Gabriel39 commented on code in PR #69598:
URL: https://github.com/apache/doris/pull/69598#discussion_r4376926039
##########
fe/fe-connector/fe-connector-iceberg/src/main/java/org/apache/doris/connector/iceberg/IcebergConnector.java:
##########
@@ -1454,9 +1451,13 @@ private HadoopAuthenticator pluginAuthenticator() {
*/
static HadoopAuthenticator buildPluginAuthenticator(Map<String, String>
properties,
Map<String, String> storageHadoopConfig) {
- if
("kerberos".equalsIgnoreCase(properties.get(HADOOP_SECURITY_AUTHENTICATION))) {
- return HadoopAuthenticator.getHadoopAuthenticator(
- IcebergCatalogFactory.buildHadoopConfiguration(properties,
storageHadoopConfig));
+ // Storage bindings normalize hdfs.authentication.* and XML settings
into Hadoop keys.
+ // Gating on the raw legacy key would leave FileIO using the plugin's
unauthenticated UGI.
+ Configuration conf =
IcebergCatalogFactory.buildHadoopConfiguration(properties, storageHadoopConfig);
+ // XML may enable Kerberos without credentials; its SIMPLE fallback
must retain the engine's storage identity.
+ AuthenticationConfig authConfig =
AuthenticationConfig.getKerberosConfig(conf);
+ if (authConfig instanceof KerberosAuthenticationConfig) {
Review Comment:
Fixed in 797c27de988. `extractVendedToken` now reads through
`IcebergAuthenticatedFileIO` decorators to inspect the native
`SupportsStorageCredentials` list. It keeps the existing properties/credential
precedence and reads refreshed credentials on each call; file operations still
use the authenticated decorator, with no new optional capabilities added to it.
Corrected the stale comment claiming Kerberos and REST-vended credentials were
disjoint. Two new tests use the actual Iceberg 1.12 `S3FileIO` with credentials
stored separately from empty properties: XML-resolved Kerberos with nested scan
wrappers and credential refresh, and scan-node
access-key/secret-key/session-token forwarding to BE. Both failed before the
fix and pass afterward. The full Iceberg module reports 1729 passed, 14
skipped, no failures or errors; full FE Checkstyle and the preset test reactor
passed. KDC/S3/HDFS end-to-end suites were not run locally.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
