalog itself, set
`trino.bypass.iceberg.rest-catalog.security=OAUTH2` and
`trino.bypass.iceberg.rest-catalog.session=USER` explicitly on that catalog's
properties, alongside its bo [...]
@@ -247,7 +261,8 @@ populate the session's extra-credentials with the caller's
access token under th
[trinodb/trino discussion
#24403](https://github.com/trinodb/trino/discussions/24403) and
[issue #27917](https://github.com/trinodb/trino/issues/27917) for this
feature request. Until
it lands upstream, forwarding OAuth2 user tokens requires a Trino
distribution that
- provides this extra-credential itself. Sessions without it use the shared
service metadata.
+ provides this extra-credential itself. Sessions without it use the shared
service metadata,
+ but cannot access tables through an IRC that uses `session=USER`.
**2. Gravitino server: enable OAuth2** (in `conf/gravitino.conf`):
