waterWang opened a new pull request, #17602: URL: https://github.com/apache/iceberg/pull/17602
Fixes #17600 ## Problem When `token-exchange-enabled` is set to `false`, a session created by token exchange (`AuthSession.fromTokenExchange`) inherits the parent catalog config — including `credential` and `exchangeEnabled=false`. On refresh, `OAuth2Util.refreshToken` checks `exchangeEnabled`, finds it `false`, and falls back to the `client_credentials` flow using the inherited credential. The refreshed token now identifies the catalog client rather than the exchanged subject, silently changing the session identity. ## Root cause `AuthSession.fromTokenExchange` calls `fromTokenResponse`, which copies the parent config via `AuthConfig.builder().from(parent.config())`. This propagates both `credential` and `exchangeEnabled=false` to the child session. The `exchangeEnabled` flag was intended by #13809 to control how credential-derived sessions refresh, but applying it to token-exchange-derived sessions changes which principal the session represents. ## Fix After building the session from `fromTokenResponse`, clear the inherited `credential` and set `exchangeEnabled=true` on the child session. This ensures that: - The child session always refreshes via token exchange (using the current token), not via client credentials - The `exchangeEnabled` flag only affects catalog-level credential-derived sessions as intended - The session identity is preserved across token refreshes -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
