Hi all,
The REST catalog spec describes X-Iceberg-Access-Delegation as an "optional
signal to the server that the client supports delegated access via a
comma-separated list of access mechanisms. The server may choose to supply
access via any or none of the requested mechanisms." [1]

In Apache Polaris we recently discussed what a server should do when the
header is present but it can satisfy none of the requested mechanisms, for
example vended-credentials against an S3-compatible store without STS, or
remote-signing on a server that does not implement it [2].

Polaris fails such requests with HTTP 400 and a message naming the reason,
because in these cases the inability is a static property of the catalog
and a 200 without credentials would only move the failure to the first data
access.

Two readings of "any or none" came up and the text does not settle which is
intended:
  (a) "none" means the server returns 200 with the table and no delegated
access, and the client detects this from the response: an empty
storage-credentials (and, we understand, an empty remote-signing-config
once that field lands in 1.12), falling back to the config map for older
servers [3].

  (b) "none" also permits the server to reject the request when it cannot
provide any of the requested mechanisms.

Questions for the community:
  1. Is rejecting the request a permitted server choice under the current
text, or is (a) the only intended behavior?
  2. If rejection is permitted, is there a preferred status code and error
type, so clients can distinguish "delegation unavailable" from other 400s?
  3. If (a) is the intended behavior, should the spec state explicitly that
the absence of credentials in both storage-credentials and config (and of
remote-signing-config) is the signal that no delegation was applied?

I'm happy to draft a clarification to the parameter description once there
is agreement.

[1]
https://github.com/apache/iceberg/blob/778d103c0fa802be5e85e4cb2e4e4b4bcd8ac891/open-api/rest-catalog-open-api.yaml#L2151-L2161
[2] https://lists.apache.org/thread/9oyv4v0vk3t8stv9832npl8t0yyp4j8r
[3]
https://github.com/apache/iceberg/blob/778d103c0fa802be5e85e4cb2e4e4b4bcd8ac891/open-api/rest-catalog-open-api.yaml#L4246-L4249

Thanks,
Youngrae Kim

Reply via email to