Hi All, As discovered during the review of PR 5756 [1], now that SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION is not recommended for mainstream use [3], deployments (e.g. tests) using non-cloud options for ADLS and GS (GCS) storage need a mechanism for opting out of minting session tokens and resolving to local (server and/or client) credentials for storage access.
I propose adding the following properties at the Management API level [1]. * AzureStorageConfigInfo.skipSasTokenGeneration * GcpStorageConfigInfo.skipCredentialDownscoping Both names relate to the corresponding native APIs in each technology. Setting these properties will effectively disable credential vending. This is similar to stsUnavailable in AwsStorageConfigInfo. The main purpose of the new properties is establishing a catalog-level opt in/out mechanism and providing well-defined user-level settings. PolarisStorageIntegration implementations still retain value without credential vending because they potentially define non-credential properties in StorageAccessConfig. The latter case currently applies only to S3, but downstream customizations may utilize it too. [1] https://github.com/apache/polaris/pull/5756#discussion_r4362688654 [2] https://github.com/apache/polaris/blob/5fafc67a832a8900fefb399abc00549d864470d6/spec/polaris-management-service.yml#L21 [3] https://lists.apache.org/thread/1trcnbm04zzqztpxkzrzs1pvrlyd49bg Thoughts? Thanks, Dmitri.
