(iceberg) branch main updated: AWS: Don't pass a null refresh endpoint to custom credentials providers (#18579)

[singhpk234.apache.org via commits]

This is an automated email from the ASF dual-hosted git repository.

singhpk234 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg.git


The following commit(s) were added to refs/heads/main by this push:
     new 5b99042b4c AWS: Don't pass a null refresh endpoint to custom 
credentials providers (#18579)
5b99042b4c is described below

commit 5b99042b4cae30735aacb9d628b7aeedef6d8185
Author: Yusuf YILDIZ <yusufyildi...@gmail.com>
AuthorDate: Sun Nov 8 18:59:17 2026 -0500

    AWS: Don't pass a null refresh endpoint to custom credentials providers 
(#18579)
    
    When no refresh endpoint is configured, credentialsProvider() put a null
    credentials.uri into the properties handed to a custom provider, which
    breaks providers that re-read them through AwsClientProperties.
    
    Closes #17536
    
    Co-authored-by: Prabal864 <940...@gmail.com>
    Co-authored-by: water <672684...@qq.com>
---
 .../apache/iceberg/aws/AwsClientProperties.java    |  7 ++++--
 .../iceberg/aws/TestAwsClientProperties.java       | 28 +++++++++++++++++++++-
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/aws/src/main/java/org/apache/iceberg/aws/AwsClientProperties.java 
b/aws/src/main/java/org/apache/iceberg/aws/AwsClientProperties.java
index c5850d0c79..9918066f1c 100644
--- a/aws/src/main/java/org/apache/iceberg/aws/AwsClientProperties.java
+++ b/aws/src/main/java/org/apache/iceberg/aws/AwsClientProperties.java
@@ -213,8 +213,11 @@ public class AwsClientProperties implements Serializable {
   public AwsCredentialsProvider credentialsProvider(
       String accessKeyId, String secretAccessKey, String sessionToken) {
     if (!Strings.isNullOrEmpty(this.clientCredentialsProvider)) {
-      clientCredentialsProviderProperties.put(
-          VendedCredentialsProvider.URI, refreshCredentialsEndpoint);
+      if (!Strings.isNullOrEmpty(refreshCredentialsEndpoint)) {
+        clientCredentialsProviderProperties.put(
+            VendedCredentialsProvider.URI, refreshCredentialsEndpoint);
+      }
+
       return credentialsProvider(this.clientCredentialsProvider);
     }
 
diff --git 
a/aws/src/test/java/org/apache/iceberg/aws/TestAwsClientProperties.java 
b/aws/src/test/java/org/apache/iceberg/aws/TestAwsClientProperties.java
index 47bb12c83b..a12a231a90 100644
--- a/aws/src/test/java/org/apache/iceberg/aws/TestAwsClientProperties.java
+++ b/aws/src/test/java/org/apache/iceberg/aws/TestAwsClientProperties.java
@@ -41,8 +41,18 @@ import software.amazon.awssdk.services.s3.S3ClientBuilder;
 public class TestAwsClientProperties {
 
   public static class CustomCredentialProvider implements 
AwsCredentialsProvider {
+    private final Map<String, String> properties;
+
+    private CustomCredentialProvider(Map<String, String> properties) {
+      this.properties = properties;
+    }
+
     public static AwsCredentialsProvider create(Map<String, String> 
properties) {
-      return new CustomCredentialProvider();
+      return new CustomCredentialProvider(properties);
+    }
+
+    Map<String, String> properties() {
+      return properties;
     }
 
     @Override
@@ -261,5 +271,21 @@ public class TestAwsClientProperties {
     AwsCredentialsProvider provider =
         awsClientProperties.credentialsProvider("key", "secret", "token");
     assertThat(provider).isInstanceOf(CustomCredentialProvider.class);
+    assertThat(((CustomCredentialProvider) provider).properties())
+        .containsEntry(VendedCredentialsProvider.URI, 
"http://localhost:1234/v1/credentials";);
+  }
+
+  @Test
+  void customCredentialsProviderWithoutRefreshEndpoint() {
+    AwsClientProperties awsClientProperties =
+        new AwsClientProperties(
+            ImmutableMap.of(
+                AwsClientProperties.CLIENT_CREDENTIALS_PROVIDER,
+                CustomCredentialProvider.class.getName()));
+    AwsCredentialsProvider provider =
+        awsClientProperties.credentialsProvider("key", "secret", "token");
+    assertThat(provider).isInstanceOf(CustomCredentialProvider.class);
+    assertThat(((CustomCredentialProvider) provider).properties())
+        .doesNotContainKey(VendedCredentialsProvider.URI);
   }
 }