Revanth14 commented on code in PR #2163: URL: https://github.com/apache/iceberg-go/pull/2163#discussion_r4238795872
########## website/src/configuration.md: ########## @@ -227,15 +227,20 @@ Tuning properties: ### Azure Data Lake Storage / Blob -Authentication is selected in the following order (`io/gocloud/azure/azure.go`); the first applicable option wins, and if none of 1-4 apply the default credential chain (5) is used: +Authentication is selected in the following order (`io/gocloud/azure/azure.go`); the first applicable option wins, and if none of 1-5 apply the default credential chain (6) is used: 1. Shared key: a nonempty `adls.auth.shared-key.account.name` selects this path and requires a nonempty `adls.auth.shared-key.account.key`. 2. Per-host SAS token: `adls.sas-token.<hostname>`, where `<hostname>` exactly matches the storage account hostname (for example, `myaccount.dfs.core.windows.net`). 3. Per-account connection string: `adls.connection-string.<account-name>` (for example, `adls.connection-string.myaccount`). -4. Managed identity: `adls.auth.managed-identity.enabled` set to exactly `"true"` selects this path and uses `ManagedIdentityCredential` directly. Set `adls.client-id` to select a user-assigned managed identity; otherwise, the system-assigned managed identity is used. -5. Default credential chain: `DefaultAzureCredential`, which includes managed identity among its credential sources. +4. Static access token: a nonempty `adls.token`, supplied without the `Bearer ` prefix. +5. Managed identity: `adls.auth.managed-identity.enabled` set to exactly `"true"` selects this path and uses `ManagedIdentityCredential` directly. Set `adls.client-id` to select a user-assigned managed identity; otherwise, the system-assigned managed identity is used. +6. Default credential chain: `DefaultAzureCredential`, which includes managed identity among its credential sources. -> **Note on cross-client parity.** The two properties in step 4 diverge from the +`adls.token` accepts an OAuth2 access token for Azure Storage, including a token supplied by a catalog. An empty value is ignored. A rejected or expired token does not fall back to managed identity or the default credential chain. + +The token is static and is not refreshed. As in [Java](https://github.com/apache/iceberg/blob/main/azure/src/main/java/org/apache/iceberg/azure/AzureProperties.java) and [PyIceberg](https://github.com/apache/iceberg-python/blob/main/pyiceberg/io/fsspec.py), the credential reports a one-hour cache window to the Azure SDK each time the SDK requests the token. This does not extend the token's actual validity: Azure enforces its expiration. Callers must obtain a new token and recreate the FileIO when it expires; changing the original properties map does not update an existing FileIO. Review Comment: Good catch on the vended path. The stronger fix turns out to be there already: `expiration-time` is in `credentialExpiryKeys`, so a vended token that carries it is renewed on that expiry. The docs now say so, along with the fallbacks: a 60-minute default when the table can fetch new credentials, and no expiry at all when it can't (a scan plan's credentials). They also recommend that catalogs vending `adls.token` send `expiration-time`. `TestVendedCredsRefreshedADLSTokenExpiry` covers both the honored case and the fallback. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
