adutra opened a new pull request, #18756: URL: https://github.com/apache/iceberg/pull/18756
Add `org.apache.iceberg.rest.auth.oauth2.OAuth2Manager`, an `AuthManager` that authenticates against any OAuth2 authorization server with the `client_credentials` grant and renews access tokens before they expire by running the grant again. It is selected explicitly by class name (`rest.auth.type=org.apache.iceberg.rest.auth.oauth2.OAuth2Manager`) and configured with `rest.auth.oauth2.*` properties; the legacy oauth2 manager is unchanged. Compared to the legacy manager, the new one discovers the token endpoint from the issuer URL (RFC 8414 or OpenID Connect Discovery), supports the `client_secret_basic` and `client_secret_post` authentication methods, and does not use token exchange for refresh. Static tokens, token exchange and tokens vended by the catalog server in table responses are not supported. Session contexts carrying OAuth2 properties get a self-contained session; nothing is inherited from the catalog configuration. The legacy properties `credential`, `oauth2-server-uri`, `scope`, `audience` and `resource` are translated with a warning, and the token endpoint falls back to the catalog's `v1/oauth/tokens` endpoint when neither a token endpoint nor an issuer URL is configured. Important: the `token` property is not supported anymore by this manager, but is supported by the `BearerAuthManager`, see #18754. The suggested migration path for people using `token` is therefore to use the `BearerAuthManager`. The implementation is built on the Nimbus OAuth SDK, and requests to the authorization server go through the catalog's `RESTClient`, which gains an `unwrap(Class)` method for that purpose. Runtime bundle `LICENSE` files and dependency baselines are updated accordingly. **This PR supersedes #15703.** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
