Hyukjin Kwon created SPARK-59139:
------------------------------------
Summary: Rust Spark Connect client cannot connect to a TLS-secured
server that requires token authentication
Key: SPARK-59139
URL: https://issues.apache.org/jira/browse/SPARK-59139
Project: Spark
Issue Type: Bug
Components: Connect
Affects Versions: connect-rust-4.2.0
Reporter: Hyukjin Kwon
Fix For: connect-rust-4.3.0
The Rust Spark Connect client (and the pyspark-client-rust Python wrapper)
cannot establish a session with a Spark Connect server that uses TLS and
requires bearer-token authentication. The first RPC hangs. Two independent
causes:
1. TLS trust store is never loaded. The client builds
ClientTlsConfig::new().domain_name(...) but never calls .with_native_roots().
tonic >= 0.11 does not load a trust store from the tls-native-roots feature
alone, so the TLS handshake has no CA anchors and fails; the retry policy then
masks the failure as an apparent hang.
2. The connection-string token is parsed but never attached to requests as an
"Authorization: Bearer <token>" header (it is excluded from request metadata),
so servers that require token auth reject/hold the connection.
Fix: load native roots in the TLS config, and attach the token as an
Authorization: Bearer header on every request. Add a regression test asserting
the header is attached (the existing test_token_bearer_in_metadata only checks
that the token parses, not that it is sent).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
