github-actions[bot] commented on code in PR #69598:
URL: https://github.com/apache/doris/pull/69598#discussion_r4375924247
##########
fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java:
##########
@@ -1454,9 +1451,13 @@ private HadoopAuthenticator pluginAuthenticator() {
*/
static HadoopAuthenticator buildPluginAuthenticator(Map<String, String>
properties,
Map<String, String> storageHadoopConfig) {
- if
("kerberos".equalsIgnoreCase(properties.get(HADOOP_SECURITY_AUTHENTICATION))) {
- return HadoopAuthenticator.getHadoopAuthenticator(
- IcebergCatalogFactory.buildHadoopConfiguration(properties,
storageHadoopConfig));
+ // Storage bindings normalize hdfs.authentication.* and XML settings
into Hadoop keys.
+ // Gating on the raw legacy key would leave FileIO using the plugin's
unauthenticated UGI.
+ Configuration conf =
IcebergCatalogFactory.buildHadoopConfiguration(properties, storageHadoopConfig);
+ // XML may enable Kerberos without credentials; its SIMPLE fallback
must retain the engine's storage identity.
+ AuthenticationConfig authConfig =
AuthenticationConfig.getKerberosConfig(conf);
+ if (authConfig instanceof KerberosAuthenticationConfig) {
Review Comment:
[P2] Preserve vended credentials on newly authenticated REST scans
A client-planned REST catalog with
`iceberg.rest.vended-credentials-enabled=true` can now select this
authenticator solely from a classpath `core-site.xml` containing a valid
Kerberos mode/principal/keytab, without any raw catalog authentication key.
Previously that catalog returned null here.
`IcebergScanPlanProvider.resolveTable` now calls `wrapTableForScan` with
non-null auth, wrapping its `BaseTable` FileIO in `IcebergAuthenticatedFileIO`,
which hides `SupportsStorageCredentials`. `extractVendedToken` consequently
reads only `properties()`. Iceberg 1.12 stores the REST response's separate
`storage-credentials` in `credentials()`, without merging them into
`properties()`. When those are the only S3 keys, FE can read manifests through
the credentialed delegate, but `getScanNodeProperties` cannot forward the
temporary keys to BE and private data-file reads fail. Preserve the credential
interface or extract credentials from the raw IO, and cover XML-resolved
Kerberos together with
REST-vended credentials. This differs from the fixed SIMPLE-fallback thread:
the login pair is complete and the lost values are BE S3 credentials.
Dependency evidence: [REST credential
handoff](https://github.com/apache/iceberg/blob/apache-iceberg-1.12.0/core/src/main/java/org/apache/iceberg/rest/RESTSessionCatalog.java#L1281-L1341),
[S3FileIO's separate credential
list](https://github.com/apache/iceberg/blob/apache-iceberg-1.12.0/aws/src/main/java/org/apache/iceberg/aws/s3/S3FileIO.java#L614-L637).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
