waterWang opened a new pull request, #17768: URL: https://github.com/apache/iceberg/pull/17768
Fixes #17756 ## Problem One failed background OAuth2 token refresh permanently stops refresh for that `AuthSession`. `scheduleTokenRefresh` chains one-shot scheduled tasks: a successful `AuthSession.refresh(client)` returns the next expiration, which schedules the following task. When refresh fails (retries exhausted + credential fallback fails), `refresh` returns `null`, and the chain simply ends — no manager or request path re-arms it: - `authenticate` keeps attaching the stale token already stored in the session. - After the token expires, requests receive 401s for the remaining lifetime of the catalog object even after the token endpoint recovers. Reproduced by the issue: a token endpoint down for ~8s at refresh time (6 `Tasks` attempts + 1 credential fallback, ~3.1s of sleep) permanently disabled refresh. StarRocks reports the same production failure (StarRocks/starrocks#76438). ## Fix Distinguish the three outcomes the scheduling chain needs: 1. **Refresh succeeded** → schedule from the new expiration (unchanged). 2. **Refresh failed temporarily** → schedule a bounded retry (60s) so a transient endpoint outage delays refresh instead of permanently disabling it. 3. **Session closed** (`stopRefreshing()`/`close()`, i.e. `keepRefreshed == false`) → do not schedule again. - `scheduleTokenRefresh`: when `refresh()` returns `null` but `session.config().keepRefreshed()` is still `true`, reschedule with a fixed 60s bounded wait instead of dropping the chain. - `fromAccessToken` initial-refresh path: when the initial refresh of an already-expired token fails while the session stays active, schedule the same bounded retry instead of leaving `expiresAtMillis` null (which skipped scheduling entirely). A fixed bounded retry avoids hammering an unavailable token endpoint while still allowing recovery, and it automatically stops for closed sessions (no unconditional `null`-rescheduling loop). ## Tests Three new tests in `TestOAuth2Util`: - `failedRefreshSchedulesBoundedRetryWhileSessionStaysActive` — a scheduled refresh that fails (token endpoint down) reschedules with a ~60s delay. - `closedSessionDoesNotRescheduleAfterFailedRefresh` — after `close()`, a failed refresh does not reschedule. - `initialRefreshFailureSchedulesBoundedRetryWhenSessionStaysActive` — an already-expired token whose initial refresh fails still schedules the bounded retry. All 12 tests in `TestOAuth2Util` pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
