bharos opened a new issue, #16022: URL: https://github.com/apache/iceberg/issues/16022
### Apache Iceberg version 1.10.1 (latest release) ### Query engine None ### Please describe the bug 🐞 When token-exchange-enabled=false, the optionalOAuthParams map (containing audience, resource, scope is silently dropped during token refresh. The initial token fetch correctly includes these parameters, but all subsequent refreshes send ImmutableMap.of() instead. **Impact** After the first token expires and is refreshed, the IDP receives a `client_credentials` grant request without the configured audience/resource. Depending on the IDP: - The refreshed token may have wrong/default audience → 403 errors against the catalog - The IDP may reject the request entirely → 401 errors - The token may grant overly broad permissions (security concern) This affects any deployment using OAuth2 with `token-exchange-enabled=false` and a configured `audience `or `resource` — e.g., Gravitino REST catalog with Azure AD or similar IDPs that require audience scoping. ### Willingness to contribute - [x] I can contribute a fix for this bug independently - [ ] I would be willing to contribute a fix for this bug with guidance from the Iceberg community - [ ] I cannot contribute a fix for this bug at this time -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
