Revanth14 opened a new pull request, #2547: URL: https://github.com/apache/iceberg-go/pull/2547
## Problem `rest.auth.type` (#2502, #2538) still rejects `sigv4`, the last value Java accepts. Java's `sigv4` signs every request and authenticates with a delegate auth type from `rest.auth.sigv4.delegate-auth-type`, `oauth2` by default. The delegate's header also needs care. iceberg-go's SigV4 signer writes its signature to `Authorization`, overwriting the header the auth manager set, so with `rest.sigv4-enabled=true` plus a token, the token is silently dropped today. Java's `RESTSigV4AuthSession` instead moves that header to `Original-Authorization` and signs it with the request. ## Fix - `rest.auth.type=sigv4` turns on signing and resolves `rest.auth.sigv4.delegate-auth-type` (default `oauth2`) through the same switch; a `sigv4` delegate is rejected, as in Java. Signing still applies when `WithAuthManager` supplies the delegate's manager. - The signing it turns on is a separate flag from `rest.sigv4-enabled`, which `fetchConfig` re-reads from the merged config. A server override of `rest.sigv4-enabled=false` can't turn off signing the client chose with `rest.auth.type`, keeping the client-properties-only rule from #2502. - `toProps` emits the SigV4 settings for either flag, so the S3 region hint from the signing region still applies. - The `catalog/rest/sigv4` backend moves an existing `Authorization` header to `Original-Authorization` before signing, so it's included in the signed headers, as in Java. A header that's already a SigV4 signature, as on a same-origin redirect, is replaced rather than relocated. This also changes `rest.sigv4-enabled` with a token, which now sends the token instead of dropping it. ## Testing - `TestSigV4AuthTypeSignsAndDelegates`: `oauth2` (default), `basic` and `none` delegates, and `WithAuthManager`, each signed on `/v1/config` and the catalog request. - `TestSigV4AuthTypeIgnoresServerOverrides`: `rest.sigv4-enabled=false` and `rest.auth.type=none` overrides change neither signing nor the delegate. - `TestAuthTypeErrors`: a `sigv4` delegate, and `sigv4` without the backend imported. - `TestSignRequestRelocatesAuthorization`, `TestSignRequestWithoutAuthorizationAddsNoOriginal`: the relocated header is signed, re-signing keeps the original token, and nothing is added without one. Each fails with its fix reverted. gofmt, `go vet` (also with `-tags integration`), the `modernize` analyzer and `go test -race ./...` pass locally. golangci-lint and a live AWS endpoint were not run. ## Context Completes the Java `rest.auth.type` values after #2502 and #2538 (#2428). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
