lkindere commented on issue #13515:
URL: https://github.com/apache/iceberg/issues/13515#issuecomment-3084224830
Similar issue using Azure oauth.
After running for 1 hour with token refresh disabled:
```
Caused by: org.apache.iceberg.exceptions.NotAuthorizedException: Not
authorized:
at
org.apache.iceberg.rest.ErrorHandlers$DefaultErrorHandler.accept(ErrorHandlers.java:234)
at
org.apache.iceberg.rest.ErrorHandlers$TableErrorHandler.accept(ErrorHandlers.java:123)
at
org.apache.iceberg.rest.ErrorHandlers$TableErrorHandler.accept(ErrorHandlers.java:107)
at org.apache.iceberg.rest.HTTPClient.throwFailure(HTTPClient.java:215)
at org.apache.iceberg.rest.HTTPClient.execute(HTTPClient.java:299)
at org.apache.iceberg.rest.BaseHTTPClient.get(BaseHTTPClient.java:77)
at
org.apache.iceberg.rest.RESTSessionCatalog.loadInternal(RESTSessionCatalog.java:373)
at
org.apache.iceberg.rest.RESTSessionCatalog.loadTable(RESTSessionCatalog.java:397)
at
org.apache.iceberg.catalog.BaseSessionCatalog$AsCatalog.loadTable(BaseSessionCatalog.java:99)
at org.apache.iceberg.rest.RESTCatalog.loadTable(RESTCatalog.java:106)
at
org.apache.iceberg.connect.data.IcebergWriterFactory.createWriter(IcebergWriterFactory.java:59)
at
org.apache.iceberg.connect.data.SinkWriter.lambda$writerForTable$3(SinkWriter.java:139)
at java.base/java.util.HashMap.computeIfAbsent(Unknown Source)
at
org.apache.iceberg.connect.data.SinkWriter.writerForTable(SinkWriter.java:138)
at
org.apache.iceberg.connect.data.SinkWriter.routeRecordDynamically(SinkWriter.java:124)
at org.apache.iceberg.connect.data.SinkWriter.save(SinkWriter.java:83)
at java.base/java.util.ArrayList.forEach(Unknown Source)
at org.apache.iceberg.connect.data.SinkWriter.save(SinkWriter.java:68)
at org.apache.iceberg.connect.channel.Worker.save(Worker.java:124)
at
org.apache.iceberg.connect.channel.CommitterImpl.save(CommitterImpl.java:151)
at
org.apache.iceberg.connect.IcebergSinkTask.put(IcebergSinkTask.java:83)
at
org.apache.kafka.connect.runtime.WorkerSinkTask.deliverMessages(WorkerSinkTask.java:624)
... 11 more
```
After running for 1 hour with token refresh enabled it attempts to refresh
several times but still fails in the end
```
Failed to clean up on failure (org.apache.iceberg.util.Tasks:289)
org.apache.iceberg.exceptions.BadRequestException: Malformed request:
unsupported_grant_type: AADSTS70003: The app requested an unsupported grant
type 'urn:ietf:params:oauth:grant-type:token-exchange'. Trace ID:
7cab4d7a-1afb-484c-ac51-9854a6ed0f00 Correlation ID:
c70aba69-e095-4ba4-9242-608d126e0d00 Timestamp: 2025-07-17 13:27:30Z
at
org.apache.iceberg.rest.ErrorHandlers$OAuthErrorHandler.accept(ErrorHandlers.java:278)
at
org.apache.iceberg.rest.ErrorHandlers$OAuthErrorHandler.accept(ErrorHandlers.java:252)
at org.apache.iceberg.rest.HTTPClient.throwFailure(HTTPClient.java:215)
at org.apache.iceberg.rest.HTTPClient.execute(HTTPClient.java:299)
at
org.apache.iceberg.rest.BaseHTTPClient.postForm(BaseHTTPClient.java:111)
at
org.apache.iceberg.rest.auth.OAuth2Util.refreshToken(OAuth2Util.java:170)
at
org.apache.iceberg.rest.auth.OAuth2Util$AuthSession.refreshExpiredToken(OAuth2Util.java:607)
at
org.apache.iceberg.rest.auth.OAuth2Util$AuthSession.lambda$refresh$0(OAuth2Util.java:552)
at org.apache.iceberg.util.Tasks$Builder.tryRunOnFailure(Tasks.java:286)
at
org.apache.iceberg.util.Tasks$Builder.runSingleThreaded(Tasks.java:225)
at org.apache.iceberg.util.Tasks$Builder.run(Tasks.java:203)
at org.apache.iceberg.util.Tasks$Builder.run(Tasks.java:196)
at
org.apache.iceberg.rest.auth.OAuth2Util$AuthSession.refresh(OAuth2Util.java:562)
at
org.apache.iceberg.rest.auth.OAuth2Util$AuthSession.lambda$scheduleTokenRefresh$2(OAuth2Util.java:645)
at
java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
at
java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown
Source)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown
Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown
Source)
at java.base/java.lang.Thread.run(Unknown Source)
```
Is it possible to enable refresh using only client credentials and not token
exchange?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
