Hello Alex, thank you for being so persistent here. As already said in Glasgow, I like the approach and hope the surface is now small enough. Should we add this to the agenda of this week's Catalog sync?
Best Christian On Mon, 2 Nov 2026 at 19:21, Alex Dutra via dev <[email protected]> wrote: > Hi all, > > During Community over Code in Glasgow, we discussed authentication in > Iceberg REST and concluded that we should downscope the OAuth2 > AuthManager v2 initiative. > > The general feedback was that v2 contains too much new surface at > once, especially grant types. Support for complex legacy behavior > (e.g. vended tokens) also unnecessarily clutters the implementation, > and some people suggested dropping that as well. > > I therefore propose to reboot the initiative, with a much smaller scope in > mind: > > - One single grant: client_credentials. > - Two client authentication methods: client_secret_basic and > client_secret_post. > - Simplified token renewal (by re-running the grant before expiry). > - Reduced support for legacy v1 (migrate common properties, but leave > the rest out). > > The above scope fits in one PR, so here it is: > > https://github.com/apache/iceberg/pull/18756 > > I truly hope we can get this released in Iceberg 1.13, so that users > can finally benefit from a standards-complaint OAuth2 manager in > Iceberg REST. > > Let me know your thoughts. > > Thanks, > Alex >
