This is an automated email from the ASF dual-hosted git repository. github-actions[bot] pushed a commit to branch cherry-pick-af3a0f4c-to-branch-1.3 in repository https://gitbox.apache.org/repos/asf/gravitino.git
commit 7302c7ab130366cc8a0733ac87900730fdbf6661 Author: Yuhui <[email protected]> AuthorDate: Thu Oct 22 19:39:13 2026 +0800 [#14125] improvement(trino-connector): Clarify that Iceberg REST routing requires OAuth2 (#14126) ### What changes were proposed in this pull request? - Reword the `GRAVITINO_MISSING_CONFIG` error for `basic`/`kerberos` auth: authenticated Iceberg REST routing requires `security=OAUTH2`; drop the `security=NONE` suggestion. - Add the same note to the Trino connector install page. ### Why are the changes needed? The old message suggested `security=NONE`, which an authenticated Iceberg REST server rejects only when a query runs, and the install page did not mention the OAuth2 requirement. Fix: #14125 ### Does this PR introduce _any_ user-facing change? Error message and docs only. ### How was this patch tested? Updated `TestGravitinoConfig#testIcebergRestConfigRejectsBasicAuthWithoutExplicitSecurity`. --- docs/trino-connector/installation.md | 5 +++++ .../org/apache/gravitino/trino/connector/GravitinoConfig.java | 9 ++++----- .../apache/gravitino/trino/connector/TestGravitinoConfig.java | 5 ++++- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/docs/trino-connector/installation.md b/docs/trino-connector/installation.md index edb1824b51..5638dafd0b 100644 --- a/docs/trino-connector/installation.md +++ b/docs/trino-connector/installation.md @@ -150,6 +150,11 @@ gravitino.metalake=test Full configurations for Apache Gravitino Trino connector can be seen [here](configuration.md) +If the Gravitino server requires authentication, Iceberg catalogs routed through the Iceberg REST +server need OAuth2, because Trino's Iceberg REST client does not support Basic or Kerberos. Set +`gravitino.iceberg.rest-catalog.security=OAUTH2` and its `oauth2.*` properties; see +[Authenticating to the Iceberg REST Server](./catalog-iceberg.md#authenticating-to-the-iceberg-rest-server). + If you haven't created the metalake named `test`, you can use the following command to create it. ```shell diff --git a/trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConfig.java b/trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConfig.java index c87a193efc..cfbcb51d00 100644 --- a/trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConfig.java +++ b/trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConfig.java @@ -953,11 +953,10 @@ public class GravitinoConfig { GravitinoErrorCode.GRAVITINO_MISSING_CONFIG, String.format( "Cannot route an Iceberg catalog through the Iceberg REST server: " - + "gravitino.client.authType=%s has no equivalent Trino Iceberg REST security " - + "mode, so no credentials would be sent to it. If the REST server requires " - + "authentication, set 'gravitino.iceberg.rest-catalog.security' (and any " - + "matching oauth2.* properties) explicitly. If it does not, set " - + "'gravitino.iceberg.rest-catalog.security=NONE' to confirm that.", + + "Trino's Iceberg REST client cannot carry gravitino.client.authType=%s " + + "credentials. If the server requires authentication, set " + + "'gravitino.iceberg.rest-catalog.security=OAUTH2' and the matching oauth2.* " + + "properties.", authType)); } diff --git a/trino-connector/trino-connector/src/test/java/org/apache/gravitino/trino/connector/TestGravitinoConfig.java b/trino-connector/trino-connector/src/test/java/org/apache/gravitino/trino/connector/TestGravitinoConfig.java index 164780de5f..b07ca05cb2 100644 --- a/trino-connector/trino-connector/src/test/java/org/apache/gravitino/trino/connector/TestGravitinoConfig.java +++ b/trino-connector/trino-connector/src/test/java/org/apache/gravitino/trino/connector/TestGravitinoConfig.java @@ -19,6 +19,7 @@ package org.apache.gravitino.trino.connector; import static org.apache.gravitino.trino.connector.GravitinoErrorCode.GRAVITINO_ILLEGAL_ARGUMENT; +import static org.apache.gravitino.trino.connector.GravitinoErrorCode.GRAVITINO_MISSING_CONFIG; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertThrows; @@ -474,8 +475,10 @@ public class TestGravitinoConfig { "gravitino.client.basic.password", "admin-pass")); TrinoException e = assertThrows(TrinoException.class, config::getIcebergRestCatalogConfig); + assertEquals(GRAVITINO_MISSING_CONFIG.toErrorCode(), e.getErrorCode()); assertTrue(e.getMessage().contains("gravitino.client.authType=basic")); - assertTrue(e.getMessage().contains("gravitino.iceberg.rest-catalog.security")); + assertTrue(e.getMessage().contains("gravitino.iceberg.rest-catalog.security=OAUTH2")); + assertFalse(e.getMessage().contains("NONE")); } @Test
