[
https://issues.apache.org/jira/browse/SPARK-59139?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Hyukjin Kwon reassigned SPARK-59139:
------------------------------------
Assignee: Hyukjin Kwon
> Rust Spark Connect client cannot connect to a TLS-secured server that
> requires token authentication
> ---------------------------------------------------------------------------------------------------
>
> Key: SPARK-59139
> URL: https://issues.apache.org/jira/browse/SPARK-59139
> Project: Spark
> Issue Type: Bug
> Components: Connect
> Affects Versions: connect-rust-4.2.0
> Reporter: Hyukjin Kwon
> Assignee: Hyukjin Kwon
> Priority: Major
> Fix For: connect-rust-4.3.0
>
>
> The Rust Spark Connect client (and the pyspark-client-rust Python wrapper)
> cannot establish a session with a Spark Connect server that uses TLS and
> requires bearer-token authentication. The first RPC hangs. Two independent
> causes:
> 1. TLS trust store is never loaded. The client builds
> ClientTlsConfig::new().domain_name(...) but never calls .with_native_roots().
> tonic >= 0.11 does not load a trust store from the tls-native-roots feature
> alone, so the TLS handshake has no CA anchors and fails; the retry policy
> then masks the failure as an apparent hang.
> 2. The connection-string token is parsed but never attached to requests as an
> "Authorization: Bearer <token>" header (it is excluded from request
> metadata), so servers that require token auth reject/hold the connection.
> Fix: load native roots in the TLS config, and attach the token as an
> Authorization: Bearer header on every request. Add a regression test
> asserting the header is attached (the existing test_token_bearer_in_metadata
> only checks that the token parses, not that it is sent).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
