(gravitino) branch branch-1.3 updated: [Cherry-pick to branch-1.3] [#14125] improvement(trino-connector): Clarify that Iceberg REST routing requires OAuth2 (#14126) (#14188)

[jshao]

This is an automated email from the ASF dual-hosted git repository.

jerryshao pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/branch-1.3 by this push:
     new 57c3df0ba8 [Cherry-pick to branch-1.3] [#14125] 
improvement(trino-connector): Clarify that Iceberg REST routing requires OAuth2 
(#14126) (#14188)
57c3df0ba8 is described below

commit 57c3df0ba8bac77541dc7ce3acd4d9fb370011d4
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Fri Oct 23 22:53:39 2026 +0800

    [Cherry-pick to branch-1.3] [#14125] improvement(trino-connector): Clarify 
that Iceberg REST routing requires OAuth2 (#14126) (#14188)
    
    **Cherry-pick Information:**
    - Original commit: af3a0f4c563d0af05afcb5716997ee26a579c878
    - Target branch: `branch-1.3`
    - Status: ✅ Clean cherry-pick (no conflicts)
    
    Co-authored-by: Yuhui <h...@datastrato.com>
---
 docs/trino-connector/installation.md                             | 5 +++++
 .../org/apache/gravitino/trino/connector/GravitinoConfig.java    | 9 ++++-----
 .../apache/gravitino/trino/connector/TestGravitinoConfig.java    | 5 ++++-
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/docs/trino-connector/installation.md 
b/docs/trino-connector/installation.md
index edb1824b51..5638dafd0b 100644
--- a/docs/trino-connector/installation.md
+++ b/docs/trino-connector/installation.md
@@ -150,6 +150,11 @@ gravitino.metalake=test
 
 Full configurations for Apache Gravitino Trino connector can be seen 
[here](configuration.md)
 
+If the Gravitino server requires authentication, Iceberg catalogs routed 
through the Iceberg REST
+server need OAuth2, because Trino's Iceberg REST client does not support Basic 
or Kerberos. Set
+`gravitino.iceberg.rest-catalog.security=OAUTH2` and its `oauth2.*` 
properties; see
+[Authenticating to the Iceberg REST 
Server](./catalog-iceberg.md#authenticating-to-the-iceberg-rest-server).
+
 If you haven't created the metalake named `test`, you can use the following 
command to create it.
 
 ```shell
diff --git 
a/trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConfig.java
 
b/trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConfig.java
index c87a193efc..cfbcb51d00 100644
--- 
a/trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConfig.java
+++ 
b/trino-connector/trino-connector/src/main/java/org/apache/gravitino/trino/connector/GravitinoConfig.java
@@ -953,11 +953,10 @@ public class GravitinoConfig {
         GravitinoErrorCode.GRAVITINO_MISSING_CONFIG,
         String.format(
             "Cannot route an Iceberg catalog through the Iceberg REST server: "
-                + "gravitino.client.authType=%s has no equivalent Trino 
Iceberg REST security "
-                + "mode, so no credentials would be sent to it. If the REST 
server requires "
-                + "authentication, set 
'gravitino.iceberg.rest-catalog.security' (and any "
-                + "matching oauth2.* properties) explicitly. If it does not, 
set "
-                + "'gravitino.iceberg.rest-catalog.security=NONE' to confirm 
that.",
+                + "Trino's Iceberg REST client cannot carry 
gravitino.client.authType=%s "
+                + "credentials. If the server requires authentication, set "
+                + "'gravitino.iceberg.rest-catalog.security=OAUTH2' and the 
matching oauth2.* "
+                + "properties.",
             authType));
   }
 
diff --git 
a/trino-connector/trino-connector/src/test/java/org/apache/gravitino/trino/connector/TestGravitinoConfig.java
 
b/trino-connector/trino-connector/src/test/java/org/apache/gravitino/trino/connector/TestGravitinoConfig.java
index 164780de5f..b07ca05cb2 100644
--- 
a/trino-connector/trino-connector/src/test/java/org/apache/gravitino/trino/connector/TestGravitinoConfig.java
+++ 
b/trino-connector/trino-connector/src/test/java/org/apache/gravitino/trino/connector/TestGravitinoConfig.java
@@ -19,6 +19,7 @@
 package org.apache.gravitino.trino.connector;
 
 import static 
org.apache.gravitino.trino.connector.GravitinoErrorCode.GRAVITINO_ILLEGAL_ARGUMENT;
+import static 
org.apache.gravitino.trino.connector.GravitinoErrorCode.GRAVITINO_MISSING_CONFIG;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -474,8 +475,10 @@ public class TestGravitinoConfig {
                 "gravitino.client.basic.password", "admin-pass"));
 
     TrinoException e = assertThrows(TrinoException.class, 
config::getIcebergRestCatalogConfig);
+    assertEquals(GRAVITINO_MISSING_CONFIG.toErrorCode(), e.getErrorCode());
     assertTrue(e.getMessage().contains("gravitino.client.authType=basic"));
-    
assertTrue(e.getMessage().contains("gravitino.iceberg.rest-catalog.security"));
+    
assertTrue(e.getMessage().contains("gravitino.iceberg.rest-catalog.security=OAUTH2"));
+    assertFalse(e.getMessage().contains("NONE"));
   }
 
   @Test