seethasp commented on issue #5099:
URL: https://github.com/apache/polaris/issues/5099#issuecomment-5029606700
Yes vastdata.com . We are integrating Apache Polaris with
VAST[**release-5.4.3-sp2-hf15-2422867**] S3-compatible object storage using
STS-based credential vending. When we call the VAST STS endpoint directly
through the AWS CLI, sts assume-role succeeds and returns temporary credentials
including AccessKeyId, SecretAccessKey, and SessionToken. Using those temporary
credentials, we are able to perform storage operations successfully.
However, when Polaris attempts to create/write/load an Iceberg table using
delegated or subscoped credentials, Polaris fails while generating subscoped
credentials. The failure occurs inside
StorageCredentialCache.getOrGenerateSubScopeCreds(...) and the STS service
returns HTTP 501 Not Implemented with the message:
A header you provided implies functionality that is not implemented.
This suggests that Polaris may be sending additional STS parameters,
headers, session tags, scoped session policy, or delegation-related fields that
are not supported by the VAST STS implementation, even though basic AssumeRole
works successfully
**Direct STS validation using AWS CLI**
The following AWS CLI command succeeds against the same STS endpoint:
aws \
--endpoint-url "https://xxx.com"; \
--region us-east-1 \
sts assume-role \
--role-arn "arn:vast::t-sc-xxx-npe:role/xxx-iamrole" \
--role-session-name polaris-test \
--duration-seconds 36000
The response includes valid temporary credentials:
{
"Credentials": {
"AccessKeyId": "xxx",
"SecretAccessKey": "xxxx",
"SessionToken": "AQAAAFRFTVBPTFpFWVNUMk9XQzZZM1RIAAAAAAAAAAA=",
"Expiration": "2026-07-20T02:12:24+00:00"
},
"AssumedRoleUser": {
"AssumedRoleId": "rQQAAA==:polaris-test",
"Arn": "arn:vast::t-sc-xxx-npe:role/xxx-iamrole"
}
}
Using the returned temporary credentials, we are able to execute object
storage commands successfully, including list/read/write operations against the
target bucket/prefix.
**When Polaris attempts to generate delegated/subscoped credentials, it
fails with the following exception:**
2026-07-21 02:26:49,256 DEBUG [org.apa.pol.ser.exc.IcebergExceptionMapper]
[7568ebea-a11c-9788-a3ac-4e5b4ff7eecd,SCCT] [,,,] (executor-thread-1) Full
RuntimeException: org.apache.iceberg.exceptions.UnprocessableEntityException:
Failed to get subscoped credentials: A header you provided implies
functionality that is not implemented. (Service: Sts, Status Code: 501, Request
ID: 1f30c1015ae770, Extended Request ID: 1f30c1015ae770) (SDK Attempt Count: 1)
at
org.apache.polaris.core.storage.cache.StorageCredentialCache.lambda$getOrGenerateSubScopeCreds$2(StorageCredentialCache.java:185)
at
com.github.benmanes.caffeine.cache.BoundedLocalCache.lambda$doComputeIfAbsent$0(BoundedLocalCache.java:2707)
at
java.base/java.util.concurrent.ConcurrentHashMap.compute(ConcurrentHashMap.java:1916)
at
com.github.benmanes.caffeine.cache.BoundedLocalCache.doComputeIfAbsent(BoundedLocalCache.java:2705)
at
com.github.benmanes.caffeine.cache.BoundedLocalCache.computeIfAbsent(BoundedLocalCache.java:2686)
at
com.github.benmanes.caffeine.cache.LocalCache.computeIfAbsent(LocalCache.java:112)
at
com.github.benmanes.caffeine.cache.LocalManualCache.get(LocalManualCache.java:63)
at
org.apache.polaris.core.storage.cache.StorageCredentialCache.getOrGenerateSubScopeCreds(StorageCredentialCache.java:187)
at
org.apache.polaris.core.storage.cache.ServiceProducers_ProducerMethod_storageCredentialCache_hzAWPa00ffa2II6zBfUMmDXk9AQ_ClientProxy.getOrGenerateSubScopeCreds(Unknown
Source)
at
org.apache.polaris.service.catalog.io.StorageAccessConfigProvider.getStorageAccessConfig(StorageAccessConfigProvider.java:135)
at
org.apache.polaris.service.catalog.io.StorageAccessConfigProvider_ClientProxy.getStorageAccessConfig(Unknown
Source)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalog.loadFileIOForTableLike(IcebergCatalog.java:2221)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalog$BasePolarisTableOperations.doCommit(IcebergCatalog.java:1561)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalog$BasePolarisTableOperations.commit(IcebergCatalog.java:1416)
at
org.apache.iceberg.BaseMetastoreCatalog$BaseMetastoreCatalogTableBuilder.create(BaseMetastoreCatalog.java:201)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalogHandler.createTableDirect(IcebergCatalogHandler.java:487)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter.lambda$createTable$7(IcebergCatalogAdapter.java:289)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter.withCatalogByName(IcebergCatalogAdapter.java:112)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter.withCatalog(IcebergCatalogAdapter.java:104)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter.createTable(IcebergCatalogAdapter.java:273)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter_Subclass.createTable$$superforward(Unknown
Source)
at
org.apache.polaris.service.catalog.iceberg.IcebergRestCatalogEventServiceDelegator_Gj_WCptqTcdHu-fbZfgVkAwPXCI_Delegate_Subclass.createTable(Unknown
Source)
at
org.apache.polaris.service.catalog.iceberg.IcebergRestCatalogEventServiceDelegator.createTable(IcebergRestCatalogEventServiceDelegator.java:307)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter_Subclass.createTable(Unknown
Source)
at
org.apache.polaris.service.catalog.iceberg.IcebergCatalogAdapter_ClientProxy.createTable(Unknown
Source)
at
org.apache.polaris.service.catalog.api.IcebergRestCatalogApi.createTable(IcebergRestCatalogApi.java:193)
at
org.apache.polaris.service.catalog.api.IcebergRestCatalogApi_Subclass.createTable$$superforward(Unknown
Source)
at
org.apache.polaris.service.catalog.api.IcebergRestCatalogApi_Subclass$2.apply(Unknown
Source)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:73)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext$NextAroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:97)
at
io.smallrye.faulttolerance.FaultToleranceInterceptor.lambda$syncFlow$8(FaultToleranceInterceptor.java:364)
at io.smallrye.faulttolerance.core.Future.from(Future.java:85)
at
io.smallrye.faulttolerance.FaultToleranceInterceptor.lambda$syncFlow$9(FaultToleranceInterceptor.java:364)
at
io.smallrye.faulttolerance.core.FaultToleranceContext.call(FaultToleranceContext.java:20)
at io.smallrye.faulttolerance.core.Invocation.apply(Invocation.java:29)
at
io.smallrye.faulttolerance.core.metrics.MetricsCollector.apply(MetricsCollector.java:98)
at
io.smallrye.faulttolerance.FaultToleranceInterceptor.syncFlow(FaultToleranceInterceptor.java:367)
at
io.smallrye.faulttolerance.FaultToleranceInterceptor.intercept(FaultToleranceInterceptor.java:205)
at
io.smallrye.faulttolerance.FaultToleranceInterceptor_Bean.intercept(Unknown
Source)
at
io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:70)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext$NextAroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:97)
at
io.quarkus.micrometer.runtime.MicrometerTimedInterceptor.timedMethod(MicrometerTimedInterceptor.java:79)
at
io.quarkus.micrometer.runtime.MicrometerTimedInterceptor_Bean.intercept(Unknown
Source)
at
io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:70)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext$NextAroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:97)
at
io.quarkus.security.runtime.interceptor.SecurityHandler.handle(SecurityHandler.java:27)
at
io.quarkus.security.runtime.interceptor.RolesAllowedInterceptor.intercept(RolesAllowedInterceptor.java:31)
at
io.quarkus.security.runtime.interceptor.RolesAllowedInterceptor_Bean.intercept(Unknown
Source)
at
io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:70)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:62)
at
io.quarkus.resteasy.reactive.server.runtime.StandardSecurityCheckInterceptor.intercept(StandardSecurityCheckInterceptor.java:48)
at
io.quarkus.resteasy.reactive.server.runtime.StandardSecurityCheckInterceptor$RolesAllowedInterceptor_Bean.intercept(Unknown
Source)
at
io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:42)
at
io.quarkus.arc.impl.AroundInvokeInvocationContext.perform(AroundInvokeInvocationContext.java:30)
at
io.quarkus.arc.impl.InvocationContexts.performAroundInvoke(InvocationContexts.java:27)
at
org.apache.polaris.service.catalog.api.IcebergRestCatalogApi_Subclass.createTable(Unknown
Source)
at
org.apache.polaris.service.catalog.api.IcebergRestCatalogApi$quarkusrestinvoker$createTable_01f5a1bd6d7815fd3314a553161c943c8cd03101.invoke(Unknown
Source)
at
org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
at
io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:190)
at
org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
at
io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:677)
at
org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2651)
at
org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2630)
at
org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1622)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1589)
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
at
org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
at
io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
